Next generation 6G networks are designed to meet the requirements of modern applications, including the need for higher bandwidth and ultra-low latency services. While these networks show significant potential to fulfill these evolving connectivity needs, they also bring new challenges, particularly in the area of security. Meanwhile, ensuring the privacy is paramount in 6G network development, demanding robust solutions following “privacy-by-design” principles. To address these challenges, PRIVATEER project strengthens existing security mechanisms, introducing privacy-centric enablers tailored for 6G networks. This work, evaluates key enablers within PRIVATEER, focusing on the development and acceleration of AI -driven anomaly detection models, as well as attestation mechanisms for both hardware accelerators and containerized applications.

Unmanned Aerial Vehicles (UAVs) are increasingly deployed in inspection and monitoring missions, yet onboard computation and communication impose significant energy burdens that limit flight time and operational scope. In this work, we introduce a novel, blockchain-enabled framework-grounded in the Distributed Autonomous Organization (DAO) paradigm-for orchestrating distributed analytics across a swarm of UAVs. Leveraging the OASEES project's smart-contract architecture, each drone embeds a Metrics Module for real-time power monitoring, a Behavioral Module for adaptive control, and a Blockchain Agent that autonomously proposes, votes on, and executes collective decisions. Three concurrent threads-Proposal Trigger, Voting, and Action Execution-enable fully decentralized governance of swarm behavior: from detecting critical energy thresholds and formulating swarm-wide conservation maneuvers, to executing approved strategies across all members. We validate our framework in a UAV-based infrastructure inspection scenario, employing a YOLOv5 object-detection pipeline to classify four corrosion classes on a telecommunications mast under three video-capture modalities (short-distance, long-distance, and horizontally concatenated streams). Across all configurations, our system achieves near-perfect precision, recall, and mean Average Precision (mAP50-95$\approx 0.995$), demonstrating both the efficacy of distributed workload inference and the feasibility of treating a single drone as a multi-feed processor. These results underscore the potential of DAO-driven UAV swarms for energy-aware, resilient aerial analytics, and pave the way for fully decentralized 5G/6G-enabled airborne networks.

Public key cryptography is nowadays a crucial component of global communications which are critical to our economy, security and way of life. The quantum computers are expected to be a threat and the widely used RSA, ECDSA, ECDH, and DSA cryptosystems will need to be replaced by quantum safe cryptography. The main objective of the HORIZON Europe PQ-REACT project is to design, develop and validate a framework for a faster and smoother transition from classical to quantum safe cryptography for a wide variety of contexts and usage domains that could have a potential interest for defence purposes. This framework will include Post Quantum Cryptography (PQC) migration paths and cryptographic agility methods and will develop a portfolio of tools for validation of post quantum cryptographic systems using Quantum Computing. A variety of real-world pilots using PQC and Quantum Cryptography, i.e., Smart Grids, 5G and Ledgers will be deployed to validate the defined framework.

This work presents a Moving Target Defense (MTD) framework for the protection of network slices and virtual resources in a telco cloud environment. The preliminary implementation provides a closed-loop security management of services with proactive MTD operations to reduce the success probability of attacks, and reactive MTD operations, empowered by a tampering detection and a traffic-based anomaly detection system. MTD strategies are adaptive and optimized with deep reinforcement learning (deep-RL) for balancing costs, security, and availability goals defined in a Multi-Objective Markov Decision Process (MOMDP).

5G mobile networks introduce the concept of network slicing, the functionality of creating virtual networks on top of shared physical infrastructure. Such slices can be tailored to various vertical services. A single User Equipment (UE) may be served by multiple network slice instances simultaneously, which opens up the possibility of dynamically steering traffic in response to the specific needs of individual applications – and as a reaction to events inside the network, e.g., network failures.This paper presents the PoLicy-based Architecture for Network Slicing (PLANS). In this policy framework, the network slice management entity in the 5G core and the UE can cooperatively optimize the usage of the available network slices via policy systems installed both inside the network and on the UE. The PLANS architecture has been implemented and evaluated in a 5G testbed. For two different case studies, we show how such a system can be leveraged to provide optimized services and increased robustness against network failures. First, we consider a drone autopilot scenario, and demonstrate how PLANS can reduce network-slice recovery time by more than 90%. Second, we illustrate for a 360°video streaming scenario how PLANS can help prevent video quality degradation when a network slice becomes unavailable.

