WO2016172978A1 - 一种软件安全验证方法、设备及系统 - Google Patents

一种软件安全验证方法、设备及系统 Download PDF

Info

Publication number
WO2016172978A1
WO2016172978A1 PCT/CN2015/078136 CN2015078136W WO2016172978A1 WO 2016172978 A1 WO2016172978 A1 WO 2016172978A1 CN 2015078136 W CN2015078136 W CN 2015078136W WO 2016172978 A1 WO2016172978 A1 WO 2016172978A1
Authority
WO
WIPO (PCT)
Prior art keywords
vnf
security verification
software image
result
information
Prior art date
Application number
PCT/CN2015/078136
Other languages
English (en)
French (fr)
Inventor
冯成燕
王江胜
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2017556567A priority Critical patent/JP6449487B2/ja
Priority to PCT/CN2015/078136 priority patent/WO2016172978A1/zh
Priority to EP15890358.3A priority patent/EP3282647B1/en
Priority to CN201580042929.3A priority patent/CN106576068B/zh
Publication of WO2016172978A1 publication Critical patent/WO2016172978A1/zh
Priority to US15/795,623 priority patent/US10757129B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/12—Discovery or management of network topologies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks

Definitions

  • the present invention relates to the field of communications, and in particular, to a software security verification method, device, and system.
  • NFV Network Function Virtualization
  • VNF Virtualised Network Function
  • hardware devices such as general-purpose servers, switches, and storage devices, so that these network functions are on general-purpose hardware devices. Operation, no need to configure a new dedicated network element device, can greatly enhance the flexibility of network deployment and reduce investment costs.
  • the VNF runs on the hardware in the form of software, and realizes the allocation and release of VNF resources through the instantiation and termination of the VNF.
  • the instantiation of the so-called VNF refers to the process of allocating resources and installing software for a VNF; the term "terminating" refers to the process of releasing resources allocated to the VNF.
  • the resources required for VNF instantiation are stored in the VNF package, and the VNF is instantiated according to the VNF package.
  • the signature file of the software is added in the VNF package, and the receiving end passes the verification software signature file to the VNF after receiving the VNF package.
  • the package performs security verification to ensure the security of the VNF package during the transmission process.
  • the receiving end needs to perform security verification on the stored VNF package before the VNF is instantiated to ensure the security of the VNF package in the storage, and this The delay of VNF instantiation is increased, and the performance of VNF instantiation is reduced.
  • the embodiment of the present invention provides a software security verification method, device, and system, which can solve the problem that the VNF packet is verified by the security verification in the prior art, and the VNF instantiation delay is reduced, and the VNF instantiation performance is reduced.
  • the embodiment of the present invention provides a software security verification method, after the first device receives the instantiation request of the virtual network function VNF, the method includes:
  • the first device After the first device starts to instantiate the VNF according to the instantiation request of the VNF or starts to instantiate the VNF, perform security verification on the VNF packet of the VNF that has been stored;
  • the first device sends the first result information to the second device, so that the second device determines that the VNF packet security verification of the VNF is successful according to the first result information.
  • the VM is connected to the virtual machine VM, where the VM is a VM created by the second device for the VNF, and the first result information includes information that the VNF packet security verification of the VNF is successful.
  • the method further includes:
  • the first device terminates instantiation of the VNF, or the first device sends first result information to the second device, where the first result information includes The VNF VNF package security verification failed information.
  • the VNF packet of the VNF includes a software image of the VNF
  • the first device performs security verification on the VNF packet of the VNF that has been stored, including:
  • the first device performs security verification on the software image of the VNF.
  • the VNF packet of the VNF does not include the software image of the VNF
  • the method further includes:
  • the first device sends the first indication information to the second device, where the first indication information is used to indicate that the second device performs security verification on the software image of the VNF, and the second device stores the A software image of the VNF.
  • the sending, by the first device, the first indication information to the second device includes:
  • the first device sends a second indication message to the second device, where the second indication
  • the message is used to indicate that the second device allocates resources for the VNF and establishes a connection, and the first indication information is sent to the second device in the second indication message.
  • the sending, by the first device, the first indication information to the second device includes:
  • the first device sends a third indication message to the second device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is included in the The third indication message is sent to the second device.
  • the method further includes:
  • the first device receives the second result information sent by the second device, and the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • an embodiment of the present invention provides a software security verification method, including:
  • the second device determines the result of the VNF packet security verification of the VNF
  • the second device determines that the VNF packet security verification of the VNF is successful, the second device performs a network connection to the virtual machine VM, where the VM is a VM created by the second device for the first virtual network function VNF. .
  • the method further includes:
  • the second device determines that the VNF packet security verification of the VNF fails, the second device terminates instantiation of the VNF, and instantiating the VNF includes performing a network connection to the VM.
  • the second device determines The results of VNF's VNF package security verification include:
  • the second device determines a result of the VNF packet security verification of the VNF according to the first result information.
  • the VNF packet of the VNF does not include the software image of the VNF
  • the software image of the VNF is stored in the second device, and the method further includes:
  • the second device receives the first indication information that is sent by the first device, where the first indication information is used to instruct the second device to perform security verification on the software image of the VNF;
  • the second device performs security verification on the software image of the VNF according to the first indication information, and determines a result of the software image security verification of the VNF;
  • the second device determines that the VNF packet security verification of the VNF is successful, the second device performs network connection on the VM, including:
  • the second device determines that the VNF packet of the VNF and the software image security verification of the VNF are successful, the second device performs a network connection to the VM.
  • the second device performs security verification on the software image of the VNF according to the first indication information, include:
  • the second device performs security verification on the software image of the VNF according to the first indication information, while creating the VM and performing network connection for the VM.
  • the receiving, by the second device, the first indication information that is sent by the first device includes:
  • the second device receives a second indication message that is sent by the first device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection.
  • the first indication information is sent to the second device in the second indication message.
  • the receiving, by the second device, the first indication information that is sent by the first device includes:
  • the second device is configured according to After the first indication information is used to perform security verification on the software image of the VNF, the method further includes:
  • the second device sends second result information to the first device, where the second result information includes a result of security verification of the software image of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • an embodiment of the present invention provides a first device, including:
  • a security verification unit configured to: after the first device receives the instantiation request of the virtual network function VNF, start instantiating the VNF according to the instantiation request of the VNF, or start instantiating the VNF After that, the VNF package of the VNF that has been stored is securely verified;
  • a sending unit configured to: when the verification result of the security verification unit is that the VNF packet security verification of the VNF is successful, send the first result information to the second device, so that the second device determines, according to the first result information, After the VNF package security verification of the VNF is successful, the virtual machine VM is connected to the network, the VM is the VM created by the second device for the VNF, and the first result information includes the VNF package security of the VNF. Verify successful information.
  • the first device further includes a termination unit, configured to terminate instantiation of the VNF when the VNF packet security verification of the VNF fails;
  • the sending unit is further configured to: when the VNF packet security verification of the VNF fails, send the first result information to the second device, where the first result information includes information about the VNF packet security verification failure of the VNF. .
  • the VNF packet of the VNF includes a software image of the VNF
  • the security verification unit is further configured to perform security verification on the software image of the VNF.
  • the VNF packet of the VNF does not include the software image of the VNF ,
  • the sending unit is further configured to send the first indication information to the second device, where the first indication information is used to instruct the second device to perform security verification on the software image of the VNF, where the second device is A software image of the VNF is stored.
  • the sending unit is further configured to send a second indication message to the second device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication information is And being sent to the second device in the second indication message.
  • the sending unit is further configured to send a third indication message to the second device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information includes Sending to the second device in the third indication message.
  • the first device further includes a receiving unit, configured to receive second result information sent by the second device, where the second result information includes a result of security verification of the software image of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • an embodiment of the present invention provides a second device, including:
  • a security verification unit for determining the result of the VNF package security verification of the VNF
  • a resource management unit configured to: when the security verification unit determines that the VNF package security verification of the VNF is successful, perform a network connection to the virtual machine VM, where the VM is created by the second device for the first virtual network function VNF VM.
  • the second device further includes a termination unit, configured to terminate instantiation of the VNF when the security verification unit determines that the VNF packet security verification of the VNF fails, and instantiating the VNF includes performing the VM Internet connection.
  • a termination unit configured to terminate instantiation of the VNF when the security verification unit determines that the VNF packet security verification of the VNF fails, and instantiating the VNF includes performing the VM Internet connection.
  • the second device further includes a receiving unit, configured to receive first result information sent by the first device, where the first result information includes a result of VNF packet security verification of the VNF;
  • the security verification unit is further configured to determine a result of the VNF packet security verification of the VNF according to the first result information received by the receiving unit.
  • the VNF packet of the VNF does not include the software image of the VNF
  • the software image of the VNF is stored in the second device
  • the second device further includes a receiving unit, configured to receive the first An indication information, the first indication information is used to instruct the second device to perform security verification on the software image of the VNF;
  • the security verification unit is further configured to perform security verification on the software image of the VNF according to the first indication information received by the receiving unit, and determine a result of security verification of the software image of the VNF;
  • the resource management unit is further configured to perform network connection on the VM when the security verification unit determines that the VNF package of the VNF and the software image security verification of the VNF are successful.
  • the security verification unit is further configured to: when the second device creates the VM for the VNF and performs network connection for the VM, performing security on the software image of the VNF according to the first indication information. verification.
  • the receiving unit is further configured to receive a second indication message that is sent by the first device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication is Information is sent to the second device in the second indication message.
  • the receiving unit is further configured to receive a third indication message that is sent by the first device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is And being sent to the second device in the third indication message.
  • the second device further includes a sending unit, configured to send the second node to the first device
  • the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • an embodiment of the present invention provides a first device, including: a processor, a memory, a bus, and a transmitter, where the processor, the memory, and the transmitter are connected to each other through the bus;
  • the processor is configured to: after the first device receives the instantiation request of the virtual network function VNF, start to instantiate the VNF according to the instantiation request of the VNF, or start an instance of the VNF After the security, the VNF package of the VNF that has been stored is securely verified;
  • the transmitter is configured to: when the verification result of the processor is that the VNF packet security verification of the VNF is successful, send the first result information to the second device, so that the second device is configured according to the first result information. After determining that the VNF package security verification of the VNF is successful, performing a network connection to the virtual machine VM, where the VM is a VM created by the second device for the VNF, and the first result information includes a VNF package of the VNF. Security verification success information.
  • the processor is further configured to terminate instantiation of the VNF when the VNF packet security verification of the VNF fails;
  • the transmitter is further configured to: when the VNF packet security verification of the VNF fails, send the first result information to the second device, where the first result information includes information about the VNF packet security verification failure of the VNF. .
  • the VNF packet of the VNF includes a software image of the VNF
  • the processor is further configured to perform security verification on the software image of the VNF.
  • the VNF packet of the VNF does not include the software image of the VNF ,
  • the transmitter is further configured to send the first indication information to the second device, where the first indication information is used to instruct the second device to perform security verification on a software image of the VNF, where the second device A software image of the VNF is stored.
  • the transmitter is further configured to send a second indication message to the second device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication information is And being sent to the second device in the second indication message.
  • the transmitter is further configured to send a third indication message to the second device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information includes Sending to the second device in the third indication message.
  • the first device further includes a receiver, configured to receive second result information sent by the second device, where the second result information includes a result of security verification of the software image of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • an embodiment of the present invention provides a second device, including: a processor, a memory, and a bus, where the processor and the memory are connected to each other through the bus;
  • the processor is configured to determine a result of the VNF package security verification of the VNF; when it is determined that the VNF package security verification of the VNF is successful, the virtual machine VM is connected to the network,
  • the VM is a VM created by the second device for the first virtual network function VNF.
  • the processor is further configured to terminate instantiation of the VNF when determining that the VNF packet security verification of the VNF fails, and instantiating the VNF includes performing network connectivity on the VM.
  • the second device further includes a receiver, configured to receive first result information sent by the first device, where the first result information includes a result of VNF packet security verification of the VNF;
  • the processor is further configured to determine a result of the VNF packet security verification of the VNF according to the first result information received by the receiver.
  • the VNF packet of the VNF does not include the software image of the VNF
  • the software image of the VNF is stored in the second device
  • the second device further includes a receiver, configured to receive first indication information that is sent by the first device, where the first indication information is used to instruct the second device to perform security verification on a software image of the VNF;
  • the processor is further configured to perform security verification on the software image of the VNF according to the first indication information received by the receiver, and determine a result of security verification of the software image of the VNF; when determining the VNF When the VNF package and the software image security verification of the VNF are successful, the VM is connected to the network.
  • the processor is further configured to perform security verification on the software image of the VNF according to the first indication information, when the second device creates the VM for the VNF and performs network connection for the VM. .
  • the fifth aspect of the sixth aspect is In the way of implementation,
  • the receiver is further configured to receive a second indication message that is sent by the first device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication is Information is sent to the second device in the second indication message.
