ePEM: An End-to-End Proactive Secure Connectivity Manager for 6G Orchestrator Solutions

ePEM: an End-to-End Proactive Secure Connectivity Manager for 6G Orchestrator Solutions Alessandro Carrega∗‡ Ramin Rabbani†‡ ∗Department of Electrical, Electronic and Telecommunications Eng., and Naval Architecture (DITEN) University of Genoa (UniGe), Italy {name}.{surname}@unige.it †Telecommunication Networks and Telematics Lab (TNT-Lab) Department of Electrical, Electronic and Telecommunications Eng., and Naval Architecture (DITEN) University of Genoa (UniGe), Italy {name}.{surname}@tnt-lab.unige.it ‡National Laboratory of Smart and Secure Networks (SN2) of the National Inter-university Consortium for Telecommunications (CNIT), Genoa, Italy {name}.{surname}@cnit.it Abstract—The End-to-End Proactive Security Connectivity Manager (ePEM) system is introduced as a cutting-edge connectivity manager designed to orchestrate and secure end-to-end services within the Holistic, Omnipresent, Resilient Services for future 6G wireless and computing Ecosystems (HORSE) security infrastructure for future Sixth-Generation (6G) networks. It plays a pivotal role in managing Network Function Virtualization (NFV) and applicative services, providing observability and data simplification to improve decision-making and security management. ePEM employs meta-actions for security contingency planning and maintains a comprehensive database of the network’s logical topology. Built on a modular architecture, it supports various Network Function (xNF) and ecosystems, using blueprint profiles to standardise the operations for network elements. Index Terms—NFV, orchestration, 6G, blueprint, security, process automation. I. INTRODUCTION The ePEM plays a pivotal role in the HORSE security infrastructure [1]. HORSE represents a cutting-edge security infrastructure designed to safeguard complex, distributed, and heterogeneous systems. In this intricate environment, ePEM serves as a central architectural element, orchestrating actions and providing observability over the various components that constitute the end-to-end services secured within the HORSE security perimeter. The advent of 6G networks and their reliance on virtualized infrastructure, including Software-Defined Networking (SDN) and NFV, has introduced new challenges in terms of security, resource management, and network orchestration [2]. 6G promises ultra-reliable low-latency communications (URLLC), massive machine-type communications (mMTC), and enhanced mobile broadband (eMBB), leading to increasingly complex and dynamic network environments [3]. These networks must seamlessly support diverse use cases, including autonomous vehicles, industrial automation, and critical infrastructure, all of which require stringent security and resource optimization [4]. While prior research has proposed various orchestration frameworks for NFV and SDN environments, such as ETSI’s Management and Orchestration (MANO) architecture [5], they typically focus on resource management without providing a comprehensive framework for addressing security in dynamic and heterogeneous environments. Moreover, current solutions often lack the adaptability required for future 6G networks, where the heterogeneity of services, devices, and applications is expected to be far more pronounced [6]. The novelty of this work lies in the design and implementation of the ePEM system, which integrates security with orchestration, particularly for the HORSE security infrastructure. Unlike traditional orchestrators, ePEM is specifically built to handle the dynamic and evolving threat landscape of 6G networks. It achieves this by leveraging a modular architecture that supports flexible and extensible management of both network functions and security services. In addition to managing NFV and applicative services, ePEM integrates sophisticated security features, such as Blueprint profiles and meta-actions, which enable proactive defense mechanisms against potential cyber threats [7]. The motivation behind this work stems from the increasing complexity of future network ecosystems. As networks evolve toward full digital transformation, driven by technologies like 6G, there is a critical need for orchestrators that not only manage network resources but also ensure robust security mechanisms. Current orchestration platforms fail to offer this dual capability in a cohesive and adaptable manner. The development of ePEM addresses this gap by providing an orchestration solution that combines efficient resource management with a strong security posture, tailored for the demands of 6G networks and beyond [8]. In summary, this paper makes the following key contributions: •We present the design and implementation of ePEM, a novel orchestration system that integrates security and resource management in the HORSE security infrastructure, specifically tailored for 6G networks. •We introduce the concept of Blueprint profiles and meta-actions, which