Search

Postmortem normothermic regional perfusion (NRP) is a rising preservation strategy in controlled donation after circulatory determination of death (cDCD). Herein, we present results for cDCD liver transplants performed in Spain 2012-2019, with outcomes evaluated through December 31, 2020. Results were analyzed retrospectively and according to recovery technique (abdominal NRP [A-NRP] or standard rapid recovery [SRR]). During the study period, 545 cDCD liver transplants were performed with A-NRP and 258 with SRR. Median donor age was 59 years (interquartile range 49-67 years). Adjusted risk estimates were improved with A-NRP for overall biliary complications (OR 0.300, 95% CI 0.197-0.459, p

Microservice platforms have brought many advantages to support the deployment of light-weight applications at both near the edge and data centers. Still, their suitability to support telecommunication and vertical services beyond the network edge is far from being a reality. On one hand, their flat networking approach does not support the establishment of link-layer connectivity among the different components of telecommunication and vertical services (e.g., access points, routers, specific-purpose servers, etc.) due to their reliance on high-level APIs. On the other hand, their networking approach has not been designed to operate over ad hoc networks built by the resource-constrained devices that may be available beyond the network edge. This can lead to suboptimal behaviors for the delivery of data traffic between microservices. This article presents the results of a research collaboration between Universidad Carlos III of Madrid and Telefónica: L2S-M. Our solution provides a programmable data plane that enables the establishment of on-demand link layer connectivity between microservices on ad hoc networks. This solution has the flexibility to execute different algorithms to build traffic paths between microservices, as well as to react against temporary link breakdowns, which could be present in these types of networks. The article presents a proof of concept for a functional validation of L2S-M, using an aerial ad hoc network deployed at 5TONIC Laboratory in collaboration with Telefonica. The validation results showcase the proper operation of L2S-M as a networking service for microservice platforms in ad hoc networks, including its ability to reconfigure the programmable data plane when link disruptions occur. This article has been supported by the TRUE5G (PID2019-108713RB681) project funded by the Spanish National Research Agency (MCIN/AEI/10.13039/5011000110) and by the H2020 FISHY Project (Grant agreement ID: 952644).

We present a demonstration of software defined networking (SDN) services utilizing quantum key distribution (QKD) technology, fully integrated with standard telecommunication network connecting production facilities of Telefonica in Madrid. All communications “co-propagate” over the same fiber infrastructure.

It is widely expected that future networks of 6G and beyond will deliver on the unachieved goals set by 5G. Technologies such as Internet of Skills and Industry 4.0 will become stable and viable, as a direct consequence of networks that offer sustained and reliable mobile performance levels. The primary challenges for future technologies are not just low-latency and high-bandwidth. The more critical problem Mobile Service Providers (MSPs) will face will be in balancing the inflated demands of network connections and customers' trust in the network service, that is, being able to interconnect billions of unique devices while adhering to the agreed terms of Service Level Agreements (SLAs). To meet these targets, it is self-evident that MSPs cannot operate in a solitary environment. They must enable cooperation among themselves in a manner that ensures trust, both between themselves as well as with customers. In this study, we present the BEAT (Blockchain-Enabled Accountable and Transparent) Infrastructure Sharing architecture. BEAT exploits the inherent properties of permissioned type of distributed ledger technology (i.e., permissioned distributed ledgers) to deliver on accountability and transparency metrics whenever infrastructure needs to be shared between providers. We also propose a lightweight method that enables device-level accountability. BEAT has been designed to be deployable directly as only minor software upgrades to network devices such as routers. Our simulations on a resource-limited device show that BEAT adds only a few seconds of overhead processing time -- with the latest state-of-the-art network devices, we can reasonably anticipate much lower overheads., arXiv admin note: text overlap with arXiv:2107.04328