  • the receiver is further configured to receive a third indication message that is sent by the first device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is And being sent to the second device in the third indication message.
  • the second device further includes a transmitter, configured to send second result information to the first device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • the software security verification method and device provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the first device starts according to the instantiation request of the VNF. After the VNF is instantiated or after the VNF is instantiated, the VNF packet of the stored VNF is securely verified. When the VNF packet security verification of the VNF is successful, the first device sends the first result information to the second device. The first result information contains information about the successful verification of the VNF package security of the VNF. Because the VNF package of the VNF is securely verified while executing the instantiation process of the VNF, the VNF package of the VNF is secured before the instantiation compared to the prior art. Verification saves time, reduces the delay of VNF instantiation, and improves the performance of VNF instantiation.
  • FIG. 1 is a schematic structural diagram of a network function virtualization system according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a software security verification method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of another software security verification method according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a software security verification method according to another embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a software security verification method according to another embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a first device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a second device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a first device according to another embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a second device according to another embodiment of the present invention.
  • Embodiments of the present invention provide a network function virtualization system.
  • the network function virtualization system 10 includes NFVO (Network Functions).
  • Virtualization Orchestrator Network Function Virtualization Orchestrator 101, VNFM (Virtualized Network Function Manager) 102, VIM (Virtualised Infrastructure Manager) 103, OSS/BSS (Operations and Business Support Systems) , Operation and Service Support System 104, EM (Element Management, Network Element Manager) 105, VNF (Virtualised Network Function) 106, NFVI (Network Function Virtualization Infrastructure) 107.
  • NFVO101 is used for network side programming and management of NFV infrastructure resources and software resources, and implements NFV service topology on NFVI107.
  • VNFM102 is used to manage the life cycle of a VNF instance.
  • VIM103 used to control and manage entities that implement compute, storage, and network resources and their virtualization.
  • OSS/BSS104 for network management, system management, billing, accounting, customer service, etc.
  • the VNF 106 corresponds to a PNF (Physical Network Function) in a traditional non-virtualized network, such as a virtualized EPC (Evolved Packet Core) node, to implement a specific network function.
  • a VNF can be composed of multiple lower-level components. Therefore, a VNF can be deployed on multiple VMs, each controlling one VNF component.
  • NFVI107 which consists of hardware resources, virtual resources, and virtual layers, is the entity that provides the required virtual resources.
  • the VNF mentioned in the present invention may be a VNF or a part of a VNF, such as a VNFC (Virtualised Network Function Component).
  • VNF Virtualised Network Function Component
  • the present invention is not limited, and the VNF is only used.
  • the representation is a VNF in a VNF or a VNF, or a plurality of VNFCs in a VNF, and is not intended to be limiting.
  • An embodiment of the present invention provides a software security verification method, which is applied to a first device.
  • the information security verification method provided in this embodiment may be in the network function shown in FIG.
  • the software security verification method provided by the embodiment is: after the first device receives the instantiation request of the VNF (Virtualised Network Function), and the second device pair Before the VM (Virtual Machine) performs the network connection, the VM is the VM created by the second device for the first virtual network function VNF, including:
  • the instantiation process of the VNF includes: S1, verifying the instantiation request of the VNF and confirming; S2, instantiating the feasibility check, S3, allocating resources for the VNF and establishing a connection; S4, instantiation is finished.
  • the S2 step may or may not be performed.
  • the VNF package VNF package is verified for security verification, thus saving the instantiation time.
  • the security verification of the VNF packet of the VNF by the first device may be started at any step in the instantiation process of the VNF. Of course, in order to save time, the sooner the better, the optimal solution is to receive the VNF at the first device. After instantiating the request, security verification of the VNF package of the VNF is started.
  • the VNF package of the VNF may or may not include a software image of the VNF.
  • the method for performing security verification on the VNF package of the VNF is not limited in the present invention.
  • the first device when the VNF package of the VNF includes the software image of the VNF, the first device performs security verification on the VNF package of the VNF that has been stored, including performing security verification on the software image of the VNF by the first device. .
  • the first device sends the first indication information to the second device, where An indication is used to instruct the second device to perform security verification on the software image of the VNF, and the second device stores the software image of the VNF.
  • the first device may send a second indication message to the second device, where the second indication message is used to indicate that the second device is a VNF And the first indication information is sent to the second device in the second indication message; or, the first device sends a third indication message to the second device, where the third indication message is used to indicate the first
  • the second device performs a resource availability check for the VNF, and the first indication information is sent to the second device in the second indication message.
  • the first device may further receive the second result information sent by the second device, where the second result information includes the software image security of the second device to the VNF. The result of the verification.
  • the first device may send the first result information to the second device.
  • the first result information includes information about successful VNF packet security verification of the VNF.
  • the first device sends the first result information to the second device, so that the second device determines that the VNF packet security verification of the VNF is successful according to the first result information, and performs network connection to the virtual machine VM, where the VM is the VM created by the second device for the VNF. .
  • the first device may be the NFVO 101 in the network function virtualization system 10 shown in FIG. 1
  • the second device may be the VIM 103 in the network function virtualization system 10 shown in FIG. 1 . It does not mean that the invention is limited thereto.
  • the first device terminates the instantiation of the VNF, or the first device sends the first result information to the second device, where the first result information includes the VNF packet security verification failure of the VNF. Information.
  • the software security verification method provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the first device starts to perform an instance of the VNF according to the instantiation request of the VNF. After the VNF is instantiated or the VNF is instantiated, the VNF packet of the VNF is stored for security verification. When the VNF packet security verification of the VNF is successful, the first device sends the first result information to the second device, the first result. The information contains information about the VNF's VNF package security verification success.
  • VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • An embodiment of the present invention provides another software security verification method, which is applied to a second device.
  • the information security verification method provided in this embodiment may be implemented in the network function virtualization system shown in FIG. 1.
  • the software security verification method provided in this embodiment is performed on the second device to the VM.
  • the VM is the VM created by the second device for the first virtual network function VNF, including:
  • the second device determines a result of VNF packet security verification of the VNF.
  • the VNF package of the VNF may or may not include a software image of the VNF.
  • the VNF package of the VNF includes a software image of the VNF
  • the second device may receive the first result information sent by the first device, because the VNF package includes the software image of the VNF, and therefore, the first result
  • the information includes the result of the software image security verification of the VNF; the second device determines the result of the VNF package security verification of the VNF according to the first result information.
  • the VNF package of the VNF does not include the software image of the VNF
  • the software image of the VNF is stored in the second device
  • the second device may receive the first indication information sent by the first device, where An indication information is used to instruct the second device to perform security verification on the software image of the VNF; the second device performs security verification on the software image of the VNF according to the first indication information, and determines a result of the security verification of the software image of the VNF, and then according to the first The resulting information determines the results of the VNF package security verification of the VNF.
  • the second device receives the second indication message sent by the first device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, and the first indication information And being sent to the second device in the second indication message; or, optionally, the second device receives the third indication message sent by the first device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF.
  • the first indication information is included in the third indication message and sent to the second device.
  • the second device determines that the VNF packet security verification of the VNF is successful, the second device performs a network connection to the VM.
  • the second device determines the VNF package of the VNF and the software image of the VNF.
  • the VM is connected to the network.
  • the second device determines that the VNF packet security verification of the VNF fails, the second device terminates instantiation of the VNF, and instantiating the VNF includes performing network connection to the VM.
  • the VNF package of the VNF does not include the software image of the VNF, if the second device determines that the VNF packet of the VNF or the software image security verification of the VNF fails, the instantiation of the VNF is terminated.
  • the second device may further send the second result information to the first device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the second device needs to determine that the VNF package of the VNF and the software image security verification of the VNF are successful, and then the network connection can be performed to the VM, if the VNF VNF package or the VNF If the software image security verification fails, it proves that the VNF VNF package or VNF software image is illegally tampered with. If accessing the network poses a threat to network security, the VNF VNF package and VNF software must be determined before the VM performs network connection. The result of mirroring security verification.
  • the VM is connected to the network, specifically connecting the VM to the internal network of the VNF.
  • the first device may be the NFVO 101 in the network function virtualization system 10 shown in FIG. 1
  • the second device may be the VIM 103 in the network function virtualization system 10 shown in FIG. 1 . It does not mean that the invention is limited thereto.
  • the software security verification method provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the second device determines the result of the VNF packet security verification of the VNF. When the second device determines that the VNF packet security verification of the VNF is successful, the second device performs a network connection to the VM. Because the VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • FIG. 2 Another embodiment of the present invention provides a software security verification method, which is applied to the network function virtualization system 10 shown in FIG. 1.
  • the first device of the present invention is shown in FIG.
  • the NFVO 101 the second device is the VIM 103 in FIG. 1 as an example.
  • the VNF package of the VNF stored by the first device does not include
  • the software image of the VNF the software image of the VNF is stored in the second device.
  • the embodiment is merely illustrative, and the present invention is not limited thereto. Referring to FIG. 4, the following steps are included:
  • the NFVO receives an instantiation request of the VNF.
  • the instantiation request for this VNF is sent by the OSS to the NFVO (first device).
  • NFVO verifies the instantiation request of the VNF.
  • the NFVO verifies the validity of the instantiation request of the VNF, and when it is confirmed that the instantiation request of the VNF is valid, step 405 is performed.
  • NFVO performs security verification on the VNF package of VNF.
  • NFVO determines the result of VNF packet security verification of VNF.
  • NFVO confirms the instantiation of the VNF.
  • the NFVO may also send an instantiation request of the VNF to the VNFM, and the VNFM verifies and processes the instantiation request of the VNF, including modifying/supplementing the instantiated input data in the VNFD (Virtualised Network Function Descriptor). And VNF life cycle specific parameters.
  • VNFD Virtualised Network Function Descriptor
  • step 403 and step 405 may further include steps 404a-404d:
  • NFVO sends a resource availability check indication to the VIM.
  • the first indication information may be sent to the VIM simultaneously with the resource availability check indication.
  • the first indication information is used to instruct the second device to perform security verification on the software image of the VNF.
  • VIM check resource availability
  • VIM sends a resource availability check result to NFVO.
  • step 403 and the step 405 are performed synchronously.
  • the method further includes:
  • the NFVO sends a second indication message to the VIM.
  • the second indication message is used to instruct the second device to allocate resources and establish a connection for the VNF. If step 404b is not performed or the first indication information is not sent in step 404b, The second indication message includes the first indication information sent to the VIM.
  • the first result information and the second indication message may be sent to the VIM at the same time, and the first result information is used to indicate the result of the VNF packet security verification of the VNF.
  • the VNF package security verification of the VNF is successful.
  • the first result information may also be separately sent by the NFVO to the VIM after step 407.
  • the VIM creates a VM and an internal network.
  • the VM is a VM created by the VIM for the VNF instance.
  • the internal network is a network formed by interconnecting the VNFCs in the VNF. It should be noted that the VM may include multiple VMs, and the present invention is not limited thereto.
  • the VIM performs security verification on the software image of the VNF and determines the verification result. Steps 407 and 408 are in no particular order.
  • step 408 is performed after the VIM receives the first indication information. If the first indication information is sent to the VIM in step 404b, then after step 404b, the VIM can perform security verification on the software image of the VNF; if the first indication information is sent to the VIM in step 406, then after step 406, the VIM is The software image of the VNF can be verified securely.
  • the VIM determines that the software image security verification of the VNF is successful, it also includes:
  • the VIM performs network connection to the VM.
  • Networking the VM is the internal network that connects the VM to the VNF.
  • the VIM sends a resource allocation completion confirmation to the NFVO.
  • the resource allocation completion confirmation may be sent to the NFVO together with the second result information, and the second result information includes a result of the software image security verification of the VNF by the second device.
  • the software image security verification of the VNF is successful.
  • the VIM determines that the software image security verification of the VNF fails, it also includes:
  • the VIM sends the second result information to the NFVO.
  • the second result information indicates that the second device fails the software image security verification of the VNF.
  • the software security verification method provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device connects the VM to the network, the first device According to the instantiation request of the VNF, when the VNF is instantiated or after the VNF is instantiated, the VNF package of the already stored VNF is verified by security. When the VNF package security verification of the VNF is successful, the first device goes to the first device. The second device sends the first result information, and the first result information includes information about the VNF packet security verification success of the VNF.
  • VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • FIG. 1 Another embodiment of the present invention provides a software security verification method, which is applied to the network function virtualization system 10 shown in FIG. 1.
  • the first device of the present invention is shown in FIG.
  • the NFVO 101, the second device is the VIM 103 in FIG. 1 as an example.
  • the VNF package of the VNF stored by the first device includes a software image of the VNF.
  • the embodiment is merely an example and does not represent the present embodiment. The invention is limited to this, and as shown in FIG. 5, the following steps are included:
  • the NFVO receives the instantiation request of the VNF.
  • the instantiation request for this VNF is sent by the EM to the NFVO (first device).
  • the NFVO verifies the instantiation request of the VNF.
  • the NFVO verifies the validity of the instantiation request of the VNF, and when it is confirmed that the instantiation request of the VNF is valid, step 503 is performed.
  • NFVO performs security verification on the VNF package of VNF.
  • VNF package of the VNF stored by the NFVO contains a software image of the VNF.
  • NFVO's security verification of VNF's VNF package includes security verification of the VNF software image.
  • NFVO determines the result of VNF packet security verification of VNF.
  • NFVO confirmed the instantiation of VNF.
  • the NFVO may also send an instantiation request of the VNF to the VNFM, and the VNFM verifies and processes the instantiation request of the VNF, including modifying/supplementing the instantiated input data in the VNFD (Virtualised Network Function Descriptor). And VNF life cycle specific parameters.
  • VNFD Virtualised Network Function Descriptor
