Poster: Secure NFV Infrastructure based on Software Fault Isolation Considering Multi-Tenant Environment

Network Function Virtualization Infrastructure (NFVI) enables the operation of Network Function Chaining (NFC) in a low-cost and flexible manner by realizing network functions as software on general-purpose servers. One of NFVI's security requirements is access control to packet buffers, which can be achieved using Intra-process Isolation techniques. This paper proposes a secure NFVI using Software Fault Isolation (SFI) for access control to packet buffers by inserting bounds check instructions before indirect memory access instructions. The measurement results show that the proposed method is faster than ERIM, another Intra-process isolation method based on domain switching.