# US 2018/0026992 A1 · Virtual network function (vnf) hardware trust in a network function virtualization (nfv) software defined network (sdn)

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0026992 A1
- Document ID: US20180026992A1
- Status: Published application
- Kind: A1
- Application number: 15/216,677
- Filed: 2016-07-21
- Published: 2018-01-25
- Earliest claimed: 2016-07-21
- Assignees: Sprint Communications Company L.P.
- Applicants: Sprint Communications Company L.P.
- Inventors: Lyle Walter Paczkowski; James Patrick Sisul; Marouane Balmakhtar
- Web page: https://patentgrep.com/patent/US20180026992A1

## CPC

- H04L 63/123: {received data contents, e.g. message integrity}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 45/645: Splitting route computation layer and forwarding layer, e.g. routing according to path computational element [PCE] or based on OpenFlow functionality
- H04L 45/76: Routing in software-defined topologies, e.g. routing between virtual machines
- H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A Network Function Virtualization (NFV) Software Defined Network (SDN) maintains hardware trusted communications. A source trust controller and a target trust controller establish hardware trust with a trust server. The trust server exchanges information with the source trust controller that indicates the hardware trust for a target vSW. The source trust controller exchanges the information with the source vSW that indicates the hardware trust for the target vSW. The source vSW receives a Virtual Data Unit (VDU) from the source VNF for delivery to the target VNF over the target vSW, and before transfer, the source vSW verifies hardware trust of the target vSW based on the HT information. Responsive to the hardware trust verification, the source vSW transfers the VDU for the delivery to the target vSW. The target vSW transfers the VDU to the target VNF.

## Claims

### Claim 1

A method of operating a Network Function Virtualization (NFV) Software Defined Network (SDN) to maintain hardware trusted communications, the method comprising:
a source hardware trust controller establishing hardware trust with an NFV SDN hardware trust server;
a target hardware trust controller establishing hardware trust with the NFV SDN hardware trust server;
a source SDN Hardware Trust Virtual Switch (HT vSW) executing under control of the source hardware trust controller to serve a source Virtual Network Function (VNF);
a target SDN HT vSW executing under control of the target hardware trust controller to serve a target VNF;
the NFV SDN hardware trust server exchanging Hardware Trust (HT) information with the source hardware trust controller that indicates the hardware trust for the target SDN HT vSW;
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target SDN HT vSW;
the source SDN HT vSW receiving a Virtual Data Unit (VDU) from the source VNF for delivery to the target VNF over the target SDN HT vSW, and before transfer, verifying hardware trust of the target SDN HT vSW based on the HT information, and responsive to the hardware trust verification, transferring the VDU for the delivery to the target SDN HT vSW; and
the target SDN HT vSW transferring the VDU to the target VNF.

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
the NFV SDN hardware trust server exchanging HT information with the target hardware trust controller that indicates the hardware trust for the source SDN HT vSW;
the target hardware trust controller exchanging the HT information with the target SDN HT vSW that indicates the hardware trust for the source SDN HT vSW;
the target SDN HT vSW receiving the VDU from the source SDN HT vSW for delivery to the target VNF, and before transfer, verifying hardware trust of the source SDN HT vSW based on the HT information, and responsive to the hardware trust verification, transferring the VDU to the target VNF.

### Claim 3 (depends on 1)

The method of claim 1 wherein the hardware trust server establishing the hardware trust with the source hardware trust controller and with the target hardware trust controller comprises:
the source hardware trust controller executing at a Ring 0 security level;
the target hardware trust controller executing at the Ring 0 security level;

### Claim 4 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for the target VNF;
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target VNF; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target VNF based on the HT information, and responsive to the hardware trust verification of the target VNF and the target SDN HT vSW, transferring the VDU to the target SDN HT vSW.

### Claim 5 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for a target VNF Component (VNFC);
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target VNFC; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target VNFC based on the HT information, and responsive to the hardware trust verification of the target VNFC and the target SDN HT vSW, transferring the VDU for delivery to the target SDN HT vSW.

### Claim 6 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for a target NFV thread;
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target NFV thread; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target NFV thread based on the HT information, and responsive to the hardware trust verification of the target NFV thread and the target SDN HT vSW, transferring the VDU for delivery to the target SDN HT vSW.

### Claim 7 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for a target NFV Infrastructure (NFVI);
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target NFVI; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target NFVI based on the HT information, and responsive to the hardware trust verification of the target NFVI and the target SDN HT vSW, transferring the VDU for delivery to the target SDN HT vSW.

### Claim 8 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for a target NFV server;
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target NFV server; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target NFV server based on the HT information, and responsive to the hardware trust verification of the target NFV server and the target SDN HT vSW, transferring the VDU for delivery to the target SDN HT vSW.