  • step 503 and step 505 may further include steps 504a-504b:
  • the VIM sends a reservation result to the NFVO.
  • the NFVO sends a second indication message to the VIM.
  • the second indication message is used to instruct the second device to allocate resources and establish a connection for the VNF.
  • VIM creates a VM and an internal network.
  • the VM is a VM created by the VIM for the VNF instance.
  • the internal network is a network formed by interconnecting the VNFCs in the VNF. It should be noted that the VM may include multiple VMs, and the present invention is not limited thereto.
  • step 503 and step 505 are performed synchronously. After step 503, the method further includes:
  • the NFVO sends the first result information to the VIM.
  • the first result information is used to indicate the result of the VNF packet security verification of the VNF.
  • the step 508 may also be combined with the step 506, that is, the first result information may also be carried in the second indication message.
  • the VIM determines the result of the VNF packet security verification of the VNF.
  • the VIM determines that the software image security verification of the VNF is successful, it also includes:
  • the VIM performs a network connection to the VM. VIM connects the newly created VM to the internal network.
  • Networking the VM is the internal network that connects the VM to the VNF.
  • the VIM sends a resource allocation completion confirmation to the NFVO.
  • the software security verification method provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the first device starts to perform an instance of the VNF according to the instantiation request of the VNF. After the VNF is instantiated or the VNF is instantiated, the VNF packet of the VNF is stored for security verification. When the VNF packet security verification of the VNF is successful, the first device sends the first result information to the second device, the first result. The information contains information about the VNF's VNF package security verification success.
  • VNF VNF package is securely verified while performing the VNF instantiation process, the VNF VNF package is verified for security before the instantiation, saving Time is reduced, the delay of VNF instantiation is reduced, and the performance of VNF instantiation is improved.
  • the embodiment of the present invention provides a first device, which is used to perform the software security verification method described in the foregoing embodiment corresponding to FIG. 2, and is preferably applicable to the method shown in FIG.
  • the network function virtualization system 10 the first device provided in this embodiment may be the NFVO 101 in FIG.
  • the first device 60 includes a security verification unit 601 and a transmission unit 602.
  • the security verification unit 601 is configured to: after the first device receives the instantiation request of the virtual network function VNF, and starts to instantiate the VNF according to the instantiation request of the VNF or starts to instantiate the VNF, The VNF package of the already stored VNF is securely verified.
  • the sending unit 602 is configured to: when the verification result of the security verification unit 601 is that the VNF packet security verification of the VNF is successful, send the first result information to the second device, so that the second device determines the VNF packet security verification of the VNF according to the first result information. After the success, the VM is connected to the VM, and the VM is the VM created by the second device for the VNF.
  • the first result information includes information about the VNF packet security verification success of the VNF.
  • the first device 60 further includes a termination unit 603, configured to terminate instantiation of the VNF when the VNF packet security verification of the VNF fails.
  • the sending unit 602 is further configured to: when the VNF packet security verification of the VNF fails, send the first result information to the second device, where the first result information includes information that the VNF packet security verification of the VNF fails.
  • the VNF package of the VNF includes a software image of the VNF.
  • the security verification unit 601 is further configured to perform security verification on the software image of the VNF.
  • the VNF package of the VNF does not include a software image of the VNF.
  • the sending unit 602 is further configured to send the first indication information to the second device, where the first indication information is used to instruct the second device to perform security verification on the software image of the VNF, and the second device stores the software image of the VNF.
  • the sending unit 602 is further configured to send the second indication to the second device.
  • the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication information is sent to the second device in the second indication message.
  • the sending unit 602 is further configured to send a third indication message to the second device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is included in the third indication.
  • the message is sent to the second device.
  • the first device 60 further includes a receiving unit 604, configured to receive second result information sent by the second device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • the first device provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the first device starts to instantiate the VNF according to the instantiation request of the VNF. After the VNF is instantiated, the VNF packet of the VNF is stored for security verification. When the VNF packet security verification of the VNF is successful, the first device sends the first result information to the second device, and the first result information. Information on the successful verification of the VNF package containing the VNF. Because the VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • the embodiment of the present invention provides a second device, which is used to perform the software security verification method described in the foregoing embodiment corresponding to FIG. 3, and is preferably applicable to the method shown in FIG.
  • the network function virtualization system 10 the second device provided in this embodiment may be the VIM 103 in FIG.
  • the first device 70 includes a security verification unit 701 and a resource management unit 702.
  • the security verification unit 701 is configured to determine a result of the VNF packet security verification of the VNF.
  • the resource management unit 702 is configured to perform a network connection to the virtual machine VM when the security verification unit 701 determines that the VNF package security verification of the VNF is successful, and the VM is a VM created by the second device for the first virtual network function VNF.
  • the second device 70 further includes a termination unit 703, configured to be a security verification Element 701 determines that the VNF packet security verification of the VNF fails, terminating the VNF instantiation, and instantiating the VNF includes performing a network connection to the VM.
  • a termination unit 703 configured to be a security verification Element 701 determines that the VNF packet security verification of the VNF fails, terminating the VNF instantiation, and instantiating the VNF includes performing a network connection to the VM.
  • the second device 70 further includes a receiving unit 704, configured to receive first result information sent by the first device, where the first result information includes a result of VNF packet security verification of the VNF.
  • the security verification unit 701 is further configured to determine a result of the VNF packet security verification of the VNF according to the first result information received by the receiving unit 704.
  • the VNF package of the VNF does not include the software image of the VNF, and the software image of the VNF is stored in the second device.
  • the receiving unit 70 is configured to receive first indication information that is sent by the first device, where the first indication information is used to instruct the second device to perform security verification on the software image of the VNF.
  • the security verification unit 701 is further configured to perform security verification on the software image of the VNF according to the first indication information received by the receiving unit 704, and determine a result of the software image security verification of the VNF.
  • the resource management unit 702 is further configured to perform network connection to the VM when the security verification unit 701 determines that the VNF package of the VNF and the software image security verification of the VNF are successful.
  • the security verification unit 701 is further configured to: when the second device creates a VM for the VNF and performs a network connection for the VM, performing security verification on the software image of the VNF according to the first indication information.
  • the receiving unit 704 is further configured to receive a second indication message that is sent by the first device, where the second indication message is used to indicate that the second device allocates a resource for the VNF and establishes a connection, where the first indication information is included in the second indication.
  • the message is sent to the second device.
  • the receiving unit 704 is further configured to receive a third indication message that is sent by the first device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is included in the third indication message. Sent to the second device.
  • the second device 70 further includes a sending unit 705, configured to send second result information to the first device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • a sending unit 705 configured to send second result information to the first device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is Virtual Infrastructure Manager VIM.
  • the second device determines the result of the VNF packet security verification of the VNF after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, when the second device determines When the VNF packet security verification of the VNF is successful, the second device performs a network connection to the VM. Because the VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • the first device 80 includes: at least one processor 801, a memory 802, a bus 803, and a transmitter 804.
  • the at least one processor 801, the memory 802, and the transmitter 804 are connected and completed by a bus 803. Communication.
  • the bus 803 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus, or an EISA (Extended Industry Standard Architecture) bus.
  • the bus 803 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 8, but it does not mean that there is only one bus or one type of bus. among them:
  • the memory 802 is used to execute the application code of the inventive scheme, and the application code for executing the inventive scheme is stored in a memory and controlled by the processor 801 for execution.
  • the memory can be a read only memory ROM or other type of static storage device that can store static information and instructions, a random access memory RAM or other type of dynamic storage device that can store information and instructions, or can be electrically erasable or programmable.
  • These memories are connected to the processor via a bus.
  • the processor 801 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. Integrated circuits.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • the processor is configured to: after the first device receives the instantiation request of the virtual network function VNF, and starts to instantiate the VNF according to the instantiation request of the VNF or starts to instantiate the VNF, the processor is already stored.
  • the VNF VNF package is securely verified.
  • a transmitter configured to send the first result information to the second device when the VNF packet security verification of the VNF is successful, so that the second device determines, according to the first result information, that the VNF packet security verification of the VNF is successful.
  • the VM is connected to the VM, and the VM is the VM created by the second device for the VNF.
  • the first result information includes information about the VNF packet security verification success of the VNF.
  • the processor 801 is further configured to terminate instantiation of the VNF when the VNF packet security verification of the VNF fails.
  • the transmitter 804 is further configured to: when the VNF packet security verification of the VNF fails, send the first result information to the second device, where the first result information includes information that the VNF packet security verification of the VNF fails.
  • the VNF package of the VNF includes a software image of the VNF.
  • the processor 801 is further configured to perform security verification on the software image of the VNF.
  • the VNF package of the VNF does not include a software image of the VNF.
  • the transmitter 804 is further configured to send the first indication information to the second device, where the first indication information is used to indicate that the second device performs security verification on the software image of the VNF, and the second device stores the software image of the VNF.
  • the transmitter 804 is further configured to send a second indication message to the second device, where The second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication information is included in the second indication message and sent to the second device.
  • the transmitter 804 is further configured to send a third indication message to the second device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is included in the third indication.
  • the message is sent to the second device.
  • the first device 80 further includes a receiver 805, configured to receive second result information sent by the second device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • the first device provided by the embodiment of the present invention, after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, the first device starts to instantiate the VNF according to the instantiation request of the VNF. After the VNF is instantiated, the VNF packet of the VNF is stored for security verification. When the VNF packet security verification of the VNF is successful, the first device sends the first result information to the second device, and the first result information. Information on the successful verification of the VNF package containing the VNF. Because the VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • another embodiment of the present invention provides a second device, which is used to perform the software security verification method described in the foregoing embodiment corresponding to FIG. 3, and is preferably applicable to FIG.
  • the network function virtualization system 10 is shown.
  • the second device provided in this embodiment may be the VIM 103 in FIG.
  • the first device 90 includes: at least one processor 901, a memory 902, and a bus 903.
  • the at least one processor 901 and the memory 902 are connected by a bus 903 and complete communication with each other.
  • the bus 903 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus, or an EISA (Extended Industry Standard Architecture) bus.
  • the bus 903 can be divided into an address bus, a data bus, and a total control Line and so on. For ease of representation, only one thick line is shown in Figure 9, but it does not mean that there is only one bus or one type of bus. among them:
  • the memory 902 is used to execute the application code of the inventive scheme, and the application code for executing the inventive scheme is stored in a memory and controlled by the processor 901 for execution.
  • the memory can be a read only memory ROM or other type of static storage device that can store static information and instructions, a random access memory RAM or other type of dynamic storage device that can store information and instructions, or can be electrically erasable or programmable.
  • These memories are connected to the processor via a bus.
  • the processor 901 may be a central processing unit 901 (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. Integrated circuits.
  • the processor 901 is configured to determine a result of the VNF packet security verification of the VNF. When it is determined that the VNF package security verification of the VNF is successful, the virtual machine VM is connected to the network, and the VM is the VM created by the second device for the first virtual network function VNF.
  • the processor 901 is further configured to terminate instantiation of the VNF when determining that the VNF packet security verification of the VNF fails, and performing the network connection to the VM by instantiating the VNF.
  • the second device 90 further includes a receiver 904, configured to receive first result information sent by the first device, where the first result information includes a result of VNF packet security verification of the VNF.
  • the processor 901 is further configured to determine a result of the VNF packet security verification of the VNF according to the first result information received by the receiver 904.
  • the VNF package of the VNF does not include the software image of the VNF, and the software image of the VNF is stored in the second device.
  • the receiver 90 is configured to receive first indication information sent by the first device, where the first indication is The information is used to instruct the second device to perform security verification on the software image of the VNF.
  • the processor 901 is further configured to perform security verification on the software image of the VNF according to the first indication information received by the receiver 904, and determine a result of the software image security verification of the VNF.
  • the VM is connected to the network.
  • the processor 901 is further configured to: when the second device creates a VM for the VNF and performs a network connection for the VM, performing security verification on the software image of the VNF according to the first indication information.
  • the receiver 904 is further configured to receive a second indication message that is sent by the first device, where the second indication message is used to indicate that the second device allocates resources for the VNF and establishes a connection, where the first indication information is included in the second indication. The message is sent to the second device.
  • the receiver 904 is further configured to receive a third indication message that is sent by the first device, where the third indication message is used to indicate that the second device performs a resource availability check for the VNF, where the first indication information is included in the third indication message. Sent to the second device.
  • the second device 90 further includes a transmitter 905, configured to send the second result information to the first device, where the second result information includes a result of the software image security verification of the VNF by the second device.
  • the first device is a network function virtualization orchestrator NFVO
  • the second device is a virtual infrastructure device manager VIM.
  • the second device determines the result of the VNF packet security verification of the VNF after the first device receives the instantiation request of the VNF, and before the second device performs the network connection to the VM, when the second device determines When the VNF packet security verification of the VNF is successful, the second device performs a network connection to the VM. Because the VNF package VNF package is securely verified while the VNF instantiation process is executed, the VNF package VNF package is safely verified before the instantiation, saving time and reducing the VNF instantiation time. Delay, improve the performance of VNF instantiation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种软件安全验证方法、设备及系统，涉及通信领域，能够解决现有技术中，对VNF包进行安全验证增加了VNF实例化的时延，降低了VNF实例化性能的问题。具体方案为：当第一设备接收到VNF的实例化请求后，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。本发明用于软件安全验证。

