System and methods for transit path security assured network slices
Systems and methods of configuring, managing and ensuring security compliance of Virtual Network Slices that transit through physical networks, virtual networks (SDN), cloud networks, radio access networks, service provider networks, and enterprise networks are identified. The methods include user side security validation methods while attempting to use a network slice for a specific service, and security validation of physical or virtual networks and the associated transit network elements. The methods disclose enriching the Security Certificates with policy parameters and the associated procedures that transit elements are required to assure for security compliance. Additionally, methods for incorporating a mobile native security platform in Wireless Mobile Network (4G/5G) that supports generating X.509 Certificates enhanced with policy requirements, validating allowed/disallowed list of transit network vendor devices, virtual network appliances are identified.
1. A method of defining a secure network slice in a multi-domain network, comprising:
incorporating an enhanced digital certificate into a plurality of network devices in the multi-domain network, wherein the enhanced digital certificate comprises metadata regarding a provenance of the network device;
determining one or more forwarding paths through the network that connect two endpoints;
querying each network device along each of the one or more forwarding paths to determine if each network device comprises the enhanced digital certificate; and
defining the secure network slice as a forwarding path between the two endpoints wherein each network device in the forwarding path has an enhanced digital certificate having desired parameters.
2. The method of claim 1 , wherein the multi-domain network comprises at least one of an enterprise network, a cloud provider, a communications service provider, a SDN, physical/virtual network segment, a 5G radio access network and a 5G core network.
3. The method of claim 1 , wherein the metadata is selected from the group consisting: hardware or software make;
hardware or software model or release; a region where the network device is manufactured; and a location where the network device is manufactured.
4. The method of claim 2 , wherein an Operation Management Platform (OMP) is employed by the service provider for a network domain, and the OMP provides access to the enhanced digital certificates of network devices disposed in the network domain.
5. The method of claim 2 , wherein an Operation Management Platform (OMP) is employed by the service provider for a network domain, the OMP creates a forwarding path in the network domain using only network devices that have the enhanced digital certificate, and wherein the forwarding path created by the OMP is used to create the secure network slice.
6. The method of claim 5 , wherein a second OMP is employed by a second service provider for a second network domain, and wherein the second OMP creates a forwarding path in the second network domain using only network devices that have the enhanced digital certificate, and wherein the forwarding path from the second OMP is combined with the forwarding path from the service provider to create the secure network slice.
7. The method of claim 1 , wherein the desired parameters comprise that the network device was manufactured in one of a selected group of countries.
8. The method of claim 1 , wherein one of a plurality of security levels is supported by the secure network slice.
9. The method of claim 8 , wherein a first security level requires each network device comprise an enhanced digital certificate indicating that the network device was manufactured in one of a selected group of countries.
10. The method of claim 9 , wherein a second security level requires all limitation of the first security level and also disables port mirroring and flooding.
11. The method of claim 10 , wherein a third security level requires all limitations of the second security level and forces a specific forwarding path, such that upon interface failures, traffic is not redirected or redirected to an alternative path that is not validated.
12. The method of claim 1 , wherein the enhanced digital certificates of the network devices disposed in the secure network slice are revalidated periodically.
13. The method of claim 1 , wherein each of the network devices in the secure network slice restricts its usable interfaces to only those interfaces that are in communication with other network devices having an enhanced digital certificate having the desired parameters.
14. The method of claim 1 , wherein the network devices comprise hardware and software components.