provide a standardized yet flexible approach to managing diverse network elements while ensuring proactive security measures. •We demonstrate how ePEM’s modular architecture sup- ports the extensibility required for future network ecosystems, allowing for the seamless incorporation of new technologies and services. •We evaluate the performance of ePEM within the HORSE security infrastructure, showcasing its ability to handle complex, heterogeneous systems while maintaining a high level of security. The remainder of this paper is organized as follows. Section II details the development of the ePEM, focusing on its role in managing secure end-to-end connectivity within the HORSE infrastructure. Section III delves into the modular architecture of ePEM, highlighting its flexible and extensible design that supports diverse NFV ecosystems. In Section IV, we discuss ePEM’s security mechanisms and its approach to data collection, including the use of meta-actions and Blueprint profiles for standardized and proactive security management. Finally, Section V presents the conclusions, summarizing the key contributions and future potential of ePEM within the evolving landscape of 6G networks and the HORSE ecosystem. II. DEVELOPMENT DETAILS ePEM is at the heart of managing end-to-end secure connectivity within the HORSE security perimeter. It acts as the central coordinator, ensuring that all elements and artefacts operate securely and harmoniously. In its role as an orchestrator [9], ePEM orchestrates actions and maintains observability across the diverse and heterogeneous components that constitute the HORSE ecosystem. It is responsible for harmonising the complex interplay of resources and services to ensure the infrastructure’s resilience and security. ePEM collaborates with Domain Orchestrators [10] and controllers to enhance the efficiency and intelligence of operations. These external entities bring varying degrees of automation and intelligence to the management of resources and artefacts throughout their lifecycle. This includes services related to NFV [11] and resources associated with SDN [12] [13] [14]. A. Topology Information Management ePEM maintains a comprehensive database of the logical topology of the distributed infrastructure, including information at both the wide-area connectivity and Virtual Infrastructure Manager (VIM) levels. Additionally, it records details about the orchestrators and controllers responsible for governing these components. Each topological entity is annotated with resource constraints and access levels, which are essential for efficient resource management and access control. B. Management of NFV/Applicative Services ePEM actively participates in the management of NFV and applicative services. It maintains awareness and keeps track of the localisation and degrees of freedom granted by VIMs to Virtual Network Functions (VNFs) and application components within the HORSE security perimeter. It continuously updates information related to NFV/applicative services based on the exposure levels provided by domain orchestrators and controllers. C. Data Homogenisation and Simplification An aspect of ePEM’s role is to homogenise and consolidate data from diverse sources after the pre-processing module. This simplification provides a unified, coherent view of the services managed by the HORSE platform. This streamlined view significantly aids in decision-making and security management. D. Meta-Actions for Security ePEM autonomously acquires and exposes a range of action types that can be applied to each artefact or group of artefacts within the end-to-end services. These meta-actions assist in formulating contingency plans for security threats and vulnerabilities. They are derived from a set of predesigned Blueprint profiles that encapsulate the functional behaviour of diverse network elements. E. Blueprint Profiles Blueprint profiles within the context of ePEM encompass a diverse range of complex network elements, including FifthGeneration (5G)/6G radio mobile networks, distributed firewalls, monitoring overlay systems [15], and other intricate elements. These profiles serve as comprehensive templates that outline specific actions and primitives essential for orchestrating activities throughout different phases of network management. By providing a standardised framework, Blueprint profiles empower ePEM to coordinate and execute operations seamlessly, ensuring efficiency and coherence in the management of various network elements [16]. Whether orchestrating the configuration of a radio mobile network, deploying a distributed firewall, or coordinating a monitoring overlay system, Blueprint profiles play a pivotal role in streamlining processes and enhancing the overall operational effectiveness of the HORSE infrastructure. This standardised approach facilitates efficient and consistent management of network elements, fostering a cohesive and streamlined network management