HARDWARE TRUST FOR INTEGRATED NETWORK FUNCTION VIRTUALIZATION (NFV) AND SOFTWARE DEFINED NETWORK (SDN) SYSTEMS

• US 20160219076A1
• Filed: 01/26/2015
• Published: 07/28/2016
• Est. Priority Date: 01/26/2015
• Status: Abandoned Application

• Current Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Paczkowski, Lyle Walter, Rajagopal, Arun, Marquardt, Ronald R.
• Application Number:
  US14/605,569
• Publication Number:
  US 20160219076A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A data communication system has data processing circuitry to transfer data communications. Trust modules establish and maintain network trust of the data processing circuitry. A Network Function Virtualization (NFV) system executes hypervisors to establish and maintain an NFV processing environment in the data processing circuitry. A Software Defined Network (SDN) system executes SDN applications, SDN controllers, and SDN data machines in the data processing circuitry during NFV slices to transfer the data communications. The data communication system maintains a data structure that associates, based on execution relationships, individual blocks of the data processing circuitry, the trust modules, the hypervisors, the NFV slices, the SDN applications, the SDN controllers, and the SDN data machines. The database may be queried for the hardware trust data related to specific NFV and SDN software modules.

Claims

1. A method of operating a data communication system comprising data processing circuitry to transfer data communications, the method comprising:

executing trust modules in the data processing circuitry to establish and maintain network trust of the data processing circuitry;

executing hypervisors in the data processing circuitry to establish and maintain a Network Function Virtualization (NFV) processing environment;

executing Software Defined Network (SDN) applications, SDN controllers, and SDN data machines in the data processing circuitry during NFV slices to transfer the data communications; and

maintaining a data structure that associates, based on execution relationships, individual blocks of the data processing circuitry, the trust modules, the hypervisors, the NFV slices, the SDN applications, the SDN controllers, and the SDN data machines.

2. The method of claim 1 wherein establishing and maintaining the network trust of the data processing circuitry comprises:

reading secret keys embedded in the individual blocks of the data processing circuitry;

generating trust values based on the secret keys and transferring the trust values; and

receiving hardware trust validations for the individual blocks of the data processing circuitry responsive to the transferred trust values.

3. The method of claim 2 further comprising maintaining the data structure to associate, based on the execution relationships, the hardware trust validations for the individual blocks of the data processing circuitry with the NFV slices, the trust modules, the hypervisors, the SDN applications, the SDN controllers, and the SDN data machines.

4. The method of claim 3 further comprising:

receiving a trust query for one of the SDN controllers;

processing the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN controllers;

transferring a response indicating the one of the hardware trust validations for the one of the SDN controllers.

5. The method of claim 3 further comprising:

receiving a trust query for one of the hypervisors;

processing the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the hypervisors;

transferring a response indicating the one of the hardware trust validations for the one of the hypervisors.

6. The method of claim 3 further comprising:

receiving a trust query for one of the SDN applications;

processing the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN applications;

transferring a response indicating the one of the hardware trust validations for the one of the SDN applications.

7. The method of claim 3 further comprising:

receiving a trust query for one of the SDN data machines;

processing the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN data machines;

transferring a response indicating the one of the hardware trust validations for the one of the SDN data machines.

8. The method of claim 1 wherein the network applications comprise Long Term Evolution (LTE) core network applications.

9. The method of claim 1 wherein the network applications comprise Long Term Evolution (LTE) access node applications.

10. The method of claim 1 wherein the network applications comprises Internet Multimedia Subsystem (IMS) server applications.

11. A data communication system comprising data processing circuitry to transfer data communications, the method comprising:

a trust system configured to establish and maintain network trust of the data processing circuitry;

a Network Function Virtualization (NFV) system configured to execute hypervisors in the data processing circuitry to establish and maintain an NFV processing environment;

a Software Defined Network (SDN) system to execute SDN applications, SDN controllers, and SDN data machines in the data processing circuitry during NFV slices to transfer the data communications; and

a data structure that associates, based on execution relationships, individual blocks of the data processing circuitry, the trust modules, the hypervisors, the NFV slices, the SDN applications, the SDN controllers, and the SDN data machines.

12. The data communication system of claim 11 wherein the trust system is configured to read secret keys embedded in the individual blocks of the data processing circuitry, generate trust values based on the secret keys, transfer the trust values, and receive hardware trust validations for the individual blocks of the data processing circuitry responsive to the transferred trust values.

13. The data communication system of claim 12 wherein the data structure is configured to associate, based on the execution relationships, the hardware trust validations for the individual blocks of the data processing circuitry with the NFV slices, the trust modules, the hypervisors, the SDN applications, the SDN controllers, and the SDN data machines.

14. The data communication system of claim 13 wherein the trust system is configured to receive a trust query for one of the SDN controllers, process the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN controllers, and transfer a response indicating the one of the hardware trust validations for the one of the SDN controllers.

15. The data communication system of claim 13 wherein the trust system is configured to receive a trust query for one of the hypervisors, process the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the hypervisors, and transfer a response indicating the one of the hardware trust validations for the one of the hypervisors.

16. The data communication system of claim 13 wherein the trust system is configured to receive a trust query for one of the SDN applications, process the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN applications, and transfer a response indicating the one of the hardware trust validations for the one of the SDN applications.

17. The data communication system of claim 13 wherein the trust system is configured to receive a trust query for one of the SDN data machines, process the data structure to identify one of the hardware trust validations for the block of the data processing circuitry executing the one of the SDN data machines, and transfer a response indicating the one of the hardware trust validations for the one of the SDN data machines.

18. The data communication system of claim 11 wherein the network applications comprise Long Term Evolution (LTE) core network applications.

19. The data communication system of claim 11 wherein the network applications comprise Long Term Evolution (LTE) access node applications.

20. The data communication system of claim 11 wherein the network applications comprise Internet Multimedia Subsystem (IMS) server applications.