Technologies for Secure Inter-Virtual Network Function Communication

• US 20160127333A1
• Filed: 10/31/2014
• Published: 05/05/2016
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sood, Kapil, Shaw, Jeffrey B., Fastabend, John R.
• Granted Patent: US 9,407,612 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Technologies for secure inter-virtual network function communication include a computing device to determine a cryptographic key for secure communication over at least one of an inter-virtual network function (VNF) network, an inter-virtual network function component (VNFC) network, or a VNF-VNFC network based on a security policy of the computing device; and. The computing device securely communicates over at least one of the inter-VNF, inter-VNFC, or VNF-VNFC network based on the determined cryptographic key.

Claims

1. A computing device for secure inter-virtual network function communication, the computing device comprising:

a processor;

a memory; and

a network function virtualization infrastructure module to;

(i) determine a cryptographic key for secure communication over at least one of an inter-virtual network function (VNF) communication network, an inter-virtual network function component (VNFC) communication network, or a VNF-VNFC communication network based on a security policy of the computing device;

(ii) receive a communication from at least one of a first VNF of the computing device or a first VNFC of the computing device to be communicated to at least one of a second VNF or a second VNFC;

(iii) determine, based on the security policy, that the communication from the at least one of the first VNF or the first VNFC to the at least one of the second VNF or the second VNFC should be encrypted;

(iv) encrypt the communication with the cryptographic key in response to the determination that the communication should be encrypted; and

(v) transmit the encrypted communication to the at least one of the second VNF or the second VNFC over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC network.

2. The computing device of claim 1, wherein the network function virtualization infrastructure module is further to establish the cryptographic key for the communication.

3. The computing device of claim 2, further comprising a trusted execution environment module, wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate with a corresponding trusted execution environment module of a remote computing device.

4. The computing device of claim 2, wherein to establish the cryptographic key comprises to utilize at least one of a root of trust or a fuse key of the computing device.

5. The computing device of claim 4, wherein to establish the cryptographic key comprises to:

generate a base cryptographic key based on the at least one of the root of trust or the fuse key of the computing device; and

generate a temporary cryptographic key based on the generated base cryptographic key for secure communication over at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network.

6. The computing device of claim 2, wherein to establish the cryptographic key comprises to establish a first cryptographic key for communication between a first pair of entities selected from a set of VNFs and VNFCs of the computing device.

7. The computing device of claim 6, wherein the network function virtualization infrastructure module is further to establish a second cryptographic key for communication between a second pair of entities, different from the first pair, selected from the set of VNFs and VNFCs of the computing device.

8. The computing device of claim 6, wherein to establish the first cryptographic key for the communication between the first pair of entities comprises to establish the first cryptographic key for communication between the first pair of entities associated with a first service flow;

and

wherein the network function virtualization infrastructure module is further to establish a second cryptographic key for communication between the first pair of entities associated with a second service flow different from the first service flow.

9. The computing device of claim 1, wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate securely over an inter-VNF communication network.

10. The computing device of claim 1, wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate securely over an inter-VNFC communication network.

11. The computing device of claim 1, wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate securely over a VNF-VNFC communication network.

12. The computing device of claim 1 further comprising a trusted execution environment, wherein the network function virtualization infrastructure module is further to;

determine whether the trusted execution environment module has access to the cryptographic key; and

prevent communication over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network based on the security policy in response to determining that the trusted execution environment module does not have access to the cryptographic key.

13. The computing device of claim 12, wherein to determine the trusted execution environment module of the computing device does not have access to the cryptographic key comprises to determine that the trusted execution environment module has not been securely booted.

14. The computing device of claim 1, wherein to determine the cryptographic key comprises to retrieve the cryptographic key based on the security policy;

wherein the security policy defines corresponding cryptographic keys for secure communication between a plurality of pairs of entities selected from a set of VNFs and VNFCs of the computing device.

15. One or more machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing device, cause the computing device to:

determine a cryptographic key for secure communication over at least one of an inter-virtual network function (VNF) communication network, an inter-virtual network function component (VNFC) communication network, or a VNF-VNFC communication network based on a security policy of the computing device;

receive a communication from at least one of a first VNF of the computing device or a first VNFC of the computing device to be communicated to at least one of a second VNF or a second VNFC;

determine, based on the security policy, that the communication from the at least one of the first VNF or the first VNFC to the at least one of the second VNF or the second VNFC should be encrypted;

encrypt the communication with the cryptographic key in response to the determination that the communication should be encrypted; and

transmit the encrypted communication to the at least one of the second VNF or the second VNFC over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC network.

16. The one or more machine-readable storage media of claim 15, wherein the plurality of instructions further cause the computing device to establish, by a network function virtualization infrastructure module of the computing device, the cryptographic key for the secure communication;

and

wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate by the network function virtualization infrastructure of the computing device.

17. The one or more machine-readable storage media of claim 16, wherein to communicate securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises to communicate, by a trusted execution environment module, with a corresponding trusted execution environment module of a remote computing device.

18. The one or more machine-readable storage media of claim 16,

wherein to establish the cryptographic key comprises to utilize at least one of a root of trust or a fuse key of the computing device.

19. The one or more machine-readable storage media of claim 18, wherein to establish the cryptographic key comprises to:

generate a base cryptographic key based on the at least one of the root of trust or the fuse key of the computing device; and

generate a temporary cryptographic key based on the generated base cryptographic key for secure communication over at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network.

20. The one or more machine-readable storage media of claim 16, wherein to establish the cryptographic key comprises to establish a first cryptographic key for communication between a first pair of entities selected from a set of VNFs and VNFCs of the computing device.

21. The one or more machine-readable storage media of claim 20, wherein the plurality of instructions further cause the computing device to establish a second cryptographic key for communication between a second pair of entities, different from the first pair, selected from the set of VNFs and VNFCs of the computing device.

22. The one or more machine-readable storage media of claim 20, wherein to establish the first cryptographic key for the communication between the first pair of entities comprises to establish the first cryptographic key for communication between the first pair of entities associated with a first service flow;

and

wherein the plurality of instructions further cause the computing device to establish a second cryptographic key for communication between the first pair of entities associated with a second service flow different from the first service flow.

23. The one or more machine-readable storage media of claim 15, wherein the plurality of instructions further cause the computing device to;

determine whether a network function virtualization infrastructure module of the computing device has access to the cryptographic key; and

prevent communication over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network based on the security policy in response to a determination that the network function virtualization infrastructure module does not have access to the cryptographic key.

24. A method for secure inter-virtual network function communication by a computing device, the method comprising:

determining, by the computing device, a cryptographic key for secure communication over at least one of an inter-virtual network function (VNF) communication network, an inter-virtual network function component (VNFC) communication network, or a VNF-VNFC communication network based on a security policy of the computing device;

receiving a communication from at least one of a first VNF of the computing device or a first VNFC of the computing device to be communicated to at least one of a second VNF or a second VNFC;

determining, based on the security policy, that the communication from the at least one of the first VNF or the first VNFC to the at least one of the second VNF or the second VNFC should be encrypted;

encrypting the communication with the cryptographic key in response to the determination that the communication should be encrypted; and

transmitting the encrypted communication to the at least one of the second VNF or the second VNFC over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC network.

25. The method of claim 24, further comprising establishing, by a network function virtualization infrastructure module of the computing device, the cryptographic key for the secure communication;

and

wherein communicating securely over the at least one of the inter-VNF, inter-VNFC, or VNF-VNFC communication network comprises communicating by the network function virtualization infrastructure of the computing device.