The promise of disparate features envisioned by the 3GPP for 5G, such as offering enhanced Mobile Broadband connectivity while providing massive Machine Type Communications likely with very low data rates and maintaining Ultra Reliable Low Latency Communications requirements, create a very challenging environment for protecting the 5G networks themselves and associated assets. To overcome such complexity, future 5G networks must employ a very high degree of network and service management automation, which is a security challenge by itself as well as an opportunity for smarter and more efficient security functions. In this paper, we present the smart, trustworthy and liable 5G security platform being designed and developed in the INSPIRE-5Gplus1 project. This platform takes advantage of new techniques such as Machine Learning (ML), Artificial Intelligence (AI), Distributed Ledger Technologies (DLT), network softwarization and Trusted Execution Environment (TEE) for closed-loop and end-to-end security management following a zero-touch model in 5G and Beyond 5G networks. To this end, we specifically elaborate on two key aspects of our platform, namely security management with Security Service Level Agreements (SSLAs) and liability management, in addition to the description of the overall architecture.

Software Defined Networking (SDN) and Network Function Virtualisation (NFV) are transforming modern networks towards a service-oriented architecture. At the same time, the cybersecurity industry is rapidly adopting Machine Learning (ML) algorithms to improve detection and mitigation of complex attacks. Traditional intrusion detection systems perform signature-based detection, based on well-known malicious traffic patterns that signify potential attacks. The main drawback of this method is that attack patterns need to be known in advance and signatures must be preconfigured. Hence, typical systems fail to detect a zero-day attack or an attack with unknown signature. This work considers the use of machine learning for advanced anomaly detection, and specifically deploys the Apache Spot ML framework on an SDN/NFV-enabled testbed running cybersecurity services as Virtual Network Functions (VNFs). VNFs are used to capture traffic for ingestion by the ML algorithm and apply mitigation measures in case of a detected anomaly. Apache Spot utilises Latent Dirichlet Allocation to identify anomalous traffic patterns in Netflow, DNS and proxy data. The overall performance of Apache Spot is evaluated by deploying Denial of Service (Slowloris, BoNeSi) and a Data Exfiltration attack (iodine).

In pursuit of a flexible, resource efficient and high- performant 5G infrastructure, many operators, vendors and research consortia are currently developing, testing and inte­grating their NFV platform with associated management and orchestration (MANO) functionality. The SONATA NFV platform follows a micro-service design, which involves a tight coupling between an SDK, monitoring and MANO functionality, targeting a secure and stable software foundation. This experience paper gives a thorough overview on the encountered challenges, insights and resulting learnings when implementing and integrating the SONATA Service Platform using a continuous integration and delivery DevOps methodology. This is the result of a strong cooperation between prominent equipment vendors, network operators, software companies and universities, providing a set of constructive recommendations in hope of catalysing the development and deployment of NFV platforms.

Visible Light Communication (VLC) is a powerful supplement, which has gained tremendous attention recently and has become a favorable technology in short-range communication scenarios for the Fifth Generation (5G) networks. VLC possesses a number of prominent features to address the highly demanding 5G system requirements for high capacity, high data rate, high spectral efficiency, high energy efficiency, low battery consumption, and low latency. However, this prominent performance is limited by the imperfect reception, since line of sight channel condition may not always exist in practice. This paper presents and experimentally validates a SDN-assisted VLC system, which is coupled with WiFi access technology in order to improve the reliability of VLC system, reassuring zero packet loss reception quality due to misalignment or path obstructions or when the user is moving between two consecutive VLC transmitters and experience “dead coverage zones”.

SHIELD is an EU-funded project, targeting at the design and development of a novel cybersecurity framework, which offers security-as-a-Service in an evolved telco environment. The SHIELD framework leverages NFV (Network Functions Virtualization) and SDN (Software-Defined Networking) for virtualization and dynamic placement of virtualised security appliances in the network (virtual Network Security Functions - vNSFs), Big Data analytics for real-time incident detection and mitigation, as well as attestation techniques for securing both the infrastructure and the services. This papers discusses key use cases and requirements for the SHIELD framework and presents a high-level architectural approach.

Research in 5G architectures is focused on exploring ways to leverage the use of virtualisation offered by cloud infrastructures and network programmability to provide flexibility and agility in the development and deployment of Network Services and virtual network functions. In this context, this paper presents the description of SONATA project demonstrator. SONATA supports agile development and orchestration of network services in 5G networks.

