Digital Twin (DT) is a prominent technology to utilise and deploy within the healthcare sector. Yet, the main challenges facing such applications are: strict health data-sharing policies, high-performance network requirements, and possible infrastructure resource limitations. In this paper, we address all the challenges by provisioning adaptive Virtual Network Functions (VNFs) to enforce security policies associated with different data-sharing scenarios. We define a Cloud-Native Network orchestrator on top of a multi-node cluster mesh infrastructure for flexible and dynamic container scheduling. The proposed framework considers the intended data-sharing use case, the policies associated, and infrastructure configurations, then provisions Service Function Chaining (SFC) and provides routing configurations accordingly with little to no human intervention. As a result, we provide an adaptive network orchestration for digital health twin use cases, that is policy-aware, requirements-aware, and resource-aware.

On the road towards personalised medicine, one of the main challenges is to enforce security and network low-level policies to secure data-sharing. The proposed dynamic framework defines the topology of the service chains to enforce network and security policies by instantiating Virtual Network Functions (VNF's) on the fly via light-weight and easily-deployable containers. In this paper, we profile the resource utilisation of chained VNF's deployed to enable data movement within different healthcare use cases. We provide example configurations that map to a couple of use cases (e-Health record query and heath data streaming), then we monitor and collect CPU utilisation of the different VNF compositions. In the considered policies we can: discard flow, protect (encrypt) and transmit, or allow with no protection. To enforce each policy, we deploy a firewall function (relatively heavy-weight function), encryption function, and a decryption function (light-weight stream cipher). As a result, we analyse the behaviour of the VNF services with various setups, and then we aim to further use this analysis to build the placement heuristic according to available and trusted clusters resources. Subsequently, we will recommend heuristic-based placement based on collected profiling data of the resource usage and limits for high availability, optimal performance, and minimal resource waste.

Utilising programmable infrastructures is a promising approach to support secure data-sharing across healthcare domains of different capabilities in terms of network and security. The EPI1(Enabling Personalised Interventions) framework automates the setup of the underlying infrastructure while considering different requirements communicated by the EPI components, such as logic area generator and policy management system.In our approach to dynamically provide collaborative environments, we containerise network functions (VFs), that are shipped out and instantiated at the edge of the network. We use container-based Virtual Network Function (VNFs) to accomplish fast deployment, high reusability, and low-performance overhead.Traffic interception and redirection through the chain of containerised network functions is a core feature of our framework. In this paper, we focus on the implementation and design of this tool for packet interception and redirection. We evaluate the performance of two approaches: an NGINX-based reverse proxy method and a SOCKS protocol-based method. We benchmark them to determine the overhead compared to a direct data-sharing session with no proxy. We conclude that the reverse proxy performs better in terms of overhead. Nonetheless, the SOCKS-based method works on a lower network level support all traffic types and offer a higher processing rate. We compare the methods according to other performance parameters. Subsequently, the choice of method will depend on the application performance requirements.