NFV CPU Hardware Trust Validation for Secure Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-core CPUs with System-on-a-Chip (SOC) and Network-on-a-Chip (NOC) cores do not effectively and efficiently provide hardware-trusted communications to Network Function Virtualization (NFV) Virtual Network Functions (VNFs, as they lack robust verification mechanisms for ensuring the integrity and trustworthiness of data exchanges.
Innovation Solution
Implementing a hardware trust system within NFV CPUs, where a network core validates hardware trust certificates from external circuitry and blocks untrusted data transfers, using a hardware trust controller to hash and verify read-only hardware identifiers, and distributing trust data to maintain secure communication between SOC and NOC cores, ensuring accurate execution of VNFs during specific hypervisor or operating system states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware trust verification is implemented in NFV CPUs, then security and reliability of data communication is improved, but device complexity increases
Solution Approach 1:
The NFV CPU is divided into distinct cores with specialized functions: system cores execute VNFs while network cores handle data transfer and trust verification. This segmentation allows security functions to be isolated in dedicated network cores without complicating the VNF execution logic in system cores, thereby improving reliability while managing device complexity through functional separation.
Solution Approach 2:
A hardware trust verification mechanism acts as an intermediary between the network core and external circuitry. The network core validates hardware trust certificates from external devices before allowing data transfers, serving as a security mediator that prevents untrusted data from entering the NFV system. This intermediary approach enhances security without requiring complex security logic in every core.
2Reliability
If hardware trust certificates are validated for every data transfer, then data communication security is improved, but processing time increases
Solution Approach 1:
Hardware trust certificates are validated in advance before data transfers are initiated. The network core performs trust verification on external circuitry beforehand, establishing trusted communication channels prior to data exchange. This preliminary validation ensures security is established upfront, allowing subsequent data transfers to proceed efficiently without repeated verification delays.
Solution Approach 2:
The network core autonomously performs hardware trust certificate validation without requiring intervention from system cores or external controllers. By self-managing the security verification process, the network core eliminates additional processing steps that would otherwise be required, maintaining security while minimizing time loss through automated self-verification.
3Reliability
If untrusted data transfers are blocked, then system security is improved, but productivity of data communication decreases
Solution Approach 1:
The network core serves as an intermediary that intelligently filters data transfers based on hardware trust validation. Rather than blocking all external communication, it selectively permits transfers from trusted sources while blocking only untrusted data. This mediated approach maintains system security through targeted blocking rather than blanket restrictions, preserving productivity by allowing legitimate data communication to proceed uninterrupted.
Solution Approach 2:
Security trust validation is applied locally at the point of data transfer in the network core, rather than imposing system-wide restrictions. Each data transfer is evaluated individually based on the specific external circuitry's trust status. This localized security enforcement blocks only the specific untrusted transfers needed for security while allowing other productive communications to continue, minimizing the impact on overall data communication productivity.
Data Source
AI summary
A Network Function Virtualization (NFV) Central Processing Unit (CPU) comprises a network core and a system core. The network core receives and validating hardware trust certificates from external circuitry that obtains the hardware trust certificates using a read-only hardware trust identifier that is physically-embedded in the external circuitry. The system core executing an NFV Virtual Network Function Component (VNFC) and generating VNFC data for the external circuitry. The system core calls an Application Programming Interface (API) for a hardware trusted communication with the external circuitry and transfers the VNFC data to the network core. In response to the API call, the network core transfers the VNFC data to the external circuitry when the network core successfully validates the hardware trust certificates from the external circuitry. The network core blocks the user data when the network core did not successfully validate the hardware trust certificates from the external circuitry.