Native blockchain platform for improving workload mobility in telecommunication networks

• US 10,361,843 B1
• Filed: 11/29/2018
• Issued: 07/23/2019
• Est. Priority Date: 06/08/2018
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Suthar, Om Prakash, Rayes, Ammar, Geller, Michael David, Campbell, Ian McDowell, Dodd-Noble, Aeneas Sean
• Primary Examiner(s): Abedin, Shanto
• Application Number:
  US16/205,017
• Time in Patent Office: 236 Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/342 : between virtual entities, e.g. orchestrators, SDN or NFV entities
• CPC Class Codes: H04L 41/40 : using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5019 : Ensuring fulfilment of SLA
• CPC Class Codes: H04L 43/0817 : by checking functioning
• CPC Class Codes: H04L 43/20 : the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 47/70 : Admission control; Resource allocation
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/0637 : Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/083 : involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 : involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3257 : using blind signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/50 : using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/8016 : based on quality of service [QoS]
• CPC Class Codes: H04M 15/8038 : Roaming or handoff
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 60/00 : Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 60/04 : using triggered events
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 88/02 : Terminal devices

Abstract

A network slice manager receives a workload mobility request to add network resources to a domain in the communication network, and authenticates a virtual network function (VNF) with a blockchain authentication function (BAF) over a blockchain network interface based on the workload mobility request. The network slice manager further receives an indication of a successful authentication from the BAF, and instantiates the VNF in the domain of the communication network based on the indication of the successful authentication. Notably, these authentication processes may be readily adapted to instantiate new network resources or migrate existing network resources between domains.

Claims

1. A method for sharing resources in a communication network, the method comprising:

receiving, by a network slice manager entity, a workload mobility request to add network resources to a domain in the communication network;

authenticating, by the network slice manager entity, a virtual network function (VNF) with a blockchain authentication function (BAF) entity over a blockchain network interface based on the workload mobility request;

receiving, by the network slice manager entity, an indication of a successful authentication from the BAF entity; and

instantiating, by the network slice manager entity, the VNF in the domain of the communication network based on the indication of the successful authentication;

assigning blockchain credentials to the VNF, wherein the blockchain credentials are associated with the BAF entity; and

registering the VNF with a core network by sending the blockchain credentials to a Network Repository Function (NRF) entity over the blockchain network interface.

2. The method of claim 1, wherein the domain in the communication network is a first domain, the method further comprising:

assigning the blockchain credentials to the VNF on initial instantiation;

receiving, by the network slice manager entity, a second workload mobility request to add additional network resources to a second domain in the communication network;

identifying, by the network slice manager entity, the VNF instantiated in the first domain for migration to the second domain based on the second workload mobility request;

selecting, by the network slice manager entity, the BAF entity from a plurality of BAF entities based on the blockchain credentials assigned to the VNF;

re-authenticating, by the network slice manager entity, the VNF with the BAF entity over the blockchain network interface; and

migrating, by the network slice manager entity, the VNF from the first domain to the second domain based on an indication of a successful authentication.

3. The method of claim 1, wherein the domain in the communication network is a first domain, and wherein the VNF is an existing virtual network function (VNF) associated with a second domain in the communication network, the method comprising:

identifying the existing VNF for migration from the second domain to the first domain based on the workload mobility request; and

releasing one or more network resources associated with the VNF in the second domain.

4. The method of claim 1, wherein instantiating the VNF in the domain further comprises:

sending, by the network slice manager entity, configuration parameters associated with the VNF to a network function virtualization orchestrator (NFVO) entity to cause the NFVO entity to build a VNF descriptor file that defines each network resource of the VNF for instantiation.

5. The method of claim 1, wherein authenticating the VNF with the BAF entity further comprises:

comparing a first public key associated with the VNF with a second public key stored by the BAF entity.

6. The method of claim 1, wherein authenticating the VNF with the BAF entity further comprises:

sending a public key associated with the VNF to the BAF entity to register the VNF with the BAF entity.

