System, method, and computer program for managing security in a network function virtualization (NFV) based communication network

• US 9,460,286 B1
• Filed: 12/16/2014
• Issued: 10/04/2016
• Est. Priority Date: 12/19/2013
• Status: Active Grant

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.)
• Original Assignee: Amdocs Software Systems Limited (Amdocs Ltd.)
• Inventors: Felstaine, Eyal, Hermoni, Ofer, Sandlerman, Nimrod
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/572,723
• Time in Patent Office: 658 Days
• Field of Search: 726/23
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method, and computer program product are provided for providing security in a Network Function Virtualization based (NFV-based) communication network. In operation, a security attack is identified. Additionally, a first hardware unit attacked by the security attack is identified. Further, a hardware unit in which to initiate a security defense software program is identified. Moreover, the security defense software program is initiated in the identified hardware unit.

Claims

1. A method, comprising:

identifying, by a first hardware unit in a Network Function Virtualization based (NFV-based) network, that a security attack has occurred within the first hardware unit;

responsive to identifying the security attack, identifying by the first hardware unit a second hardware unit in the NFV-based network that is operative to replace the first hardware unit;

initiating, by the first hardware unit, a migration of functionality of the first hardware unit to the identified second hardware unit; and

after the functionality of the first hardware unit is migrated to the second hardware unit, executing a security defense software program in the first hardware unit to cleanse the first hardware unit; and

after the first hardware unit is cleansed, reinitiating the migrated functionality at the first hardware unit.

2. The method of claim 1, wherein initiating the migration of functionality of the first hardware unit to the identified second hardware unit includes:

determining whether the identified second hardware unit already includes code to perform the functionality;

responsive to determining that the identified second hardware unit does not already include the code, initiating installation of the code on the second hardware unit;

determining whether the identified second hardware unit already includes data required to execute the functionality without causing a session and/or service discontinuity otherwise resulting from the migrating;

responsive to determining that the identified second hardware unit does not already include the data, initiating a provisioning of the data to the second hardware unit from a mirroring facility or a backup facility;

once the second hardware unit has the code and the data, configuring the second hardware unit according to parameters of the first hardware unit; and

after the configuring, diverting communications incoming to the first hardware unit to the second hardware unit.

3. A computer program product embodied in a computer storage device having computer code, when executed by a computer hardware processor, to perform functions of:

identifying, by a first hardware unit in a Network Function Virtualization based (NFV-based) network, that a security attack has occurred within the first hardware unit;

responsive to identifying the security attack, identifying by the first hardware unit a second hardware unit in the NFV-based network that is operative to replace the first hardware unit;

initiating, by the first hardware unit, a migration of functionality of the first hardware unit to the identified second hardware unit; and

after the functionality of the first hardware unit is migrated to the second hardware unit, executing a security defense software program in the identified first hardware unit to cleanse the first hardware unit; and

after the first hardware unit is cleansed, reinitiating the migrated functionality at the first hardware unit.

4. A system comprising:

a memory system of a first hardware unit in a Network Function Virtualization based (NFV-based) network; and

one or more hardware processing cores of the first hardware unit that are coupled to the memory system and that are each configured to;

identify, by the first hardware unit, that a security attack has occurred within the first hardware unit;

responsive to identifying the security attack, identify by the first hardware unit a second hardware unit in the NFV-based network that is operative to replace the first hardware unit;

initiate, by the first hardware unit, a migration of functionality of the first hardware unit to the identified second hardware unit; and

after the functionality of the first hardware unit is migrated to the second hardware unit, execute a security defense software program in the first hardware unit to cleanse the first hardware unit; and

after the first hardware unit is cleansed, reinitiate the migrated functionality at the first hardware unit.