# US 2019/0245889 A1 · Virtualized network function security wrapping orchestration in the cloud environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0245889 A1 - Document ID: US20190245889A1 - Status: Published application - Kind: A1 - Application number: 16/340,856 - Filed: 2016-10-11 - Published: 2019-08-08 - Earliest claimed: 2016-10-11 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Aapo Kalliola; Yoan Jean Claude Miche; Ian Justin Oliver - Web page: https://patentgrep.com/patent/US20190245889A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/0272: {Virtual private networks} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for protection of virtualized network functions may comprise: obtaining security orchestration information for one or more virtualized network functions; determining network interfaces relevant to protection of the one or more virtualized network functions based at least in part on network topology information, in response to the security orchestration information; and issuing a security instruction for the protection of the one or more virtualized network functions, according to the determined network interfaces. ## Claims ### Claim 1 A method, comprising: obtaining security orchestration information for one or more virtualized network functions; determining, in response to the security orchestration information, network interfaces relevant to protection of the one or more virtualized network functions based at least in part on network topology information; and issuing a security instruction for the protection of the one or more virtualized network functions, according to the determined network interfaces. ### Claim at position 2 -12. (canceled) ### Claim 13 (depends on 1) The method according to claim 1, wherein the one or more virtualized network functions comprise at least a virtualized network function aggregate formed by a first group of the one or more virtualized network functions which are interdependent in their functionalities. ### Claim at position 4 -17. (canceled) ### Claim 18 An apparatus, comprising: at least one processor; and at least one memory comprising computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to: obtain security orchestration information for one or more virtualized network functions; determine, in response to the security orchestration information, network interfaces relevant to protection of the one or more virtualized network functions based at least in part on network topology information; and issue a security instruction for the protection of the one or more virtualized network functions, according to the determined network interfaces. ### Claim 19 (depends on 18) The apparatus according to claim 18, wherein the determined network interfaces comprises at least one of: network interfaces at which protector virtualized network functions need to be placed; and network interfaces from which protector virtualized network functions need to be removed. ### Claim 20 (depends on 18) The apparatus according to claim 18, wherein the security orchestration information further comprises at least a security command for at least one of: activate protection of at least a first virtualized network function of the one or more virtualized network functions; and deactivate protection of at least a second virtualized network function of the one or more virtualized network functions. ### Claim 21 (depends on 20) The apparatus according to claim 20, wherein the protection of the first virtualized network function is activated by placing one or more protector virtualized network functions at the determined network interfaces for the first virtualized network function. ### Claim 22 (depends on 20) The apparatus according to claim 20, wherein the protection of the second virtualized network function is deactivated by removing protector virtualized network functions from the determined network interfaces for the second virtualized network function. ### Claim 23 (depends on 18) The apparatus according to claim 18, wherein the one or more virtualized network functions comprise at least a group of topologically contiguous virtualized network functions, and wherein the protection of the group of the topologically contiguous virtualized network functions is performed by wrapping the group of the topologically contiguous virtualized network functions with protector virtualized network functions. ### Claim 24 (depends on 18) The apparatus according to claim 18, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: verify whether a security command in the security orchestration information is valid; and get instruction information on implementing the valid security command. ### Claim 25 (depends on 18) The apparatus according to claim 18, wherein the security instruction further indicates at least one of: instantiate at least one protector virtualized network function; insert at least one instantiated protector virtualized network function; terminate at least one instantiated protector virtualized network function; and remove at least one protector virtualized network function. ### Claim 26 (depends on 18) The apparatus according to claim 18, wherein the security instruction comprises at least a network routing related operation information. ### Claim 27 (depends on 18) The apparatus according to claim 18, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: monitor one or more protector virtualized network functions instantiated for the protection of the one or more virtualized network functions. ### Claim 28 (depends on 27) The apparatus according to claim 27, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: receive reporting information from the one or more protector virtualized network functions. ### Claim 29 (depends on 28) The apparatus according to claim 28, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: instruct the one or more protector virtualized network functions to take actions, based at least in part on the received reporting information. ### Claim 30 (depends on 18) The apparatus according to claim 18, wherein the one or more virtualized network functions comprise at least a virtualized network function aggregate formed by a first group of the one or more virtualized network functions which are interdependent in their functionalities. ### Claim 31 (depends on 30) The apparatus according to claim 30, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: monitor a security violation of the virtualized network function aggregate enclosed in a protection envelope which is formed by wrapping the first group of virtualized network functions with protector virtualized network functions; and manage preparation of a second group of virtualized network functions to replace the virtualized network function aggregate upon the monitored security violation. ### Claim 32 (depends on 31) The apparatus according to claim 31, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: instantiate the second group of virtualized network functions, in response to the monitored security violation; and replace the virtualized network function aggregate with the second group of instantiated virtualized network functions. ### Claim 33 (depends on 32) The apparatus according to claim 32, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: terminate the virtualized network function aggregate, in response to the second group of instantiated virtualized network functions taking the place of the virtualized network function aggregate. ### Claim 34 (depends on 33) The apparatus according to claim 33, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus at least to: analyze the terminated virtualized network function aggregate for creating preventative measures against the monitored security violation. ### Claim 35 A non-transitory computer program product comprising a computer-readable medium bearing computer program codes embodied therein for use with a computer, the computer program codes comprising: code for obtaining security orchestration information for one or more virtualized network functions; code for determining, in response to the security orchestration information, network interfaces relevant to protection of the one or more virtualized network functions based at least in part on network topology information; and code for issuing a security instruction for the protection of the one or more virtualized network functions, according to the determined network interfaces. ### Claim at position 23 -52. (canceled)