{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T02:55:27Z","timestamp":1771037727395,"version":"3.50.1"},"reference-count":27,"publisher":"MDPI AG","issue":"13","license":[{"start":{"date-parts":[[2020,6,27]],"date-time":"2020-06-27T00:00:00Z","timestamp":1593216000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001961","name":"AXA Research Fund","doi-asserted-by":"publisher","award":["AXA Postdoctoral Scholarship, Cyber-SecIoT project"],"award-info":[{"award-number":["AXA Postdoctoral Scholarship, Cyber-SecIoT project"]}],"id":[{"id":"10.13039\/501100001961","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010198","name":"Ministerio de Econom\u00eda, Industria y Competitividad, Gobierno de Espa\u00f1a","doi-asserted-by":"publisher","award":["FPI Programme (ref. PRE2018-083731)"],"award-info":[{"award-number":["FPI Programme (ref. PRE2018-083731)"]}],"id":[{"id":"10.13039\/501100010198","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010198","name":"Ministerio de Econom\u00eda, Industria y Competitividad, Gobierno de Espa\u00f1a","doi-asserted-by":"publisher","award":["Fondos FEDER,  PERSEIDES project (TIN2017-86885-R)."],"award-info":[{"award-number":["Fondos FEDER,  PERSEIDES project (TIN2017-86885-R)."]}],"id":[{"id":"10.13039\/501100010198","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["H2020 CyberSec4Europe project (contract 830929)"],"award-info":[{"award-number":["H2020 CyberSec4Europe project (contract 830929)"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>IoT systems can be leveraged by Network Function Virtualization (NFV) and Software-Defined Networking (SDN) technologies, thereby strengthening their overall flexibility, security and resilience. In this sense, adaptive and policy-based security frameworks for SDN\/NFV-aware IoT systems can provide a remarkable added value for self-protection and self-healing, by orchestrating and enforcing dynamically security policies and associated Virtual Network Functions (VNF) or Virtual network Security Functions (VSF) according to the actual context. However, this security orchestration is subject to multiple possible inconsistencies between the policies to enforce, the already enforced management policies and the evolving status of the managed IoT system. In this regard, this paper presents a semantic-aware, zero-touch and policy-driven security orchestration framework for autonomic and conflict-less security orchestration in SDN\/NFV-aware IoT scenarios while ensuring optimal allocation and Service Function Chaining (SFC) of VSF. The framework relies on Semantic technologies and considers the security policies and the evolving IoT system model to dynamically and formally detect any semantic conflict during the orchestration. In addition, our optimized SFC algorithm maximizes the QoS, security aspects and resources usage during VSF allocation. The orchestration security framework has been implemented and validated showing its feasibility and performance to detect the conflicts and optimally enforce the VSFs.<\/jats:p>","DOI":"10.3390\/s20133622","type":"journal-article","created":{"date-parts":[[2020,6,29]],"date-time":"2020-06-29T11:17:17Z","timestamp":1593429437000},"page":"3622","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":38,"title":["Semantic-Aware Security Orchestration in SDN\/NFV-Enabled IoT Systems"],"prefix":"10.3390","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0038-9012","authenticated-orcid":false,"given":"Alejandro","family":"Molina Zarca","sequence":"first","affiliation":[{"name":"Department of Information and Communications Engineering, University of Murcia, 30100 Murcia, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5280-3276","authenticated-orcid":false,"given":"Miloud","family":"Bagaa","sequence":"additional","affiliation":[{"name":"Communications and Networking Department, School of Electrical Engineering, Aalto University, 02150 Espoo, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7538-4788","authenticated-orcid":false,"given":"Jorge","family":"Bernal Bernabe","sequence":"additional","affiliation":[{"name":"Department of Information and Communications Engineering, University of Murcia, 30100 Murcia, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1119-1239","authenticated-orcid":false,"given":"Tarik","family":"Taleb","sequence":"additional","affiliation":[{"name":"Communications and Networking Department, School of Electrical Engineering, Aalto University, 02150 Espoo, Finland"},{"name":"Centre for Wireless Communications (CWC), University of Oulu, 90570 Oulu, Finland"},{"name":"Department of Computer and Information Security, Sejong University, Seoul 05006, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5525-1259","authenticated-orcid":false,"given":"Antonio F.","family":"Skarmeta","sequence":"additional","affiliation":[{"name":"Department of Information and Communications Engineering, University of Murcia, 30100 Murcia, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,6,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"82721","DOI":"10.1109\/ACCESS.2019.2924045","article-title":"A Survey on IoT Security: Application Areas, Security Threats, and Solution Architectures","volume":"7","author":"Hassija","year":"2019","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"812","DOI":"10.1109\/COMST.2018.2862350","article-title":"A Survey on Emerging SDN and NFV Security Mechanisms for IoT Systems","volume":"21","author":"Farris","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"e2038","DOI":"10.1002\/nem.2038","article-title":"Enhancing IoT security through network softwarization and virtual security appliances","volume":"28","author":"Farris","year":"2018","journal-title":"Int. J. Netw. Manag."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Alejandro, M.Z., Garcia-Carrillo, D., Bernal Bernabe, J., Ortiz, J., Marin-Perez, R., and Skarmeta, A. (2019). Enabling Virtual AAA Management in SDN-Based IoT Networks. Sensors, 19.","DOI":"10.3390\/s19020295"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1262","DOI":"10.1109\/JSAC.2020.2986621","article-title":"Virtual IoT HoneyNets to Mitigate Cyberattacks in SDN\/NFV-Enabled IoT Networks","volume":"38","author":"Zarca","year":"2020","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"8005","DOI":"10.1109\/JIOT.2019.2904123","article-title":"Security Management Architecture for NFV\/SDN-Aware IoT Systems","volume":"6","author":"Bernabe","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1109\/MNET.001.1900273","article-title":"ZSM Security: Threat Surface and Best Practices","volume":"34","author":"Benzaid","year":"2020","journal-title":"IEEE Netw."