The specific demands of supply chains built upon large and complex IoT systems, make it a must to design a coordinated framework for cyber resilience provisioning, intended to guarantee trusted supply chains of ICT systems, built upon distributed, dynamic, potentially insecure, and heterogeneous ICT infrastructures. As such, the solution proposed in this paper is envisioned to deal with the whole supply chain system components, from the IoT ecosystem to the infrastructure connecting them, addressing security and privacy functionalities related to risks and vulnerabilities management, accountability, and mitigation strategies, as well as security metrics and evidence-based security assurance. In this paper, we present FISHY as a preliminary architecture that is designed to orchestrate existing and beyond state-of-the-art security appliances in composed ICT scenarios. To this end, the FISHY architecture leverages the capabilities of programmable networks and IT infrastructure through seamless orchestration and instantiation of novel security services, both in real-time and proactively. The paper also includes a thorough business analysis to go far beyond the technical benefits of a potential FISHY adoption, as well as three real-world use cases highlighting the envisioned benefits of a potential FISHY adoption., This research was funded by H2020 FISHY Project, grant number 952644, and for UPC authors by the Spanish Ministry of Science, Innovation and Universities and FEDER, grant number RTI2018-094532-B-I00.

Infrastructure sharing is a widely discussed and implemented approach and is successfully adopted in telecommunications networks today. In practice, it is implemented through prior negotiated Service Level Agreements (SLAs) between the parties involved. However, it is recognised that these agreements are difficult to negotiate, monitor and enforce. For future 6G networks, resource and infrastructure sharing is expected to play an even greater role. It will be a crucial technique for reducing overall infrastructure costs and increasing operational efficiencies for operators. More efficient SLA mechanisms are thus crucial to the success of future networks. In this work, we present "BEAT", an automated, transparent and accountable end-to-end architecture for network sharing based on blockchain and smart contracts. This work focuses on a particular type of blockchain, Permissioned Distributed Ledger (PDL), due to its permissioned nature allowing for industry-compliant SLAs with stringent governance. Our architecture can be implemented with minimal hardware changes and with minimal overheads.

A recently proposed direction that is pursued by standardization organizations for 5G Network Function Virtualization (NFV) technologies at the core of next-generation networks (5G and beyond) is the adoption of “Cloud-native” design principles. These principles are catalyzed by Platform as a Service (PaaS) solutions that allow re-usability of common or dedicated Virtual Network Functions, in order to fulfill the diverse vertical requirements for network slices. PaaS solutions can also be extended to Multi-access Edge Computing environments (i.e. at the edge of the cellular network) to take advantage of predefined edge-based network functions and services and to decouple their lifecycle management from centralized, delay-introducing operations. Currently, core-to-edge coordination for end-to-end network slicing, from 5G Core Network to the edge, takes place at a very low abstraction level, leading to significant overheads that pose scalability and latency threats, especially crucial for mission-critical applications. To tackle this challenge, we describe a methodology for automating the interaction between the NFV MANO and edge platforms that encompass PaaS functions at the edge. The methodology offers benefits for 1) eliminating configuration, integration and management effort for end-to-end network slicing, and 2) the exposure of edge resources to the NFV MANO as usable platform services. We showcase the automation and management overhead benefits of our solution through experiments on an edge-based Internet of Things (IoT) use case, deployed at the 5G-VINNI Spanish 5G Facility site.

To fully cope with the requirements of innovative 5G use cases, evolving business models and flexible networking scenarios spanning multiple administrative domains are envisioned. In this context, transparent and trusted frameworks that enable network service providers and infrastructure providers to advertise, negotiate and acquire, in real time, 5G resources and services, distributed over various geographical areas, are extremely valuable. To address this goal, emerging Distributed Ledger Technologies (DLTs) arise as well-suited solutions to ensure distributed security and trust, as well as effective and agile transaction management across the various parties involved in the 5G service chain implementation. Following this vision, this paper presents the design of a DLT-enabled Marketplace aimed to foster the secure trading of heterogeneous resources in dynamic 5G ecosystems. The performance of an initial implementation as proof-of-concept is also analyzed. The results of this proof-of-concept validate the feasibility of a decentralized marketplace implementation in the context of 5G resource trading.

