Hardware-trusted network bearers in network function virtualization infrastructure (NFVI) servers that execute virtual network functions (VNFS) under management and orchestration (MANO) control
Network Function Virtualization Infrastructure (NFVI) servers execute Virtual Network Functions (VNFs) to exchange user data under the control of a Management and Orchestration (MANO) system. A Hardware-Trust (HT) server maintains hardware trust in some of the NFVI servers. The HT server exchanges NFVI/VNF execution data with the MANO system to associate executing VNFs with hardware-trusted NFVI servers. A control set of the VNFs receives a request for a hardware-trusted communication and responsively selects a network bearer supported by data VNFs. The HT server determines if the data VNFs are hardware-trusted VNFs, and if so, the HT server indicates to the control VNFs that the hardware-trusted communication may proceed. The control VNFs direct the data VNFs to transfer the hardware-trusted data communication over the selected network bearer.
1. A method of operating a data communication network having Network Function Virtualization Infrastructure (NFVI) servers, the method comprising:
the NFVI servers and a Management and Orchestration (MANO) system exchanging networking data, and in response, the NFVI servers executing Virtual Network Functions (VNFs) to exchange user data;
a Hardware Trust (HT) server and a hardware-trusted set of the NFVI servers exchanging trust data, and in response, the HT server maintaining hardware trust in the hardware-trusted set of the NFVI servers;
the HT server and the MANO system exchanging NFVI/VNF execution data, and in response, the HT server associating a hardware-trusted set of the VNFs with the hardware-trusted set of the NFVI servers;
a control set of the VNFs receiving a communication request for a hardware-trusted data communication and responsively selecting a network bearer that is supported by a data set of the VNFs and indicating the data set of the VNFs to the HT server;
the HT server determining if the data set of the VNFs is in the hardware-trusted set of the VNFs, and if the data set of the VNFs is in the hardware-trusted set of the VNFs, then indicating to the control set of the VNFs that the hardware-trusted data communication may proceed; and
the control set of the VNFs directing the data set of the VNFs to proceed with the hardware-trusted data communication responsive to the indication from the HT server, and the data set of the VNFs transferring the hardware-trusted data communication over the selected network bearer.
2. The method of claim 1 wherein:
receiving the communication request for the hardware-trusted communication session comprises receiving a Radio Resource Control (RRC) hardware-trust indicator from a user communication device; and
selecting the network bearer for the hardware-trusted communication session comprises identifying an Access Point Name (APN).
3. The method of claim 1 wherein:
receiving the communication request for the hardware-trusted communication session comprises receiving a Non-Access Stratum (NAS) hardware-trust indicator from a user communication device; and
selecting the network bearer for the hardware-trusted communication session comprises identifying an Access Point Name (APN).
4. The method of claim 1 wherein:
receiving the communication request for the hardware-trusted communication session comprises receiving a Session Initiation Protocol (SIP) hardware-trust indicator from a user communication device; and
selecting the network bearer for the hardware-trusted communication session comprises identifying an Access Point Name (APN).
5. The method of claim 1 further comprising:
the HT server and a hardware-trusted set of Software Defined Network (SDN) data machines exchanging additional trust data, and in response, the HT server maintaining hardware trust in the hardware-trusted set of the SDN data machines;
wherein the selected network bearer is supported by a data set of the SDN data machines and further comprising the control set of the VNFs indicating the data set of the SDN data machines to the HT server;
the HT server determining if the data set of the SDN data machines is in the hardware-trusted set of the SDN data machines, and wherein indicating to the control set of the VNFs that the hardware-trusted data communication may proceed comprises indicating that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the SDN data machines is in the hardware-trusted set of the SDN data machines.
6. The method of claim 1 further comprising:
the HT server and a hardware-trusted set of wireless relays exchanging additional trust data, and in response, the HT server maintaining hardware trust in the hardware-trusted set of the wireless relays;
wherein the selected network bearer is supported by a data set of the wireless relays and further comprising the control set of the VNFs indicating the data set of the wireless relays to the HT server;
the HT server determining if the data set of the wireless relays is in the hardware-trusted set of the wireless relays, and wherein indicating to the control set of the VNFs that the hardware-trusted data communication may proceed comprises indicating that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the wireless relays is in the hardware-trusted set of the wireless relays.
7. The method of claim 1 further comprising:
the HT server and a hardware-trusted set of User Equipment (UEs) exchanging additional trust data, and in response, the HT server maintaining hardware trust in the hardware-trusted set of the UEs;
wherein the selected network bearer is supported by a data set of the UEs and further comprising the control set of the VNFs indicating the data set of the UEs to the HT server;
the HT server determining if the data set of the UEs is in the hardware-trusted set of the UEs, and wherein indicating to the control set of the VNFs that the hardware-trusted data communication may proceed comprises indicating that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the UEs is in the hardware-trusted set of the UEs.