Description

一种软件安全验证方法、设备及系统 技术领域
本发明涉及通信领域，尤其涉及一种软件安全验证方法、设备及系统。
背景技术
NFV(Network Function Virtulization，网络功能虚拟化)通过在通用的服务器、交换机、存储器等硬件设备上建立VNF(Virtualised Network Function，虚拟网络功能)实现部分网络功能，使得这些网络功能在通用的硬件设备上运行，不需要配置新的专用网元设备，能够极大的增强网络部署的灵活性，并且降低了投资成本。
在通过NFV技术实现网络功能的过程中，VNF以软件的形式运行在硬件上，通过VNF的实例化和终止来实现VNF资源的分配与释放。其中，所谓VNF的实例化，是指为一个VNF分配资源和安装软件的过程；所谓终止，是指释放分配给该VNF的资源的过程。通常，VNF实例化所需要的资源存储在VNF包中，根据VNF包对VNF进行实例化。
在现有技术中，为了避免VNF包在传输和存储过程中被伪造和篡改，在VNF包中增加了该软件的签名文件，接收端在接收到该VNF包后通过验证软件的签名文件对VNF包进行安全验证，以保证VNF包在传输过程中的安全性；此外，接收端在VNF实例化之前还需要对存储的VNF包进行安全验证，以保证VNF包在存储中的安全性，而这增加了VNF实例化的时延，降低了VNF实例化的性能。
发明内容
本发明的实施例提供一种软件安全验证方法、设备及系统，能够解决现有技术中，对VNF包进行安全验证增加了VNF实例化的时延，降低了VNF实例化性能的问题。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，本发明实施例提供一种软件安全验证方法，在第一设备接收到虚拟网络功能VNF的实例化请求后，包括：
所述第一设备根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
当所述VNF的VNF包安全验证成功时，所述第一设备向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
结合第一方面，在第一方面的第一种可能的实现方式中，所述方法还包括：
当所述VNF的VNF包安全验证失败时，所述第一设备终止对所述VNF实例化，或者，所述第一设备向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
结合第一方面或第一方面的第一种可能的实现方式中任一实现方式，在第一方面的第二种可能的实现方式中，所述VNF的VNF包包含所述VNF的软件镜像；
所述第一设备对已经存储的所述VNF的VNF包进行安全验证，包括：
所述第一设备对所述VNF的软件镜像进行安全验证。
结合第一方面或第一方面的第一种可能的实现方式中任一实现方式，在第一方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，所述方法还包括：
所述第一设备向所述第二设备发送第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述第一设备向所述第二设备发送第一指示信息，包括：
所述第一设备向所述第二设备发送第二指示消息，所述第二指示 消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第一方面的第三种可能的实现方式，在第一方面的第五种可能的实现方式中，所述第一设备向所述第二设备发送第一指示信息，包括：
所述第一设备向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第一方面的第三种可能的实现方式至第一方面的第五种可能的实现方式中任一实现方式，在第一方面的第六种可能的实现方式中，所述方法还包括：
所述第一设备接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第一方面至第一方面的第六种可能的实现方式中任一实现方式，在第一方面的第七种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
第二方面，本发明实施例提供一种软件安全验证方法，包括：
第二设备确定VNF的VNF包安全验证的结果；
当所述第二设备确定所述VNF的VNF包安全验证成功时，所述第二设备对虚拟机VM进行网络连接，所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
结合第二方面，在第二方面的第一种可能的实现方式中，所述方法还包括：
当所述第二设备确定所述VNF的VNF包安全验证失败时，所述第二设备终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
结合第二方面或第二方面的第一种可能的实现方式中任一实现方式，在第二方面的第二种可能的实现方式中，所述第二设备确定所 述VNF的VNF包安全验证的结果，包括：
所述第二设备接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
所述第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证的结果。
结合第二方面或第二方面的第一种可能的实现方式中任一实现方式，在第二方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备，所述方法还包括：
所述第二设备接收所述第一设备发送的第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；
所述当所述第二设备确定所述VNF的VNF包安全验证成功时，所述第二设备对所述VM进行网络连接，包括：
当所述第二设备确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，所述第二设备对所述VM进行网络连接。
结合第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证，包括：
所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
结合第二方面的第三种可能的实现方式，在第二方面的第五种可能的实现方式中，所述第二设备接收所述第一设备发送的第一指示信息，包括：
所述第二设备接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接， 所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第二方面的第三种可能的实现方式，在第二方面的第六种可能的实现方式中，所述第二设备接收所述第一设备发送的第一指示信息，包括：
所述第二设备接收所述第一设备发送的第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第二方面的第三种可能的实现方式至第二方面的第六种可能的实现方式中任一实现方式，在第二方面的第七种可能的实现方式中，所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证之后，还包括：
所述第二设备向所述第一设备发送第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第二方面至第二方面的第七种可能的实现方式中任一实现方式，在第二方面的第八种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
第三方面，本发明实施例提供一种第一设备，包括：
安全验证单元，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
发送单元，用于当所述安全验证单元的验证结果为所述VNF的VNF包安全验证成功时，向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
结合第三方面，在第三方面的第一种可能的实现方式中，
所述第一设备还包括终止单元，用于当所述VNF的VNF包安全验证失败时，终止对所述VNF实例化；
或者，所述发送单元，还用于当所述VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
结合第三方面或第三方面的第一种可能的实现方式中任一实现方式，在第三方面的第二种可能的实现方式中，所述VNF的VNF包包含所述VNF的软件镜像；
所述安全验证单元，还用于对所述VNF的软件镜像进行安全验证。
结合第三方面或第三方面的第一种可能的实现方式中任一实现方式，在第三方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，
所述发送单元，还用于向所述第二设备发送第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
结合第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，
所述发送单元，还用于向所述第二设备发送第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第三方面的第三种可能的实现方式，在第三方面的第五种可能的实现方式中，
所述发送单元，还用于向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第三方面的第三种可能的实现方式至第三方面的第五种可 能的实现方式中任一实现方式，
所述第一设备还包括接收单元，用于接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第三方面至第三方面的第六种可能的实现方式中任一实现方式，在第三方面的第七种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
第四方面，本发明实施例提供一种第二设备，包括：
安全验证单元，用于确定VNF的VNF包安全验证的结果；
资源管理单元，用于当所述安全验证单元确定所述VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接，所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
结合第四方面，在第四方面的第一种可能的实现方式中，
所述第二设备还包括终止单元，用于当所述安全验证单元确定所述VNF的VNF包安全验证失败时，终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
结合第四方面或第四方面的第一种可能的实现方式中任一实现方式，在第四方面的第二种可能的实现方式中，
所述第二设备还包括接收单元，用于接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
所述安全验证单元，还用于根据所述接收单元接收的所述第一结果信息确定所述VNF的VNF包安全验证的结果。
结合第四方面或第四方面的第一种可能的实现方式中任一实现方式，在第四方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备；
所述第二设备还包括接收单元，用于接收所述第一设备发送的第 一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
所述安全验证单元，还用于根据所述接收单元接收的所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；
所述资源管理单元，所述还用于当所述安全验证单元确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，对所述VM进行网络连接。
结合第四方面的第三种可能的实现方式，在第四方面的第四种可能的实现方式中，
所述安全验证单元，还用于当所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
结合第四方面的第三种可能的实现方式，在第四方面的第五种可能的实现方式中，
所述接收单元，还用于接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第四方面的第三种可能的实现方式，在第四方面的第六种可能的实现方式中，
所述接收单元，还用于接收所述第一设备发送的第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第四方面的第三种可能的实现方式至第四方面的第六种可能的实现方式中任一实现方式，在第四方面的第七种可能的实现方式中，
所述第二设备还包括发送单元，用于向所述第一设备发送第二结 果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第四方面至第四方面的第七种可能的实现方式中任一实现方式，在第四方面的第八种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
第五方面，本发明实施例提供一种第一设备，包括：处理器、存储器、总线及发送器，所述处理器、所述存储器及所述发送器通过所述总线相互连接；
所述处理器，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
所述发送器，用于当所述处理器的验证结果为所述VNF的VNF包安全验证成功时，向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
结合第五方面，在第五方面的第一种可能的实现方式中，
所述处理器，还用于当所述VNF的VNF包安全验证失败时，终止对所述VNF实例化；
或者，所述发送器，还用于当所述VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
结合第五方面或第五方面的第一种可能的实现方式中任一实现方式，在第五方面的第二种可能的实现方式中，所述VNF的VNF包包含所述VNF的软件镜像；
所述处理器，还用于对所述VNF的软件镜像进行安全验证。
结合第五方面或第五方面的第一种可能的实现方式中任一实现方式，在第五方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，
所述发送器，还用于向所述第二设备发送第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
结合第五方面的第三种可能的实现方式，在第五方面的第四种可能的实现方式中，
所述发送器，还用于向所述第二设备发送第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第五方面的第三种可能的实现方式，在第五方面的第五种可能的实现方式中，
所述发送器，还用于向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第五方面的第三种可能的实现方式至第五方面的第五种可能的实现方式中任一实现方式，
所述第一设备还包括接收器，用于接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第五方面至第五方面的第六种可能的实现方式中任一实现方式，在第五方面的第七种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
第六方面，本发明实施例提供一种第二设备，包括：处理器、存储器及总线，所述处理器及所述存储器通过所述总线相互连接；
所述处理器，用于确定VNF的VNF包安全验证的结果；当确定所述VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接， 所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
结合第六方面，在第六方面的第一种可能的实现方式中，
所述处理器，还用于当确定所述VNF的VNF包安全验证失败时，终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
结合第六方面或第六方面的第一种可能的实现方式中任一实现方式，在第六方面的第二种可能的实现方式中，
所述第二设备还包括接收器，用于接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
所述处理器，还用于根据所述接收器接收的所述第一结果信息确定所述VNF的VNF包安全验证的结果。
结合第六方面或第六方面的第一种可能的实现方式中任一实现方式，在第六方面的第三种可能的实现方式中，所述VNF的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备；