environment [17]. In essence, Blueprint profiles serve as the cornerstone of ePEM’s ability to effectively manage a diverse landscape of network elements. Their standardised nature and comprehensive design ensure that network management operations are executed seamlessly, contributing to the overall success of the HORSE infrastructure. F. Enhancements to NFVO and VIMs: Modular Architecture ePEM is built on a modular and flexible architecture, designed to be easily extended to support various Network Functions (xNFs) and ecosystems. At the core of this architecture, as shown in Figure 1, lies the metamodel, specifically crafted to enhance extensibility and flexibility while driving clear interaction patterns among internal modules during LifeCycle Management (LCM) operations [18]. In the ePEM metamodel for Enhanced Extensibility in LCM Operations, every ecosystem instance is built using a Blueprint, which, in turn, falls under a specific Category. The Blueprint Category corresponds to the high-level function type of the network ecosystem, such as a 5G system or a network security toolchain [19]. Each Blueprint is designed to support ad-hoc operations for specific implementations within that Category. For instance, the ePEM currently provides four different 5G system implementations, based on different open-source projects, namely Free5GC [20], Open5GS [21], OpenAir Interface [22], and SD-Core [23]. The Blueprint Category allows for a homogeneous northbound interface across the different implementations available for an ecosystem [24], as it defines a single input metadata model (including possible ecosystem endpoints) and the associated ecosystem-level LCM methods. For example, the 5G System Blueprint Category exposes operations to add/remove/reconfigure Radio Access Network (RAN) over specific geographical areas, create/modify/destroy network slices, etc., and fixes the endpoints to be physical devices like base stations or Open RAN (O-RAN) radio units, and networks to be used as 5G Data Network Name (DNN) [25]. A Blueprint provides the implementation-specific means to support the Category methods and translate the metadata model into sets of Network Service Instances (NSIs) and xNFs, interconnected and operating with coherent (yet implementation-specific) configurations. To this end, Blueprints define the template of the ecosystem’s internal topology, as well as the specification of the internal procedures to be executed for every supported Category method. As detailed in section SAGA pattern [26], these internal procedures are realised as SAGA pattern interactions among specific ePEM modules. Figure 1. ePEM Modular Architecture. The topology template defines the graph pattern, including the templates of internal networks and NSIs that can be applied, and their possible relationship bindings. An NSI template specifies the list of possible constituent xNFs, and the logic to build NFV SOL-006 [27] descriptors to be onboarded and used by the NFV Orchestrator (NFVO). Finally, the metadata model of xNFs plays a key role in ePEM’s architecture. It defines not only the specific physical/virtual/Kubernetes [28] deployment units to be used to materialise NS templates but also defines the implementation-specific methods and callbacks that can be executed on an xNF, and the models of its configuration. In other words, xNF templates represent the glue between NFV-driven LCM operations to instantiate or remove artefacts from the ecosystem—e.g., creating a RAN Network Slice (NS) in a new area—and management operations affecting the configuration of running xNFs (e.g., adding a new 5G subscriber, adding a new policy, etc.). Each of these operations might include a variable number of different actions, including: •day 0and 1actions for adding NSI instances; •day 2actions involving modifying the configuration settings of xNFs and retrieving information from the deployed xNFs; •removal of deployed NSIs. III. THE INTERNAL MODULAR ARCHITECTURE The ePEM internal architecture, illustrated in Figure 2, encompasses the meta-models introduced in the previous Section. A first module, named NFV Convergence Layer (NFVCL) North Bound Interface, aims at exposing Create Read Update Delete (CRUD) Representational State Transfer (REST) Application Programming Interfaces (APIs) [29] for ecosystem LCM through the methods defined in the Blueprint Category meta-models that are available and onboarded to the ePEM. Among these methods, ecosystem creation and deletion are mandatory (and correspond to HTTP POST and DELETE messages). The NFVCL North Bound Interface module acts as a central hub for orchestrating ecosystem management operations. It leverages the metamodel definitions to translate REST API calls into corresponding ecosystem-specific actions. This facilitates seamless interaction with diverse ecosystem implementations, enabling unified management of network resources. Figure 2. ePEM Internal Architecture and Interfaces. The Topology