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Luizelli, M.C., Bays, L.R., Buriol, L.S., Barcellos, M.P., and Gaspary, L.P. (2015, January 11\u201315). Piecing together the NFV provisioning puzzle: Efficient placement and chaining of virtual network functions. Proceedings of the 2015 IFIP\/IEEE International Symposium on Integrated Network Management (IM), Ottawa, ON, Canada.","DOI":"10.1109\/INM.2015.7140281"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3746","DOI":"10.1109\/TCOMM.2016.2580150","article-title":"Delay-aware scheduling and resource optimization with network function virtualization","volume":"64","author":"Qu","year":"2016","journal-title":"IEEE Trans. Commun."},{"key":"ref_10","first-page":"69","article-title":"Network service orchestration: A survey","volume":"142","author":"Perez","year":"2019","journal-title":"Comput. Commun."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1016\/j.future.2018.07.039","article-title":"Research challenges in nextgen service orchestration","volume":"90","author":"Vaquero","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Alam, I., Sharif, K., Li, F., Latif, Z., Karim, M.M., Biswas, S., Nour, B., and Wang, Y. (2020). A Survey of Network Virtualization Techniques for Internet of Things Using SDN and NFV. ACM Comput. Surv., 53.","DOI":"10.1145\/3379444"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"5591","DOI":"10.1109\/ACCESS.2016.2607786","article-title":"SDN and Virtualization Solutions for the Internet of Things: A Survey","volume":"4","author":"Bizanis","year":"2016","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"114066","DOI":"10.1109\/ACCESS.2020.2996214","article-title":"A Machine Learning Security Framework for IoT Systems","volume":"8","author":"Bagaa","year":"2020","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Galeano-Brajones, J., Carmona-Murillo, J., Valenzuela-Vald\u00e9s, J.F., and Luna-Valero, F. (2020). Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach. Sensors, 20.","DOI":"10.3390\/s20030816"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Cohen, R., Lewin-Eytan, L., Naor, J.S., and Raz, D. (May, January 26). Near optimal placement of virtual network functions. Proceedings of the 2015 IEEE Conference on Computer Communications (INFOCOM), Kowloon, Hong Kong.","DOI":"10.1109\/INFOCOM.2015.7218511"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Sahhaf, S., Tavernier, W., Colle, D., and Pickavet, M. (2015, January 13\u201317). Network service chaining with efficient network function mapping based on service decompositions. Proceedings of the 2015 1st IEEE Conference on Network Softwarization (NetSoft), London, UK.","DOI":"10.1109\/NETSOFT.2015.7116126"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Nguyen, T.T.L., and Pham, T.M. (2020). Efficient Traffic Engineering in an NFV Enabled IoT System. Sensors, 20.","DOI":"10.3390\/s20113198"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"554","DOI":"10.1109\/TNSM.2017.2723090","article-title":"A Reliability-Aware Network Service Chain Provisioning with Delay Guarantees in NFV-Enabled Enterprise Datacenter Networks","volume":"14","author":"Qu","year":"2017","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"13897","DOI":"10.1007\/s10586-018-2124-0","article-title":"AI-based software-defined virtual network function scheduling with delay optimization","volume":"22","author":"Liao","year":"2019","journal-title":"Clust. Comput."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"154","DOI":"10.1016\/j.future.2012.05.011","article-title":"Semantic-aware multi-tenancy authorization system for cloud architectures","volume":"32","author":"Bernabe","year":"2014","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1016\/j.comnet.2016.08.014","article-title":"Security policy enforcement for networked smart objects","volume":"108","author":"Sicari","year":"2016","journal-title":"Comput. Netw."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"707","DOI":"10.1109\/TNET.2019.2895278","article-title":"Adding Support for Automatic Enforcement of Security Policies in NFV Networks","volume":"27","author":"Basile","year":"2019","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_24","first-page":"79","article-title":"A formal approach for network security policy validation","volume":"8","author":"Valenza","year":"2017","journal-title":"J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1002\/nem.1917","article-title":"Inter-function anomaly analysis for correct SDN\/NFV deployment","volume":"26","author":"Basile","year":"2016","journal-title":"Int. J. Netw. Manag."},{"key":"ref_26","unstructured":"Zarca, A.M., Bernab\u00e9, J.B., Ort\u00edz, J., and Skarmeta, A. (2018). Policy-based Definition and Policy for Orchestration Final Report. Anastacia H2020 European Project Deliverable D2.5, University of Murcia. Available online: http:\/\/www.anastacia-h2020.eu\/deliverables\/ANASTACIA-WP2-T2.1-UMU-D2.5-PolicyBasedDefinitionAndPolicyForOrchestrationFinalReport-v1.0.pdf."},{"key":"ref_27","unstructured":"Zarca, A.M., Bernab\u00e9, J.B., Skarmeta, A., and Miloud, B. (2019). Final Security Enforcement Manager Report. Anastacia H2020 European Project Deliverable D3.4, Aalto University. Available online: http:\/\/www.anastacia-h2020.eu\/deliverables\/ANASTACIA-WP3-UMUT3.1-D3.4-FinalSecurityEnforcementManagerReport-v1.0.pdf."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/13\/3622\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T09:43:45Z","timestamp":1760175825000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/13\/3622"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,27]]},"references-count":27,"journal-issue":{"issue":"13","published-online":{"date-parts":[[2020,7]]}},"alternative-id":["s20133622"],"URL":"https:\/\/doi.org\/10.3390\/s20133622","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,6,27]]}}}