Securing communications in a network function virtualization (NFV) core network

• US 10,542,115 B1
• Filed: 10/01/2015
• Issued: 01/21/2020
• Est. Priority Date: 10/01/2015
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Marquardt, Ronald R., Paczkowski, Lyle W., Persson, Carl J., Rajagopal, Arun
• Primary Examiner(s): Patel, Dhairya A
• Assistant Examiner(s): Khanal, Sandarva
• Application Number:
  US14/872,936
• Time in Patent Office: 1,573 Days
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/35 containing special prefixes
• CPC Class Codes: H04L 2101/355 containing special suffixes
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/3025 Domain name generation or assignment
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A method of electronic communication via a virtual network function (NFV) implementation of a core network. The method comprises receiving a hypertext transfer protocol (HTTP) content request from a user equipment (UE), wherein the HTTP content request comprises an identification of a content source and determining by an orchestrator service that insufficient NFV processing capacity is available to perform the HTTP content request, where the orchestrator service is an application that executes on a first physical host. The method further comprises dynamically increasing the NFV processing capacity by the orchestrator service, performing the HTTP content request using the increased NFV processing capacity, and returning a HTTP content response to the UE, wherein the HTTP content response does not comprise identification of the content source.

Claims

1. A method of electronic communication via a virtual network function (NFV) implementation of a core network, comprising:

receiving a first domain name lookup request that comprises an abstract service name having a format that does not include a domain name suffix referencing a top-level domain;

in response to receiving the first domain name lookup request, looking up an internet protocol (IP) address of a server associated with the abstract service name;

creating a mapping between a one-time-use domain name and the IP address, where the one-time-use domain name is created dynamically;

transmitting a reply to the first domain name lookup request comprising the one-time-use domain name, wherein the one-time-use domain name is dependent on and generated according to the abstract service name such that the one-time-use domain name comprises at least a portion of the abstract service name, and wherein the one-time-use domain name is configured to prevent inclusion of the domain name in the first domain name lookup request to access a service identified by the abstract service name;

receiving a hypertext transfer protocol (HTTP) content request from a user equipment (UE), wherein the HTTP content request is a trusted HTTP content request received from a trusted browser application executing in a trusted security zone of the UE and comprises the one-time-use domain name, and wherein the trusted security zone of the UE provides hardware assisted security on the UE;

in response to receiving the HTTP content request, looking up the IP address based on the one-time-use domain name and destroying the mapping between the one-time-use domain name and the IP address;

determining, by a trusted orchestrator service that executes in a trusted security zone of a first physical host, that insufficient NFV trusted processing capacity is available to perform the trusted HTTP content request;

dynamically increasing the NFV trusted processing capacity by the trusted orchestrator service;

performing the HTTP content request using the increased NFV trusted processing capacity; and

returning a HTTP content response to the UE, wherein the HTTP content response contains content responsive to the HTTP content request, and wherein the HTTP content response does not comprise an identification of a source of the content.

2. The method of claim 1, wherein increasing the NFV trusted processing capacity comprises:

identifying by the trusted orchestrator service a second physical host that comprises a trusted security zone, wherein the trusted security zone provides hardware assisted security;

creating by the trusted orchestrator service a virtual server on the second physical host; and

configuring by the trusted orchestrator service a plurality of trust keys into the virtual server on the second physical host.

3. The method of claim 2, further comprising the trusted orchestrator service obtaining the plurality of trust keys from a trusted repository of trust keys.

4. The method of claim 2, further comprising the trusted orchestrator initiating at least one instance of a function in the virtual server on the second physical host that is also initiated on the first physic al host.

5. The method of claim 1, wherein the UE is one of a mobile smart phone, a media player, a personal digital assistant (PDA), a laptop computer, a notebook computer, a tablet computer, a wearable computer, and a headset computer.