所述第二设备还包括接收器，用于接收所述第一设备发送的第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
所述处理器，还用于根据所述接收器接收的所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；当确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，对所述VM进行网络连接。
结合第六方面的第三种可能的实现方式，在第六方面的第四种可能的实现方式中，
所述处理器，还用于当所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
结合第六方面的第三种可能的实现方式，在第六方面的第五种可 能的实现方式中，
所述接收器，还用于接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
结合第六方面的第三种可能的实现方式，在第六方面的第六种可能的实现方式中，
所述接收器，还用于接收所述第一设备发送的第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
结合第六方面的第三种可能的实现方式至第六方面的第六种可能的实现方式中任一实现方式，在第六方面的第七种可能的实现方式中，
所述第二设备还包括发送器，用于向所述第一设备发送第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
结合第六方面至第六方面的第七种可能的实现方式中任一实现方式，在第六方面的第八种可能的实现方式中，
所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
本发明实施例提供的一种软件安全验证方法及设备，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全 验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种网络功能虚拟化系统结构示意图；
图2为本发明实施例提供的一种软件安全验证方法流程示意图；
图3为本发明实施例提供的另一种软件安全验证方法流程示意图；
图4为本发明另一实施例提供的一种软件安全验证方法流程示意图；
图5为本发明又一实施例提供的一种软件安全验证方法流程示意图；
图6为本发明实施例提供的一种第一设备结构示意图；
图7为本发明实施例提供的一种第二设备结构示意图；
图8为本发明另一实施例提供的一种第一设备结构示意图；
图9为本发明另一实施例提供的一种第二设备结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明的实施例提供一种网络功能虚拟化系统，参照图1所示，该网络功能虚拟化系统10包括NFVO(Network Functions  Virtualization Orchestrator，网络功能虚拟化编排器)101、VNFM(Virtualized Network Function Manager，虚拟网络功能管理器)102、VIM(Virtualised Infrastructure Manager，虚拟基础设备管理器)103、OSS/BSS(Operations and Business Support Systems，运营和业务支撑系统)104、EM(Element Management，网元管理器)105、VNF(Virtualised Network Function，虚拟网络功能)106、NFVI(Network Function Virtulization Infrastructure，网络功能虚拟化基础设施)107。
其中，NFVO101，用于对NFV的基础设施资源及软件资源进行网络侧的编排和管理，以及在NFVI107上实现NFV业务拓扑。
VNFM102，用于对VNF实例的生命周期进行管理。
VIM103，用于控制和管理实现计算、存储和网络资源以及它们的虚拟化的实体。
OSS/BSS104，用于网络管理、系统管理、计费、账务、客户服务等等。
EM105，管理网络单元。
VNF106，对应于传统非虚拟化网络中的PNF(Physical network function，物理网络功能)，如虚拟化的EPC(Evolved Packet Core，演进分组核心)节点，实现特定的网络功能。VNF可以由多个更低级别的组件来组成。因此，一个VNF可以部署在多个VM上，每个VM控制一个VNF组件。
NFVI107，由硬件资源、虚拟资源及虚拟层组成，是提供所需虚拟资源的实体。
应理解，本发明中所说的VNF可以是一个VNF，也可以是一个VNF的一部分，例如一个VNFC(Virtualised Network Function Component，虚拟网络功能部件)，对此，本发明不做限制，VNF只用于表示是一个VNF或一个VNF中的一个VNFC，或一个VNF中的多个VNFC，而并不用于限定。
本发明实施例提供一种软件安全验证方法，应用于第一设备，可选的，本实施例提供的信息安全验证方法可以在图1所示的网络功能 虚拟化系统中实现，参照图2所示，本实施例提供的软件安全验证方法，当第一设备接收到VNF(Virtualised Network Function，虚拟网络功能)的实例化请求后，且在第二设备对VM(Virtual Machine，虚拟机)进行网络连接之前，VM是第二设备为第一虚拟网络功能VNF创建的VM，包括：
201、第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证。
需要说明的是，VNF的实例化流程包括：S1、验证VNF的实例化请求并确认；S2、实例化可行性检查、S3、为VNF分配资源并建立连接；S4、实例化结束。当然，此处只是举例说明VNF实例化的主要步骤，并不代表本发明局限于此。S2步骤可以执行也可以不执行。在执行VNF实例化流程的过程中，同步执行对VNF的VNF包进行安全验证的操作，这样，就节省了实例化的时间长度。第一设备对VNF的VNF包进行安全验证可以是在VNF的实例化流程中的任一步骤开始，当然，为节省时间，越早越好，最优的方案是在第一设备接收到VNF的实例化请求之后就开始对VNF的VNF包进行安全验证。
可选的，VNF的VNF包可能包含或不包含VNF的软件镜像，当然，对VNF的VNF包进行安全验证的方法，本发明不做限制。
可选的，在一种应用场景中，当VNF的VNF包包含VNF的软件镜像时，第一设备对已经存储的VNF的VNF包进行安全验证，包括第一设备对VNF的软件镜像进行安全验证。
或者可选的，在另一种应用场景中，当VNF的VNF包不包含VNF的软件镜像时，如果VNF的VNF包安全验证成功，则第一设备向第二设备发送第一指示信息，第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证，第二设备存储了VNF的软件镜像。
此时，对应VNF的实例化流程，可选的，第一设备可以向第二设备发送第二指示消息，第二指示消息用于指示第二设备为VNF分 配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备；或者，可选的，第一设备向第二设备发送第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第二指示消息中发送至第二设备。
可选的，如果第一设备向第二设备发送了第一指示信息，则第一设备还可以接收第二设备发送的第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
202、当VNF的VNF包安全验证成功时，第一设备可以向第二设备发送第一结果信息。
其中，第一结果信息包含VNF的VNF包安全验证成功的信息。第一设备向第二设备发送第一结果信息，以便第二设备根据第一结果信息确定VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，VM是第二设备为VNF创建的VM。
优选的，第一设备可以是图1所示的网络功能虚拟化系统10中的NFVO101，第二设备可以是图1所示的网络功能虚拟化系统10中的VIM103，当然，此处只是举例说明，并不代表本发明局限于此。
可选的，当VNF的VNF包安全验证失败时，第一设备终止对VNF实例化，或者，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证失败的信息。
本发明实施例提供的软件安全验证方法，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
本发明实施例提供另一种软件安全验证方法，应用于第二设备， 可选的，本实施例提供的信息安全验证方法可以在图1所示的网络功能虚拟化系统中实现，参照图3所示，本实施例提供的软件安全验证方法，在第二设备对VM(Virtual Machine，虚拟机)进行网络连接之前，VM是第二设备为第一虚拟网络功能VNF创建的VM，包括：
301、第二设备确定VNF的VNF包安全验证的结果。
可选的，结合图2对应的实施例中步骤201中的描述，第一设备对VNF的VNF包进行安全验证时，VNF的VNF包可能包含或者不包含VNF的软件镜像。
可选的，在一种应用场景中，VNF的VNF包包含VNF的软件镜像，第二设备可以接收第一设备发送的第一结果信息，因为VNF包包含VNF的软件镜像，因此，第一结果信息包含VNF的软件镜像安全验证的结果；第二设备根据第一结果信息确定VNF的VNF包安全验证的结果即可。
或者，可选的，在另一应用场景中，VNF的VNF包不包含VNF的软件镜像，VNF的软件镜像存储于第二设备，第二设备可以接收第一设备发送的第一指示信息，第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证；第二设备根据第一指示信息对VNF的软件镜像进行安全验证，并确定VNF的软件镜像安全验证的结果，再根据第一结果信息确定VNF的VNF包安全验证的结果。
此时，对应VNF的实例化流程，可选的，第二设备接收第一设备发送的第二指示消息，第二指示消息用于指示第二设备为VNF分配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备；或者，可选的，第二设备接收第一设备发送的第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第三指示消息中发送至第二设备。
302、当第二设备确定VNF的VNF包安全验证成功时，第二设备对VM进行网络连接。
优选的，结合步骤301中的描述，当VNF的VNF包不包含VNF的软件镜像时，第二设备确定VNF的VNF包及VNF的软件镜像安 全验证成功时，对VM进行网络连接。
可选的，当第二设备确定VNF的VNF包安全验证失败时，第二设备终止对VNF实例化，对VNF实例化包括对VM进行网络连接。进一步可选的，当VNF的VNF包不包含VNF的软件镜像时，如果第二设备确定VNF的VNF包或VNF的软件镜像安全验证失败时，终止对VNF实例化。
可选的，第二设备还可以向第一设备发送第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
此处需要说明的是，在一种优选的应用场景中，第二设备需要确定VNF的VNF包及VNF的软件镜像安全验证都成功时，才能对VM进行网络连接，如果VNF的VNF包或VNF的软件镜像安全验证失败，则证明VNF的VNF包或VNF的软件镜像被非法篡改，如果接入网络会对网络安全造成威胁，因此必须在VM进行网络连接之前确定VNF的VNF包及VNF的软件镜像安全验证的结果。此处对VM进行网络连接，特指将VM连接到VNF的内部网络。
优选的，第一设备可以是图1所示的网络功能虚拟化系统10中的NFVO101，第二设备可以是图1所示的网络功能虚拟化系统10中的VIM103，当然，此处只是举例说明，并不代表本发明局限于此。
本发明实施例提供的软件安全验证方法，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第二设备确定VNF的VNF包安全验证的结果，当第二设备确定VNF的VNF包安全验证成功时，第二设备对VM进行网络连接。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图2和图3对应的实施例，本发明另一实施例提供一种软件安全验证方法，应用于图1所示的网络功能虚拟化系统10，本发明以第一设备是图1中的NFVO101，第二设备是图1中的VIM103为例进行说明，本实施例中，第一设备存储的VNF的VNF包不包含 VNF的软件镜像，VNF的软件镜像存储在第二设备中，当然，本实施例只是举例说明，并不代表本发明局限于此，参照图4所示，包括以下步骤：
401、NFVO接收VNF的实例化请求。
该VNF的实例化请求由OSS发送至NFVO(第一设备)。
402、NFVO对VNF的实例化请求进行验证。
NFVO验证VNF的实例化请求的有效性，当确认VNF的实例化请求有效时，执行步骤405。
403、NFVO对VNF的VNF包进行安全验证。
404、NFVO确定VNF的VNF包安全验证的结果。
405、NFVO确认对VNF进行实例化。
可选的，NFVO还可以向VNFM发送VNF的实例化请求，VNFM验证VNF的实例化请求并进行处理，包括修改/补充VNFD(Virtualised Network Function Descriptor，虚拟网络功能描述器)中的实例化输入数据以及VNF生命周期特定的参数。
可选的，步骤403步骤405之间还可以包括步骤404a-404d：
404a、NFVO和VNFM之间进行实例化可行性检查。
404b、NFVO向VIM发送资源可用性检查指示。
可选的，当执行步骤404a-404d时，第一指示信息可以与资源可用性检查指示同时发送至VIM。第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证。
404c、VIM检查资源可用性。
404d、VIM向NFVO发送资源可用性检查结果。
需要说明的是，步骤403及步骤405是同步进行的，当NFVO确定VNF的VNF包安全验证成功时，步骤403和步骤405之后，还包括：
406、NFVO向VIM发送第二指示消息。
第二指示消息用于指示第二设备为VNF分配资源并建立连接。如果步骤404b未执行或步骤404b中第一指示信息没有发送，可以在 第二指示消息中包含第一指示信息发送至VIM。可选的，第一结果信息与第二指示消息可以同时发送至VIM，第一结果信息用于指示VNF的VNF包安全验证的结果，当然，此处，VNF的VNF包安全验证成功。可选地，第一结果信息也可在步骤407后由NFVO单独发送给VIM。
407、VIM创建VM及内部网络。
VM为VIM为VNF实例创建的VM，内部网络是VNF内为各个VNFC之间互相连接而组成的网络。需要说明的是，VM可以包含多个VM，对此本发明不做限制。
408、VIM对VNF的软件镜像进行安全验证并确定验证结果。步骤407、408不分先后顺序。
可选的，步骤408在VIM收到第一指示信息之后执行。如果第一指示信息在步骤404b中发送至VIM，则步骤404b之后，VIM就可以对VNF的软件镜像进行安全验证；如果第一指示信息在步骤406中发送至VIM，则步骤406之后，VIM就可以对VNF的软件镜像进行安全验证。
当VIM确定VNF的软件镜像安全验证成功时，还包括：
409、VIM对VM进行网络连接。
对VM进行网络连接是将VM连接入VNF的内部网络。
410、VIM向NFVO发送资源分配完成确认。
可选的，资源分配完成确认可以与第二结果信息一起发送至NFVO，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。此处，VNF的软件镜像安全验证成功。
当VIM确定VNF的软件镜像安全验证失败时，还包括：
411、VIM向NFVO发送第二结果信息。
此处，第二结果信息指示第二设备对VNF的软件镜像安全验证失败。
本发明实施例提供的软件安全验证方法，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备 根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图2和图3对应的实施例，本发明又一实施例提供一种软件安全验证方法，应用于图1所示的网络功能虚拟化系统10，本发明以第一设备是图1中的NFVO101，第二设备是图1中的VIM103为例进行说明，本实施例中，第一设备存储的VNF的VNF包包含VNF的软件镜像，当然，本实施例只是举例说明，并不代表本发明局限于此，参照图5所示，包括以下步骤：
