Technologies for secure bootstrapping of virtual network functions

Patent metadata

Field	Value
Publication number	US-10977372-B2
Application number	US-201916539385-A
Country	US
Kind code	B2
Filing date	Aug 13, 2019
Priority date	May 11, 2015
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

Technologies for bootstrapping virtual network functions in a network functions virtualization (NFV) network architecture include a virtual network function (VNF) bootstrap service (VBS) in secure network communication with a VBS agent of a VNF instance. The VBS agent is configured to execute a secure VNF bootstrap capture protocol in the NFV network architecture. Accordingly, the VBS agent can be configured to register with the VBS via secure communications transmitted between the VBS and the VBS agent. The secure communications include transmitting a security quote from a TEE of a platform on which the VNF instance is instantiated and a security credential request to the VBS, as well as receiving a security credential in response to validating the security quote and the security credential request. Other embodiments are described and claimed.

First claim

The invention claimed is:

1. A network functions virtualization (NFV) network system for securely bootstrapping a virtual network function (VNF), the NFV network system comprising:
a hardware processor;
a VNF bootstrap service (VBS);
a VBS agent associated with a VNF instance; and
wherein a hypervisor is to: (i) receive a command to spin-up the VNF instance, the command including a set of startup parameters, (ii) verify an authenticity of the received command, (iii) instantiate the VNF instance as a function of the startup parameters, and (iv) register the instantiated VNF instance with a trusted execution environment (TEE), and
wherein the VBS agent is initiated responsive to instantiation of the VNF instance, the VBS agent to: (i) generate a VNF public/private key pair, (ii) request an attested quote from the TEE using a VNF public key of the public/private key pair, wherein the request is usable to calculate a quote hash and sign the quote hash using a private key of the TEE, (iii) execute, in response to having received the signed quote hash from the TEE, a VBS capture protocol with the VBS to securely bind the VBS agent with the VBS, (iv) activate the VNF instance, and (v) transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated.

2. The NFV network system of claim 1 , the NFV network system additionally includes an NFV security controller, and wherein the VBS forms a portion of the NFV security controller.

3. The NFV network system of claim 1 , the startup parameters include a public key of the VBS, an Internet Protocol (IP) address of the VBS, a unique identifier of the VNF instance, and a unique identifier of the NFV infrastructure platform.

4. The NFV network system of claim 1 , the VBS is further to transmit the startup parameters to a VIM, and wherein the command for the hypervisor to spin-up the VNF instance is transmitted by the VIM in response to having received the VBS startup parameters.

5. The NFV network system of claim 1 , to register the instantiated VNF instance with the TEE comprises to register the startup parameters with the TEE.

6. The NFV network system of claim 1 , wherein the TEE is to securely provision the VBS.

7. The NFV network system of claim 6 , to securely provision the VBS by the TEE comprises to securely provision the VBS using an out-of-band channel between the TEE and the VBS.

8. The NFV network system of claim 1 , to verify the authenticity of the received command comprises the hypervisor to verify one or more signatures of the VNF.

9. The NFV network system of claim 8 , to verify the one or more signatures of the VNF comprises to verify at least one of a signed image of the VNF and a signed descriptor of the VNF.

10. One or more non-transitory, machine-readable storage media comprising a plurality of instructions stored thereon that, when executed, cause a network functions virtualization (NFV) network system to:
receive, by a hypervisor of the NFV network system, a command to spin-up a virtual network function (VNF) instance, the command including a set of startup parameters;
verify, by the hypervisor, an authenticity of the received command;
instantiate, by the hypervisor, the VNF instance as a function of the startup parameters;
register the instantiated VNF instance with a Trusted Execution Environment (TEE) of the NFV system;
generate, by a VNF bootstrap service (VBS) agent, a VNF public/private key pair in response to the instantiation of the VNF instance;
request, by the VBS agent, an attested quote from the TEE using a VNF public key of the public/private key pair, wherein the request is usable to calculate a quote hash and sign the quote hash using a private key of the TEE;
execute, by the VBS agent and in response to having received the signed quote hash from the TEE, a VBS capture protocol to securely bind the VBS agent with an associated VBS;
activate the VNF instance; and
transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated.

11. The one or more non-transitory, machine-readable storage media of claim 9 , the startup parameters include a public key of the VBS, an Internet Protocol (IP) address of the VBS, a unique identifier of the VNF instance, and a unique identifier of the NFV infrastructure platform.

12. The one or more non-transitory, machine-readable storage media of claim 9 , the plurality of instructions, when executed, further cause the NFV network system to securely provision, by the TEE, the VBS, wherein to securely provision the VBS by the TEE comprises to securely provision the VBS using an out-of-band channel between the TEE and the VBS.

13. The one or more non-transitory, machine-readable storage media of claim 9 , wherein to verify the authenticity of the received command comprises to verify at least one of a signed image of the VNF and a signed descriptor of the VNF.

14. A method for security bootstrapping a virtual network function (VNF), the method comprising:
receiving, by a hypervisor of a network functions virtualization (NFV) network system, a command to spin-up a VNF instance, the command including a set of startup parameters;
verifying, by the hypervisor, an authenticity of the received command;
instantiating, by the hypervisor, the VNF instance as a function of the startup parameters;
registering the instantiated VNF instance with a Trusted Execution Environment (TEE) of the NFV system;
generating, by a VNF bootstrap service (VBS) agent, a VNF public/private key pair in response to the instantiation of the VNF instance;
requesting, by the VBS agent, an attested quote from the TEE using a VNF public key of the public/private key pair, wherein the request is usable to calculate a quote hash and sign the quote hash using a private key of the TEE;
executing, by the VBS agent and in response to having received the signed quote hash from the TEE, a VBS capture protocol to securely bind the VBS agent with an associated VBS;
activating, by the VBS agent, the VNF instance; and
transmitting, by the VBS agent, an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated.

15. The method of claim 14 , the startup parameters include a public key of the VBS, an Internet Protocol (IP) address of the VBS, a unique identifier of the VNF instance, and a unique identifier of the NFV infrastructure platform.

16. The method of claim 14 , further comprising securely provisioning the VBS by the TEE, wherein securely provisioning the VBS by the TEE comprises securely provisioning the VBS using an out-of-band channel between the TEE and the VBS.

17. The method of claim 14 , verifying the one or more signatures of the VNF comprises verifying at least one of a signed image of the VNF and a signed descriptor of the VNF.

Assignees

• Intel Corp

Inventors

• Sood Kapil
• Walker Jesse

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/575 Primary

  Secure boot · CPC title