Evolution of Policy Verification and Control for 6G Secure Service Orchestration in Telco Clouds

The telecommunications industry has undergone a significant transformation in the post-virtualization era of cloud computing. The deployment of 5 G core network functions as stateless Virtualized Network Functions (VNFs) in cloud-native environments-such as Docker containers or Kubernetes pods-has enhanced operational flexibility and cost efficiency. These Network Functions (NFs) are managed based on Service Level Agreements (SLAs) and Quality of Service (QoS) requirements, with coordination between the Element Manager (EM) and the NFV Management and Orchestration (NFV MANO) framework. However, this coordination relies on policy enforcement by the NFV Orchestrator (NFVO) and VNF Manager (VNFM), which are vulnerable to policy manipulation or misinterpretation in the presence of cyber threats. Attacks on NFV MANO or the operator network can lead to orchestration compromises, policy violations, and ultimately service disruptions. While access control mechanisms provide some security, current NFVO implementations lack the capability to detect policy anomalies, potentially resulting in resource depletion and outages. To address this challenge, we propose a novel policy verification function within NFV MANO, following the zero-trust principle. Our approach employs an ML-based anomaly detection technique using One-Class Support Vector Machine (OCSVM) to identify anomalous policy parameters. We evaluated this method through integration with an operator's core network using the open-source ETSI OSM. Experimental results demonstrated an anomaly detection precision of 0.71, recall of 0.82, and an F1score of 0.76, highlighting the effectiveness of our approach in enhancing and evolving the orchestration security and reliability.