Multi-Access Edge Computing (MEC) is one of the fundamental technologies committed to satisfy the requirements targeted by 5G and beyond networks, such as low latency and massive communications. Nevertheless, deploying a large-scale MEC infrastructure will require a huge investment that should be minimized by optimizing the resources at edge locations, and to use centralized datacenters when possible. Thus, automated orchestration is essential for implementing mechanisms that deploy applications at the best location and even that relocate them, when necessary, to satisfy the Quality of Service (QoS) requirements. In this paper we describe an architecture for this purpose, which we have implemented in an experiment that demonstrates how Open Source MANO (OSM) can automate the relocation of a video processing application that helps drivers to remember the latest traffic sign viewed. Our proposal also includes two new components: the first one maintains the state of the applications when they are deployed at a new location, and the second one allows OSM managing the Open Network Edge Services Software (OpenNESS) edge platform. Finally, we elaborate on open challenges in MEC platforms.

The specific demands inherent to supply chains built upon large IoT systems, make a must the design of a coordinated framework for cyber resilience provisioning intended to guaranteeing trusted supply chains of ICT systems, built upon distributed, dynamic, potentially insecure and heterogeneous ICT infrastructures. As such, the proposed solution is envisioned to deal with the whole supply chain system components, from the IoT ecosystem to the infrastructure connecting them, addressing security and privacy functionalities related to risks and vulnerabilities management, accountability and mitigation strategies as well as security metrics and evidence-based security assurance. In this paper we present FISHY, as a preliminary designed architecture, designed to orchestrate both existing and beyond state-of-the-art security appliances in composed ICT scenarios and also leveraging capabilities of programmable network and IT infrastructure through seamless orchestration and instantiation of novel security services, both in real-time and proactively. The paper also includes a thorough business analysis to go far beyond the technical benefits of a potential FISHY adoption as well as three real-world use cases where to strongly support the envisioned benefits of a FISHY adoption.

Network Function Virtualization (NFV) has been regarded as one of the key enablers for the 5th Generation of mobile networks, or 5G. This paradigm allows to reduce the dependence on specialized hardware to deploy telecommunications and vertical services. To this purpose, it relies on virtualization techniques to softwarize network functions, simplifying their development and reducing deployment time and costs. In this context, Universidad Carlos III de Madrid, Telefónica, and IMDEA Networks Institute have developed an NFV ecosystem inside 5TONIC, an open network innovation center focused on 5G technologies, enabling the creation of complex, close to reality experimentation scenarios across a distributed set of NFV infrastructures, which can be made available by stakeholders at different geographic locations. This article presents the protocol that has been defined to incorporate new remote NFV sites into the multi-site NFV ecosystem based on 5TONIC, describing the requirements for both the existing and the newly incorporated infrastructures, their connectivity through an overlay network architecture, and the steps necessary for the inclusion of new sites. The protocol is exemplified through the incorporation of an external site to the 5TONIC NFV ecosystem. Afterwards, the protocol details the verification steps required to validate a successful site integration. These include the deployment of a multi-site vertical service using a remote NFV infrastructure with Small Unmanned Aerial Vehicles (SUAVs). This serves to showcase the potential of the protocol to enable distributed experimentation scenarios. This work was partially supported by the European H2020 LABYRINTH project (grant agreement H2020-MG-2019-TwoStages-861696), and by the TRUE5G project (PID2019-108713RB-C52PID2019-108713RB-C52 / AEI / 10.13039/501100011033) funded by the Spanish National Research Agency. In addition, the work of Borja Nogales, Ivan Vidal and Diego R. Lopez has partially been supported by the European H2020 5G-VINNI project (grant agreement number 815279). Finally, the authors thank Alejandro Rodríguez García for his support during the realization of this work.

We report on the Madrid Quantum Communication Infrastructure, which demonstrates that a telecommunications network can also host quantum communications in a unified, logical and physical infrastructure. Using new Quantum Key Distribution systems paired with modern networking paradigms, we demonstrate a high technology readiness level of QKD installing the network in production facilities and running relevant use cases.

