With the advent of zero trust (ZT) security architectures, vendors can bolster their services' security by continuously verifying every end-to-end traffic flow through the policy enforcement point (PEP). However, the demand for dedicated hardware substantially hinders the extensive deployment of PEP across networks. Consequently, the PEP-based verification can incur overwhelming cost when accommodating network requests involving a sequence of end-to-end traffic flows such as service function chains (SFCs). In this work, we introduce the concept of ZT as a function (ZTaaF) to minimize the verification cost in PEP-based SFC deployment. The ZTaaF enhances the verification flexibility and saves the verification cost by virtualizing the hardware-based PEP into a software module and enabling the inter-trust among the servers from the same vendor. Based on the ZTaaF paradigm, we define a novel problem called SFC deployment with ZTaaF (SFCZT). After analyzing the challenges in SFCZT, we propose an efficient algorithm based on the layered graph technique named ZTaaF-aware SFC embedding (ZAN). Through thorough mathematical analysis, we demonstrate ZAN's optimality when the network provides sufficient resources for the incoming SFC request. Extensive simulation results validate ZAN's optimality under the above assumption and show that ZAN significantly outperforms the benchmarks.

Internet-connected devices generate service function chain (SFC) requests for reliability-sensitive applications such as smart factories and intelligent healthcare. To facilitate reliable SFCs provisioning, one can employ the dedicated SFC protection approaches to protect the primary service function path (SFP) by constructing a fault-disjointed backup SFP. Notably, the construction processes of the fault-disjointed primary and backup SFPs are interdependent, and the direct application of existing SFC embedding approaches to construct these SFPs in separate processes may not effectively optimize the overall resource consumption. In this work, for the first time, we comprehensively study how to embed and protect an SFC in collaborative processes that yield provable bounds. We formally define the problem of SFC embedding and protection (SFCEP), for which we develop novel techniques of backup SFP identifier (BSI) and resource-aware Bellman-Ford's loop (RBL) to address the challenges posed by the collaborative embedding and protection. Based on these techniques, we propose an efficient algorithm called optimal SFC embedding and protection (Opt-SEP). When the network resources are sufficient to accommodate an incoming SFC request, we prove that Opt-SEP can minimize the overall resource cost in creating a pair of fault-disjointed primary and backup SFPs. Meanwhile, when the network resources are limited, our extensive simulation results show that Opt-SEP significantly outperforms the benchmarks.