## 3 Security in SDNFV
### NFV Security Issues  
In the actual networking landscape, the deployment of Virtual Network Functions (VNFs) must ensure that the robust security features inherent in legacy networks are preserved. While NFV offers numerous benefits, it also introduces new security concerns related to orchestrator and hypervisor protection, ubiquitous virtual appliances, third-party access, shared virtual machines and storage, and more.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Type** &
\begin{tabular}{c} **Security** \\ **Property** \\ \end{tabular} & **SDN NE** & **SDN Controller** & **SDN App.** \\ \hline Spoofing & Authentication & Vulnerable & Vulnerable & Vulnerable \\ \hline Tampering & Integrity & Vulnerable & Vulnerable & Vulnerable \\ \hline Repudiation & Nonrepudiation & - & Vulnerable & - \\ \hline Information & Confidentiality & Vulnerable & Vulnerable & Vulnerable \\ \hline Denial of & Availability & Vulnerable & Vulnerable & Vulnerable \\ Service (DoS) & Authorization & Vulnerable & Vulnerable & - \\ \hline \hline \end{tabular}
\end{table}
Table 1: SDN Risks Analysis.  
VNFs, as network functions running on virtual machines, are susceptible to three categories of security threats:  
* Generic virtualization threats: These include memory leakage, interrupt isolation, and other vulnerabilities inherent in virtualized environments.
* Threats specific to legacy network functions: These encompass existing threats previously targeted at physical network functions, such as flooding attacks and routing security vulnerabilities.
* New threats arising from the combination of virtualization and networking technologies: These threats are specific to NFV environments and exploit the unique characteristics of virtualized network functions.  
The NFV security problem statement outlines these potential threats, including both novel threats and existing threats that manifest in new ways. To address these concerns, a security expert group designated by the European Telecommunications Standards Institute (ETSI) has provided comprehensive guidelines for securing NFV deployments [27]. These guidelines focus on the following key security areas:  
* Topology validation and enforcement: Ensuring the network topology adheres to security policies and preventing unauthorized modifications.
* Availability of management support infrastructure: Guaranteeing the availability and integrity of critical infrastructure supporting NFV management.
* Secured boot: Implementing mechanisms that ensure only verified software is loaded during the boot process.
* Secure crash: Protecting system memory and state information in the event of a system crash.
* Performance isolation: Preventing resource starvation and ensuring fair resource allocation among VNFs.
* User/tenant authentication, authorization, and accounting (AAA): Implementing robust user and tenant authentication, authorization, and accounting mechanisms.
* Authenticated time service: Providing a reliable and tamper-proof time service for VNFs.
* Private keys within cloned images: Protecting private keys used for encryption and authentication within cloned virtual machine images.
* Backdoors via virtualized test and monitoring functions: Preventing the introduction of unauthorized backdoors through virtualized testing and monitoring functions.
* Multiadministrator isolation: Ensuring the isolation of different administrative domains to prevent unauthorized access and privilege escalation.  
By implementing these security measures and adhering to best practices outlined by ETSI, network operators can leverage the benefits of NFV while mitigating potential security risks and ensuring a secure and reliable network environment.