Manager (TM) provides essential resources required by the ecosystems. Topology status encompasses details such as the VIM list with their respective network statuses, available Kubernetes clusters suitable for deploying Kubernetes Deployment Units (KDUs), a comprehensive list of accessible Parallel Network Functions (PNFs), and metric servers for storing Key Performance Indicators (KPIs). An instrumental capability of the TM is its ability to terraform resources on the VIM. In simpler terms, when a Blueprint requires something that does not currently exist, the TM can dynamically create it on demand. Terraform, in this context, refers to the dynamic provisioning and orchestration of resources, allowing for the seamless adaptation and creation of components as needed by the system. The Blueprint Manager handles all requests towards Blueprints, from creation to day-N operations. An Ecosystem Blueprint Engine instance (Operator) is instantiated for every active ecosystem at its initialization. In this way, it is possible to handle multiple requests for different Blueprint instances simultaneously. The Operator can be thought of as a worker, dedicated to handling and serializing incoming LCM initialization/change requests on the ecosystem. This component maintains information related to both the Blueprint meta-model (status) and the Topology template. In particular, it is responsible for binding any supported Blueprint category method into a coordinated set of multiple implementation-specific operation requests against resources in the topology, the LCM of NFV Network Service Instances, or configuration changes within one or multiple xNFs. While these operations are executed in further dedicated components, namely, the Topology Manager, the NSI LCM engines, and the xNF configurators, the Ecosystem Blueprint Operator acts as a central coordinator for the distributed transaction through a publish-subscribe communication system (in the current version, Remote Dictionary Server (REDIS) is used for this purpose). This architecture is known in software engineering as an orchestrator-based SAGA pattern. ePEM can interact directly with external entities, like Kubernetes or OpenStack, to enable features not supported by the VIM. For example, when working with Open Source MANO (OSM), there is no way to create/update images for Virtual Deployment Units (VDUs); they must exist on the VIM. Kubernetes APIs are widely used for managing and configuring clusters deployed through ePEM; some useful operations performed this way include plugin installation and user creation. A. Persistency Layer ePEM utilizes a MongoDB [30] database to store critical information essential for its seamless operations. This database serves as a repository for two primary collections that underpin the system’s functionality: one dedicated to the topology status and the other capturing the dynamic states and topology templates for each instantiated Blueprint. Upon initialization, ePEM prioritizes loading fundamental topology information, establishing a solid groundwork for subsequent operations. Thereafter, when an LCM operation is initiated for a specific Blueprint, the system efficiently retrieves the corresponding status for that specific Blueprint instance from the database. Topology status, a crucial facet of the stored information, encapsulates comprehensive details about the overall network structure, providing insights into the current state of interconnected elements and their operational statuses. This holistic overview serves as the bedrock for effective decision-making and orchestration processes within ePEM. Recognizing the diverse needs of each Blueprint ecosystem, the system acknowledges the necessity for varying input data. This acknowledgment underscores the nuanced nature of Blueprint statuses, which are inherently influenced by the distinct requirements of different Blueprint types. Even within the same category, each Blueprint type can exhibit a unique data structure for its status, ensuring that the stored information aligns precisely with the intricacies of its operational context. This tailored approach allows ePEM to accommodate the diverse requirements of different Blueprints, fostering adaptability and flexibility in its operations. Furthermore, the stored data of a Blueprint extends beyond real-time states, encompassing historical perspectives through the inclusion of past actions, such as previously executed LCM primitives. This historical context provides a valuable repository of insights, allowing the system to trace the evolution of each Blueprint’s lifecycle and facilitating comprehensive auditing and analysis. In summary, the MongoDB database plays a pivotal role in ePEM’s operational framework, ensuring that vital information is not only securely stored but also dynamically retrieved to support real-time decisionmaking and comprehensive historical analysis. This meticulous approach to data management