7. The method of claim 1, wherein authenticating the VNF with the BAF entity further comprises:

exchanging, by the network slice manager entity, messages with the BAF entity through a Security Edge Protection Proxy (SEPP) entity.

8. The method of claim 1, wherein the VNF includes at least one of a network function (NF) associated with a core network of the communication network or a user plane function (UPF) entity associated with user equipment (UE).

9. The method of claim 1, wherein the domain includes at least one of a private cloud domain, a public cloud domain, a trusted domain, an untrusted domain, or a network slice domain.

10. A network slice manager device, comprising:

one or more network interfaces to communicate within a communication network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store instructions executable by the processor, the instructions when executed operable to;

receive a workload mobility request to add network resources to a domain in the communication network;

authenticate a virtual network function (VNF) with a blockchain authentication function (BAF) entity over a blockchain network interface based on the workload mobility request;

receive an indication of a successful authentication from the BAF entity; and

instantiate the VNF in the domain of the communication network based on the indication of the successful authentication;

assign blockchain credentials to the VNF, wherein the blockchain credentials are associated with the BAF entity; and

register the VNF with a core network by sending the blockchain credentials to a Network Repository Function (NRF) entity over the blockchain network interface.

11. The network slice manager device of claim 10, wherein

the domain in the communication network is a first domain, wherein the instructions, when executed, are further operable to:

assign blockchain credentials to the VNF on initial instantiation;

receive a second workload mobility request to add additional network resources to a second domain in the communication network;

identify the VNF instantiated in the first domain for migration to the second domain based on the second workload mobility request;

select the BAF entity from a plurality of BAF entities based on the blockchain credentials assigned to the VNF;

re-authenticate the VNF with the BAF entity over the blockchain network interface; and

migrate the VNF from the first domain to the second domain based on an indication of a successful authentication.

12. The network slice manager device of claim 11, wherein the domain in the communication network is a first domain, and wherein the VNF is an existing virtual network function (VNF) associated with a second domain in the communication network, wherein the instructions, when executed, are further operable to:

identify the existing VNF for migration from the second domain to the first domain based on the workload mobility request; and

release one or more network resources associated with the VNF in the second domain.

13. A tangible, non-transitory, computer-readable media having instructions encoded thereon, the instructions, when executed by a processor, are operable to:

receive a workload mobility request to add network resources to a domain in the communication network;

authenticate a virtual network function (VNF) with a blockchain authentication function (BAF) entity over a blockchain network interface based on the workload mobility request;

receive an indication of a successful authentication from the BAF entity; and

instantiate the VNF in the domain of the communication network based on the indication of the successful authentication;

assign blockchain credentials to the VNF, wherein the blockchain credentials are associated with the BAF entity; and

register the VNF with a core network by sending the blockchain credentials to a Network Repository Function (NRF) entity over the blockchain network interface.

14. The tangible, non-transitory, computer-readable media of claim 13, wherein the domain in the communication network is a first domain, wherein the instructions, when executed, are further operable to:

assign blockchain credentials to the VNF on initial instantiation;

receive a second workload mobility request to add additional network resources to a second domain in the communication network;

identify the VNF instantiated in the first domain for migration to the second domain based on the second workload mobility request;

select the BAF entity from a plurality of BAF entities based on the blockchain credentials assigned to the VNF;

re-authenticate the VNF with the BAF entity over the blockchain network interface; and

migrate the VNF from the first domain to the second domain based on an indication of a successful authentication.

15. The tangible, non-transitory, computer-readable media of claim 13, wherein the domain in the communication network is a first domain, and wherein the VNF is an existing virtual network function (VNF) associated with a second domain in the communication network, wherein the instructions, when executed, are further operable to:

identify the existing VNF for migration from the second domain to the first domain based on the workload mobility request; and

release one or more network resources associated with the VNF in the second domain.