# US 12,015,687 B2 · Securing communications in a network function virtualization (NFV) core network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,687 B2
- Document ID: US12015687B2
- Status: Granted
- Kind: B2
- Application number: 17/724,366
- Filed: 2022-04-19
- Published: 2022-07-28
- Granted: 2024-06-18
- Earliest claimed: 2015-10-01
- Assignees: T-Mobile Innovations LLC
- Applicants: T-Mobile Innovations LLC
- Inventors: Ronald R. Marquardt; Lyle W. Paczkowski; Carl J. Persson; Arun Rajagopal
- Web page: https://patentgrep.com/patent/US12015687B2

## CPC

- H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70)
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 61/3025: {Domain name generation or assignment}
- H04L 61/4511: using domain name system [DNS]
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 61/503: using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 2101/35: containing special prefixes
- H04L 2101/355: containing special suffixes
- H04L 2101/668: Internet protocol [IP] address subnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method of electronic communication via a virtual network function (NFV) implementation of a core network. The method comprises receiving a hypertext transfer protocol (HTTP) content request from a user equipment (UE), wherein the HTTP content request comprises an identification of a content source and determining by an orchestrator service that insufficient NFV processing capacity is available to perform the HTTP content request, where the orchestrator service is an application that executes on a first physical host. The method further comprises dynamically increasing the NFV processing capacity by the orchestrator service, performing the HTTP content request using the increased NFV processing capacity, and returning a HTTP content response to the UE, wherein the HTTP content response does not comprise identification of the content source.

## Claims

### Claim 1

A method of providing a trusted communication service using network function virtualization (NFV), comprising:
determining by a trusted orchestrator service that a communication processing load of a common function supported by at least one virtual server executing in a NFV core network is greater than a predefined processing load threshold, where the trusted orchestrator service is an application that executes in a trusted security zone of a first physical host that provides hardware assisted security;
in response to the determination of the processing load being greater than the predefined processing load threshold, creating by the trusted orchestrator service a second virtual server on a second physical host that provides hardware assisted security;
requesting by the trusted orchestrator service a plurality of trust keys from a trusted repository of trust keys, wherein the trusted orchestrator service communicates over a trusted end-to-end communication link with the trusted repository of trust keys to obtain the plurality of trust keys;
initiating by the trusted orchestrator service at least one instance of the common function in the second virtual server, wherein the at least one instance of the common function is configured with at least one of the plurality of trust keys received from the trusted repository;
enabling by the trusted orchestrator service a trusted security zone of the second physical host; and
provisioning by the trusted orchestrator service the plurality of trusted keys into the enabled trusted security zone of the second physical host.

### Claim 2 (depends on 1)

The method of claim 1, wherein the common function is one of a policy function, a mobility function, a bearer function, a context function, an authentication function, an attach function, and a data function.

### Claim 3 (depends on 1)

The method of claim 1, wherein the trusted orchestrator service is part of an orchestrator service, wherein the orchestrator service provides communication services to user equipments (UEs) in the NFV core network by invoking a plurality of common functions executing on virtual servers in the NFV core network to compose the communication services.

### Claim 4 (depends on 3)

The method of claim 3, wherein the common functions comprise a mobility function, a bearer function, a context function, an authentication function, an attach function, and a data function, wherein a plurality of the common functions comprise an associated common function trustlet that executes in a trusted security zone of the physical host on which the common function executes.

### Claim 5 (depends on 4)

The method of claim 4, wherein the common function trustlet is an extract of a plurality of executable instructions of the associated common function that execute in the trusted security zone.

### Claim 6 (depends on 3)

The method of claim 3, wherein the UEs comprise mobile smart phones, media players, personal digital assistants (PDAs), laptop computers, notebook computers, tablet computers, wearable computers, and headset computers.

### Claim 7 (depends on 1)

The method of claim 1, wherein the common function comprises a trustlet that executes in the trusted security zone of the second physical host.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
initiating by a user equipment (UE) a trusted communication to access data via a content server;
in response to the initiation, requesting by an enhanced node B a trusted communication link with the content server by sending a trusted link request to the core NFV network;
transitioning the common function to executing the trustlet in response to the trusted link request from the enhanced node B;
sending by the trustlet the at least one of the plurality of trust keys to the enhanced node B, wherein a trusted communication link is established between the common function and the enhanced node B based on the at least one of the plurality of trust keys; and
establishing an end-to-end trusted bearer path from the UE to the content server based at least in part on the trusted communication link between the common function and the enhanced node B.

### Claim 9

A system for providing a trusted communication service using network function virtualization (NFV), comprising:
a non-transitory memory;
a processor; and
a trusted orchestrator service stored in the non-transitory memory that, when executed by the processor:
determines that a communication processing load of a common function supported by at least one virtual server executing in a NFV core network is greater than a predefined processing load threshold, where the trusted orchestrator service is an application that executes in a trusted security zone of a first physical host that provides hardware assisted security,
in response to the determination of the processing load being greater than the predefined processing load threshold, creates a second virtual server on a second physical host that provides hardware assisted security,
requests a plurality of trust keys from a trusted repository of trust keys, wherein the trusted orchestrator service communicates over a trusted end-to-end communication link with the trusted repository of trust keys to obtain the plurality of trust keys,
initiates at least one instance of the common function in the second virtual server, wherein the at least one instance of the common function is configured with at least one of the plurality of trust keys received from the trusted repository,
enables a trusted security zone of the second physical host, and
provisions the plurality of trusted keys into the enabled trusted security zone of the second physical host.

### Claim 10 (depends on 9)

The system of claim 9, wherein the common function is one of a policy function, a mobility function, a bearer function, a context function, an authentication function, an attach function, and a data function.

### Claim 11 (depends on 9)

The system of claim 9, wherein the trusted orchestrator service is part of an orchestrator service, wherein the orchestrator service provides communication services to user equipments (UEs) in the NFV core network by invoking a plurality of common functions executing on virtual servers in the NFV core network to compose the communication services.

### Claim 12 (depends on 11)

The system of claim 11, wherein the common functions comprise a mobility function, a bearer function, a context function, an authentication function, an attach function, and a data function, wherein a plurality of the common functions comprise an associated common function trustlet that executes in a trusted security zone of the physical host on which the common function executes.

### Claim 13 (depends on 12)

The system of claim 12, wherein the common function trustlet is an extract of a plurality of executable instructions of the associated common function that execute in the trusted security zone.

### Claim 14 (depends on 11)

The system of claim 11, wherein the UEs comprise mobile smart phones, media players, personal digital assistants (PDAs), laptop computers, notebook computers, tablet computers, wearable computers, and headset computers.

### Claim 15 (depends on 9)

The system of claim 9, wherein the common function comprises a trustlet that executes in the trusted security zone of the second physical host.

### Claim 16 (depends on 15)

The system of claim 15, wherein the common function is transitioned to executing the trustlet based on a trusted link request from an enhanced node B in response to a user equipment (UE) initiating a trusted communication to access data via a content server, wherein the trustlet sends the at least one of the plurality of trust keys to the enhanced node B, wherein a trusted communication link is established between the common function and the enhanced node B based on the at least one of the plurality of trust keys, and wherein an end-to-end trusted bearer path from the UE to the content server is established based at least in part on the trusted communication link between the common function and the enhanced node B.