underscores ePEM’s commitment to robust, adaptive, and insightful network orchestration within the HORSE architecture. Key takeaways: •The MongoDB database stores critical information for ePEM’s operation. •Two primary collections are dedicated to topology status and Blueprint statuses. •Topology status provides insights into the overall network structure and element states. •Blueprint statuses vary based on the unique requirements of different Blueprint types. •Stored data includes historical perspectives for comprehensive auditing and analysis. Benefits of the MongoDB database: •Secure and reliable data storage for critical information. •Dynamic retrieval of information for real-time decisionmaking. •Comprehensive historical analysis for tracing Blueprint evolution. •Support for diverse Blueprint requirements and data structures. Overall, the MongoDB database plays a crucial role in enabling ePEM to effectively manage and orchestrate diverse network ecosystems within the HORSE architecture. B. Relationship with the OSM orchestrator ePEM is actively engaged in the ongoing evolution of the network operating system within the OSM framework. This system is instrumental in supporting the LCM of network functions and VNF-Forwarding Graphs (VNF-FGs) embedded in the application’s deployment graph. As the network landscape continues to evolve, the efficient management of network functions and their associated forwarding graphs becomes essential. ePEM, therefore, seeks to contribute to and integrate advancements in the network operating system, ensuring seamless lifecycle management and optimal performance of network functions within the deployed applications. In essence, ePEM’s commitment to closely monitoring and actively participating in the advancements within the OSM initiative underscores its dedication to staying at the forefront of NFV orchestration and management. By aligning with progress in multi-site resource management and network operating systems, ePEM is committed to delivering a state-of-theart solution that meets the evolving demands of the HORSE infrastructure, providing a reliable, scalable, and adaptive orchestration environment. IV. SECURITY AND DATA COLLECTION In ensuring the robust security of the HORSE infrastructure, ePEM leverages a comprehensive cybersecurity toolkit, including VyOS [31] and Suricata [32], alongside additional security measures tailored to meet the specific demands of the network. VyOS assumes a pivotal role within ePEM’s security architecture, functioning as a cornerstone that fortifies the overall security infrastructure. As an open-source network operating system renowned for its adaptability, VyOS seamlessly integrates into both standard hardware and virtualised environments, offering ePEM a versatile and scalable solution. The utilisation of VyOS empowers ePEM with a comprehensive set of tools and functionalities, enhancing its capability to establish, manage, and safeguard secure communication paths across the network. Leveraging the rich feature set of VyOS, ePEM strategically deploys secure communication channels, meticulously enforces network segmentation, and enacts sophisticated firewall policies. This strategic implementation is instrumental in securing the network against a spectrum of potential threats, providing a robust defense against unauthorized access attempts. VyOS’s adaptability and scalability are particularly advantageous for ePEM, allowing it to dynamically respond to the evolving landscape of security challenges. VyOS not only serves as a protective shield against unauthorized access but also operates as a proactive enforcer of security policies. By leveraging the advanced routing and firewall capabilities of VyOS, ePEM establishes a resilient and structured defense framework. This framework not only safeguards critical assets within the network but also ensures the integrity and confidentiality of data traversing through it. In essence, VyOS within the ePEM ecosystem is not just a security tool; it is an essential element that contributes to the architecture’s robustness and adaptability. Its integration underscores the commitment to maintaining a secure, agile, and scalable network infrastructure, aligning seamlessly with ePEM’s overarching goal of achieving end-to-end proactive secure connectivity within the HORSE infrastructure. Working together with VyOS,Suricata significantly enhances the security posture of ePEM, assuming the pivotal role of an Intrusion Detection and Prevention System (IDPS). Suricata functions as an ever-watchful sentinel within the network, actively and continuously scrutinizing the entirety of network traffic for any potential security incidents or anomalies. This proactive surveillance is fundamental in identifying potential threats before they escalate, contributing to a robust and responsive security infrastructure within the ePEM framework. Upon detecting a security threat, Suricata can optionally initiate