Domain name system security extension (DNSSEC) for container signature management
A method, system and apparatus are disclosed. According to one or more embodiments, a verifier is provided. The verifier includes processing circuitry configured to obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image, determine an identifier for the VNF image based at least on the hash algorithm and the FQDN, perform domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request, and perform validation of the VNF image in response to successful DNSSEC resolution.
1. A verifier, comprising:
processing circuitry configured to:
obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image;
determine an identifier for the VNF image based at least on the hash algorithm and the FQDN;
perform domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request; and
perform validation of the VNF image in response to successful DNSSEC resolution.
2. The verifier of claim 1 , wherein the DNSSEC resolution is successful based at least on the at least one requested attribute of the VNF image being received and the response associated with the request being validated; and
the DNSSEC resolution is unsuccessful based at least on a proof of non-existence of the at least one requested attribute of the VNF image being received in response to the request.
3. The verifier of claim 1 , wherein the processing circuitry is further configured to receive a manifest including the VNF image; and
the performing of validation of the VNF image includes:
determining at least one attribute of the VNF image based at least on the manifest; and
comparing the determined at least one attribute of the VNF image to the requested at least one attribute of the VNF image.
4. The verifier of claim 1 , wherein the at least one attribute includes a content type and a hash of the VNF image.
5. The verifier of claim 1 , wherein the processing circuitry is further configured to instantiate the VNF image based at least on successful validation of the VNF image.
6. The verifier of claim 1 , wherein the response includes a DNSSEC signature; and
the processing circuitry configured to validate the DNSSEC signature at least in part by checking a chain of trust up to a root zone.
7. The verifier of claim 1 , wherein the obtaining includes receiving a manifest and extracting at least one of the hash algorithm and the FQDN.
8. The verifier of claim 1 , wherein the obtaining is based on a pre-configuration of the hash algorithm and the FQDN for performing the DNSSEC resolution and the validation of the VNF image.
9. A signer, comprising:
processing circuitry configured to:
obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image;
determine an identifier for the VNF image based at least on the hash algorithm and the FQDN;
determine at least one attribute of the VNF image;
store the identifier for the VNF image and the at least one attribute of the VNF image;
receive a request for at least one attribute of the VNF image for validation, the request being based on the identifier for the VNF image; and
respond to the request for the at least one attribute of the VNF image, the response being part of a domain name system security extensions, DNSSEC, resolution of the identifier of the VNF image.
10. The signer of claim 9 , wherein the response includes one of:
the at least one requested attribute of the VNF image; and
an indication of a proof of non-existence of the at least one requested attribute of the VNF image.
11. The signer of claim 9 , wherein the storing includes inserting the identifier for the VNF and the at least one attribute of the VNF image in a zone; and
the processing circuitry being further configured to sign the zone with a zone signing key to generate at least one DNSSEC signature, a delegation of the zone being provided by DNSSEC until a root zone, the root zone being a trusted zone from which a chain of trust is built.
12. The signer of claim 11 , wherein the response includes the DNSSEC signature.
13. The signer of claim 9 , wherein the at least one attribute of the VNF image includes a content type and a hash of the VNF image.
14. The signer of claim 9 , wherein the obtaining includes receiving a manifest and extracting at least one of the hash algorithm and the FQDN.
15. The signer of claim 9 , wherein the obtaining is based on a pre-configuration of the hash algorithm and the FQDN for performing the DNSSEC resolution and the validation of the VNF image.
16. A method implemented by a verifier, the method comprising:
obtaining a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image;
determining an identifier for the VNF image based at least on the hash algorithm and the FQDN;
performing domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request; and
performing validation of the VNF image in response to successful DNSSEC resolution.
17. The method of claim 16 , wherein the DNSSEC resolution is successful based at least on the at least one requested attribute of the VNF image being received and the response associated with the request being validated; and
the DNSSEC resolution is unsuccessful based at least on a proof of non-existence of the at least one requested attribute of the VNF image being received in response to the request.
18. The method of claim 16 , further comprising receiving a manifest including the VNF image; and
the performing of validation of the VNF image includes:
determining at least one attribute of the VNF image based at least on the manifest; and
comparing the determined at least one attribute of the VNF image to the requested at least one attribute of the VNF image.
19. The method of claim 16 , wherein the at least one attribute includes a content type and a hash of the VNF image.
20. The method of claim 16 , further comprising instantiating the VNF image based at least on successful validation of the VNF image.
21. The method of claim 16 , wherein the response includes a DNSSEC signature; and
the method further comprising validating the DNSSEC signature at least in part by checking a chain of trust up to a root zone.
22. The method of claim 16 , wherein the obtaining includes receiving a manifest and extracting at least one of the hash algorithm and the FQDN.
23. The method of claim 16 , wherein the obtaining is based on a pre-configuration of the hash algorithm and the FQDN for performing the DNSSEC resolution and the validation of the VNF image.
24. A method implemented by a signer, the method comprising:
obtaining a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image;
determining an identifier for the VNF image based at least on the hash algorithm and the FQDN;
determining at least one attribute of the VNF image;
storing the identifier for the VNF image and the at least one attribute of the VNF image;
receiving a request for at least one attribute of the VNF image for validation, the request being based on the identifier for the VNF image; and
responding to the request for the at least one attribute of the VNF image, the response being part of a domain name system security extensions, DNSSEC, resolution of the identifier of the VNF image.
25. The method of claim 24 , wherein the response includes one of:
the at least one requested attribute of the VNF image; and
an indication of a proof of non-existence of the at least one requested attribute of the VNF image.
26. The method of claim 24 , wherein the storing includes inserting the identifier for the VNF and the at least one attribute of the VNF image in a zone; and
the method further comprising signing the zone with a zone signing key to generate at least one DNSSEC signature, a delegation of the zone being provided by DNSSEC until a root zone, the root zone being a trusted zone from which a chain of trust is built.
27. The method of claim 26 , wherein the response includes the DNSSEC signature.
28. The method of claim 24 , wherein the at least one attribute of the VNF image includes a content type and a hash of the VNF image.
29. The method of claim 24 , wherein the obtaining includes receiving a manifest and extracting at least one of the hash algorithm and the FQDN.
30. The method of claim 24 , wherein the obtaining is based on a pre-configuration of the hash algorithm and the FQDN for performing the DNSSEC resolution and the validation of the VNF image.