COMPUTER SYSTEM HARDWARE VALIDATION FOR VIRTUAL COMMUNICATION NETWORK ELEMENTS

• US 20160212620A1
• Filed: 01/20/2015
• Published: 07/21/2016
• Est. Priority Date: 01/20/2015
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Paczkowski, Lyle Walter, Rajagopal, Arun, Marquardt, Ronald R.
• Granted Patent: US 9,743,282 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A data communication network has computer systems that process virtual network elements during network processing time cycles to forward data communication packets for user data services. The computer systems process hardware-embedded codes during the network processing time cycles to identify the computer systems. A security server validates the computer system identities for the virtual network elements. A database system maintains a distributed data structure that individually associates the data services, the computer systems, the virtual network elements, and the computer system validities. The security server and the database system could be discrete systems or they may be at least partially integrated within the computer systems where they would typically execute during different processing time cycles from the virtual network elements.

Claims

1. A method of securing a data communication network that has computer systems, the method comprising:

processing virtual network elements comprising software virtual machines in the computer systems during network processing time cycles to forward data communication packets for user data services;

processing hardware-embedded identification codes in the computer systems during the network processing time cycles to identify computer system identities of the computer systems;

validating the computer system identities for the virtual network elements by comparing the hardware-embedded identification codes to an authorized computer system list to determine computer system validities; and

maintaining a distributed data structure that individually associates the data services, the computer systems, the virtual network elements, and the computer system validities.

2. The method of claim 1 further comprising individually associating the data services with the network processing time cycles based on associations between the virtual network elements and the data services and between the virtual network elements and the network processing time cycles.

3. The method of claim 1 further comprising individually associating Access Point Names (APNs) with the network processing time cycles based on associations between the virtual network elements and the APNs and between the virtual network elements and the network processing time cycles.

4. The method of claim 1 further comprising individually associating Uniform Resource Identifiers (URIs) with the network processing time cycles based on associations between the virtual network elements and the URIs and between the virtual network elements and the network processing time cycles.

5. The method of claim 1 wherein the computer systems of the data communication network are located at different physical sites and further comprising individually associating the different physical sites with the data services, the computer systems, and the computer system validities based on associations between the virtual network elements and the different physical sites.

6. The method of claim 1 wherein:

validating the computer system identities comprises validating the computer system identities during security processing time cycles that are different from the network processing time cycles; and

maintaining the distributed data structure comprises individually associating the data services, the computer systems, the virtual network elements, and the computer system validities and storing the associations during the security processing time cycles.

7. The method of claim 1 wherein the virtual network elements comprise at least one of a:

Mobility Management Entity (MME), Service Gateway (S-GW), Packet Data Network Gateway (P-GW), Policy Charging and Rules Function (PCRF), and Home Subscriber System (HSS).

8. The method of claim 1 wherein the virtual network elements comprise at least one of a:

Baseband Processing Unit (BBU), Radio Resource Control (RRC) processor, Radio Link Control (RLC) processor, Packet Data Convergence Protocol (PDCP) processor, Media Access Control (MAC) processor.

9. The method of claim 1 wherein the virtual network elements comprise at least one of a:

Residential Gateway (R-GW), Set-Top Box (STB), Dynamic Host Control Protocol (DHCP) server, and Network Address Translation (NAT) firewall.

10. The method of claim 1 wherein the virtual network elements comprise at least one of:

border controllers, load balancers, media servers, and network accelerators.

11. A data communication network comprising:

a plurality of computer systems configured to process virtual network elements comprising software virtual machines during network processing time cycles to forward data communication packets for user data services and to process hardware-embedded identification codes during the network processing time cycles to identify computer system identities of the computer systems;

a security server configured to validate the computer system identities for the virtual network elements by comparing the hardware-embedded identification codes to an authorized computer system list to determine computer system validities; and

a database system configured to maintain a distributed data structure that individually associates the data services, the computer systems, the virtual network elements, and the computer system validities.

12. The data communication network of claim 11 wherein the computer systems are configured to individually associate the data services with the network processing time cycles based on associations between the virtual network elements and the data services and between the virtual network elements and the network processing time cycles.

13. The data communication network of claim 11 wherein the computer systems are configured to individually associate Access Point Names (APNs) with the network processing time cycles based on associations between the virtual network elements and the APNs and between the virtual network elements and the network processing time cycles.

14. The data communication network of claim 11 wherein the computer systems are configured to individually associate Uniform Resource Identifiers (URIs) with the network processing time cycles based on associations between the virtual network elements and the URIs and between the virtual network elements and the network processing time cycles.

15. The data communication network of claim 11 wherein the computer systems are located at different physical sites and are configured to individually associate the different physical sites with the data services, the computer systems, and the computer system validities based on associations between the virtual network elements and the different physical sites.

16. The data communication network of claim 11 wherein:

the security server is configured to validate the computer system identities for the virtual network elements during security processing time cycles that are different from the network processing time cycles; and

the database system is configured to maintain the distributed data structure to individually associate the data services, the computer systems, the virtual network elements, and the computer system validities during the security processing time cycles.

17. The data communication network of claim 11 wherein the virtual network elements comprise at least one of a:

Mobility Management Entity (MME), Service Gateway (S-GW), Packet Data Network Gateway (P-GW), Policy Charging and Rules Function (PCRF), and Home Subscriber System (HSS).

18. The data communication network of claim 11 wherein the virtual network elements comprise at least one of a:

Baseband Processing Unit (BBU), Radio Resource Control (RRC) processor, Radio Link Control (RLC) processor, Packet Data Convergence Protocol (PDCP) processor, Media Access Control (MAC) processor.

19. The data communication network of claim 11 wherein the virtual network elements comprise at least one of a:

Residential Gateway (R-GW), Set-Top Box (STB), Dynamic Host Control Protocol (DHCP) server, and Network Address Translation (NAT) firewall.

20. The data communication network of claim 11 wherein the virtual network elements comprise at least one of:

border controllers, load balancers, media servers, and network accelerators.