Digital trust broker and end to end trust assurance in multi-domain, multi-operator and cloud networks for high security environments
System and methods of brokering trust across multiple Authentication and Authorization methods in a multi-domain, multi-operator, private and public cloud networks are identified. A Digital Trust Broker (DTB) is disclosed that brokers trust between infrastructure authentication methods that use digital certificates (PKI) and operator/enterprise Authentication/Authorization methods through interaction with multiple operator/service provider control and management platforms. The Digital Trust Broker interacts with vendor management and security platforms for associating device manufacturing, assembly, supply-chain, and logistics attributes for assuring trust of compute, network, storage and other system components that a high security enterprise or service provider acquires and installs in their networks. Additionally, methods of generating enhanced certificates for secure network slices and other Cloud and SDN hosted virtual network functions as trust assured services are also disclosed.
1. A method of incorporating security, trust and other policy requirements that include provenance and other metadata policy attributes for a network that includes a plurality of physical and virtual network functions (VNFs) that offer a service, the method comprising:
embedding required policy attributes in an enhanced digital certificate (eDC) in one or more VNF; and
using the eDC to validate before, during and after use of the service;
wherein the VNFs include physical or virtual elements that process, store, or transport data in virtual or physical network environments, wherein the virtual or physical network environments are enterprise data centers, Software Defined Networks, public/private/hybrid Clouds, Wireless operator networks and/or Wireline operator networks.
2. The method of claim 1 , wherein the service comprises an end-to-end secure network slice (SNS) through a multi-domain, multi-operator network; wherein the policy attributes dictate the provenance data, other policy and configuration data for each type of network element and the types of functions performed by the network element, wherein the eDC is referred to as a slice certificate, and wherein the slice certificate determines the policy attributes.
3. The method of claim 2 , wherein the metadata for the virtual network function includes provenance data, geolocation for each type of device/function and configurable features that each network element (NE) involved in providing the service or network slice required to support and the configuration attributes of the device feature while in operation.
4. The method of claim 2 , wherein the slice certificate is incorporated in end points that terminate the SNS.
5. The method of claim 2 , wherein the SNS is constructed by joining multiple secure network slices where each secure network slice includes a slice certificate that corresponds to a segment of the SNS in each transit operator or service provider network.
6. The method of claim 1 , wherein the service corresponds to a physical or virtual distributed function, wherein the function is a database service, an application service, a proxy service, or a network service, that interconnects two different networks with different security domains, and the eDC is referred to as a service certificate and wherein the service certificate is used to orchestrate the service.
7. The method of claim 6 , wherein the service that the service certificate orchestrates corresponds to a virtual network function that is implemented over a distributed system and is incorporated in the virtual/physical nodes that offer the service to clients or manage the service.
8. The method of claim 6 , wherein a Digital Trust Broker interacts with a plurality of management platforms in service provider networks to assure security and trust policies orchestrated by the service certificate, at a granularity of resources and frequency according to policies defined by the service certificate.
9. The method of claim 1 , the service comprises multiple classes of security levels, where each security level orchestrates policy attributes for the specific security level.
10. The method of claim 1 , wherein the policy attributes include authorization for types of accesses while using the service, and/or provenance and metadata attributes for transit physical/virtual network elements that offer the service.
11. A method of facilitating supply chain tracking of a device for high security and trust assurance from manufacturing location to a service provider or enterprise procurement locations, the method comprising:
creating an enhanced Digital Certificate (eDC) for the device, wherein the eDC contains supply chain data;
incorporating additional human and/or machine-readable identifiers which are readable while the device is powered off; and
using the supply chain data in the eDC to validate and assure that the device only traversed through trusted vendors, trusted locations and trusted regions before, during and/or after the device is used in processing highly sensitive data.
12. The method of claim 11 , wherein the additional human and/or machine-readable identifiers comprises a Manufacturing Vendor name, a Vendor location, a Model Name, a Model Number, a MAC address, a bar code, a QR Code, and/or a RFID tag.
13. The method of claim 11 , further comprising: interacting with a plurality of vendor systems involved in the device shipment from manufacturing location to the service provider or enterprise procurement locations.
14. The method of claim 11 , wherein the supply chain data is onboarded as allowed transit paths into the enhanced digital certificate so that the eDC serves to orchestrate allowed transit vendors and their locations.
15. The method of claim 11 , further comprising: using a Digital Trust Broker (DTB) that bridges trust between multiple authorization and authentication systems for validating supply chain attributes.