NFV Orchestrator Security via Trusted DNS and Disposable Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems in network function virtualization (NFV) core networks face security vulnerabilities, particularly in unsecured communication links, which can lead to tampering and intrusion, hindering the adoption of new applications and services.
Innovation Solution
Implementing a method that dynamically increases NFV processing capacity, using a one-time-use domain name for secure DNS lookups, and establishing trusted communication channels with hardware-assisted security to prevent exposure of IP addresses and mitigate denial-of-service attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP addresses are exposed in DNS lookups and HTTP responses, then communication routing is enabled, but security is compromised due to packet sniffing and denial-of-service attacks
Solution Approach 1:
The patent introduces a trusted DNS server as an intermediary between the UE and content servers. This server performs DNS lookups on behalf of the UE and returns only domain names without exposing IP addresses. The trusted orchestrator service further mediates HTTP responses to prevent content source identification, creating layered intermediary protection against packet sniffing and DoS attacks while maintaining communication functionality.
Solution Approach 2:
The patent employs one-time-use domain names that are dynamically generated for each DNS lookup request. These temporary domain names expire after single use, preventing replay attacks and long-term tracking. This disposable approach to domain name resolution enhances security by ensuring that intercepted communications cannot be reused or traced back to permanent identifiers.
2Reliability
If NFV processing capacity is increased to handle communication loads, then service reliability is improved, but system complexity increases
Solution Approach 1:
The trusted orchestrator service performs multiple functions within a single component: it manages NFV resource allocation, enforces security policies, generates one-time domain names, and controls HTTP response filtering. This multi-functional approach consolidates complexity into a centralized management plane rather than distributing it across multiple specialized components, making the system more manageable while maintaining enhanced processing capacity.
3Ease of operation
If unsecured communication links are used, then ease of operation is improved, but security is compromised due to tampering and intrusion
Solution Approach 1:
The patent extracts security-critical functions (DNS resolution, HTTP response filtering, trust verification) from the general communication path and places them in a dedicated trusted security zone. This separation allows the majority of communication to proceed through simple unsecured channels while isolating only the essential security functions in a protected environment, maintaining ease of operation for standard communications while ensuring security for critical operations.
Data Source
AI summary
A method of electronic communication via a virtual network function (NFV) implementation of a core network. The method comprises receiving a hypertext transfer protocol (HTTP) content request from a user equipment (UE), wherein the HTTP content request comprises an identification of a content source and determining by an orchestrator service that insufficient NFV processing capacity is available to perform the HTTP content request, where the orchestrator service is an application that executes on a first physical host. The method further comprises dynamically increasing the NFV processing capacity by the orchestrator service, performing the HTTP content request using the increased NFV processing capacity, and returning a HTTP content response to the UE, wherein the HTTP content response does not comprise identification of the content source.