Correlating remote attestation quotes with a virtualized network function (VNF) resource allocation event
AssigneeTelefonaktiebolaget L M Ericsson (publ)
InventorsBernard Smeets, Cristina Badulescu, Daniel Migault, Stere Preda
Life of this patent
Estimating the term…
Abstract
A method, network node and non-transitory computer readable media having stored thereon instructions for correlating a remote attestation quote with a virtualized network function (VNF) resource allocation event. The method comprises obtaining a set of VNF components (VNFCs) that require remote attestation. The method comprises obtaining an attestation quote for each VNFC of the set of VNFCs, the attestation quote ensuring that instances of each VNFC are used in a legitimate context. The method comprises correlating each attestation quote with the VNF resource allocation event.
Claims23
A method, executed in a security manager (SM), for correlating remote attestation quotes with a virtualized network function (VNF) resource allocation event, comprising:
- obtaining a set of VNF components (VNFCs) that require remote attestation;
- obtaining an attestation quote for each VNFC of the set of VNFCs, the attestation quote ensuring that instances of each VNFC are used in a legitimate context;
- and
- correlating each attestation quote with the VNF resource allocation event;
- wherein correlating further comprises:
- computing a first fingerprint of a VNFC image, the VNFC image corresponding to an instantiation of the VNFC, wherein the first fingerprint is computed using a lifecycle operation identifier received from a Management and orchestration (MANO) and wherein the first fingerprint is included in the attestation quote;
- computing a second fingerprint of a VNFC image, wherein the second fingerprint is computed using the lifecycle operation identifier;
- verifying a signature and reference values of the attestation quote;
- verifying that the first and second fingerprints are the same;
- verifying that the attestation quote is received within an attestation time-window;
- and
- verifying that a number of attestation quotes including a same hash value is lower or equal to a number of VNFC instances that are permitted to be attested.
The method of claim, 1 wherein the first and second fingerprints each comprises a characteristic computed from the VNFC image.
A network node comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the network node executes a security manager (SM) for correlating remote attestation quotes with a virtualized network function (VNF) resource allocation event, the network node being operative to:
- obtain a set of VNF components (VNFCs) that require remote attestation;
- obtain an attestation quote for each VNFC of the set of VNFCs, the attestation quote ensuring that instances of each VNFC are used in a legitimate context;
- and
- correlate each attestation quote with the VNF resource allocation event;
- wherein correlating further comprises:
- computing a first fingerprint of a VNFC image, the VNFC image corresponding to an instantiation of the VNFC, wherein the first fingerprint is computed using a lifecycle operation identifier received from a Management and orchestration (MANO) and wherein the first fingerprint is included in the attestation quote;
- computing a second fingerprint of a VNFC image, wherein the second fingerprint is computed using the lifecycle operation identifier;
- verifying a signature and reference values of the attestation quote;
- verifying that the first and second fingerprints are the same;
- verifying that the attestation quote is received within an attestation time-window;
- and
- verifying that a number of attestation quotes including a same hash value is lower or equal to a number of VNFC instances that are permitted to be attested.
A non-transitory computer readable media having stored thereon instructions for correlating a remote attestation quote with a virtualized network function (VNF) resource allocation event, the instructions comprising:
- obtaining a set of VNF components (VNFCs) that require remote attestation;
- obtaining an attestation quote for each VNFC of the set of VNFCs, the attestation quote ensuring that instances of each VNFC are used in a legitimate context;
- and
- correlating each attestation quote with the VNF resource allocation event;
- wherein correlating further comprises:
- computing a first fingerprint of a VNFC image, the VNFC image corresponding to an instantiation of the VNFC, wherein the first fingerprint is computed using a lifecycle operation identifier received from a Management and orchestration (MANO) and wherein the first fingerprint is included in the attestation quote;
- computing a second fingerprint of a VNFC image, wherein the second fingerprint is computed using the lifecycle operation identifier;
- verifying a signature and reference values of the attestation quote;
- verifying that the first and second fingerprints are the same;
- verifying that the attestation quote is received within an attestation time-window;
- and
- verifying that a number of attestation quotes including a same hash value is lower or equal to a number of VNFC instances that are permitted to be attested.
Dependencies are inferred from the claim text.