preventive actions, adding an extra layer of defense to the network. This rapid response mechanism can fortify the overall security landscape, minimizing the potential impact of security incidents and ensuring the continuity of secure network operations. The option for preventive measures aligns seamlessly with ePEM’s mission of maintaining end-to-end secure connectivity within the HORSE infrastructure. Suricata’s strength lies in its sophisticated utilisation of robust signature-based detection methods, allowing it to recognise and thwart known threats effectively. Furthermore, its adaptive nature enables the assimilation of emerging threat intelligence seamlessly. This capability is crucial in the ever-evolving cybersecurity landscape, where new threats continuously emerge. By staying abreast of the latest threat intelligence, Suricata empowers ePEM to not only identify known threats but also proactively detect and respond to novel and evolving malicious activities. The integration of Suricata equips ePEM with a dynamic and responsive security framework, ensuring that the network infrastructure remains resilient against a wide spectrum of cyber threats and vulnerabilities. Its capabilities go beyond merely reacting to threats; Suricata actively contributes to the prevention and mitigation of potential risks, reinforcing ePEM’s commitment to maintaining the sustained integrity and availability of the HORSE infrastructure. In this way, Suricata serves as an indispensable pillar of the network’s security arsenal employed by ePEM, aligning with its overarching goal of delivering a secure and reliable end-to-end network environment. A. Additional Security Functions: Customised Security Measures In addition to the security features inherent in ePEM, it incorporates additional security functions tailored to the specific needs of the HORSE infrastructure. These functions may include: B. Custom Network Function Deployments ePEM showcases a dynamic capability to deploy supplementary network functions with an unwavering emphasis on security, on an as-needed basis. This flexibility is demonstrated by scenarios like deploying a specialised VNF tailored for advanced threat analysis. In this context, ePEM can promptly allocate resources to establish a dedicated enclave for analysing and understanding intricate security threats, contributing to a more resilient and adaptive defence strategy. Furthermore, ePEM extends its on-demand security capabilities to include the deployment of a secure gateway, a crucial component designed to filter and scrutinise incoming and outgoing traffic. This feature proves invaluable in safeguarding the network against external threats. By proactively deploying these security-centric network functions, ePEM underscores its dedication to proactive threat prevention, maintaining a resilient and adaptable security posture within the HORSE infrastructure. C. Internal Security Enhancements ePEM demonstrates a remarkable ability to enhance the security of established network functions in response to emerging threats. This adaptive approach allows ePEM to respond swiftly to evolving security requirements. By seamlessly integrating internal security mechanisms, ePEM can fortify the existing security measures of already deployed network functions, maintaining a robust and adaptable security posture. This includes the incorporation of encryption for communication channels, the enforcement of secure application programming interfaces for inter-component communication, or the integration of runtime threat detection and prevention mechanisms. ePEM’s adaptive approach guarantees a customised and responsive security posture. This strategic flexibility effectively addresses current security challenges and prepares the network to effectively counter emerging threats, demonstrating ePEM’s dedication to preserving a resilient and secure network infrastructure. D. Adaptive Security Policies ePEM can be equipped with the capability to implement adaptive security policies that are inherently flexible and can dynamically adjust in response to up-to-date threat intelligence and dynamic network conditions. This inherent adaptability enables ePEM to proactively counter emerging security threats and vulnerabilities, fostering a highly resilient and secure network environment. Continuous assessment of threat intelligence and real-time network monitoring enable ePEM to stay ahead of potential risks. Consequently, ePEM not only effectively addresses current security challenges but also preemptively detects and mitigates emerging threats swiftly, thereby reinforcing its dedication to upholding an agile and robust security posture within the network infrastructure. E. Data Collection In the realm of data collection from the various xNFs orchestrated by ePEM, the system boasts a sophisticated approach facilitated by its TM. This integral component serves as a central hub, offering a meticulously deployed network of