Abstract:With the emergence of cloud native technology, the network slicing enables automatic service orchestration, flexible network scheduling and scalable network resource allocation, which profoundly affects the traditional security solution. Security is regarded as a technology independent of the cloud native architecture in the initial design, traditional passive defense such as “reinforced” and “stacked” is relied on to achieve system security protection. The lack of intrinsic security mechanisms makes the system capability insufficient when faces the uncertain threat brought by vulnerabilities and backdoors under the ecosystem of opening-up and sharing. The static nature of existing networks and computing systems makes them easy to be compromised and hard to defend, and thus it is urgent to provide intrinsic security and proactive protection against the unpredictable attacks. To this end, this paper proposes a novel paradigm named intrinsic cloud security (iCS) from the perspective of dynamic defense. The dynamic defense provides component-level security, and has complementary and consistency with the cloud native environment. In particular, iCS introduces mimic defense and moving target defense (MTD), and makes full use of the new features introduced by cloud native to implement an intrinsic and proactive defense mechanism with acceptable costs and efficiency. The iCS paradigm achieves seamless integration and symbiosis evolution between security and cloud native. We implement a trial of iCS based on 5GC commercial system and evaluate its performance on costs, efficiency and attack success. The result shows that the iCS enhanced mode always can provide a better and more stable defense effects.

CPFirewall: A Novel Parallel Firewall Scheme for FWaaS in the Cloud Environment.

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Intrinsic Security and Self-Adaptive Cooperative Protection Enabling Cloud Native Network Slicing

Cloud-Fog Automation: Heterogenous Applications over New Generation Infrastructure of Virtualized Computing and Converged Networks

A Novel Job Scheduling Model to Enhance Efficiency and Overall User Fairness of Cloud Computing Environment.

A Decentralized Cloud Firewall Framework with Resources Provisioning Cost Optimization

A Design of Firewall Based on Feedback of Intrusion Detection System in Cloud Environment

APFA: Asynchronous Parallel Finite Automaton for Deep Packet Inspection in Cloud Computing

C-FPA: A Cloud-Based FPA Novel Approach to Defend Hotspot Issues and Attacks in WSN

RuleCache: Accelerating Web Application Firewalls by On-line Learning Traffic Patterns

A Novel Agent-Based Framework in Bridge-Mode Hypervisors of Cloud Security.

A Firewall Optimization for Threat-Resilient Micro-Segmentation in Power System Networks

SFP: Service Function Chain Provision on Programmable Switches for Cloud Tenants

CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Privacy-preserving Network Functionality Outsourcing.

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Network Softwarization and Parallel Networks: Beyond Software-Defined Networks

A Fine-Grained Rule Partition Algorithm in Cloud Data Centers.

A Novel Framework to Carry out Cloud Penetration Test

CloudSEC: A Cloud Architecture for Composing Collaborative Security Services