Pushing Forward Security in Network Slicing by Leveraging Continuous Usage Control

Fifth generation softwarized network systems will make it possible to flexibly partition the network infrastructure into logically independent network slices, hosting end-to-end network services able to dynamically meet the diverse requirements of vertical industries. However, the high dynamicity of NFV-related operations and the interdependence of multiple slices running on top of a shared underlying infrastructure pose peculiar security challenges. In this article we investigate how such challenges can be addressed in the context of the management and orchestration (MANO) security functions within the ETSI NFV architectural framework. In particular, we target access control and authorization functions, and we discuss how to advance them for network slicing deployments with continuous and closedloop usage control mechanisms. We also present a proof of concept of a MANO framework extended with UCON capabilities able to regulate the access and use of network slices according to customizable security policies. Preliminary performance evaluation proves the effectiveness of the proposed approach with minor impact on the user experience and prompt reaction time to security policy violations.