Network functions virtualization (NFV) is consolidating as one of the base technologies for the design, deployment, and operation of network services. NFV can be seen as a natural evolution of the trend to cloud technologies in IT, and hence perceived as bringing them to the network provider environments. While this can be true for the simplest cases, focused on the IT services network providers rely on, the nature of network services raises unique requirements on the overall virtualization process. NFV aims to provide at the same time an opportunity to network providers, not only in reducing operational costs but also in bringing the promise of easing the development and activation of new services, thereby reducing their time-to-market and opening new approaches for service provisioning and operation, in general. In this chapter, the authors analyse these requirements and opportunities, reviewing the state of the art in this new way of dealing with network services. Also, the chapter presents some NFV deployments endorsed by some network operators and identifies some remaining challenges.

Quantum based technologies have been fundamental in our world. After producing the laser and the transistor, the devices that have shaped our modern information society, the possibilities enabled by the ability to create and manipulate individual quantum states opens the door to a second quantum revolution. In this paper we explore the possibilities that these new technologies bring to the Telecommunications industry.

openaire: EC/H2020/871808/EU//INSPIRE-5Gplus The promise of disparate features envisioned by the 3GPP for 5G, such as offering enhanced Mobile Broadband connectivity while providing massive Machine Type Communications likely with very low data rates and maintaining Ultra Reliable Low Latency Communications requirements, create a very challenging environment for protecting the 5G networks themselves and associated assets. To overcome such complexity, future 5G networks must employ a very high degree of network and service management automation, which is a security challenge by itself as well as an opportunity for smarter and more efficient security functions. In this paper, we present the smart, trustworthy and liable 5G security platform being designed and developed in the INSPIRE-5Gplus1 project. This platform takes advantage of new techniques such as Machine Learning (ML), Artificial Intelligence (AI), Distributed Ledger Technologies (DLT), network softwarization and Trusted Execution Environment (TEE) for closed-loop and end-to-end security management following a zero-touch model in 5G and Beyond 5G networks. To this end, we specifically elaborate on two key aspects of our platform, namely security management with Security Service Level Agreements (SSLAs) and liability management, in addition to the description of the overall architecture.

The difficulties related to operating basic quantum communication technologies and the inherent limitations of their direct transmission distances, be these be a consequence of absorption or optical aperture, leads to the fact that current generations of Quantum Key Distribution (QKD) systems are essentially designed to work in a stand-alone mode on a single link. This limits their utility and the potential impact on the market. To avoid these barriers, it is necessary to advance towards systems built for a network. QKD systems have to perform as network devices, and ideally on an equal footing with other telecom devices, without requiring any specialized or ad hoc tuning. To achieve this “zero-touch” integration, it is necessary to build a software ecosystem. This software should take a bare QKD system and provide all the information, so that the network can manage and the applications use the system. Here we present a SW architecture, based on components with a well-defined functionality, to build the SW ecosystem needed to deploy QKD systems in networks. The components support traditional and Software Defined Networks (SDN), as well as separated or integrated (sharing infrastructure) networks to improve their industrialization.

Network softwarization is a transformation trend for networks to converge in programmable service platforms able to host different requirements from multiple tenants. The concept of network slicing plays a key role in this trend. It offers isolated logical networks to different tenants over the same underlying infrastructure. Network slices hosting missioncritical services require fast reactions to changes in environment, adapting their capacity as needed to avoid service disruption and performance degradation. This represents a key challenge for the management plane, traditionally under the direct operation of human administrators, unable to provide a nimble enough response rate. To support tenants in driving lifecycle management operations over their network slices in a timely manner, datadriven, closed-loop mechanisms must be designed. In this paper we introduce a solution that takes advantage of events occurring outside the boundaries of a tenant-managed network slice to guide those adaptations. We finally demonstrate the feasibility of the proposal and describe an experimentation scenario to exploit such results.

