BSec-NFVO: A Blockchain-Based Security for Network Function Virtualization Orchestration

Network Function Virtualization (NFV) and Service Function Chaining (SFC) offer flexible end-to-end services that deploy virtual network functions in clouds of competing providers. Orchestration of virtual network functions occurs in a distributed and trustless environment that must tolerate byzantine failures and collusion attacks. This paper proposes BSec-NFVO, a blockchain-based system that secures orchestration operations in virtualized networks, ensuring auditability, non-repudiation and integrity. We propose an NFV-tailored blockchain and a transaction model. BSec-NFVO provides a modular architecture to secure orchestration in a simple and agile way. We develop a prototype of BSec-NFVO for the Open Platform for Network Function Virtualization (OPNFV) with an adaptation of the normal-case of a collusion-resistant consensus protocol. The results show BSec-NFVO incurs low overhead to the cloud orchestrator and presents stable performance as the number of consensus participants increases.