### Claim 9 (depends on 1)

The method of claim 1 wherein:
the NFV SDN hardware trust server exchanging the HT information with the source hardware trust controller comprises indicating hardware trust for a target network service descriptor;
the source hardware trust controller exchanging the HT information with the source SDN HT vSW that indicates the hardware trust for the target network service descriptor; and further comprising
transferring the VDU for the delivery to the target SDN HT vSW comprises verifying hardware trust of the target network service descriptor based on the HT information, and responsive to the hardware trust verification of the target network service descriptor and the target SDN HT vSW, transferring the VDU for delivery to the target SDN HT vSW.

### Claim 10 (depends on 1)

The method of claim 1 wherein the NFV SDN hardware trust server comprises an NFV Management and Orchestration (MANO) server.

### Claim 11

A Network Function Virtualization (NFV) Software Defined Network (SDN) to maintain hardware trusted communications, the NFV SDN comprising:
a source hardware trust controller configured to establish hardware trust with an NFV SDN hardware trust server;
a target hardware trust controller configured to establish hardware trust with the NFV SDN hardware trust server;
a source SDN Hardware Trust Virtual Switch (HT vSW) configured to execute under control of the source hardware trust controller to serve a source Virtual Network Function (VNF);
a target SDN HT vSW configured to execute under control of the target hardware trust controller to serve a target VNF;
the NFV SDN hardware trust server configured to exchange Hardware Trust (HT) information with the source hardware trust controller that indicates the hardware trust for the target SDN HT vSW;
the source hardware trust controller configured to exchange the HT information with the source SDN HT vSW that indicates the hardware trust for the target SDN HT vSW;
the source SDN HT vSW configured to receive a Virtual Data Unit (VDU) from the source VNF for delivery to the target VNF over the target SDN HT vSW, and before transfer, verify hardware trust of the target SDN HT vSW based on the HT information, and responsive to the hardware trust verification, transfer the VDU for the delivery to the target SDN HT vSW; and
the target SDN HT vSW configured to transfer the VDU to the target VNF.

### Claim 12 (depends on 11)

The NFV SDN of claim 11 further comprising:
the NFV SDN hardware trust server is configured to exchange HT information with the target hardware trust controller that indicates the hardware trust for the source SDN HT vSW;
the target hardware trust controller is configured to exchange the HT information with the target SDN HT vSW that indicates the hardware trust for the source SDN HT vSW;
the target SDN HT vSW is configured to receive the VDU from the source SDN HT vSW for delivery to the target VNF, and before transfer, verify hardware trust of the source SDN HT vSW based on the HT information, and responsive to the hardware trust verification, transfer the VDU to the target VNF.

### Claim 13 (depends on 11)

The NFV SDN of claim 11 wherein:
the source hardware trust controller is configured to execute at a Ring 0 security level;
the target hardware trust controller is configured to execute at the Ring 0 security level;

### Claim 14 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for the target VNF;
the source SDN HT vSW is configured to verify hardware trust of the target VNF based on the HT information, and responsive to the hardware trust verification of the target VNF and the target SDN HT vSW, transfer the VDU to the target SDN HT vSW.

### Claim 15 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for a target VNF Component (VNFC);
the source SDN HT vSW is configured to verify hardware trust of the target VNFC based on the HT information, and responsive to the hardware trust verification of the target VNFC and the target SDN HT vSW, transfer the VDU for delivery to the target SDN HT vSW.

### Claim 16 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for a target NFV thread;
the source SDN HT vSW is configured to verify hardware trust of the target NFV thread based on the HT information, and responsive to the hardware trust verification of the target NFV thread and the target SDN HT vSW, transfer the VDU for delivery to the target SDN HT vSW.

### Claim 17 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for a target NFV Infrastructure (NFVI);
the source SDN HT vSW is configured to verify hardware trust of the target NFVI based on the HT information, and responsive to the hardware trust verification of the target NFVI and the target SDN HT vSW, transfer the VDU for delivery to the target SDN HT vSW.

### Claim 18 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for a target NFV server;
the source SDN HT vSW is configured to verify hardware trust of the target NFV server based on the HT information, and responsive to the hardware trust verification of the target NFV server and the target SDN HT vSW, transfer the VDU for delivery to the target SDN HT vSW.

### Claim 19 (depends on 11)

The NFV SDN of claim 11 wherein:
the HT information indicates hardware trust for a target network service descriptor;
the source SDN HT vSW is configured to verify hardware trust of the target network service descriptor based on the HT information, and responsive to the hardware trust verification of the target network service descriptor and the target SDN HT vSW, transfer the VDU for delivery to the target SDN HT vSW.

### Claim 20 (depends on 11)

The NFV SDN of claim 11 wherein the NFV SDN hardware trust server comprises an NFV Management and Orchestration (MANO) server.