The fifth generation (5G) of cellular networks shall host a number of tenants and provide services tailored to meet a wide range of requirements in terms of performance, dependability and security. Network slicing will be a key enabler, by assigning dedicated resources and functionalities to meet such requirements, where the isolation between slices, i.e., that a slice may operate without interference from other slices, becomes a core issue. The objective of this paper is to give a thorough insight into the isolation concept, discuss the challenges involved in providing it, and outline the means available to provide various levels of isolation. Fundamental concepts that can be used in further work to build an isolation solution tailored to specific needs. This paper defines important concepts such as the Provider Management, the Tenant Management, and the Means of Isolation in the context of the Isolation Dimensions. The conclusion of the study is that dealing with isolation between slices needs extensions in state of the art on the mentioned concepts, and in how to tailor the isolation to meet the needs in a cost-efficiency manner. © 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Nowadays, malware has become an epidemic problem. Among the attacks exploiting the computer resources of victims, one that has become usual is related to the massive amounts of computational resources needed for digital currency cryptomining. Cybercriminals steal computer resources from victims, associating these resources to the crypto-currency mining pools they benet from. This research work focuses on offering a solution for detecting such abusive cryptomining activity, just by means of passive network monitoring. To this end, we identify a new set of highly relevant network ow features to be used jointly with a rich set of machine and deep-learning models for real-time cryptomining ow detection. We deployed a complex and realistic cryptomining scenario for training and testing machine and deep learning models, in which clients interact with real servers across the Internet and use encrypted connections. A complete set of experiments were carried out to demonstrate that, using a combination of these highly informative features with complex machine learning models, cryptomining attacks can be detected on the wire with telco-grade precision and accuracy, even if the trafc is encrypted.

Quantum computing is posing new threats on our security infrastructure. This has triggered a new research field on quantum-safe methods, and those that rely on the application of quantum principles are commonly referred as quantum cryptography. The most mature development in the field of quantum cryptography is called Quantum Key Distribution (QKD). QKD is a key exchange primitive that can replace existing mechanisms that can become obsolete in the near future. Although QKD has reached a high level of maturity, there is still a long path for a mass market implementation. QKD shall overcome issues such as miniaturization, network integration and the reduction of production costs to make the technology affordable. In this direction, we foresee that QKD systems will evolve following the same path as other networking technologies, where systems will run on specific network cards, integrable in commodity chassis. This work describes part of our activity in the EU H2020 project CiViQ in which quantum technologies, as QKD systems or quantum random number generators (QRNG), will become a single network element that we define as Quantum Switch. This allows for quantum resources (keys or random numbers) to be provided as a service, while the different components are integrated to cooperate for providing the most random and secure bit streams. Furthermore, with the purpose of making our proposal closer to current networking technology, this work also proposes an abstraction logic for making our Quantum Switch suitable to become part of software-defined networking (SDN) architectures. The model fits in the architecture of the SDN quantum node architecture, that is being under standardization by the European Telecommunications Standards Institute. It permits to operate an entire quantum network using a logically centralized SDN controller, and quantum switches to generate and to forward key material and random numbers across the entire network. This scheme, demonstrated for the first time at the Madrid Quantum Network, will allow for a faster and seamless integration of quantum technologies in the telecommunications infrastructure.

Software Defined Networking adheres to the separation of the control plane from the data plane in the network nodes and its logical centralization on one or a set of control entities. Most of the network and/or sevice intelligence is moved to these control entities. Typically, such entity is seen as a compendium of interacting control functions in a vertical, tight integrated fashion. The relocation of the control functions from a number of distributed network nodes to a logical central entity conceptually places together a number of control capabilities with different purposes. As a consequence, the existing solutions do not provide a clear separation between transport control and services that relies upon transport capabilities. This document describes an approach named Cooperating Layered Architecture for Software Defined Networking. The idea behind that is to differentiate the control functions associated to transport from those related to services, in such a way that they can be provided and maintained independently, and can follow their own evolution path.

Proceeding of: IEEE INFOCOM 2019 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS MiSARN 2019: Mission-Oriented Wireless Sensor, UAV and Robot Networking), 29 April-2 May 2019 Paris, France In this paper, we analyze the main challenges and issues related with the orchestration of Virtualized Network Functions (VNFs) on Small Unmanned Aerial Vehicles (SUAVs). Our analysis considers a reference scenario where a number of SUAVs are deployed over a delimited geographic area and provide a mobile cloud environment that supports the deployment of functionalities using Network Functions Virtualization (NFV) technologies. The orchestration of services in this reference scenario presents different challenges, due to the constrained capacity and limited lifetime of battery-powered SUAVs, the intermittent availability of network communications, and the need to consider enhanced policies for the allocation of virtual functions to SUAVs. Finally, we perform a first exploratory evaluation of the identified challenges and issues, using a well-known and widely adopted virtualized infrastructure manager, i.e., OpenStack. This article has been partially supported by the European H2020 5GRANGE project (grant agreement 777137), and by the 5GCity project (TEC2016-76795- C6-3-R) funded by the Spanish Ministry of Economy and Competitiveness.

