Optimal Security-Aware Virtual Machine Management for Mobile Edge Computing Over 5G Networks

A secure execution of offloaded tasks in the 5G-driven mobile edge computing (MEC) deployment is critical for all societal sectors. To realize it, mobile network operators have to intelligently orchestrate virtual resources in multiple cloud layers to satisfy 5G security requirements. In this article, we formulate a secure virtual machine management (VMM) mechanism using the semi-Markov decision process framework that seeks to jointly minimize the service rejection and the security risk, while meeting the location awareness requirements of latency-sensitive applications in a decentralized fashion. A new metric called mean security risk is proposed to quantify the perceived risk of an offloaded application considering the number of virtual machines (VMs) that is used to execute and to protect it. We also propose a new cost structure that allows for an efficient assessment of the long-term impact of providing additional VMs to foster security services. A comparison with an optimal security-unaware VMM mechanism shows that our model provides a less risky operation at the cost of an increase in service rejection, which is caused by the use of additional VMs to shield the computation task. Finally, we show that the cost of providing security services can be significantly reduced by fine-tuning the economic gains of it.

I. Introduction

Mobile edge computing (MEC)—an architectural networking evolution within 5G systems that brings computing, storage, and networking resources one hop away from the users—arises as an effective response to the skyrocketing demand for latency-sensitive and computing-intensive Internet of Things (IoT) applications. Fig. 1 illustrates a typical 5G deployment, where MEC is massively embedded within small cells across the densified mobile communication system. In order to foster a more reliable, performant, and secure operation, mobile network operators (MNO) may also leverage multiple cooperative cloud layers [1]–[3]. An instance of this practice is the use of a robust and resource-rich backup cloud to augment the system capacity while alleviating the resource-constrained MEC system during rush hours. This scenario is depicted in Fig. 1, which shows that a mobile user camping at the MEC site A can either offload its computation task toward the MEC through the small cell access point or the backup cloud through the macrocell base station.