Method and arrangement for configuring a secure domain in a network functions virtualization infrastructure

An apparatus capable of configuring a secure domain, SD, in a network functions virtualisation infrastructure, NFVI, where the SD is controlled by a network function virtualizations orchestrator, NFVO, and a virtualized infrastructure manager, VIM, where the NFVO and the VIM are associated with a virtualized network function, VNF, manager, the SD comprising virtual objects handling privileged information, the apparatus having a processing circuit and a memory circuit, the memory circuit having instructions executable by the processor circuit, wherein said processing circuit when executing the instructions is configured to:

• obtain, from the NFVO or the VNF manager, network service, NS, instance information of a virtual object, based on input from a party associated with the SD;
• search in the NS instance information, for a level of confidentiality and geographic location information;
• and
• allocate the virtual object to the SD according to the geographic location information, based on the level of confidentiality and a specific role of the party, when having identified the level of confidentiality and the geographic location;
• authorize access to a set of operations on the virtual object, for the party, wherein the operations are based on the specific role of the party, in a hierarchy of party roles;
• receive, from the NFVO or the VNF manager, a selection input for a further virtual object, the selection input comprising a level of confidentiality of the further virtual object and a location attribute of the further virtual object;
• when the location attribute of the further virtual object indicates a location within the geographic location information of the NS instance information, allocate the further virtual object to the NS according to the level of confidentiality as comprised in the selection input, based on the specific role of the party;
• and
• when the location attribute of the further virtual object does not indicate a location within the geographic location information of the NS instance information, wherein the processing circuit when executing the instructions is configured to:
• check whether location attributes of a second virtual object and of a second virtual link for accessing the second virtual object, allocated to an existing VNF, indicate a second location within or outside borders of a jurisdiction indicated in the geographic location information of the NS instance information;
• and
• configure the SD to allow lawful intercept, LI, by a privileged party in a hierarchy in the roles, when said location attributes of the second virtual object and of the second virtual link for accessing the second virtual object, indicate a second location within said borders of the jurisdiction, based on the role of the privileged party.