This paper introduces an approach towards automaticenforcement of security policies in NFV networks anddynamic adaptation to network changes. The approach relieson a refinement model that allows the dynamic transformationof high-level security requirements into configuration settingsfor the Network Security Functions (NSFs), and optimizationmodels that allow the optimal selection of the NSFs to use. Thesemodels are built on a formalization of the NSF capabilities, whichserves to unequivocally describe what NSFs are able to do forsecurity policy enforcement purposes. The approach proposed isthe first step towards a security policy aware NFV management,orchestration, and resource allocation system – a paradigm shiftfor the management of virtualized networks – and it requiresminor changes to the current NFV architecture. We prove thatour approach is feasible, as it has been implemented by extendingthe OpenMANO framework and validated on several networkscenarios. Furthermore, we prove with performance tests thatpolicy refinement scales well enough to support current andfuture virtualized networks.

Management and orchestration of virtual resources and functions, commonly referred to as MANO, are key functionalities of NFV environments. This article describes the design and deployment of the NFV MANO platform of 5TONIC, the open research and innovation laboratory on 5G technologies founded by Telefonica and IMDEA Networks. This NFV MANO platform provides 5TONIC trials and experiments with access to a functional production-like NFV environment, enabling experimentation with novel NFV products and services. As a relevant feature, the platform is capable of incorporating external sites to complement the portfolio of software and hardware resources that can be made available for experimentation activities. The 5TONIC MANO platform has been designed and built using open source technologies. The research carried out during its design and deployment has resulted in a contribution already made to its upstream projects regarding the automated configuration of virtualized network functions. Finally, we explore the scalability properties of the 5TONIC MANO platform, and we experimentally validate its functional capacity to orchestrate multi-site experiments.

The ONF Transport API enables to support transport services like topology or connectivity setup for optical networks. We propose, implement and demonstrate extensions to enable Quantum Encryption in optical end-to-end services.

We report on the Madrid Quantum Network, designed to demonstrate that a telecommunications network can also host quantum communications in a unified, logical and physical infrastructure. Using new Quantum Key Distribution systems paired with modern networking paradigms, we demonstrate a high technology readiness level of QKD installing the network in production facilities and running relevant use cases.

QKD technology is mature enough to be used beyond the usual single, point to point, link by creating networks. Quantum ad hoc networks, where a separate, quantum-only network, is running in parallel to a classical network have been demonstrated in several occasions. Having to, essentially, duplicate the network to introduce quantum communications is very expensive and, beyond niche use-cases, fully integrated quantumclassical networks is what the industry demands to accept quantum technologies as a serious networking technology, ready for a broad market uptake. Recently we have reported on the successful deployment of the Madrid Quantum Network. This network is novel because it has been the first installed in production sites of a Telecommunications operator and moreover it is managed through a Software Defined Networking (SDN) structure that integrates classical and quantum channels. The network was operating for four months and we could demonstrate several technologies utilizing the integration of quantum and classical networks. Here we report on some implementation aspects and its usage in several use cases, in particular to secure the management of the SDN control plane as a critical infrastructure.

© 2018 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes,creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. NFV continues to draw immense attention from researchers in both industry and academia. By decoupling NFs from the physical equipment on which they run, NFV promises to reduce CAPEX and OPEX, make networks more scalable and flexible, and lead to increased service agility. However, despite the unprecedented interest it has gained, there are still obstacles that must be overcome before NFV can advance to reality in industrial deployments, let alone delivering on the anticipated gains. While doing so, important challenges associated with network and function MANO need to be addressed. In this article, we introduce NFV and give an overview of the MANO framework that has been proposed by ETSI. We then present representative projects and vendor products that focus on MANO, and discuss their features and relationship with the framework. Finally, we identify open MANO challenges as well as opportunities for future research.

