Network management
According to an example aspect of the present invention, there is provided an apparatus comprising memory configured to store information characterizing at least one run-time behavioural pattern, at least one processing core configured to perform a behavioural determination based at least partly on the stored information, concerning a network node, and to verify, as a response to a result of the behavioural determination, whether the network node is comprised on a list of valid network nodes.
1. An apparatus comprising:
memory configured to store information characterizing at least one run-time behavioural pattern; and
at least one processing core configured to:
perform a behavioural determination based at least partly on the stored information, concerning a network node, and
verify, as a response to a result of the behavioural determination, whether the network node is comprised on a list of valid network nodes, wherein:
the network node is a virtualized network function or component of a virtualized network function that comprises a software implementation of a logical network node of a communication network; and
the run-time behavioural pattern comprises at least one of the following patterns:
an increase in CPU load combined with a decrease in capability of the network node;
an increase in memory usage with no concurrent increase in communications throughput;
an increase in outgoing traffic from the network node with no corresponding increase in ingoing traffic; and
the network node is instantiated and active without being comprised in the list; and
determine, based on the behavioural determination, whether the network node is a legal but hidden node or a spurious node.
2. The apparatus according to claim 1 , wherein the at least one processing core is configured to verify the network node has a valid credential.
3. The apparatus according to claim 1 , wherein the at least one processing core is configured to verify whether the network node has valid credentials automatically, without user intervention, as a response to the result of the behavioural determination.
4. The apparatus according to claim 1 , wherein performing the behavioural determination comprises requesting run-time information from a computational substrate running the network node.
5. The apparatus according to claim 1 wherein verifying whether the network node has a valid credential comprises obtaining the credential of the network node and querying, from a verification function, whether the credential is valid.
6. The apparatus according to claim 5 , wherein the verification function comprises a node or function that is in possession of a list of valid credentials.
7. The apparatus according to claim 1 , wherein the credential comprises at least one of the following: a hash of at least part of an execution environment of the network node, a public key of the network node, a private key of the network node, a static feature in data relating to the network node and a cryptographic token.
8. The apparatus according to claim 1 , wherein verifying whether the network node has a valid credential comprises transmitting a signature request to the network node, obtaining in response from the node a cryptographic signature and causing verifying the cryptographic signature is correct.
9. The apparatus according to claim 8 , wherein the signature request comprises a token for the network node to sign, using its private key.
10. A method comprising:
storing information characterizing at least one run-time behavioural pattern;
performing a behavioural determination based at least partly on the stored information, concerning a network node;
verifying, as a response to a result of the behavioural determination, whether the network node is comprised on a list of valid network nodes, wherein:
the network node is a virtualized network function or component of a virtualized network function that comprises a software implementation of a logical network node of a communication network; and
the run-time behavioural pattern comprises at least one of the following patterns:
an increase in CPU load combined with a decrease in capability of the network node;
an increase in memory usage with no concurrent increase in communications throughput;
an increase in outgoing traffic from the network node with no corresponding increase in ingoing traffic; and
the network node is instantiated and active without being comprised in the list; and
determining, based on the behavioural determination, whether the network node is a legal but hidden node or a spurious node.
11. The method according to claim 10 , further comprising verifying the network node has a valid credential.
12. The method according to claim 10 , wherein the verifying whether the network node has valid credentials is performed automatically, without user intervention, as a response to the result of the behavioural determination.
13. The method according to claim 10 , wherein performing the behavioural determination comprises requesting run-time information from a computational substrate running the network node.
14. The method according to claim 10 , wherein verifying whether the network node has a valid credential comprises obtaining the credential of the network node and querying, from a verification function, whether the credential is valid.
15. The method according to claim 14 , wherein the verification function comprises a node or function that is in possession of a list of valid credentials.
16. The method according to claim 10 , wherein the credential comprises at least one of the following: a hash of at least part of an execution environment of the network node, a public key of the network node, a private key of the network node, a static feature in data relating to the network node and a cryptographic token.
17. The method according to claim 10 , wherein verifying whether the network node has a valid credential comprises transmitting a signature request to the network node, obtaining in response from the node a cryptographic signature and causing verifying the cryptographic signature is correct.
18. The method according to claim 17 , wherein the signature request comprises a token for the network node to sign, using its private key.
19. An apparatus, comprising:
memory configured to store information characterizing at least one run-time behavioural pattern; and
at least one processing core configured to:
perform a behavioural determination based at least partly on the stored information, concerning a network node, and
cause termination of the network node responsive to a result of the behavioural determination, wherein:
the network node is a virtualized network function or component of a virtualized network function that comprises a software implementation of a logical network node of a communication network; and
the run-time behavioural pattern comprises at least one of the following patterns:
an increase in CPU load combined with a decrease in capability of the network node;
an increase in memory usage with no concurrent increase in communications throughput;
an increase in outgoing traffic from the network node with no corresponding increase in ingoing traffic; and
the network node is instantiated and active without being comprised in the list; and
determine, based on the behavioural determination, whether the network node is a legal but hidden node or a spurious node.
20. The apparatus according to claim 19 , wherein the at least one processing core is configured to verify the network node is comprised on a list of valid network nodes.
21. The apparatus according to claim 20 , wherein the at least one processing core is configured to verify the network node has a valid credential, and to cause the termination also in case the network node has a valid credential and is comprised on the list of valid network nodes.
22. The apparatus according to claim 19 , wherein the apparatus is configured to determine the run-time behavioural pattern based on run-time observation of the network node.
23. A method, comprising:
storing information characterizing at least one run-time behavioural pattern;
performing a behavioural determination based at least partly on the stored information, concerning a network node, wherein:
the network node is a virtualized network function or component of a virtualized network function that comprises a software implementation of a logical network node of a communication network; and
the run-time behavioural pattern comprises at least one of the following patterns:
an increase in CPU load combined with a decrease in capability of the network node;
an increase in memory usage with no concurrent increase in communications throughput;
an increase in outgoing traffic from the network node with no corresponding increase in ingoing traffic; and
the network node is instantiated and active without being comprised in the list;
causing termination of the network node responsive to a result of the behavioural determination; and
determining, based on the behavioural determination, whether the network node is a legal but hidden node or a spurious node.
24. The method according to claim 23 , further comprising verifying the network node is comprised on a list of valid network nodes.
25. The method according to claim 24 , further comprising verifying the network node has a valid credential, wherein the termination is caused also in case the network node has a valid credential and is comprised on the list of valid network nodes.
26. The method according to claim 23 , further comprising determining the run-time behavioural pattern based on run-time observation of the network node.