Abstract: Provided are a method, system, and computer-readable recording medium for registering a node in a zero trust remote access system. The method includes: receiving a request to subscribe a node to a zero trust remote access system for a network; generating a subscription identification (ID) for the node based on one or more parameters of the node; configuring the node with security logging; initiating a service of the node based on a trust percentage calculated for the node according to a security configuration of the node; and receiving security logs from the node based on the configured security logging.

Abstract: Provided are a method, system, and computer-readable recording medium for controlling zero trust remote access to a network system. The method includes: receiving a request of a user to access a target node in the network system; determining whether the user is a trusted user or an untrusted user based on whether the user has a subscription identification (ID) registered and valid in the network system; based on determining that the user is the untrusted user, generating the subscription ID for the user; validating a trust of the user; determining a validity period for the subscription ID of the user based on the validated trust; and providing the user with access to the target node in accordance with the validity period.

Abstract: A network function virtualization system, comprises a request receiving unit that receives a request to a certificate of at least one of data exchanging parties; a private key generator that generates a first private key information using a second private key information stored in a hardware-based isolated secure execution environment, in response to the request; a public key extractor that extracts a public key information of the first private key information; a public key information storage unit that stores the public key information; and a verifying unit that is accessible from the request receiving unit and verifies the certificate using the public key information corresponding to the certificate.

Abstract: A VNF package signing system, comprises an orchestration unit sending an acknowledge of receiving a VNF package including the VNF image, in response to the receiving the VNF package from a sender, a storage unit storing the VNF package and generating a certificate for the VNF package using a private key for at least generating a certificate for signing the VNF package and a HISEE (Hardware Isolated Secured Execution Environment) unit providing the private key in response to the request from the storage unit. The orchestration unit sends the acknowledge of receiving a VNF package when the storage unit successes generating the certificate of the VNF package.

Abstract: A VNF package signing system, comprises an orchestration unit sending an acknowledge of receiving a VNF package including the VNF image, in response to the receiving the VNF package from a sender, a storage unit storing the VNF package and generating a certificate for the VNF package using a private key for at least generating a certificate for signing the VNF package and a HISEE (Hardware Isolated Secured Execution Environment) unit providing the private key in response to the request from the storage unit. The orchestration unit sends the acknowledge of receiving a VNF package when the storage unit successes generating the certificate of the VNF package.

Abstract: A network function virtualization system, comprises a request receiving unit that receives a request to a certificate of at least one of data exchanging parties; a private key generator that generates a first private key information using a second private key information stored in a hardware-based isolated secure execution environment, in response to the request; a public key extractor that extracts a public key information of the first private key information; a public key information storage unit that stores the public key information; and a verifying unit that is accessible from the request receiving unit and verifies the certificate using the public key information corresponding to the certificate.

Abstract: A method and system of authenticating a network device includes providing identification information of a first network device to a second network device and a third network device. The identification information includes location information of the first network device and a timestamp. The method includes verifying the location information of the first network device by a hyperbolic verification scheme. The verification is performed by the second network device and the third network device. The method includes authenticating the first network device based on the verification.

Abstract: A method and system of authenticating a network device includes providing identification information of a first network device to a second network device and a third network device. The identification information includes location information of the first network device and a timestamp. The method includes verifying the location information of the first network device by a hyberbolic verification scheme. The verification is performed by the second network device and the third network device. The method includes authenticating the first network device based on the verification.