A provably efficient in-network computing services deployment approach for security burst

Abstract

The emerging in-network computing (INC) technique delegates computations to the network data plane, enabling clients' data to be processed during transmission. However, processing transmitted data within INC-enabled network devices may lead to security concerns and broaden the attack surface as sensitive data can be exposed during computation, making the network more susceptible to various cyber-attacks. To protect against such cyber-attacks, especially in security-sensitive applications such as finance and healthcare, clients might periodically enhance service security requirements regarding the importance of their to-be-transmitted data. This periodic security enhancement is called a “security burst” (SEB). To meet such enhancement, one may implement security-aware network functions (S-NFs) like firewall and deep packet inspection on smart routers or switches along the forwarding path while maximizing the re-utilization of this path. Despite the growing interest in INC and security service deployment, existing solutions typically assume static security requirements and overlook the dynamic, on-demand security enhancements such as SEBs. Furthermore, prior approaches rarely consider the re-utilization of existing in-path services, leading to higher additional costs. To fill this gap, this work shows pioneering efforts in tackling SEB for INC-enabled services. Assuming that re-employing the resources along the original forwarding path does not incur bandwidth cost, we formally establish a novel problem called INC-enabled Service Migration for SEB (ISME) to optimize additional cost and prove its NP-hardness. To solve this problem, we design an efficient cost-security-burst (CSB) measure and develop an innovative CSB measure-based security enhancement (CSB-SE) algorithm, which is mathematically proved to be logarithm approximate. Extensive simulations show that CSB-SE guarantees logarithm-approximate performance and outperforms the benchmark by an average of 37.11 % regarding the total service cost and 102.38 % in terms of the additional cost.