# A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services
## 1 Introduction  
Undoubtedly, the development of next-generation mobile networks, and in particular the recently available 5 th generation, or 5G, has revolutionized the landscape of broadband wireless access connectivity and mobile communication services. On the one hand, 5G significantly increases the performance of user communications at a large scale, in terms of bandwidth, latency, resiliency, and availability. On the other hand, the development of 5G has involved key vertical industries and stakeholders from the early design phases, promoting not only technological but also business innovation. This has led to an unprecedented evolution of public and private mobile networks, fostered by the groundbreaking vision of an extremely flexible communications infrastructure, capable of: (a) integrating multiple and geographically distributed compute, storage, and network resources, owned by diverse telecommunication operators, infrastructure providers, and other 5G stakeholders; and (b) accommodating highly heterogeneous and changing service demands and use cases from different vertical sectors (e.g., automotive, manufacturing, public safety, smart cities, etc.). At the heart of 5G, _softwarization_ plays a fundamental role [1], supporting the replacement of traditional specialized hardware equipment by versatile software components. In this respect, 5G adopts the European Telecommunications Standards Institute (ETSI) Network Functions Virtualization (NFV) [2]. ETSI NFV provides a reference architectural framework to automate the management and orchestration procedures of telecommunication and vertical services. These services are built as a composition of network functions, provisioned as software appliances running on virtual representations of hardware equipment (e.g., virtual machines or virtualization containers). This way, NFV enables the automated deployment of 5G services as connected graphs of virtual network functions, or VNFs. From a management perspective, NFV technologies alleviate the dependency of service provisioning on specialized hardware, as multiple VNFs can be executed on more generic virtualization-capable server computers with diverse capacities. Still, VNFs can take advantage of specific hardware features if they are available, e.g., encryption acceleration, allocation of physical CPU cores to applications, provision of direct access to network interface cards, etc. The virtualization of network functions and their automated management help reducing capital and operating expenditures in the provision of 5G services. In addition, the use of standard interfaces opens the market of virtual network functions to new vendors and software developers, favoring the availability of a wider and potentially open catalogue of network functions and added-value NFV services. It is worth highlighting that virtualization implies a high degree of flexibility to place network functions at different locations, provided that there are sufficient computing, storage and networking resources to support their proper operation. This creates new collaboration and business opportunities for telecommunication operators, infrastructure providers, service providers, and other 5G stakeholders, which may result in the deployment of telecommunication and/or vertical services across multiple sites hosting NFV infrastructures. Nevertheless, this flexibility regarding VNF placement opens new challenges in terms of their connectivity. Ideally, the multi-site nature of an NFV ecosystem should be opaque to the stakeholders requesting a service deployment, as it should be provisioned in functional terms, independently of whether the instance of the service has been deployed at a single NFV site or several of them. However, whereas the connectivity of VNFs at a single NFV infrastructure can easily be supported with the creation of virtual local links, this is problematic in a multi-site NFV ecosystem.