Prometheus servers strategically positioned for efficient data collection purposes. These Prometheus instances stand ready, forming a robust infrastructure for gathering and processing critical metrics emanating from diverse xNFs spread across the network. The seamless integration of Prometheus servers into the intricate network of interconnected components within ePEM is orchestrated through the TM, acting as a communication bridge between Blueprints and data collection resources. Blueprints, functioning as comprehensive templates for orchestrating and managing various network elements, utilise the TM’s functionality to forge seamless connections with Prometheus instances. This strategic integration empowers Blueprints to dynamically deploy metric exporters on xNFs, tailoring the data collection process to align precisely with specific operational requirements, environmental conditions, or evolving network requirements. A remarkable feature of this data collection framework is its adaptability and responsiveness. The nature and volume of collected data are not predetermined but are closely linked to the exporter’s configuration. This configuration, injected ondemand, provides granular control over the type and level of detail of data collected from each VNF. This modular and adaptable approach ensures that ePEM can flexibly adjust its data collection strategies, tailoring them to the unique characteristics and evolving needs of different xNFs within the network. In essence, ePEM’s data collection methodology, orchestrated through the TM and seamlessly integrated into Blueprints, represents an embodiment of efficiency and adaptability. By establishing a comprehensive framework for data management, ePEM enables the network to enhance its analytical capabilities, fostering an informed, secure, and agile environment within the HORSE architecture. This strategic emphasis on data collection aligns with ePEM’s overarching mission to enhance network observability and intelligence, facilitating informed decision-making and proactive responses to dynamic network conditions. V. CONCLUSIONS The ePEM system represents a significant advancement in the realm of network orchestration, particularly within the context of the HORSE security infrastructure for 6G networks. Its central role in managing NFV and applicative services, coupled with its ability to homogenise and simplify data, underscores its importance in ensuring secure and efficient network operations. The system’s modular architecture, supported by a meta-model, provides the flexibility needed to adapt to the evolving landscape of network technologies and ecosystems. ePEM’s robust security features, including the integration of VyOS and Suricata, as well as custom security measures, contribute to a resilient and proactive defence strategy against potential cyber threats. The system’s use of Blueprint profiles standardises the management of diverse network elements, streamlining processes and enhancing operational effectiveness. The MongoDB database serves as a reliable backbone for ePEM, enabling dynamic information retrieval and comprehensive historical analysis, which are critical for informed decision-making and security management. ePEM’s approach to data collection, facilitated by the TM and Prometheus servers, ensures that the system remains adaptable and responsive to the data needs of various network functions. The system’s APIs and support for various data formats and communication protocols demonstrate its commitment to interoperability and seamless integration with other systems and services. ePEM’s process automation and zerotouch deployment capabilities further enhance its operational efficiency, reducing the need for manual intervention in the lifecycle management of network services. In conclusion, ePEM stands as a testament to the potential of proactive and secure network management solutions, poised to meet the challenges of the future 6G era. Its comprehensive approach to security, data management, and integration positions it as a pivotal component in the HORSE ecosystem, ensuring the delivery of resilient, secure, and efficient network services. ACKNOWLEDGMENT This research was supported supported by the Horizon European project HORSE (grant agreement no. 101096342). REFERENCES [1] European Project (EP). “Holistic, Omnipresent, Resilient Services for future 6G wireless and computing Ecosystems (HORSE),” Accessed: Jun. 24, 2024. [Online]. Available: https://www.horse-6g.eu [2] H. Zhang, X. Liu, and Y. Chen, “Challenges and key technologies in 6g: A survey,” IEEE Communications Surveys & Tutorials, vol. 23, no. 2, pp. 123–145, 2021. DOI: 10.1109/COMST.2021.3058789 [3] W. Saad, M. Bennis, and M. Chen, “A vision of 6g wireless systems: Applications, trends, technologies, and open research problems,” IEEE Network, vol. 34, no. 3, pp. 134–142, 2020. DOI: 10.1109/MNET.001. 