501、NFVO接收VNF的实例化请求。
该VNF的实例化请求由EM发送至NFVO(第一设备)。
502、NFVO对VNF的实例化请求进行验证。
NFVO验证VNF的实例化请求的有效性，当确认VNF的实例化请求有效时，执行步骤503。
503、NFVO对VNF的VNF包进行安全验证。
此处，需要说明的是，NFVO存储的VNF的VNF包包含了VNF的软件镜像。NFVO对VNF的VNF包进行安全验证包含了对VNF的软件镜像进行安全验证。
504、NFVO确定VNF的VNF包安全验证的结果。
505、NFVO确认对VNF进行实例化。
可选的，NFVO还可以向VNFM发送VNF的实例化请求，VNFM验证VNF的实例化请求并进行处理，包括修改/补充VNFD(Virtualised Network Function Descriptor，虚拟网络功能描述器)中的实例化输入数据以及VNF生命周期特定的参数。
可选的，步骤503步骤505之间还可以包括步骤504a-504b：
504a、创建资源预留，请求VIM为新实例化的VNF检查可用的资源并进行预留。
504b、VIM向NFVO发送预留结果。
506、NFVO向VIM发送第二指示消息。
第二指示消息用于指示第二设备为VNF分配资源并建立连接。
507、VIM创建VM及内部网络。
VM为VIM为VNF实例创建的VM，内部网络是VNF内为各个VNFC之间互相连接而组成的网络。需要说明的是，VM可以包含多个VM，对此本发明不做限制。
需要说明的是，步骤503及步骤505是同步进行的，步骤503之后，还包括：
508、NFVO向VIM发送第一结果信息。
第一结果信息用于指示VNF的VNF包安全验证的结果。其中，可选地，步骤508也可以和步骤506合并，即第一结果信息也可以携带于第二指示消息中发送。
509、VIM确定VNF的VNF包安全验证的结果。
当VIM确定VNF的软件镜像安全验证成功时，还包括：
510、VIM对VM进行网络连接。VIM将新创建的VM连接到内部网络。
对VM进行网络连接是将VM连接VNF的内部网络。
511、VIM向NFVO发送资源分配完成确认。
本发明实施例提供的软件安全验证方法，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省 了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图2对应的实施例，本发明实施例提供一种第一设备，用于执行上述图2对应的实施例中所描述的软件安全验证方法，优选的，可以应用于图1所示的网络功能虚拟化系统10，本实施例提供的第一设备可以是图1中的NFVO101。参照图6所示，该第一设备60包括：安全验证单元601和发送单元602。
其中，安全验证单元601，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证。
发送单元602，用于当安全验证单元601的验证结果为VNF的VNF包安全验证成功时，向第二设备发送第一结果信息，以便第二设备根据第一结果信息确定VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，VM是第二设备为VNF创建的VM，第一结果信息包含VNF的VNF包安全验证成功的信息。
可选的，第一设备60还包括终止单元603，用于当VNF的VNF包安全验证失败时，终止对VNF实例化。
或者，发送单元602，还用于当VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证失败的信息。
可选的，在一种应用场景中，VNF的VNF包包含VNF的软件镜像。
安全验证单元601，还用于对VNF的软件镜像进行安全验证。
可选的，在另一种应用场景中，VNF的VNF包不包含VNF的软件镜像。
发送单元602，还用于向第二设备发送第一指示信息，第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证，第二设备存储了VNF的软件镜像。
具体可选的，发送单元602，还用于向第二设备发送第二指示消 息，第二指示消息用于指示第二设备为VNF分配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备。
或者，具体可选的，发送单元602，还用于向第二设备发送第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第三指示消息中发送至第二设备。
第一设备60还包括接收单元604，用于接收第二设备发送的第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
可选的，第一设备为网络功能虚拟化编排器NFVO，第二设备为虚拟基础设备管理器VIM。
本发明实施例提供的第一设备，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图3对应的实施例，本发明实施例提供一种第二设备，用于执行上述图3对应的实施例中所描述的软件安全验证方法，优选的，可以应用于图1所示的网络功能虚拟化系统10，本实施例提供的第二设备可以是图1中的VIM103。参照图7所示，该第一设备70包括：安全验证单元701和资源管理单元702。
安全验证单元701，用于确定VNF的VNF包安全验证的结果。
资源管理单元702，用于当安全验证单元701确定VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接，VM是第二设备为第一虚拟网络功能VNF创建的VM。
可选的，第二设备70还包括终止单元703，用于当安全验证单 元701确定VNF的VNF包安全验证失败时，终止对VNF实例化，对VNF实例化包括对VM进行网络连接。
可选的，在一种应用场景中，
第二设备70还包括接收单元704，用于接收第一设备发送的第一结果信息，第一结果信息包含VNF的VNF包安全验证的结果。
安全验证单元701，还用于根据接收单元704接收的第一结果信息确定VNF的VNF包安全验证的结果。
可选的，在另一种应用场景中，VNF的VNF包不包含VNF的软件镜像，VNF的软件镜像存储于第二设备。
接收单元70，用于接收第一设备发送的第一指示信息，第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证。
安全验证单元701，还用于根据接收单元704接收的第一指示信息对VNF的软件镜像进行安全验证，并确定VNF的软件镜像安全验证的结果。
资源管理单元702，还用于当安全验证单元701确定VNF的VNF包及VNF的软件镜像安全验证成功时，对VM进行网络连接。
具体可选的，安全验证单元701，还用于当第二设备为VNF创建VM及为VM进行网络连接的同时，根据第一指示信息对VNF的软件镜像进行安全验证。
具体可选的，接收单元704，还用于接收第一设备发送的第二指示消息，第二指示消息用于指示第二设备为VNF分配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备。
具体可选的，接收单元704，还用于接收第一设备发送的第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第三指示消息中发送至第二设备。
可选的，第二设备70还包括发送单元705，用于向第一设备发送第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
可选的，第一设备为网络功能虚拟化编排器NFVO，第二设备为 虚拟基础设备管理器VIM。
本发明实施例提供的第二设备，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，确定VNF的VNF包安全验证的结果，当第二设备确定VNF的VNF包安全验证成功时，第二设备对VM进行网络连接。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图2对应的实施例，本发明另一实施例提供一种第一设备，用于执行上述图2对应的实施例中所描述的软件安全验证方法，优选的，可以应用于图1所示的网络功能虚拟化系统10，本实施例提供的第一设备可以是图1中的NFVO101。参照图8所示，该第一设备80包括：至少一个处理器801、存储器802、总线803和发送器804，该至少一个处理器801、存储器802和发送器804通过总线803连接并完成相互间的通信。
该总线803可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component，外部设备互连)总线或EISA(Extended Industry Standard Architecture，扩展工业标准体系结构)总线等。该总线803可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。其中：
存储器802用于执行本发明方案的应用程序代码，执行本发明方案的应用程序代码保存在存储器中，并由处理器801来控制执行。
该存储器可以是只读存储器ROM或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器EEPROM、只读光盘CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结 构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。这些存储器通过总线与处理器相连接。
处理器801可能是一个中央处理器801(Central Processing Unit，简称为CPU)，或者是特定集成电路(Application Specific Integrated Circuit，简称为ASIC)，或者是被配置成实施本发明实施例的一个或多个集成电路。
其中，处理器，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证。
发送器，用于当处理器的验证结果为VNF的VNF包安全验证成功时，向第二设备发送第一结果信息，以便第二设备根据第一结果信息确定VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，VM是第二设备为VNF创建的VM，第一结果信息包含VNF的VNF包安全验证成功的信息。
可选的，处理器801，还用于当VNF的VNF包安全验证失败时，终止对VNF实例化。
或者，发送器804，还用于当VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证失败的信息。
可选的，在一种应用场景中，VNF的VNF包包含VNF的软件镜像。
处理器801，还用于对VNF的软件镜像进行安全验证。
可选的，在另一种应用场景中，VNF的VNF包不包含VNF的软件镜像。
发送器804，还用于向第二设备发送第一指示信息，第一指示信息用于指示第二设备对VNF的软件镜像进行安全验证，第二设备存储了VNF的软件镜像。
具体可选的，发送器804，还用于向第二设备发送第二指示消息， 第二指示消息用于指示第二设备为VNF分配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备。
或者，具体可选的，发送器804，还用于向第二设备发送第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第三指示消息中发送至第二设备。
第一设备80还包括接收器805，用于接收第二设备发送的第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
可选的，第一设备为网络功能虚拟化编排器NFVO，第二设备为虚拟基础设备管理器VIM。
本发明实施例提供的第一设备，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，第一设备根据VNF的实例化请求开始对VNF进行实例化之时或开始对VNF进行实例化之后，对已经存储的VNF的VNF包进行安全验证，当VNF的VNF包安全验证成功时，第一设备向第二设备发送第一结果信息，第一结果信息包含VNF的VNF包安全验证成功的信息。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
基于上述图3对应的实施例，本发明另一实施例提供一种第二设备，用于执行上述图3对应的实施例中所描述的软件安全验证方法，优选的，可以应用于图1所示的网络功能虚拟化系统10，本实施例提供的第二设备可以是图1中的VIM103。参照图9所示，该第一设备90包括：至少一个处理器901、存储器902和总线903，该至少一个处理器901、存储器902通过总线903连接并完成相互间的通信。
该总线903可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component，外部设备互连)总线或EISA(Extended Industry Standard Architecture，扩展工业标准体系结构)总线等。该总线903可以分为地址总线、数据总线、控制总 线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。其中：
存储器902用于执行本发明方案的应用程序代码，执行本发明方案的应用程序代码保存在存储器中，并由处理器901来控制执行。
该存储器可以是只读存储器ROM或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器EEPROM、只读光盘CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。这些存储器通过总线与处理器相连接。
处理器901可能是一个中央处理器901(Central Processing Unit，简称为CPU)，或者是特定集成电路(Application Specific Integrated Circuit，简称为ASIC)，或者是被配置成实施本发明实施例的一个或多个集成电路。
处理器901，用于确定VNF的VNF包安全验证的结果。当确定VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接，VM是第二设备为第一虚拟网络功能VNF创建的VM。
可选的，处理器901，还用于当确定VNF的VNF包安全验证失败时，终止对VNF实例化，对VNF实例化包括对VM进行网络连接。
可选的，在一种应用场景中，
第二设备90还包括接收器904，用于接收第一设备发送的第一结果信息，第一结果信息包含VNF的VNF包安全验证的结果。
处理器901，还用于根据接收器904接收的第一结果信息确定VNF的VNF包安全验证的结果。
可选的，在另一种应用场景中，VNF的VNF包不包含VNF的软件镜像，VNF的软件镜像存储于第二设备。
接收器90，用于接收第一设备发送的第一指示信息，第一指示 信息用于指示第二设备对VNF的软件镜像进行安全验证。
处理器901，还用于根据接收器904接收的第一指示信息对VNF的软件镜像进行安全验证，并确定VNF的软件镜像安全验证的结果。当确定VNF的VNF包及VNF的软件镜像安全验证成功时，对VM进行网络连接。
具体可选的，处理器901，还用于当第二设备为VNF创建VM及为VM进行网络连接的同时，根据第一指示信息对VNF的软件镜像进行安全验证。
具体可选的，接收器904，还用于接收第一设备发送的第二指示消息，第二指示消息用于指示第二设备为VNF分配资源并建立连接，第一指示信息包含在第二指示消息中发送至第二设备。
具体可选的，接收器904，还用于接收第一设备发送的第三指示消息，第三指示消息用于指示第二设备为VNF进行资源可用性检查，第一指示信息包含在第三指示消息中发送至第二设备。
可选的，第二设备90还包括发送器905，用于向第一设备发送第二结果信息，第二结果信息包含第二设备对VNF的软件镜像安全验证的结果。
可选的，第一设备为网络功能虚拟化编排器NFVO，第二设备为虚拟基础设备管理器VIM。
本发明实施例提供的第二设备，当第一设备接收到VNF的实例化请求后，且在第二设备对VM进行网络连接之前，确定VNF的VNF包安全验证的结果，当第二设备确定VNF的VNF包安全验证成功时，第二设备对VM进行网络连接。因为在执行VNF的实例化流程的同时对VNF的VNF包进行安全验证，相比于现有技术在实例化之前对VNF的VNF包进行安全验证，节省了时间，减小了VNF实例化的时延，提高了VNF实例化的性能。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (51)

