Hardware-Mediated Execution Enclave for Secure VNFC Instantiation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for creating virtualized network function instances (VNFI) lack adequate security measures to protect sensitive virtualized network function components (VNFCs) from unauthorized access and tampering.
Innovation Solution
The method involves generating a private-public key pair by a hardware-mediated execution enclave (HMEE) within the NFV system, encrypting a security credential for the VNFC using the public key, and decrypting it within the secure execution environment provided by the HMEE, ensuring that only authorized entities can access and install the sensitive VNFC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security credentials are transmitted in plain text during VNFC installation, then the installation process is simple and fast, but the security of sensitive VNFCs is compromised
Solution Approach 1:
The patent introduces a hardware-mediated execution enclave (HMEE) as an intermediary secure environment between the security control device and the VNFC installation process. The HMEE acts as a trusted mediator that receives encrypted credentials, decrypts them securely, and facilitates installation without exposing sensitive data to external systems. This resolves the contradiction by adding a specialized intermediary component that enables secure credential handling while maintaining installation simplicity.
Solution Approach 2:
The patent replaces the traditional mechanical transmission of security credentials with cryptographic encryption mechanisms. Instead of transmitting credentials in plain text, the system uses public-key encryption where the security control device encrypts credentials using the HMEE's public key, and the HMEE decrypts them using its private key. This substitution of mechanical transmission with cryptographic mechanisms resolves the security simplicity contradiction.
2Reliability
If the private key is stored externally for credential decryption, then the decryption process is accessible to multiple systems, but the security and confidentiality of the private key is reduced
Solution Approach 1:
The patent segments the decryption function within the hardware-mediated execution enclave, separating the private key storage and decryption operations from the external system. The HMEE contains the private key internally and provides decryption as a contained operation, while the external system only accesses encrypted credentials. This segmentation maintains key confidentiality while allowing controlled decryption access through the enclave's interface.
Solution Approach 2:
The HMEE provides self-service decryption functionality where the enclave itself handles the decryption operation using its internally stored private key without requiring external access to the key material. The security control device sends encrypted credentials to the HMEE, and the HMEE autonomously decrypts them using its private key, then returns the decrypted credentials to the installation process. This self-service mechanism maintains key confidentiality while enabling ease of operation.
3Reliability
If the installation process of sensitive VNFC is made visible to external systems, then the installation can be monitored and controlled, but the security and integrity of the installation process is compromised
Solution Approach 1:
The patent implements a nested structure where the installation process of the sensitive VNFC is nested within the hardware-mediated execution enclave. The HMEE contains the installation process internally, isolating it from external observation and modification. The enclave provides a contained environment where credentials are decrypted and installation occurs, while the external system only sees the encrypted credential transmission and the final installation result, not the intermediate processes. This nesting maintains integrity while managing complexity.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
This application provides a method and an apparatus for creating a virtualized network function instance VNFI, to ensure security of a virtualized network function component VNFC. The method includes: generating, by a hardware-mediated execution enclave HMEE in a network functions virtualization NFV system, a private-public key pair, where a to-be-instantiated VNFI is deployed in the NFV system, and the HMEE and a to-be-instantiated first virtualized network function component VNFC are deployed in the VNFI; sending, by the HMEE, a public key in the private-public key pair to a security control device; receiving, by the HMEE, an encrypted security credential from the security control device, where the encrypted security credential is obtained by encrypting a security credential of a package of the first VNFC based on the public key, and the security credential is used to decrypt the package of the first VNFC; and decrypting, by the HMEE, the encrypted security credential based on a private key in the private-public key pair, to obtain the security credential.