VNF Attestation Quote Correlation for Lifecycle Event Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SEC024-procedure for remote attestation of virtualized network functions (VNFs) does not adequately correlate VNFC instances with VNF lifecycle management events such as instantiation, scaling-out, and healing, leading to potential VNFC instantiation outside the context of these events.
Innovation Solution
A method and mechanism to correlate remote attestation quotes with VNF resource allocation events by using a security manager (SM) to obtain and verify attestation quotes for VNFCs, ensuring they are within the context of legitimate VNF events, involving fingerprinting of VNFC images and utilizing a standard identifier related to VNF instance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If remote attestation is performed for each VNFC independently, then attestation coverage is improved, but correlation with VNF lifecycle events is lost leading to potential instantiation outside legitimate context
Solution Approach 1:
The patent segments the attestation process by introducing distinct attestation identifiers for different VNF lifecycle events (instantiation, scaling-out, healing). Each event type receives a unique identifier that is embedded in the attestation quote, allowing individual VNFCs to be attested while maintaining traceability to their specific lifecycle event context.
Solution Approach 2:
The patent introduces a security manager as an intermediary that correlates attestation quotes with VNF lifecycle events. The security manager receives attestation information from VNFCs and uses the embedded event identifiers to match them with the appropriate lifecycle events, preventing instantiation outside legitimate context while maintaining comprehensive attestation coverage.
2Reliability
If detailed correlation mechanisms are implemented for each VNF event, then security assurance is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by generating and embedding the VNF lifecycle event identifier in the attestation quote before the actual attestation verification occurs. This pre-packaging of contextual information simplifies the correlation process, as the security manager can directly match the embedded identifier with lifecycle events without complex analysis or additional querying.
Solution Approach 2:
The patent changes the parameter representation by using compact event identifiers (e.g., event type codes or hashed identifiers) instead of detailed event descriptions. This parameter transformation maintains the ability to distinguish between different lifecycle events while significantly reducing the complexity of the correlation mechanism and the amount of data that needs to be processed and stored.
Data Source
AI summary
A method, network node and non-transitory computer readable media having stored thereon instructions for correlating a remote attestation quote with a virtualized network function (VNF) resource allocation event. The method comprises obtaining a set of VNF components (VNFCs) that require remote attestation. The method comprises obtaining an attestation quote for each VNFC of the set of VNFCs, the attestation quote ensuring that instances of each VNFC are used in a legitimate context. The method comprises correlating each attestation quote with the VNF resource allocation event.