Network function virtualization (NFV) hardware trust in data communication systems
A Network Function Virtualization (NFV) Management and Orchestration (MANO) data communication system drives an NFV Infrastructure (NFVI) to support a Network Service (NS). The NFV MANO system exchanges hardware trust data with a hardware-trusted subsystem in the NFVI to maintain hardware trust with the NFVI subsystem. The NFV MANO system exchanges NS data with an operations system and responsively exchanges network data to drive the NFVI to execute a Virtual Network Function (VNF) externally to the hardware-trusted subsystem to support the NS. The NFV MANO system also exchanges trust data for the NS with the operations system and responsively exchanges network data with the hardware-trusted subsystem to drive the subsystem to execute the VNF to support the NS.
1. A method of operating a Network Function Virtualization (NFV) Management and Orchestration (MANO) data communication system to drive an NFV Infrastructure (NFVI) to support a Network Service (NS), the method comprising:
the NFV MANO data communication system exchanging hardware trust data with a hardware-trusted subsystem in the NFVI to maintain hardware trust with the hardware-trusted subsystem in the NFVI;
the NFV MANO data communication system exchanging NS operation data with a network operations system over an Os-Nfvo link and responsively exchanging first network data over a first Nf-Vi link to drive the NFVI to execute a Virtual Network Function (VNF) externally to the hardware-trusted subsystem to support the NS; and
the NFV MANO data communication system exchanging trust operation data for the NS with the network operations system over the Os-Nfvo link and responsively exchanging second network data with the hardware-trusted subsystem in the NFVI over a second Nf-Vi link to drive the hardware-trusted subsystem to execute the VNF to support the NS.
2. The method of claim 1 wherein:
the NFV MANO data communication system comprises a first NFV Orchestrator (NFVO) and a second NFVO; and
the first NFVO exchanges the NS operation data and the trust operation data with the network operations system over the Os-Nfvo link and the first NFVO responsively exchanges the trust operation data with the second NFVO over an Os-Os link.
3. The method of claim 2 wherein:
the second NFVO exchanges the second network data with a Virtualized Infrastructure Manager (VIM) over an Or-Vi link; and
the VIM exchanges the second network data with the hardware-trusted subsystem over the second Nf-Vi link.
4. The method of claim 1 wherein:
the hardware-trusted subsystem comprises special processing circuitry that includes a secret hardware-embedded key, encodes data with the secret hardware-embedded key, and transfers the encoded data; and
the NFV MANO data communication system processing the encoded data to derive the secret hardware-embedded key to maintain the hardware trust with the hardware-trusted subsystem.
5. The method of claim 1 wherein the NFV MANO data communication system exchanges the hardware trust data with the hardware-trusted subsystem over the second Nf-Vi link.
6. The method of claim 1 wherein the NFV MANO data communication system comprises a first NFV Orchestrator (NFVO), first Virtual Network Function Manager (VNFM), a second NFVO, and a second VNFM, and further comprising:
the first NFVO exchanging first function data with the first VNFM over a first Or-Vnfm link responsive to the NS operation data and the first VNFM exchanging the first function data with the VNF over a first Ve-Vnfm link to drive the VNF to support the NS externally to the hardware-trusted subsystem;
the first NFVO exchanging the trust operation data with the second NFVO over an Os-Os link; and
the second NFVO exchanging second function data with the second VNFM over a second Or-Vnfm link responsive to the trust operation data and the second VNFM exchanging the second function data with the VNF over a second Ve-Vnfm link to drive the VNF to support the NS in the hardware-trusted subsystem.
7. The method of claim 1 wherein:
the NS comprises a first Long Term Evolution (LTE) Access Point Name (APN) and a second LTE APN;
the VNF executing externally to the hardware-trusted subsystem is accessed with the first APN; and
the VNF executing in the hardware-trusted subsystem is accessed with the second APN.