8. The method of claim 1 wherein the VNFs comprise Long Term Evolution (LTE) VNFs.
9. The method of claim 1 wherein the VNFs comprise Internet Protocol Multimedia Subsystem (IMS) VNFs.
10. The method of claim 1 wherein the VNFs comprise Software Defined Network (SDN) VNFs.
11. A data communication network that uses trusted hardware comprising:
Network Function Virtualization Infrastructure (NFVI) servers having NFVI processing circuitry and memory configured to exchange networking data with a Management and Orchestration (MANO) system, and in response, to execute Virtual Network Functions (VNFs) to exchange user data;
a Hardware Trust (HT) server having HT processing circuitry and memory configured to exchange trust data with a hardware-trusted set of the NFVI servers, and in response, to maintain hardware trust in the hardware-trusted set of the NFVI servers;
the HT processing circuitry and memory in the HT server configured to exchange NFVI/VNF execution data with the MANO system, and in response, to associate a hardware-trusted set of the VNFs with the hardware-trusted set of the NFVI servers;
a control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers and configured to receive a communication request for a hardware-trusted data communication and responsively select a network bearer that is supported by a data set of the VNFs and indicate the data set of the VNFs to the HT server;
the HT processing circuitry and memory in the HT server configured to determine if the data set of the VNFs is in the hardware-trusted set of the VNFs, and if the data set of the VNFs is in the hardware-trusted set of the VNFs, then to indicate to the control set of the VNFs that the hardware-trusted data communication may proceed; and
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers and configured to direct the data set of the VNFs to proceed with the hardware-trusted data communication responsive to the indication from the HT server, and the data set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers configured to transfer the hardware-trusted data communication over the selected network bearer.
12. The data communication network of claim 11 wherein:
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to receive the communication request for the hardware-trusted communication session by receiving a Radio Resource Control (RRC) hardware-trust indicator from a user communication device; and
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to select the network bearer for the hardware-trusted communication session by identifying an Access Point Name (APN).
13. The data communication network of claim 11 wherein:
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to receive the communication request for the hardware-trusted communication session by receiving a Non-Access Stratum (NAS) hardware-trust indicator from a user communication device; and
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to select the network bearer for the hardware-trusted communication session by identifying an Access Point Name (APN).
14. The data communication network of claim 11 wherein:
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to receive the communication request for the hardware-trusted communication session by receiving a Session Initiation Protocol (SIP) hardware-trust indicator from a user communication device; and
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to select the network bearer for the hardware-trusted communication session by identifying an Access Point Name (APN).
15. The data communication network of claim 11 further comprising:
Software Defined Network (SDN) data machines;
the HT processing circuitry and memory in the HT server configured to exchange additional trust data with a hardware-trusted set of the Software Defined Network (SDN) data machines, and in response, the HT processing circuitry and memory in the HT server configured to maintain hardware trust in the hardware-trusted set of the SDN data machines;
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to indicate a data set of the SDN data machines to the HT server; and
the HT processing circuitry and memory in the HT server configured to determine if the data set of the SDN data machines is in the hardware-trusted set of the SDN data machines and to indicate that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the SDN data machines is in the hardware-trusted set of the SDN data machines.
16. The data communication network of claim 11 further comprising:
wireless relays;
the HT processing circuitry and memory in the HT server configured to exchange additional trust data with a hardware-trusted set of the wireless relays, and in response, the HT processing circuitry and memory in the HT server configured to maintain hardware trust in the hardware-trusted set of the wireless relays;
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to indicate a data set of the wireless relays to the HT server; and
the HT processing circuitry and memory in the HT server configured to determine if the data set of the wireless relays is in the hardware-trusted set of the wireless relays and to indicate that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the wireless relays is in the hardware-trusted set of the wireless relays.
17. The data communication network of claim 11 further comprising:
the HT processing circuitry and memory in the HT server configured to exchange additional trust data with a hardware-trusted set of user communication devices, and in response, the HT processing circuitry and memory in the HT server configured to maintain hardware trust in the hardware-trusted set of the user communication devices;
the control set of the VNFs executing on the NFVI processing circuitry and memory in the NFVI servers are configured to indicate a data set of the user communication devices to the HT server; and
the HT processing circuitry and memory in the HT server configured to determine if the data set of the user communication devices is in the hardware-trusted set of the user communication devices and to indicate that the communication may proceed if both the data set of the VNFs is in the hardware-trusted set of the VNFs and if the data set of the user communication devices is in the hardware-trusted set of the user communication devices.
18. The data communication network of claim 11 wherein the VNFs comprise Long Term Evolution (LTE) VNFs.
19. The data communication network of claim 11 wherein the VNFs comprise Internet Protocol Multimedia Subsystem (IMS) VNFs.
20. The data communication network of claim 11 wherein the VNFs comprise Software Defined Network (SDN) VNFs.