Dependable Virtual Network Services: An Architecture for Fault-and Intrusion-tolerant SFCs

A virtual network service can be implemented as a Service Function Chain (SFC) which is a composition of multiple Virtualized Network Functions (VNFs) forming the service topology. The IETF defines a standard architecture for SFCs, that includes traffic classification and forwarding elements. Considering that several network services implement functionalities that are critical for the correct operation of the network, the failure of an SFC can compromise the entire infrastructure, causing monetary losses or security issues. This work proposes the Fault-& Intrusion Tolerant SFC (FIT-SFC): an architecture to support secure and highly available virtual services. While most of previous related work only assumes crash faults, FIT-SFC uses replication strategies to also tolerate intrusions on any component of the SFC architecture, while still being fully compliant with the IETF reference model. A prototype was implemented and experimental results show that FIT-SFC presents acceptable overhead and fast failover, tolerating faults/intrusions on both stateless and stateful services.