Quantum key distribution (QKD) is a physical technology that enables the secure generation of bit streams (keys) in two separated locations. This technology is designed to provide a solution for very secure (quantum-safe) key agreement, which is nowadays at risk due to advances in quantum computing. The recent demonstration of a QKD network in the metropolitan area of Madrid shows how these networks can be deployed in current production infrastructure by following existing networking paradigms, such as software-defined networking. In particular, a three-node QKD network is implemented on the metropolitan area network using existing infrastructure and coexisting with other data and control services. On the other hand, telecommunication networks are drastically changing the way services are architectured. Users of the operator’s infrastructure are moving from traditional connectivity services (e.g., virtual private networks) to a set of interconnected network functions, either physical or virtual, in the shape of service function chaining (SFC). However, SFC users do not have a method to validate that the traffic flow is appropriately forwarded across the nodes in the network, a situation that may lead to very critical security breaches (e.g., a security node or a firewall in the chain that is bypassed). This work presents a method for validating ordered proof-of-transit (OPoT) on top of the Madrid Quantum Network. We first provide a general description of the QKD network deployed in Madrid. Then, we describe an existing security protocol for PoT in packet networks, analyzing its issues and vulnerabilities. Finally, this work presents a protocol for alleviating the security breach found in this work and for providing OPoT in SFC. Finally, an example of the real implementation is shown, where nodes being part of the OPoT scheme are provisioned with QKD-derived keys.

To allow 5G-VINNI Facility Sites to implement their networks with some degree of consistency, and with the potential for inter-operability and interconnection between Facility Sites, a common architecture for 5G-VINNI is defined. This draws heavily on pre-existing work from Standards, as well as from previous 5G-PPP projects. This document is produced ahead of implementation, and so is to some extent a description of the expectations for implementing a standards compliant facility. Future versions will reflect this as a starting point, but also include lessons learned during implementation.

Hierarchical Service Function Chaining (hSFC) is a network architecture allowing an organization to decompose a large-scale network into multiple domains of administration. The goals of hSFC are to make a large-scale network easier to reason about, simpler to control and to support independent functional groups within large network operators.

This work is partially supported by the Spanish Ministry of Economy and Competitiveness, the European Regional Development Fund (Project TEC2016-76795-C6-4-R), the Spanish Ministry of Education, Culture and Sport (FPU Grant 16/03354), and the University of Granada, Andalusian Regional Government and European Social Fund under Youth Employment Program., Next-generation systems are anticipated to be digital platforms supporting innovative services with rapidly changing traffic patterns. To cope with this dynamicity in a cost-efficient manner, operators need advanced service management capabilities such as those provided by NFV. NFV enables operators to scale network services with higher granularity and agility than today. For this end, automation is key. In search of this automation, the European Telecommunications Standards Institute (ETSI) has defined a reference NFV framework that make use of model-driven templates called Network Service Descriptors (NSDs) to operate network services through their lifecycle. For the scaling operation, an NSD defines a discrete set of instantiation levels among which a network service instance can be resized throughout its lifecycle. Thus, the design of these levels is key for ensuring an effective scaling. In this article, we provide an overview of the automation of the network service scaling operation in NFV, addressing the options and boundaries introduced by ETSI normative specifications. We start by providing a description of the NSD structure, focusing on how instantiation levels are constructed. For illustrative purposes, we propose an NSD for a representative NS. This NSD includes different instantiation levels that enable different ways to automatically scale this NS. Then, we show the different scaling procedures the NFV framework has available, and how it may automate their triggering. Finally, we propose an ETSI-compliant workflow to describe in detail a representative scaling procedure. This workflow clarifies the interactions and information exchanges between the functional blocks in the NFV framework when performing the scaling operation., This work is partially supported by the Spanish Ministry of Economy and Competitiveness, the European Regional Development Fund (Project TEC2016-76795-C6-4-R), Spanish Ministry of Education, Culture and Sport (FPU Grant 16/03354), University of Granada, Andalusian Regional Government and European Social Fund under Youth Employment Program.

