Technologies for secure personalization of a security monitoring virtual network function

A non-transitory computer-readable medium comprising instructions stored thereon, that if executed by at least one processor, cause the at least one processor to perform a security services agent for a Virtual Network Function (VNF) that is to:

• receive at least an internet protocol (IP) address and an initial root security credential;
• perform part of a mutually authenticated key exchange procedure with a VNF manager using the security credential to establish a secure and trusted channel;
• open a management channel with the VNF manager;
• cause transmission of information to the VNF manager using the management channel;
• receive personalization data from the VNF manager, wherein the personalization data comprises one or more of:
• secure configuration data, an initial set of security monitoring VNF parameters, meta-data, connection information about other VNFs, vendor-specific information, performance information, traffic engineering data, or at least one quality of service (QoS) parameter or policy;
• and
• receive from the VNF manager at least one policy comprising one or more of:
• a tenant specific security processing policy, a security traffic policy, a security group policy, or a network services processing policy.

A computing platform comprising:

• a network interface controller;
• a memory device;
• and
• at least one processor coupled to the network interface controller and the memory device, the at least one processor to perform a security services agent for a Virtual Network Function (VNF) that is to:
• receive at least an internet protocol (IP) address and an initial root security credential;
• perform part of a mutually authenticated key exchange procedure with a VNF manager using the security credential to establish a secure and trusted channel;
• open a management channel with the VNF manager;
• cause transmission of information to the VNF manager using the management channel;
• receive personalization data from the VNF manager, wherein the personalization data comprises one or more of:
• secure configuration data, an initial set of security monitoring VNF parameters, meta-data, connection information about other VNFs, vendor-specific information, performance information, traffic engineering data, or at least one quality of service (QoS) parameter or policy;
• and
• receive from the VNF manager at least one policy comprising one or more of:
• a tenant specific security processing policy, a security traffic policy, a security group policy, or a network services processing policy.

A method for executing a security services agent for a Virtual Network Function (VNF), the method comprising:

• receiving at least an internet protocol (IP) address and an initial root security credential;
• performing part of a mutually authenticated key exchange procedure with a VNF manager using the security credential to establish a secure and trusted channel;
• opening a management channel with the VNF manager;
• causing transmission of information to the VNF manager using the management channel;
• receiving personalization data from the VNF manager, wherein the personalization data comprises one or more of:
• secure configuration data, an initial set of security monitoring VNF parameters, meta-data, connection information about other VNFs, vendor-specific information, performance information, traffic engineering data, or at least one quality of service (QoS) parameter or policy;
• and
• receiving from the VNF manager at least one policy comprising one or more of:
• a tenant specific security processing policy, a security traffic policy, a security group policy, or a network services processing policy.

A non-transitory computer-readable medium comprising instructions stored thereon, that if executed by at least one processor, cause the at least one processor to perform a security services agent for a Virtual Network Function (VNF) that is to:

• establish part of a secure, mutually authenticated channel to communicate with a VNF manager;
• to ensure security credentials are current and active, use the secure, mutually authenticated channel or set up and use a new secure channel for communication with the VNF manager;
• receive a policy update from the VNF manager;
• and
• based on receipt of the policy update, perform at least one or more of:
• abandon present execution, exit, block at least some traffic, or continue execution until a trigger is received, wherein receive a policy update from the VNF manager is based on a system event that comprises an addition or removal of tenants, a network or system threat, or other security policy updates.

A computer-readable medium comprising instructions stored thereon, that if executed by at least one processor, cause the at least one processor to perform a Virtual Network Function manager (VNFM) that is to:

• receive, from a network functions virtualization (NFV) security controller, one or more of:
• an identifier of a security services agent (SSA) for a Virtual Network Function (VNF), identifier of a platform, and a security credential used by the NFV security controller to provision an SSA;
• perform part of a mutually authenticated key exchange procedure with the SSA for the VNF using the security credential to establish a secure and trusted channel;
• receive information from the SSA for the VNF using a management channel;
• receive a policy for security monitoring from the NFV security controller;
• push personalization data to the SSA for the VNF;
• push one or more of the tenant, service, or network security policy to the SSA for the VNF;
• and
• provide an indication to the NFV security controller that the personalization and policy update was successful.