Security and trust framework for virtualized networks
A framework, apparatus, system and method for realizing security and trust management for virtualized networks. A computing platform for implementation in a networking device of a virtualized network comprises a root-trusted module layer, which includes a root trust module for providing root trust; and a middleware layer, which includes system-level components configured to manage security and trust of virtualized network functions by verifying, establishing or maintaining trust with regard to the virtualized network functions based on the root trust. The computing platform can further comprise a number of virtualized security and trust functions that can be flexibly deployed in the virtualized network function infrastructure supported by the above two layers.
1. An apparatus for security and trust in a virtualized network, comprising:
at least one processor; and
at least one memory including computer program code,
the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:
deploy a root trust module for providing root trust; and
deploy a middleware, for managing security and trust of virtualized network functions by verifying, establishing or maintaining trust with regard to the virtualized network functions based on the root trust,
wherein the middleware is configured to
embed policies for executions of the virtualized network functions into a secure storage;
verify trust throughout executions of the virtualized network functions based on a fulfillment of the embedded policies; and
ensure the embedded policies to be fulfilled.
2. An apparatus of claim 1 , wherein the middleware is further configured to:
monitor performance of the virtualized network functions;
evaluate reputations of the virtualized network functions based on the performance and other collected related information; and
select trustworthy virtualized network functions based on respective evaluated reputations.
3. An apparatus of claim 1 , wherein the middleware is further configured to:
monitor QoS-related performance of a virtualized network function;
evaluate trust of the virtualized network function based on the monitored performance;
adaptively select a resource arrangement strategy and control modes based on the evaluated trust.
4. An apparatus of claim 1 , wherein the policies are defined by a third party, and the apparatus is further configured to cause an authentication for the third party before the policies is allowed to be embedded.
5. An apparatus of claim 1 , wherein the policies comprise virtualized network function forwarding graphs.
6. An apparatus of claim 1 , wherein the virtualized network functions are identified by using associated hash codes which are registered in the root trust module.
7. An apparatus of claim 1 , wherein the middleware and the root trust module are deployed in the apparatus as a platform as a service.
8. An apparatus of claim 1 , wherein the apparatus is further caused to: deploy virtualized network functions related to security and trust.
9. An apparatus of claim 8 , wherein the virtualized network functions is deployed in the apparatus as a service.
10. A method for security and trust management in a virtualized network, comprising:
deploying a root trust module for providing root trust; and
deploying a middleware, for managing security and trust of virtualized network functions by verifying, establishing or maintaining trust with regard to the virtualized network functions based on the root trust; and
managing security and trust of virtualized network functions by the middleware, and the managing comprises:
embedding policies for executions of the virtualized network functions into a secure storage;
verifying trust throughout executions of the virtualized network functions based on a fulfillment of the embedded policies; and
ensuring the embedded policies to be fulfilled.
11. A method of claim 10 , further comprising:
managing security and trust of virtualized network functions by the middleware, wherein the managing comprises:
monitoring performance of the virtualized network functions;
evaluating reputations of the virtualized network functions based on the performance and other collected related information; and
selecting trustworthy virtualized network functions based on respective evaluated reputations.
12. A method of claim 10 , further comprising:
managing security and trust of virtualized network functions by the middleware, and the managing comprises:
monitoring QoS-related performance of a virtualized network function;
evaluating trust of the virtualized network function based on the monitored performance;
adaptively selecting a resource arrangement strategy and control modes based on the evaluated trust.
13. A method of claim 10 , wherein the policies are defined by a third party, and the managing further comprises:
causing an authentication for the third party before the policies is allowed to be embedded.
14. A method of claim 10 , wherein the policies comprise virtualized network function forwarding graphs.
15. A method of claim 10 , wherein the virtualized network functions are identified by using associated hash codes that are registered in the root trust module.
16. A method of claim 10 , wherein the middleware and the root trust module are deployed as a platform as a service.
17. A method of claim 10 , further comprising:
deploying virtualized network functions related to security and trust.
18. A method of claim 17 , wherein the virtualized network functions is deployed in the apparatus as a service.