基于TPM的Kubernetes上5G VNF的持续远程证明与完整性验证
TPM-Based Continuous Remote Attestation and Integrity Verification for 5G VNFs on Kubernetes
AI总结：
针对5G云化部署中VNF运行时完整性验证缺失的问题，提出基于TPM 2.0与IMA、结合Keylime框架的Kubernetes Pod级持续远程证明方案，经k3s集群实验验证可实时检测篡改并增强5G基础设施安全性。
摘要：
在5G技术快速发展的格局下，采用云基础设施部署5G服务已日益普遍。借助基于服务的架构，接入与移动性管理功能（AMF）、会话管理功能（SMF）、用户面功能（UPF）等关键5G组件如今以容器化Pod的形式运行在Kubernetes集群上。尽管这种方式提升了可扩展性、灵活性与弹性，但也带来了新的安全挑战，尤其是如何确保这些组件的完整性与可信性。当前的5G安全规范（例如3GPP TS 33.501）聚焦于通信安全，假设网络功能在认证后始终可信，因此缺乏在运行时持续验证VNF完整性的机制。为填补这一空白，并契合“永不信任，始终验证”的零信任原则，我们提出了一种基于TPM 2.0的持续远程证明方案，用于部署在Kubernetes上的核心5G组件。我们的方法利用Linux完整性度量架构（IMA）与可信平台模块（TPM）提供基于硬件的运行时验证。我们将开源Keylime框架与自定义IMA模板集成，该模板可隔离Pod级别的度量值，实现逐Pod的完整性验证。我们在一个包含1个主节点、2个工作节点的k3s集群上实现了原型系统，用于对AMF、SMF和UPF等核心功能进行证明。实验结果表明，该系统能够实时检测未授权修改，标记每个Pod的信任状态，并生成详细的审计日志。本工作为云原生与边缘部署提供了基于硬件的持续证明，增强了5G作为关键基础设施在多供应商和任务关键型5G场景中的弹性。
英文摘要：
In the rapidly evolving landscape of 5G technology, the adoption of cloud-based infrastructure for the deployment of 5G services has become increasingly common. Using a service-based architecture, critical 5G components, such as the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF), now run as containerized pods on Kubernetes clusters. Although this approach improves scalability, flexibility, and resilience, it also introduces new security challenges, particularly to ensure the integrity and trustworthiness of these components. Current 5G security specifications (for example, 3GPP TS 33.501) focus on communication security and assume that network functions remain trustworthy after authentication, consequently lacking mechanisms to continuously validate the integrity of NVFs at runtime. To close this gap, and to align with Zero Trust principles of 'never trust, always verify', we present a TPM 2.0-based continuous remote attestation solution for core 5G components deployed on Kubernetes. Our approach uses the Linux Integrity Measurement Architecture (IMA) and a Trusted Platform Module (TPM) to provide hardware-based runtime validation. We integrate the open-source Keylime framework with a custom IMA template that isolates pod-level measurements, allowing per-pod integrity verification. A prototype on a k3s cluster (consisting of 1 master, 2 worker nodes) was implemented to attest to core functions, including AMF, SMF and UPF. The experimental results show that the system detects unauthorized modifications in real time, labels each pod's trust state, and generates detailed audit logs. This work provides hardware-based continuous attestation for cloud native and edge deployments, strengthening the resilience of 5G as critical infrastructure in multi-vendor and mission-critical scenarios of 5G.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
