Design and Implementation of Virtual Security Function Based on Multiple Enclaves

Juan Wang, Yang Yu, Yi Li, Chengyang Fan and Shirong Hao
Additional contact information
Juan Wang: School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
Yang Yu: School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
Yi Li: School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
Chengyang Fan: School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
Shirong Hao: School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China

Future Internet, 2021, vol. 13, issue 1, 1-23

Abstract: Network function virtualization (NFV) provides flexible and scalable network function for the emerging platform, such as the cloud computing, edge computing, and IoT platforms, while it faces more security challenges, such as tampering with network policies and leaking sensitive processing states, due to running in a shared open environment and lacking the protection of proprietary hardware. Currently, Intel ® Software Guard Extensions (SGX) provides a promising way to build a secure and trusted VNF (virtual network function) by isolating VNF or sensitive data into an enclave. However, directly placing multiple VNFs in a single enclave will lose the scalability advantage of NFV. This paper combines SGX and click technology to design the virtual security function architecture based on multiple enclaves. In our design, the sensitive modules of a VNF are put into different enclaves and communicate by local attestation. The system can freely combine these modules according to user requirements, and increase the scalability of the system while protecting its running state security. In addition, we design a new hot-swapping scheme to enable the system to dynamically modify the configuration function at runtime, so that the original VNFs do not need to stop when the function of VNFs is modified. We implement an IDS (intrusion detection system) based on our architecture to verify the feasibility of our system and evaluate its performance. The results show that the overhead introduced by the system architecture is within an acceptable range.

Keywords: NFV; SGX; enclave; hot swapping; click (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2021
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/13/1/12/pdf (application/pdf)
https://www.mdpi.com/1999-5903/13/1/12/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:13:y:2021:i:1:p:12-:d:475887

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().