Technologies for secure bootstrapping of virtual network functions

One or more non-transitory, machine-readable storage media comprising a plurality of instructions stored thereon that, when executed, cause a network functions virtualization (NFV) network system to:

• receive, by a hypervisor of the NFV network system, a command to spin-up a virtual network function (VNF) instance, wherein the request includes a set of startup parameters;
• verify, by the hypervisor, an authenticity of the received command;
• instantiate, by the hypervisor, the VNF instance as a function of the startup parameters;
• register the instantiated VNF with a Trusted Execution Environment (TEE) of the NFV system;
• generate, by a VNF bootstrap service (VBS) agent of the NFV network system and in response to having received the notification from the hypervisor, a VNF public/private key pair as a function of the portion of the startup parameters received with the notification;
• request, by the VBS agent, an attested quote from the TEE using a VNF public key of the public/private key pair, wherein the request is usable to calculate a quote hash and sign the quote hash using a private key of the TEE;
• execute, by the VBS agent and in response to having received the signed quote hash from the TEE, a VBS capture protocol to securely bind the VBS agent with an associated VBS;
• activate the VNF instance;
• and
• transmit an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated.

A method for security bootstrapping a virtual network function (VNF), the method comprising:

• receiving, by a hypervisor of a network functions virtualization (NFV) network system, a command to spin-up a VNF instance, wherein the request includes a set of startup parameters;
• verifying, by the hypervisor, an authenticity of the received command;
• instantiating, by the hypervisor, the VNF instance as a function of the startup parameters;
• registering the instantiated VNF with a Trusted Execution Environment (TEE) of the NFV system;
• generating, by a VNF bootstrap service (VBS) agent and in response to having received the notification from the hypervisor, a VNF public/private key pair as a function of the portion of the startup parameters received with the notification;
• requesting, by the VBS agent, an attested quote from the TEE using a VNF public key of the public/private key pair, wherein the request is usable to calculate a quote hash and sign the quote hash using a private key of the TEE;
• executing, by the VBS agent and in response to having received the signed quote hash from the TEE, a VBS capture protocol to securely bind the VBS agent with an associated VBS;
• activating, by the VBS agent, the VNF instance;
• and
• transmitting, by the VBS agent, an indication to a VNF manager of the NFV network system that indicates the VNF instance has been activated.