Fifth-generation (5G) envisages a “hyper-connected society” where an enormous number of diverse entities could communicate with each other anywhere and at any time, some of which will demand extremely challenging performance requirements such as sub-millisecond latency, and higher data rates. Cloud-enabled radio access networks (CE-RANs) where intelligence is placed at the edge of the mobile network and in the proximity of end users emerge as a promising solution to improve online experience. To make CE-RAN more flexible and cost-effective, network functions virtualization and software defined networking technologies are employed, enabling features such as resource pooling, scalability, spectral efficiency, and multi tenancy. The accommodation of such technologies in the context of 5G requires multipronged efforts at various levels, in particular at the management and orchestration. Among all topics that falls into this subject, e.g., resource optimization and efficient lifecycle management, this paper focuses on two critical challenges, i.e., service mapping and quality of service assurance. Particularly, the proposed service placement solution takes into account two main constraints, i.e., quality of user experience and limited hardware capabilities available at the network edge. Simulation tools as well as the SESAME testbed have been used to extract results in this paper and a proof-of-concept evaluation is presented.

One of the primary challenges associated with network functions virtualization (NFV) is the automated management of the service lifecycle. In this paper, we present a full software-based management and orchestration (MANO) stack which operates with OpenStack and OpenDaylight controllers and has the in-built functionality to automate the key phases of the NFV service lifecycle, namely resource discovery and matching, service mapping, service deployment, and monitoring. The MANO stack is being implemented by the EU FP7 project T-NOVA, with the components being released as open-source software. Service mapping and service deployment solutions developed in the scope of T-NOVA are presented in detail. As a proof-of-concept, we evaluate the performance of a virtualized traffic classifier network function, demonstrating the gains of virtualized hardware acceleration.

The EU funded FP7 project T-NOVA, with the specific goal of accelerating the evolution of NFV, proposes an open architecture to provide Virtual Network Functions as a Service (VNFaaS), together with a dynamic, and flexible platform for the management of Network Services (NSs) composed by those Virtual Network Functions (VNFs). The proposed architecture allows operators to deploy distinct virtualized network functions, not only for their internal operational needs, but also to offer them to their customers, as value-added services. Virtual network appliances (e.g. gateways, proxies or even traffic analyzers) can be provided on-demand, eliminating the need to acquire, install, and maintain specialized hardware at customer premises. This demo illustrates early work carried out on the deployment of a VNF on a Network Function Virtualization Infrastructure (NFVI) using resource aware scheduling methods to ensure optimal use of resources and performance.

The paper proposes a novel flexible packet forwarding (FPF) method designed for Future Internet networks. It follows the source routing principle at an inter-domain level and applies the list of domain customized identifiers to forward packets on the end-to-end path. The main features are capability to introduce flexible routing path selection, native support for multipath and multicast packet transfer, ability for exploitation of advanced in-network packet processing as, e.g., content recoding and caching. The performance and scalability of FPF approach were evaluated by experimentation on developed prototype as well as by scalability studies assuming Internet-scale network scenario.

While the explicit provision of Network Awareness to applications towards QoE optimisation has attracted significant attention during the past decade, very few solutions have been proposed which can be considered both feasible and scalable. Towards this direction, this paper proposes a framework which implements a Network Cost Service, explicitly providing the “network cost” between two or more network nodes as well as the a priori QoE estimation for a specific application - with the aim of assisting QoE-based optimization of current and emerging communication paradigms, such as peer-to-peer communication, distributed caching, information-centric networking and in-network cloud services. The proposed framework has been fully implemented, assessed and released as open-source for further experimentation. Large-scale deployment considerations and open research issues are also discussed.

Active network monitoring techniques have been traditionally used in network management frameworks for OAM operations. They can also provide vital end-to-end network status information which can be exploited for application optimization (Network-Aware Applications). The paper proposes a novel, standards-compliant management framework for conducting active measurements on DiffServ networks, solely based on SNMP as control protocol. A specialized SNMP agent (SNMP for Active Measurements - SAM) is introduced for this purpose, accompanied with a custom MIB, which utilizes the standardized OWAMP (One-Way Active Measurement Protocol) for establishing active measurement sessions. A proof-of-concept implementation deployed on a laboratory testbed shows that the proposed framework exhibits satisfactory accuracy and scalability, while at the same time being compatible with off-the-shelf SNMP-based network managers. The SAM framework has been released as open-source for Linux-based routers.

