Security Filters for Virtual Network Functions in 5G Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively address security exposures and anomalies in software-defined networks (SDNs) with virtualized network functions (VNFs) hosted in container architectures, particularly when these VNFs communicate with each other, as they lack comprehensive security filters and anomaly detection mechanisms.
Innovation Solution
The implementation of security filters and user plane control plane (UCO) entities that dynamically create, manage, and enforce data traffic security rules for VNFs within Kubernetes clusters, allowing or denying packets based on predefined security rules, thereby preventing malicious code and minimizing unnecessary network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems are used without security filters for VNFs, then device complexity is reduced, but security reliability deteriorates due to lack of protection against malicious code and anomalies
Solution Approach 1:
The patent introduces security filters as intermediary components that sit between VNFs and network traffic. These filters act as mediators that inspect, filter, and control data packets without requiring changes to the VNFs themselves, thus improving security reliability while maintaining relatively simple system architecture.
Solution Approach 2:
The security system is segmented into multiple independent components including security filters, anomaly detection mechanisms, and orchestration systems. Each component performs a specific security function independently, allowing the system to achieve high reliability through modular design without overwhelming complexity.
2Reliability
If comprehensive security filters are implemented for all VNFs, then security reliability improves, but device complexity increases due to multiple filtering components and management overhead
Solution Approach 1:
The security filters are designed as universal components that can be applied across multiple VNFs and network functions. A single filter implementation can handle various security tasks including packet inspection, anomaly detection, and traffic control, reducing overall system complexity through multi-functionality.
Solution Approach 2:
Security filters are configured and prepared in advance before deployment to VNFs. The orchestration system pre-configures filter rules and security policies, so that when VNFs are instantiated, security protection is already in place without requiring complex real-time setup procedures.
3Adaptability or versatility
If dynamic security filtering is implemented for VNFs, then adaptability improves for changing network conditions, but device complexity increases due to real-time monitoring and filter management
Solution Approach 1:
The security system implements feedback mechanisms where anomaly detection components continuously monitor network traffic and VNF behavior. When anomalies are detected, the system automatically adjusts filter rules and security policies in real-time, providing adaptability through closed-loop control without requiring complex manual intervention.
Solution Approach 2:
The orchestration system automatically manages the creation, configuration, and deployment of security filters based on VNF instantiation events and network conditions. This self-service capability allows the system to adapt dynamically without requiring complex external management infrastructure.
4Reliability
If security filters are created for each VNF instantiation, then security reliability improves, but productivity decreases due to time-consuming filter creation and management
Solution Approach 1:
The system uses template-based filter configurations that can be copied and instantiated rapidly for each VNF. Instead of creating unique security filters from scratch for each VNF, pre-defined templates are replicated and customized minimally, dramatically reducing the time and resources required while maintaining consistent security standards.
Solution Approach 2:
Security filter templates and configurations are prepared in advance and stored in a repository. When a VNF is instantiated, the system quickly retrieves and applies the appropriate pre-configured template, eliminating the need for time-consuming filter creation processes and improving overall productivity.
Data Source
AI summary
Security filters may protect communication and data traversing and communicating between programs in a hosted container system. In addition, an orchestration system may specifically address the creation and behavior of security filters that manage the behavior of virtual network functions residing in containers.