[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83492-en":3,"doc-seo-83492-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83492,687197100911,"Himbo","https://ap-avatar.wpscdn.com/avatar/a000239b6f1da00475?x-image-process=image/resize,m_fixed,w_180,h_180&k=1782698725881665579",8,"Research & Report","Scalable Security and Migration-Aware SFC Provisioning in LEO Satellite Networks","Low Earth orbit (LEO) satellite constellations are emerging as a backbone for global 6G connectivity, where independent tenant slices share orbital infrastructure and each needs an ordered chain of security virtual network functions (VNFs). Scarce onboard resources prevent dedicating VNFs per slice, forcing instance sharing that increases the attack surface and creates cross-slice side-channel risk. As visibility, orbital motion, and inter-satellite topology vary across epochs, VNF migration becomes essential. A security-and-migration-aware SFC placement is formulated as a multi-slice MILP using an ISO/NIST grounded co-location risk model, with ADMM-inspired decomposition schedules. Simulations on a Walker-Delta constellation eliminate co-location risk, reduce migrations, and maintain delay compliance within per-epoch budgets.","Scalable Security and Migration-Aware SFC Provisioning in LEO Satellite Networks  \nMohammed Mahyoub 1 , Wael Jaafar3 , Sami Muhaidat 1 ,2 , and Halim Yanikomeroglu 1  \n1Department of Systems and Computer Engineering, Carleton University, Ottawa, Ontario, Canada  \n2Department of Computer Science, Khalifa University, Abu Dhabi, UAE  \n3Department of Software and IT Engineering, ´Ecole de Technologie Suprieure, Montreal, Quebec, Canada  \narXiv :2607 .0047 1v 1 [ cs .ET] 1 Jul 2026  \nAbstract—Low Earth orbit (LEO) satellite constellations are emerging as a backbone for global 6G connectivity, where independent tenant slices share orbital infrastructure, each requiring an ordered chain of security virtual network functions (VNFs). Because onboard computation and networking are scarce, slices cannot be given dedicated VNFs. They must share instances on the same satellites, enlarging the attack surface and exposing tenants to cross-slice side-channel risk. This exposure shifts continually as visibility, orbital motion, and the inter-satellite topology change in time (epochs), making VNF migration a structural necessity that couples resource efficiency, service continuity, and security isolation into a single problem. We formulate this security-and migration-aware security function chain (SFC) placement as a multi-slice mixed-integer linear programming (MILP) whose core is a co-location risk model, grounded in ISO/NIST principles and supported by analytic bounds, in which we separate avoidable migrations from those forced by orbital motion. Because the joint program scales quadratically with the cross-slice co-location terms, we develop an alternating direction method of multipliers (ADMM)-inspired penalized per-slice bestresponse decomposition that recasts the coupling as a linear per-slice penalty, yielding independent subproblems through sequential (S-ADMM) and parallel, collision-repaired (P-ADMM) schedules. Simulations over a Walker-Delta satellite constellation show that the proposed framework eliminates co-location risk, reduces SFC migrations, and sustains full delay compliance, while remaining feasible within the per-epoch budget for slice counts where the monolithic security-aware MILP is intractable.  \nIndex Terms—LEO satellites, SFC placement, ADMM decomposition, security-aware optimization, VNF migration, 6G.  \nI. INTRODUCTION  \nLOW Earth orbit LEO satellite megaconstellations emerge  \nas critical infrastructure for global 6G connectivity [1] . LEO megaconstellations such as SpaceX Starlink, Amazon Kuiper, and OneWeb place thousands of satellites at altitudes of 340-1200 km, delivering broadband coverage with low latency [2] . The integration of LEO backhaul and access capacity into 5G and next-generation 6G radio access networks (RANs) has motivated a growing interest in on-orbit edge computing, offloading latency-sensitive and security-demanding processing from terrestrial data centres to satellite computing nodes [3] .  \nIn multi-slice deployments where independent organizations share the same orbital infrastructure, security processing for each slice is naturally realized as an ordered chain of software-defined virtual network functions (VNFs) [4], forming a security function chain (SFC) that may include  \nfirewall (FW), intrusion detection system (IDS), traffic monitor (TM), security information and event management (SIEM), and encryption functions [5] . The orchestration problem of deciding which satellite hosts which VNF instance for which slice’s user is the main SFC placement problem studied in this paper.  \nThis placement problem is significantly more challenging in orbital networks than in terrestrial environments due to the highly dynamic nature of LEO constellations. On one hand, unlike ground networks where topology changes are relatively infrequent, the connectivity graph in LEO systems evolves continuously as satellites move along their orbital trajectories [6] . For example, satellites operating at an alti","cbCaidEmOtjk3g3H","https://ap.wps.com/l/cbCaidEmOtjk3g3H","pdf",962352,3,1,15,"English","en",105,"# Introduction\n## Background on LEO constellations for 6G\n## Multi-slice security function chains (SFC)\n## Challenges: dynamic topology and epoch re-optimization","[{\"question\":\"Why is VNF migration necessary in LEO multi-slice deployments?\",\"answer\":\"The inter-satellite topology, visibility, and available capacity change continuously across epochs. This dynamic evolution couples SFC decisions with time, so re-optimization requires relocating VNFs to maintain service continuity and security performance.\"},{\"question\":\"What security risk arises when slices share VNF instances on the same satellites?\",\"answer\":\"Cross-slice side-channel exposure can occur through mechanisms such as cache-timing and co-resident memory probing. This risk varies over time because topology changes per epoch.\"},{\"question\":\"How does the proposed framework manage the trade-off between avoiding and performing migrations?\",\"answer\":\"The approach separates avoidable migrations from forced ones caused by orbital motion and feasibility violations. An ISO/NIST grounded co-location risk model and an ADMM-inspired per-slice decomposition reduce co-location risk while limiting unnecessary migrations under per-epoch budgets.\"}]",1784188407,38,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"scalable-security-and-migration-aware-sfc-provisioning-in-leo-satellite-networks","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/scalable-security-and-migration-aware-sfc-provisioning-in-leo-satellite-networks/83492/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-26","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is VNF migration necessary in LEO multi-slice deployments?","Question",{"text":75,"@type":76},"The inter-satellite topology, visibility, and available capacity change continuously across epochs. This dynamic evolution couples SFC decisions with time, so re-optimization requires relocating VNFs to maintain service continuity and security performance.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What security risk arises when slices share VNF instances on the same satellites?",{"text":80,"@type":76},"Cross-slice side-channel exposure can occur through mechanisms such as cache-timing and co-resident memory probing. This risk varies over time because topology changes per epoch.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the proposed framework manage the trade-off between avoiding and performing migrations?",{"text":84,"@type":76},"The approach separates avoidable migrations from forced ones caused by orbital motion and feasibility violations. An ISO/NIST grounded co-location risk model and an ADMM-inspired per-slice decomposition reduce co-location risk while limiting unnecessary migrations under per-epoch budgets.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]