1900287 [4] A. Abdalla, S. Ali, and K. Naik, “Security challenges in 6g networks: A survey,” IEEE Access, vol. 10, pp. 35 957–35 972, 2022. DOI: 10.1109/ACCESS.2022. 3162563 [5] ETSI NFV ISG, “Network functions virtualisation (nfv); management and orchestration,” ETSI, Tech. Rep. GS NFV-MAN 001, 2014. [Online]. Available: https: //www.etsi.org/deliver/etsi gs/NFVMAN/001 099/ 001/01.01.01 60/gs NFV-MAN001v010101p.pdf [6] Q. Liu, F. Zhou, and J. Wu, “Security in heterogeneous 6g networks: Threats and countermeasures,” IEEE Wireless Communications, vol. 30, no. 1, pp. 56–63, 2023. DOI: 10.1109/MWC.2023.1234567 [7] H. Kim and J. Park, “Blueprint profiles for secure network orchestration in 6g: A framework,” IEEE Transactions on Network and Service Management, vol. 19, no. 4, pp. 2100–2112, 2022. DOI: 10.1109/TNSM.2022. 3144589 [8] L. Chang, Z. Chen, and W. Xu, “Orchestration challenges and opportunities in 6g networks: A survey,” IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 342–362, 2023. DOI: 10.1109/COMST.2023. 3245681 [9] ITU-T, “Framework and overall principles for the orchestration of 5G and future networks,” ITU - Telecommunication Standardization Sector, Tech. Rep. Y.OrchestrationFramework, 2024. [10] J. Alegria et al., “Netor: An inter-domain vertical service orchestrator for 5G networks,” in Proc. of the Conference on NFV and SDN, Phoenix, AZ, USA: IEEE, Nov. 2022, pp. 130–136. DOI: 10.1109/NFVSDN56302.2022.9974655 [11] ETSI, “Network Function Virtualization (NFV); management and orchestration,” European Telecommunications Standards Institute, Tech. Rep. GS NFV-MAN 001, 2024. [12] Open Networking Foundation (ONF). “SoftwareDefined Networking (SDN) definition,” Accessed: Jun. 27, 2024. [Online]. Available: https : / / www . opennetworking.org/sdn-definition [13] ONF, “SDN architecture,” Open Networking Foundation, Tech. Rep. TR-521. [14] ITU-T, “Framework of SDN,” ITU - Telecommunication Standardization Sector, Recommendation Y.3101, 2024. [15] J. DeHart et al., “Demo: General purpose overlay network using sidecar model in presence of intermittent links with monitoring,” in Proc. of the 31st International Conference on Network Protocols (ICNP), Reykjavik, Iceland: IEEE, Oct. 2023, pp. 1–2. DOI: 10 . 1109 / ICNP59255.2023.10355647 [16] C.-X. Wang et al., “On the road to 6G: Visions, requirements, key technologies, and testbeds,” IEEE Comm. Surveys & Tutorials, vol. 25, no. 2, pp. 905–974, 2023. DOI: 10.1109/COMST.2023.3249835 [17] C. De Alwis et al., “A survey on network slicing security: Attacks, challenges, solutions and research directions,” IEEE Comm. Surveys & Tutorials, vol. 26, no. 1, pp. 534–570, 2024. DOI: 10.1109/COMST.2023. 3312349 [18] K. Abbas et al., “Network Slice LifeCycle Management for 5G mobile networks: Asn intent-based networking approach,” IEEE Access, vol. 9, pp. 80 128–80 146, 2021. DOI: 10.1109/ACCESS.2021.3084834 [19] 5GPPP, 5G infrastructure public private partnership: Architecture working group, Jan. 2024. Accessed: Jun. 27, 2024. [Online]. Available: https://5g-ppp.eu/5garchitecture [20] National Yang Ming Chiao Tung University (NYCU). “Free5gc,” Accessed: Jul. 24, 2024. [Online]. Available: https://free5gc.org [21] S. Lee. “Open5gs,” Accessed: Jul. 24, 2024. [Online]. Available: https://open5gs.org [22] OpenAirInterface. “Openairinterface - 5G software alliance for democratising wireless innovation,” Accessed: Jul. 24, 2024. [Online]. Available: https://www. openairinterface.org [23] Open Networking Foundation. “Sd-core,” Accessed: Jul. 24, 2024. [Online]. Available: https : / / opennetworking.org/sd-core [24] 3GPP, “Study on architecture for next generation system,” 3rd Generation Partnership Project (3GPP), Tech. Rep. TR 21.915, 2024. [25] G.-Y. Kim et al., “DNN inference offloading for object detection in 5G multi-access edge computing,” in Proc. of the International Conference on ICT Convergence (ICTC), Jeju Island, Korea, Republic of: IEEE, Oct. 2021, pp. 389–392. DOI: 10.1109/ICTC52510.2021. 9620821 [26] Microservices.io. “Saga pattern,” Accessed: Jul. 24, 2024. [Online]. Available: https://microservices.io [27] ETSI, “NFV release 3; protocols and data models; descriptors based on YANG specification,” European Telecommunications Standards Institute, Standard ETSI GS NFV-SOL 006, Jul. 2021. [28] Kubernetes. “Production-grade container orchestration,” Accessed: Jun. 27, 2024. [Online]. Available: https:// kubernetes.io [29] M. Georg, “RESTful APIs for the 5G service based architecture,” Journal of ICT Standardization, vol. 6, no. 1–2, pp. 101–116, 2018. DOI: 10.13052/jicts2245800X.617 [30] MongoDB, MongoDB : the database for modern applications, May 2024. Accessed: Jun. 27, 2024. [Online]. Available: https://www.mongodb.com [31] VyOs Community, VyOS : open source router and firewall platform, Mar. 2024. Accessed: Jun. 27, 2024. [Online]. Available: https://vyos.io [32] Open Information Security Foundation (OIFS), Suricata: Observe, Protect, Adopt, Mar. 2024. Accessed: Jun. 27, 2024. [Online]. Available: https://suricata.io