8. The method of claim 7 wherein the VNF comprises a virtual wireless communication network Base-Band Unit (BBU).
9. The method of claim 7 wherein the VNF comprises a virtual Packet Data Network Gateway (P-GW).
10. The method of claim 7 wherein the VNF comprises a virtual User Equipment (UE) application.
11. The method of claim 7 wherein the VNF comprises a virtual wireless communication network Base-Band Unit (BBU).
12. A Network Function Virtualization (NFV) Management and Orchestration (MANO) data communication system to drive an NFV Infrastructure (NFVI) to support a Network Service (NS), the NFV MANO data communication system comprising:
NFV MANO computer circuitry configured to exchange hardware trust data with a hardware-trusted subsystem in the NFVI to maintain hardware trust with the hardware-trusted subsystem in the NFVI;
NFV NS computer circuitry configured to exchange NS operation data with a network operations system over an Os-Nfvo link;
the NFV MANO computer circuitry configured to responsively exchange first network data over a first Nf-Vi link to drive the NFVI to execute a Virtual Network Function (VNF) externally to the hardware-trusted subsystem to support the NS; and
the NFV NS computer circuitry configured to exchange trust operation data for the NS with the network operations system over the Os-Nfvo link and responsively exchange second network data with the hardware-trusted subsystem in the NFVI over a second Nf-Vi link to drive the hardware-trusted subsystem to execute the VNF to support the NS.
13. The NFV MANO data communication system of claim 12 wherein:
the NFV NS computer circuitry comprises a first NFV Orchestrator (NFVO) and a second NFVO; and
the first NFVO is configured to exchange the NS operation data and the trust operation data with the network operations system over the Os-Nfvo link and the first NFVO is configured to responsively exchange the trust operation data with the second NFVO over an Os-Os link.
14. The NFV MANO data communication system of claim 13 wherein:
the second NFVO is configured to exchange the second network data with a Virtualized Infrastructure Manager (VIM) over an Or-Vi link; and
the VIM is configured to exchange the second network data with the hardware-trusted subsystem over the second Nf-Vi link.
15. The NFV MANO data communication system of claim 12 wherein:
the hardware-trusted subsystem comprises special processing circuitry that includes a secret hardware-embedded key and is configured to encode data with the secret hardware-embedded key and transfer the encoded data; and
the NFV MANO computer circuitry is configured to process the encoded data to derive the secret hardware-embedded key to maintain the hardware trust with the hardware-trusted subsystem.
16. The NFV MANO data communication system of claim 12 wherein the NFV MANO computer circuitry is configured to exchange the hardware trust data with the hardware-trusted subsystem over the second Nf-Vi link.
17. The NFV MANO data communication system of claim 12 wherein the NFV MANO data communication system comprises a first NFV Orchestrator (NFVO), first Virtual Network Function Manager (VNFM), a second NFVO, and a second VNFM, and further comprising:
the first NFVO is configured to exchange first function data with the first VNFM over a first Or-Vnfm link responsive to the NS operation data, and the first VNFM is configured to exchange the first function data with the VNF over a first Ve-Vnfm link to drive the VNF to support the NS externally to the hardware-trusted subsystem;
the first NFVO is configured to exchange the trust operation data with the second NFVO over an Os-Os link; and
the second NFVO is configured to exchange second function data with the second VNFM over a second Or-Vnfm link responsive to the trust operation data, and the second VNFM is configured to exchange the second function data with the VNF over a second Ve-Vnfm link to drive the VNF to support the NS in the hardware-trusted subsystem.
18. The NFV MANO data communication system of claim 12 wherein:
the NS comprises a first Long Term Evolution (LTE) Access Point Name (APN) and a second LTE APN;
the VNF executing externally to the hardware-trusted subsystem is accessed with the first APN; and
the VNF executing in the hardware-trusted subsystem is accessed with the second APN.
19. The NFV MANO data communication system of claim 18 wherein the VNF comprises a virtual Packet Data Network Gateway (P-GW).
20. The NFV MANO data communication system of claim 18 wherein the VNF comprises a virtual User Equipment (UE) application.