  1. 一种软件安全验证方法，其特征在于，在第一设备接收到虚拟网络功能VNF的实例化请求后，包括：
    所述第一设备根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
    当所述VNF的VNF包安全验证成功时，所述第一设备向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    当所述VNF的VNF包安全验证失败时，所述第一设备终止对所述VNF实例化，或者，所述第一设备向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述VNF的VNF包包含所述VNF的软件镜像；
    所述第一设备对已经存储的所述VNF的VNF包进行安全验证，包括：
    所述第一设备对所述VNF的软件镜像进行安全验证。
  4. 根据权利要求1或2所述的方法，其特征在于，所述VNF的VNF包不包含所述VNF的软件镜像，所述方法还包括：
    所述第一设备向所述第二设备发送第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
  5. 根据权利要求4所述的方法，其特征在于，所述第一设备向所述第二设备发送第一指示信息，包括：
    所述第一设备向所述第二设备发送第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述 第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  6. 根据权利要求4所述的方法，其特征在于，所述第一设备向所述第二设备发送第一指示信息，包括：
    所述第一设备向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  7. 根据权利要求4-6任一项所述的方法，其特征在于，所述方法还包括：
    所述第一设备接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
  9. 一种软件安全验证方法，其特征在于，包括：
    第二设备确定VNF的VNF包安全验证的结果；
    当所述第二设备确定所述VNF的VNF包安全验证成功时，所述第二设备对虚拟机VM进行网络连接，所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    当所述第二设备确定所述VNF的VNF包安全验证失败时，所述第二设备终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
  11. 根据权利要求9或10所述的方法，其特征在于，所述第二设备确定所述VNF的VNF包安全验证的结果，包括：
    所述第二设备接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
    所述第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证的结果。
  12. 根据权利要求9或10所述的方法，其特征在于，所述VNF 的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备，所述方法还包括：
    所述第二设备接收所述第一设备发送的第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
    所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；
    所述当所述第二设备确定所述VNF的VNF包安全验证成功时，所述第二设备对所述VM进行网络连接，包括：
    当所述第二设备确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，所述第二设备对所述VM进行网络连接。
  13. 根据权利要求12所述的方法，其特征在于，所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证，包括：
    所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
  14. 根据权利要求12所述的方法，其特征在于，所述第二设备接收所述第一设备发送的第一指示信息，包括：
    所述第二设备接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  15. 根据权利要求12所述的方法，其特征在于，所述第二设备接收所述第一设备发送的第一指示信息，包括：
    所述第二设备接收所述第一设备发送的第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  16. 根据权利要求12-15任一项所述的方法，其特征在于，所述第二设备根据所述第一指示信息对所述VNF的软件镜像进行安全验证之后，还包括：
    所述第二设备向所述第一设备发送第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  17. 根据权利要求9-16任一项所述的方法，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
  18. 一种第一设备，其特征在于，包括：
    安全验证单元，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
    发送单元，用于当所述安全验证单元的验证结果为所述VNF的VNF包安全验证成功时，向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
  19. 根据权利要求18所述的设备，其特征在于，
    所述第一设备还包括终止单元，用于当所述VNF的VNF包安全验证失败时，终止对所述VNF实例化；
    或者，所述发送单元，还用于当所述VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
  20. 根据权利要求18或19所述的设备，其特征在于，所述VNF的VNF包包含所述VNF的软件镜像；
    所述安全验证单元，还用于对所述VNF的软件镜像进行安全验证。
  21. 根据权利要求18或19所述的设备，其特征在于，所述VNF的VNF包不包含所述VNF的软件镜像；
    所述发送单元，还用于向所述第二设备发送第一指示信息，所述 第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
  22. 根据权利要求21所述的设备，其特征在于，
    所述发送单元，还用于向所述第二设备发送第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  23. 根据权利要求21所述的设备，其特征在于，
    所述发送单元，还用于向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  24. 根据权利要求21-23任一项所述的设备，其特征在于，
    所述第一设备还包括接收单元，用于接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  25. 根据权利要求18-24任一项所述的设备，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
  26. 一种第二设备，其特征在于，包括：
    安全验证单元，用于确定VNF的VNF包安全验证的结果；
    资源管理单元，用于当所述安全验证单元确定所述VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接，所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
  27. 根据权利要求26所述的设备，其特征在于，
    所述第二设备还包括终止单元，用于当所述安全验证单元确定所述VNF的VNF包安全验证失败时，终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
  28. 根据权利要求26或27所述的设备，其特征在于，
    所述第二设备还包括接收单元，用于接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
    所述安全验证单元，还用于根据所述接收单元接收的所述第一结果信息确定所述VNF的VNF包安全验证的结果。
  29. 根据权利要求26或27所述的设备，其特征在于，所述VNF的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备；
    所述第二设备还包括接收单元，用于接收所述第一设备发送的第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
    所述安全验证单元，还用于根据所述接收单元接收的所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；
    所述资源管理单元，所述还用于当所述安全验证单元确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，对所述VM进行网络连接。
  30. 根据权利要求29所述的设备，其特征在于，
    所述安全验证单元，还用于当所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
  31. 根据权利要求29所述的设备，其特征在于，
    所述接收单元，还用于接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  32. 根据权利要求29所述的设备，其特征在于，
    所述接收单元，还用于接收所述第一设备发送的第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用 性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  33. 根据权利要求29-32任一项所述的设备，其特征在于，
    所述第二设备还包括发送单元，用于向所述第一设备发送第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  34. 根据权利要求26-33任一项所述的设备，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
  35. 一种第一设备，其特征在于，包括：处理器、存储器、总线及发送器，所述处理器、所述存储器及所述发送器通过所述总线相互连接；
    所述处理器，用于在第一设备接收到虚拟网络功能VNF的实例化请求后，并根据所述VNF的实例化请求开始对所述VNF进行实例化之时或开始对所述VNF进行实例化之后，对已经存储的所述VNF的VNF包进行安全验证；
    所述发送器，用于当所述处理器的验证结果为所述VNF的VNF包安全验证成功时，向第二设备发送所述第一结果信息，以便第二设备根据所述第一结果信息确定所述VNF的VNF包安全验证成功后，对虚拟机VM进行网络连接，所述VM是所述第二设备为所述VNF创建的VM，所述第一结果信息包含所述VNF的VNF包安全验证成功的信息。
  36. 根据权利要求35所述的设备，其特征在于，
    所述处理器，还用于当所述VNF的VNF包安全验证失败时，终止对所述VNF实例化；
    或者，所述发送器，还用于当所述VNF的VNF包安全验证失败时，向第二设备发送第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证失败的信息。
  37. 根据权利要求35或36所述的设备，其特征在于，所述VNF 的VNF包包含所述VNF的软件镜像；
    所述处理器，还用于对所述VNF的软件镜像进行安全验证。
  38. 根据权利要求35或36所述的设备，其特征在于，所述VNF的VNF包不包含所述VNF的软件镜像；
    所述发送器，还用于向所述第二设备发送第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证，所述第二设备存储了所述VNF的软件镜像。
  39. 根据权利要求38所述的设备，其特征在于，
    所述发送器，还用于向所述第二设备发送第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  40. 根据权利要求38所述的设备，其特征在于，
    所述发送器，还用于向所述第二设备发送第三指示消息，所述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  41. 根据权利要求38-40任一项所述的设备，其特征在于，
    所述第一设备还包括接收器，用于接收所述第二设备发送的第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  42. 根据权利要求35-41任一项所述的设备，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
  43. 一种第二设备，其特征在于，包括：处理器、存储器及总线，所述处理器及所述存储器通过所述总线相互连接；
    所述处理器，用于确定VNF的VNF包安全验证的结果；当确定所述VNF的VNF包安全验证成功时，对虚拟机VM进行网络连接，所述VM是所述第二设备为第一虚拟网络功能VNF创建的VM。
  44. 根据权利要求43所述的设备，其特征在于，
    所述处理器，还用于当确定所述VNF的VNF包安全验证失败时， 终止对所述VNF实例化，对所述VNF实例化包括对所述VM进行网络连接。
  45. 根据权利要求43或44所述的设备，其特征在于，
    所述第二设备还包括接收器，用于接收所述第一设备发送的第一结果信息，所述第一结果信息包含所述VNF的VNF包安全验证的结果；
    所述处理器，还用于根据所述接收器接收的所述第一结果信息确定所述VNF的VNF包安全验证的结果。
  46. 根据权利要求43或44所述的设备，其特征在于，所述VNF的VNF包不包含所述VNF的软件镜像，所述VNF的软件镜像存储于所述第二设备；
    所述第二设备还包括接收器，用于接收所述第一设备发送的第一指示信息，所述第一指示信息用于指示所述第二设备对所述VNF的软件镜像进行安全验证；
    所述处理器，还用于根据所述接收器接收的所述第一指示信息对所述VNF的软件镜像进行安全验证，并确定所述VNF的软件镜像安全验证的结果；当确定所述VNF的VNF包及所述VNF的软件镜像安全验证成功时，对所述VM进行网络连接。
  47. 根据权利要求46所述的设备，其特征在于，
    所述处理器，还用于当所述第二设备为所述VNF创建所述VM及为所述VM进行网络连接的同时，根据所述第一指示信息对所述VNF的软件镜像进行安全验证。
  48. 根据权利要求46所述的设备，其特征在于，
    所述接收器，还用于接收所述第一设备发送的第二指示消息，所述第二指示消息用于指示所述第二设备为所述VNF分配资源并建立连接，所述第一指示信息包含在所述第二指示消息中发送至所述第二设备。
  49. 根据权利要求46所述的设备，其特征在于，
    所述接收器，还用于接收所述第一设备发送的第三指示消息，所 述第三指示消息用于指示所述第二设备为所述VNF进行资源可用性检查，所述第一指示信息包含在所述第三指示消息中发送至所述第二设备。
  50. 根据权利要求46-49任一项所述的设备，其特征在于，
    所述第二设备还包括发送器，用于向所述第一设备发送第二结果信息，所述第二结果信息包含所述第二设备对所述VNF的软件镜像安全验证的结果。
  51. 根据权利要求43-50任一项所述的设备，其特征在于，
    所述第一设备为网络功能虚拟化编排器NFVO，所述第二设备为虚拟基础设备管理器VIM。
PCT/CN2015/078136 2015-04-30 2015-04-30 一种软件安全验证方法、设备及系统 WO2016172978A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2017556567A JP6449487B2 (ja) 2015-04-30 2015-04-30 ソフトウェアセキュリティ検証方法、デバイス、およびシステム
PCT/CN2015/078136 WO2016172978A1 (zh) 2015-04-30 2015-04-30 一种软件安全验证方法、设备及系统
EP15890358.3A EP3282647B1 (en) 2015-04-30 2015-04-30 Software security verification method, equipment and system
CN201580042929.3A CN106576068B (zh) 2015-04-30 2015-04-30 一种软件安全验证方法、设备及系统
US15/795,623 US10757129B2 (en) 2015-04-30 2017-10-27 Software security verification method, device, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/078136 WO2016172978A1 (zh) 2015-04-30 2015-04-30 一种软件安全验证方法、设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/795,623 Continuation US10757129B2 (en) 2015-04-30 2017-10-27 Software security verification method, device, and system