Mobility management is a challenging problem in current networks, typically requiring dedicated, specialised protocols that manage the lifetime of a series of tunnels that follow mobile hosts as they roam through the network. The fundamental issue that complicates the mobility management problem is the lack of a complete naming and addressing schema in the current Internet architecture. This paper analyses what properties such schema needs to have, and discusses how Internet mobility solutions are missing parts of it. Then it looks at RINA, a network architecture with a complete naming scheme. Theoretical analysis backed up by experimental validation of the main properties for mobility support shows that managing mobility in RINA networks not only is simpler and easier to scale compared to the Internet situation, but also that no special protocols or mechanisms need to be added to RINA in order to support mobility.

Network Function Virtualization (NFV) has raised tremendous attention in the academic and industrial commu­nities alike. The former have been attracted by the service centric orchestration challenges. The latter have found that, by decoupling network functions from the underling hardware, significant savings can be obtained by means of infrastructure homogenization and service automation. As opposed to the initial NFV solutions, which heavily relied on a centralized cloud model, the emerging Multi-access Edge Computing trend is calling for a distribution of computational capacity at the customers' sites. This change of paradigm could result in the deployment of tens of thousands or even millions of Points-of-Presence. In this article we discuss the fundamental challenges of deploying NFV in scattered environments, then we introduce the Light-MANO framework, a Multi-access Network Operating System converging SDN and NFV into a single lightweight platform for management and orchestration of network services over distributed NFV infrastructure. Finally, we report on a proof- of-concept implementation of LightMANO and on its evaluation.

The evolution of the Internet has resulted in the deployment of new application-level solutions to enhance the scalability and efficiency of content dissemination (e.g., content delivery networks and peer-to-peer systems). However, despite of this improvement on performance, the utilization of this type of solutions introduces new security concerns, as a content provider must necessarily delegate the role of distributing the content to third parties, and current security solutions, such as TLS and IPsec, do not allow authenticating the original content provider or the content itself in these scenarios. In this paper, we present SCoT, a transport-layer protocol that allows a content provider to bind protection to content, enabling content authentication at receivers regardless of any third party infrastructures that have been used to disseminate the content. Content authentication procedures are executed transparently to end-user applications. We implemented a fully operational prototype of the protocol in Java, including an API to support the development of SCoT applications. We utilized it to configure an experimentation scenario that served to validate a theoretical analysis of the SCoT throughput and to illustrate the performance that can be achieved in a practical deployment. The paper concludes describing a set of use cases of the protocol. This article has been partially supported by the European H2020 5Gin-FIRE project (grant agreement 732497), and by the DRONEXT project (TEC2014-54335-C4-2-R) funded by the Spanish Ministry of Economy and Competitiveness. The work of Ignacio Soto has partially been supported by the Spanish Texeo project (TEC2016-80339-R) funded by the Spanish Ministry of Economy and Competitiveness.

This document describes the framework for Interface to Network Security Functions (I2NSF) and defines a reference model (including major functional components) for I2NSF. Network Security Functions (NSFs) are packet-processing engines that inspect and optionally modify packets traversing networks, either directly or in the context of sessions to which the packet is associated.

In pursuit of a flexible, resource efficient and high- performant 5G infrastructure, many operators, vendors and research consortia are currently developing, testing and inte­grating their NFV platform with associated management and orchestration (MANO) functionality. The SONATA NFV platform follows a micro-service design, which involves a tight coupling between an SDK, monitoring and MANO functionality, targeting a secure and stable software foundation. This experience paper gives a thorough overview on the encountered challenges, insights and resulting learnings when implementing and integrating the SONATA Service Platform using a continuous integration and delivery DevOps methodology. This is the result of a strong cooperation between prominent equipment vendors, network operators, software companies and universities, providing a set of constructive recommendations in hope of catalysing the development and deployment of NFV platforms.

Here we demonstrate, for the first time, VPN services integrated within a virtual router using QKD to perform encryption and authentication. Any management operation is also secured using QKD, providing a whole quantum-safe ecosystem.