This work is a part of complex multi-domain eco-system specification and design aiming to deliver multimedia Quality of Services (QoS) enabled services. A cooperation framework is proposed between a high level Service Provider (SP) - managing high level services - and a Content Aware Network Provider (CANP), managing an overlay, multi-domain, transportation network. The virtual CANs are requested by a SP, negotiated with, and realised by the CANP. This cooperation, through online Service Level Agreements, creates a cross-layer optimization loop between the transport, application, and services layers. Inside the VCANs the resources for QoS assurance are assured by static and dynamic provisioning, service differentiation and media flow dynamic adaptation.

This paper presents a preliminary implementation of a content-aware network node as part of a Content-Aware capable network infrastructure. The proposed network node facilitates all the possible functions provided by an ordinary router or gateway while at the same time exploits flow- and content- awareness in order to identify the content carried within a flow and handle it efficiently. In this context this paper discusses the main concepts and operating principles around the flow and content awareness and presents a preliminary implementation, build around the Linux operating system.

Creation and efficient distribution of new rich media services is foreseen to play a key role in the Future Internet. Emerging FI architectures should be able to fully support and facilitate all kinds of current and future media-oriented applications. The architecture illustrated in this paper facilitates the deployment of an integrated Media Ecosystem, where all users can efficiently not only have access to, but also compose and share rich media services. This is achieved via a mesh of intelligent, media-centric home gateways (“HomeBoxes”), which utilize novel Content-Aware network overlays, developed on top of the existing transport infrastructures. This concept has been designed and is being implemented as an international pilot demonstrator in the frame of the EU-funded ICT project ALICANTE.

In the recent years one of the most active research topics in multimedia networking is the exploitation of the Scalable Video Coding (SVC) as a scalable solution for efficient network resources utilization. SVC introduces scalability by exploiting a layered encoding of the video stream, thus enabling real-time in-network adaptation by selectively allowing the transmission of appropriate layers. This paper presents an architecture that exploits SVC capabilities in order to provide end-to-end QoS assurance via in-network video adaptation. The adaptation system management is based on MPEG-21 framework while the network QoS mechanisms are based on DiffServ standard. The performance evaluation of the proposed architecture is performed over a real test-bed infrastructure.

The continuing and rapid growth of the Internet has created an extremely large capacity problem to the service and content provider's networks. The increased network traffic and the absence of service priority, usually produce high network congestions, delayed data and service transmissions and lack of throughput. The effect of these factors in AW content transmission is to distort the initial content and decrease the content quality. To avoid this negative effect, service and content providers are looking for architectures that give them greater control on traffic passing through their domains and other heterogeneous networks. This document proposes an experimental core network architecture (MPLS-DiffServ) presenting a solution for content providers that want reliable and agreed level of quality, even if the network is under congestion. MPLS-DiffServ architecture, couples the DiffServ'sper hop guarantees with MPLS traffic engineering capabilities. Furthermore, content/services of different format will be distributed over MPLS-DiffServ network with different guarantee limits and delivered on a variety of user terminals..

The content delivery chain encompasses content creation, delivery and consumption. To support this, the content has to be identified, described, generated, delivered, managed and protected. Furthermore, content/services of different format will be distributed over heterogeneous networks and delivered on a variety of user terminals. The scarce resource of bandwidth needs to be dynamically managed and the QoS should remain within predefined limits, accepted by the end users. This will enable the provision of network and terminal resources on demand to form user communities, where the content can be created, protected and shared, always with the agreed/contracted quality, reliability and flexibility. It is therefore imperative to develop an integrated solution that is able to manage the functionality of various entities in the digital information distribution chain, from content/service generation to user terminals, using heterogeneous networks, comprised of wired (IP based core network) and wireless (DVB, WLAN, WiMAX) segments, and based on the end-to- end QoS approach. The aim of this work is to propose and to build a suitable testbed environment where such a solution, namely the approach of ENTHRONE (end-to-end QoS through integrated management of content, networks and terminals), can be tested and demonstrated. In this respect, an operational networking infrastructure is outlined which can be used as a test bed to demonstrate, in real conditions, the functionalities and the performance of ENTHRONE approach to E2E QoS provisioning.