Publications (1)

Publication Number Publication Date
WO2016172978A1 true WO2016172978A1 (zh) 2016-11-03

Family

ID=57198063

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/078136 WO2016172978A1 (zh) 2015-04-30 2015-04-30 一种软件安全验证方法、设备及系统

Country Status (5)

Country Link
US (1) US10757129B2 (zh)
EP (1) EP3282647B1 (zh)
JP (1) JP6449487B2 (zh)
CN (1) CN106576068B (zh)
WO (1) WO2016172978A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11258766B2 (en) * 2017-02-07 2022-02-22 Nec Corporation VNF package signing system and VNF package signing method

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9705849B2 (en) * 2014-09-30 2017-07-11 Intel Corporation Technologies for distributed detection of security anomalies
US10826943B2 (en) * 2018-08-21 2020-11-03 At&T Intellectual Property I, L.P. Security controller
CN112087311B (zh) * 2019-06-14 2022-04-12 华为技术有限公司 一种虚拟网络功能vnf部署方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103200072A (zh) * 2013-05-06 2013-07-10 吉林省金港计算机网络有限公司 一种基于网络的数据传输方法、装置及系统
WO2014110453A1 (en) * 2013-01-11 2014-07-17 Huawei Technologies Co., Ltd. Network function virtualization for a network device
US20140376555A1 (en) * 2013-06-24 2014-12-25 Electronics And Telecommunications Research Institute Network function virtualization method and apparatus using the same
CN104580208A (zh) * 2015-01-04 2015-04-29 华为技术有限公司 一种身份认证方法及装置

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9167501B2 (en) * 2011-08-29 2015-10-20 Telefonaktiebolaget L M Ericsson (Publ) Implementing a 3G packet core in a cloud computer with openflow data and control planes
US9992024B2 (en) * 2012-01-25 2018-06-05 Fujitsu Limited Establishing a chain of trust within a virtual machine
US9094308B2 (en) * 2012-06-06 2015-07-28 Juniper Networks, Inc. Finding latency through a physical network in a virtualized network
EP2957080B1 (en) * 2013-02-12 2020-06-10 Hewlett-Packard Enterprise Development LP Network control using software defined flow mapping and virtualized network functions
US9973375B2 (en) * 2013-04-22 2018-05-15 Cisco Technology, Inc. App store portal providing point-and-click deployment of third-party virtualized network functions
EP2849064B1 (en) * 2013-09-13 2016-12-14 NTT DOCOMO, Inc. Method and apparatus for network virtualization
US9760428B1 (en) * 2013-12-19 2017-09-12 Amdocs Software Systems Limited System, method, and computer program for performing preventative maintenance in a network function virtualization (NFV) based communication network
US9948493B2 (en) * 2014-04-03 2018-04-17 Centurylink Intellectual Property Llc Network functions virtualization interconnection gateway
US20150332351A1 (en) * 2014-05-16 2015-11-19 Centurylink Intellectual Property Llc System and Method for Service Provider Cloud Services - Cloud Marketplace
CN105282765A (zh) * 2014-06-30 2016-01-27 中兴通讯股份有限公司 一种管理配置信息的方法、设备及网元管理系统
JP6729400B2 (ja) * 2015-01-29 2020-07-22 日本電気株式会社 データファイル登録管理システム、方法、管理装置とプログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014110453A1 (en) * 2013-01-11 2014-07-17 Huawei Technologies Co., Ltd. Network function virtualization for a network device
CN103200072A (zh) * 2013-05-06 2013-07-10 吉林省金港计算机网络有限公司 一种基于网络的数据传输方法、装置及系统
US20140376555A1 (en) * 2013-06-24 2014-12-25 Electronics And Telecommunications Research Institute Network function virtualization method and apparatus using the same
CN104580208A (zh) * 2015-01-04 2015-04-29 华为技术有限公司 一种身份认证方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ETSI: "Network Functions Virtualisation (NFV); NFV Security; Security and Trust Guidance", ETSI GS NFV-SEC 003 V1.1.1, 31 December 2014 (2014-12-31), XP014235736 *
See also references of EP3282647A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11258766B2 (en) * 2017-02-07 2022-02-22 Nec Corporation VNF package signing system and VNF package signing method

Also Published As

Publication number Publication date
EP3282647A1 (en) 2018-02-14
EP3282647A4 (en) 2018-05-16
US10757129B2 (en) 2020-08-25
US20180063184A1 (en) 2018-03-01
EP3282647B1 (en) 2019-12-11
JP6449487B2 (ja) 2019-01-09
JP2018520405A (ja) 2018-07-26
CN106576068B (zh) 2019-11-19
CN106576068A (zh) 2017-04-19

Similar Documents

Publication Publication Date Title
US10701139B2 (en) Life cycle management method and apparatus
US10205719B2 (en) Network function virtualization-based certificate configuration method, apparatus, and system
EP3761170A1 (en) Virtual machine creation method and apparatus
CN106354687B (zh) 一种数据传输方法及系统
WO2015196931A1 (zh) 基于磁盘io的虚拟资源分配方法及装置
WO2018036103A1 (zh) 虚拟机创建方法、系统以及主机
EP3668009A1 (en) Life cycle management method and device for network service
EP3618352B1 (en) Virtual machine management
US11924117B2 (en) Automated local scaling of compute instances
US10757129B2 (en) Software security verification method, device, and system
EP3780499A1 (en) Resource pool processing method and apparatus
CN109995814B (zh) 云主机资源的迁移方法及装置、通信设备、存储介质
EP3101965A1 (en) Method and apparatus for adjacent node registration, and method and system for crossing node registration
EP3879875A1 (en) Resource change method and device, apparatus, and storage medium
US20230221997A1 (en) System and method for subscription management using composed systems
WO2014029239A1 (zh) 虚拟机放置策略的配置方法及装置
CN110650216A (zh) 云服务请求方法和装置
US11360824B2 (en) Customized partitioning of compute instances
US10318343B2 (en) Migration methods and apparatuses for migrating virtual machine including locally stored and shared data
CN111143031A (zh) 一种虚拟机的容量更改方法及装置
WO2017070954A1 (zh) 资源预留的方法及vnfm、vim、nfvo
CN110971470A (zh) 支持权重的私有云服务集群的限流方法及系统
US10855447B2 (en) Request approval using blockchain technology
CN109739615B (zh) 一种虚拟硬盘的映射方法、设备和云计算平台
CN116089020B (zh) 虚拟机运行方法、扩容方法、扩容系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890358

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017556567

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE