WO2017080439A1 - 一种网络功能弹性授权的方法和装置 - Google Patents

一种网络功能弹性授权的方法和装置 Download PDF

Info

Publication number
WO2017080439A1
WO2017080439A1 PCT/CN2016/105107 CN2016105107W WO2017080439A1 WO 2017080439 A1 WO2017080439 A1 WO 2017080439A1 CN 2016105107 W CN2016105107 W CN 2016105107W WO 2017080439 A1 WO2017080439 A1 WO 2017080439A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
vnfm
policy
information
vnf
Prior art date
Application number
PCT/CN2016/105107
Other languages
English (en)
French (fr)
Inventor
楚俊生
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017080439A1 publication Critical patent/WO2017080439A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Definitions

  • the present invention relates to the field of network function virtualization technologies, and in particular, to a method and apparatus for network function flexible authorization.
  • Cloud computing technology has developed rapidly. Cloud computing supports heterogeneous resources and dynamic expansion, emphasizes resource sharing and on-demand allocation. Cloud computing technology can effectively reduce construction and operation and maintenance costs.
  • Cloud computing hardware platforms generally use general-purpose or customized servers, with small hardware differences, full resource sharing, and reduced equipment procurement costs (CAPEX, CAPital Expenditure); centralized construction, deployment, and maintenance of hardware equipment, reducing operation and maintenance management costs ( OPEX, OPerating EXpense); virtualization technology realizes the decoupling of software and hardware, allocates resources on demand, improves resource utilization, and dynamically adjusts resources according to service load to meet the business processing capabilities of network functions. At the same time, the virtualization technology enables flexible allocation of resources, automatic distribution of images, and improved service deployment efficiency.
  • NFV Network Function Virtualization
  • IT Internet Technology
  • API Application Programming Interface
  • RIO return on investment
  • unified resource scheduling flexible allocation of resources and deployment of networks to ensure service Quality of service, improve resource utilization efficiency
  • network deployment enables rapid and flexible adjustment to meet system dynamics, real-time capacity expansion and capacity reduction requirements.
  • FIG. 1 illustrates a NFV architecture framework diagram.
  • the model diagram includes the operation support system/business support system (OSS/BSS), which provides management functions support for operators, including network services (NS, Network service) and virtual network functions (VNF). Registration, NS and VNF lifecycle management, performance and error handling, policy management, etc.; Element Management System (EMS), responsible for application-related errors, configuration, billing running on the VNF FCAPS (Fault Configuration Accounting Performance and Security) management, performance and security; virtual network function 103 (VNF), network function using virtual computing, virtual storage and virtual network resource deployment provided by infrastructure layer; network function virtualization
  • the infrastructure layer 104 (NFVI, NFVI) is responsible for providing infrastructure resources such as virtual computing, virtual storage, and virtual network for the deployment of NS instances and VNF instances; Network Functions Virtualisation Orchestration (NFVO) 105, responsible for NS and VNF registration, service and resource scheduling , NS and VNF instance lifetime management, etc.; Virtual Network Function Manager 106 (VNFM, Network Functions Virtualisation Management
  • Figure 2 illustrates the authorization flow chart when the VNF is instantiated, including:
  • the VNFM receives a VNF instantiation request message from the NFVO, EM, or other functional entity, and requests the VNFM to create a VNF instance according to the VNF template indicated in the request message.
  • the VNFM processes the VNF instantiation request message, and requests an operation authorization from the NFVO according to the related resource information included in the VNF template, where the virtual resource information required for instantiating the VNF and the corresponding current operation (VNF instantiation) are included;
  • the NFVO performs a related restrictive check according to the configured policy, and determines which VIM is selected to perform the deployment of the VNF instance according to the available virtual resource information of the connected VIM, and according to the virtual resource information required to deploy the VNF.
  • VIM performs virtual resource reservation;
  • the NFVO returns an operation authorization confirmation message to the VNFM, and carries VIM information for deploying the VNF instance, and identifier information of the virtual resource reserved on the VIM.
  • the VNFM interacts with the VIM according to the VIM information returned by the operation authorization and the reserved virtual resource identifier, and requests the VIM to allocate the virtual resources required by the VNF instance.
  • FIG. 3 is a flow chart showing the VNF elastic expansion, specifically including:
  • the VNFM determines, according to information received from the NFVO, EM, VNF, or other functional entity, that the VNF instance needs to be elastically stretched;
  • the VNFM processes the VNF elastic scaling, and requests an operation authorization from the NFVO, where the virtual virtual resource information required for the elastic scaling of the VNF and the corresponding current operation (VNF elastic scaling) are included;
  • the NFVO performs a related restriction check according to the configured policy, and performs related virtual resource reservation on the VIM that deploys the VNF instance according to the additional virtual resource information required for the flexible scaling of the VNF instance.
  • the NFVO returns an operation authorization confirmation message to the VNFM, and carries the identifier information of the reserved virtual resource;
  • the VNFM interacts with the VIM by using the virtual resource identifier that is reserved on the VIM, and requests the VIM to allocate the virtual resources required for the VNF elastic scaling.
  • the VNFM to NFVO is authenticated and authorized, and a method and device for network function flexible authorization are provided.
  • a method for flexible authorization of network functions comprising:
  • the authorization policy includes at least one set of authorization rules
  • the authorization information is used by the VNFM to perform a lifetime operation of the virtual network function VNF instance, determining whether the lifetime operation to the network function virtualization orchestrator NFVO is authorized for operation.
  • receiving the authorization policy includes:
  • the authorization policy is used by the VNFM to filter the VNF instance that meets the preset condition. Lifetime operations and authorization to operate at NFVO.
  • the method further includes: creating a new authorization policy according to the indication information, updating the saved authorization policy, or canceling the set authorization policy.
  • the authorization rule includes one or more of the following:
  • One or more specified time periods a specific set of operations or operations independent of virtual resources, a VNF or a set of VNFs, a type of VNF, an NS or a group of NSs, a class of NSs, or a specific tenant.
  • setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • Authorization information is set to the VNFM according to the policy information.
  • the preset condition includes one or more of the following:
  • a preset time period a preset group or groups of operations, operations independent of virtual resources, a VNF or a set of VNF identifiers.
  • setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • the VNFM determines that the VNF lifetime operation to the network function virtualization orchestrator NFVO performs operation authorization
  • the VNFM further includes:
  • the reserved resource includes one or more of the following:
  • the reserved resource information includes virtual resource information to be allocated when the VNF is instantiated or virtual resource information to be increased or decreased when the VNF is elastically stretched.
  • interacting with the virtual infrastructure manager VIM acquiring occupancy information of each VNFM for the virtual resource and setting a resource quota of each VNFM to the VIM.
  • the embodiment of the present invention further provides a method for elastic authorization of a network function, including:
  • determining whether the lifetime operation to the network function virtualization orchestrator NFVO for operating authorization includes:
  • the method further includes:
  • the embodiment of the present invention further provides a network function flexible authorization.
  • Devices including:
  • a first receiving module configured to receive an authorization policy, where the authorization policy includes at least one set of authorization rules
  • a setting module configured to set authorization information to the virtual network function manager VNFM according to the authorization policy; the authorization information is used by the VNFM to determine whether the lifetime operation is to the network when performing a lifetime operation with the virtual network function VNF instance
  • the function virtualization orchestrator NFVO performs operational authorization.
  • the first receiving module receives an authorization policy through a policy management interface or generates an authorization policy by using the configured policy information.
  • the authorization policy is used by the VNFM to filter the lifetime operation of the VNF instance that meets the preset condition and perform operation authorization to the NFVO.
  • the device further includes: an update module, configured to create a new authorization policy according to the indication information, update the saved authorization policy, or cancel the set authorization policy.
  • an update module configured to create a new authorization policy according to the indication information, update the saved authorization policy, or cancel the set authorization policy.
  • the setting, by the setting module, the setting of the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • Authorization information is set to the VNFM according to the policy information.
  • the preset condition includes one or more of the following:
  • a preset time period a preset group or groups of operations, operations independent of virtual resources, a VNF or a set of VNF identifiers.
  • the setting, by the setting module, the setting of the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • the authorization information is carried to the VNFM in a response message; or the authorization information is carried to the VNFM in an instantiated VNF operation sent to the VNFM.
  • VNFM determines that the VNF lifetime operation is authorized to operate by the network function virtualization orchestrator NFVO
  • the first receiving module is further configured to receive an operation authorization request of the VNFM, where the operation authorization request carries reserved resource information;
  • the setting module is further configured to determine to receive or reject the operation authorization request according to the authorization policy and the reserved resource restriction.
  • the setting module is further configured to perform virtual resource reservation on the reserved resource information carried by the VNFM when receiving the operation authorization request to carry the reserved resource.
  • the first receiving module is further configured to interact with the virtual infrastructure manager VIM, acquire occupancy information of each VNFM for the virtual resource, and set a resource quota of each VNFM to the VIM.
  • an embodiment of the present invention further provides an apparatus for network function flexible authorization, including:
  • a second receiving module configured to receive authorization information set by the network function virtualization orchestrator according to the authorization policy
  • the operation module is configured to determine, according to the authorization information, when the lifetime operation of the virtual network function VNF instance is performed, whether the lifetime operation is performed to the network function virtualization orchestrator NFVO for operation authorization.
  • the operation module determines whether the lifetime operation to the network function virtualization orchestrator NFVO for operating authorization includes:
  • the operation module is further configured to: send an operation authorization request to the NFVO, where the operation authorization Request to carry reserved resource information;
  • the second receiving module is further configured to: receive a response of the NFVO transmission to receive or reject the operation authorization request.
  • the embodiment of the present invention further provides a storage medium, where the storage medium is configured to store program code for performing the following steps: receiving an authorization policy, where the authorization policy includes at least one set of authorization rules; The authorization policy sets authorization information to the virtual network function manager VNFM; the authorization information is used by the VNFM to determine whether the lifetime operation to the network function virtualization orchestrator NFVO when performing the lifetime operation of the virtual network function VNF instance Authorize the operation.
  • the storage medium is further configured to store program code for performing the following steps: receiving the authorization policy comprises: receiving an authorization policy through the policy management interface or generating an authorization policy through the configured policy information.
  • the storage medium is further configured to store program code for performing the following steps: the authorization policy is used by the VNFM to filter the lifetime operations of the VNF instance satisfying the preset condition and to perform operational authorization to the NFVO.
  • the storage medium is further configured to store program code for performing the steps of: creating a new authorization policy based on the indication information, updating the already saved authorization policy, or canceling the set authorization policy.
  • the storage medium is further configured to store program code for performing the step of: the authorization rule comprising one or more of the following: one or more specified time periods, a specific set of operations, or a virtual resource An unrelated operation, a VNF or a group of VNFs, a class of VNFs, an NS or a group of NSs, a class of NSs, or a specific tenant.
  • the authorization rule comprising one or more of the following: one or more specified time periods, a specific set of operations, or a virtual resource An unrelated operation, a VNF or a group of VNFs, a class of VNFs, an NS or a group of NSs, a class of NSs, or a specific tenant.
  • the storage medium is further configured to store program code for performing the following steps: setting the authorization information to the virtual network function manager VNFM according to the authorization policy comprises: generating policy information corresponding to the VNFM according to the authorization policy
  • the policy information includes all VNF managed by the VNFM for each lifetime operation authorization or exemption of the lifetime operation authorization; and the authorization information is set to the VNFM according to the policy information.
  • the storage medium is further configured to store program code for performing the following steps: the preset condition includes one or more of the following: a preset time period, a preset one or more groups of operations, and a virtual Resource-independent operations, a VNF, or a set of VNF identifiers.
  • the storage medium is further configured to store program code for performing the following steps: setting the authorization information to the virtual network function manager VNFM according to the authorization policy comprises: sending authorization information corresponding to the VNFM through the policy management interface Giving the VNFM to the VNFM; or, when processing the VNF lifetime request authorization request of the VNFM request, carrying the authorization information to the VNFM in a response message; or instantiating a VNF operation sent to the VNFM The licens authorization information is carried to the VNFM.
  • the storage medium is further configured to store program code for performing the following steps: when the VNFM determines that the VNF lifetime operation to the network function virtualization orchestrator NFVO performs operation authorization, the method further includes: receiving the operation of the VNFM And an authorization request, where the operation authorization request carries reserved resource information; and according to the authorization policy and the reserved resource restriction, determining to receive or reject the operation authorization request.
  • the storage medium is further configured to store program code for performing the following steps: the reserved resource includes one or more of the following: an acceleration resource, a resource satisfying an affinity requirement, and a resource of a preset resource domain. VIM domain resources across multiple virtual infrastructure managers.
  • the storage medium is further configured to store program code for performing the following steps: the reserved resource information includes virtual resource information to be allocated when the VNF is instantiated or when the VNF is flexibly expanded or decreased. Virtual resource information.
  • the storage medium is further configured to store program code for performing the following steps: when receiving the operation authorization request and carrying the reserved resource, performing virtual resource reservation on the reserved resource information carried by the VNFM.
  • the storage medium is further configured to store program code for performing the steps of: interacting with the virtual infrastructure manager VIM, obtaining occupancy information of each VNFM for the virtual resource, and setting resources of each VNFM to the VIM. quota.
  • an embodiment of the present invention further provides a storage medium, where the storage The medium is configured to store program code for performing the following steps: receiving authorization information set by the network function virtualization orchestrator according to an authorization policy; determining the life when performing a lifetime operation with the virtual network function VNF instance according to the authorization information Whether the operation is authorized by the network function virtualization orchestrator NFVO.
  • the storage medium is further configured to store program code for performing the following steps: determining whether the lifetime operation to the network function virtualization orchestrator NFVO for operating authorization comprises: filtering a lifetime operation of the VNF instance that meets the preset condition And to NFVO for operational authorization.
  • the storage medium is further configured to store program code for performing the following steps: when determining that the VNF lifetime operation to the NFVO for operation authorization, further comprising: sending an operation authorization request to the NFVO, The operation authorization request carries the reserved resource information; and receives a response sent by the NFVO to receive or reject the operation authorization request.
  • the embodiment of the invention has the following beneficial effects:
  • the solution provided by the embodiment of the present invention performs authentication and authorization on VNF-related life events through VNFM to NFVO, and does not receive NFVO authorization information for VNFM.
  • VNFM defaults to each lifetime operation of VNF.
  • the NFVO is authorized to perform operations.
  • a flexible operation authorization mode is adopted between the VNFM and the NFVO to selectively filter the VNF lifetime operation and selectively perform operation authorization.
  • FIG. 1 is a schematic diagram of a related art network function virtualization framework
  • FIG. 2 is a flowchart of a related art VNF instantiation operation authorization
  • FIG. 3 is a flowchart of a related art VNF elastic telescopic operation authorization
  • FIG. 4 is a flowchart of a method for network function flexible authorization according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of another method for network function flexible authorization according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of an apparatus for network function elastic authorization according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of another apparatus for network function elastic authorization according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of implementing a network function flexible authorization according to an embodiment of the present invention.
  • FIG. 9 is a flowchart of carrying an authorization operation confirmation message by an authorization operation according to an embodiment of the present invention.
  • FIG. 10 is a flowchart of carrying the authorization information by instantiating a VNF request message according to an embodiment of the present invention.
  • FIG. 11 is a flowchart of an authorization policy for a VNF type exemption operation authorization according to an embodiment of the present invention.
  • FIG. 12 is a flowchart of the NFVO transmitting the authorization information PUSH to the VNFM according to an embodiment of the present invention
  • FIG. 13 is a flow chart of VNFM authorization information from NFVO PULL according to an embodiment of the present invention.
  • an embodiment of the present invention provides a network service deployment method, which is applied to a network function virtualization orchestrator NFVO side, and includes:
  • the authorization policy includes at least one set of authorization rules
  • the authorization information is used by the VNFM to perform a lifetime operation of the virtual network function VNF instance, determining whether the lifetime operation to the network function virtualization orchestrator NFVO is authorized for operation.
  • Receiving authorization policies includes:
  • the authorization policy is used by the VNFM to filter the lifetime operation of the VNF instance that meets the preset condition and perform operation authorization to the NFVO.
  • the authorization policy may be that the OSS/BSS is configured by calling the API interface provided by the NFVO, or may be configured by the management user on the management interface of the NFVO.
  • the authorization policy is used by VNFM to filter the lifetime operations associated with a particular VNF instance that require authorization to operate with NFVO.
  • the method further includes: creating a new authorization policy according to the indication information, updating the saved authorization policy, or canceling the set authorization policy.
  • the authorization rule includes one or more of the following:
  • One or more specified time periods a specific set of operations or operations independent of virtual resources, a VNF or a set of VNFs, a type of VNF, an NS or a group of NSs, a class of NSs, or a specific tenant.
  • Setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • Authorization information is set to the VNFM according to the policy information.
  • the per-lifetime operation authorization means that the VNFM must perform operational authorization to the NFVO each time the VNF lifetime operation is performed; the exempt life operation authorization means that the NFVO instructs the VNFM to satisfy the VNF of the specific condition. Lifetime operations are performed directly without the need for NFVO for operational authorization.
  • the preset condition includes one or more of the following:
  • a preset time period a preset group or groups of operations, operations independent of virtual resources, a VNF or a set of VNF identifiers.
  • Setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • the lifetime operations of the VNF instance include VNF instantiation, VNF elastic scaling, VNF update, VNF upgrade, VNF migration, VNF self-healing, and the like.
  • the NFVO Upon receiving or configuring the authorization policy, the NFVO actively determines to actively send the policy information to the VNFM through the policy management interface according to the configuration, or waits for the authorization operation request of the VNFM, and sends the authorization information to the VNFM in the authorization response message;
  • the VNFM determines whether the operation needs to be authorized by the NFVO according to the conditions specified in the authorization information when performing the VNF-related lifetime operation.
  • the VNFM When the VNFM performs VNF-related operations, even if it is determined according to the authorization information that the operation authorization can be exempted, if it is necessary to reserve a specific resource, it is also allowed to actively perform the operation authorization to the NFVO:
  • the VNFM determines that the VNF lifetime operation is authorized to operate the network function virtualization orchestrator NFVO, it also includes:
  • the NFVO determines to accept or reject the operation authorization request of the VNFM according to the authorization policy, the resource quota limit, and the available resource capacity.
  • the reserved resource includes one or more of the following:
  • the VNFM For the case where the VNFM does not receive the NFVO authorization information, the VNFM performs the operation authorization to the NFVO by default for each lifetime operation of the VNF.
  • the reserved resource information includes virtual resource information to be allocated when the VNF is instantiated or The virtual resource information to be increased or decreased when the VNF is elastically stretched.
  • the virtual resource reservation is performed on the reserved resource information carried by the VNFM.
  • VIM Interact with the virtual infrastructure manager VIM, obtain occupancy information of each VNFM for virtual resources, and set resource quotas for each VNFM to the VIM.
  • the embodiment of the present invention further provides a network service deployment method, which is applied to a VNFM side of a virtual network function manager, and includes:
  • Determining whether the lifetime operation to the network function virtualization orchestrator NFVO for operation authorization includes:
  • the method further includes:
  • the embodiment of the present invention further provides a network service deployment device, which is disposed on the NFVO side of the network function virtualization orchestrator, and includes:
  • a first receiving module configured to receive an authorization policy, where the authorization policy includes at least one set of authorization rules
  • a setting module configured to set authorization information to the virtual network function manager VNFM according to the authorization policy; the authorization information is used by the VNFM to determine whether the lifetime operation is to the network when performing a lifetime operation with the virtual network function VNF instance
  • the function virtualization orchestrator NFVO performs operational authorization.
  • the first receiving module receives an authorization policy through a policy management interface or generates an authorization policy through the configured policy information.
  • the authorization policy is used by the VNFM to filter the lifetime operation of the VNF instance that meets the preset condition and perform operation authorization to the NFVO.
  • the device further includes: an update module, configured to create a new authorization policy according to the indication information, update the saved authorization policy, or cancel the set authorization policy.
  • Setting the authorization information to the virtual network function manager VNFM according to the authorization policy by the setting module includes:
  • Authorization information is set to the VNFM according to the policy information.
  • the preset condition includes one or more of the following:
  • a preset time period a preset group or groups of operations, operations independent of virtual resources, a VNF or a set of VNF identifiers.
  • Setting the authorization information to the virtual network function manager VNFM according to the authorization policy by the setting module includes:
  • VNFM determines that the VNF lifetime operation is authorized to operate the network function virtualization orchestrator NFVO
  • the first receiving module is further configured to receive an operation authorization request of the VNFM, where the operation authorization request carries reserved resource information;
  • the setting module is further configured to determine to receive according to the authorization policy and the reserved resource limit Or reject the operation authorization request.
  • the setting module is further configured to perform virtual resource reservation on the reserved resource information carried by the VNFM when receiving the operation authorization request to carry the reserved resource.
  • the first receiving module is further configured to interact with the virtual infrastructure manager VIM, acquire occupancy information of each VNFM for the virtual resource, and set a resource quota of each VNFM to the VIM.
  • the embodiment of the present invention further provides a network service deployment device, which is disposed on the VNFM side of the virtual network function manager, and includes:
  • a second receiving module configured to receive authorization information set by the network function virtualization orchestrator according to the authorization policy
  • the operation module is configured to determine, according to the authorization information, when the lifetime operation of the virtual network function VNF instance is performed, whether the lifetime operation is performed to the network function virtualization orchestrator NFVO for operation authorization.
  • the operation module determines whether the lifetime operation to the network function virtualization orchestrator NFVO for operating authorization includes:
  • the operation module is further configured to: send an operation authorization request to the NFVO;
  • the second receiving module is further configured to: receive a response of the NFVO transmission to receive or reject the operation authorization request.
  • Figure 8 illustrates the steps to implement network functional resiliency authorization.
  • the implementation steps include:
  • the NFVO receives the authorization policy from the OSS/BSS through the policy management interface, or configures the survival authorization policy according to the portal interface.
  • the NFVO sets the authorization information to the VNFM according to the received or generated authorization policy.
  • the VNFM determines whether the operation needs to authorize the NFVO according to the authorization information when performing the operation related to the VNF lifetime.
  • Figure 9 illustrates the authorization information to confirm the message carrying process through the authorization operation:
  • the NFVO initiates a VNF instantiation request to the VNFM, where the VNF Descriptor (VNFD) and the like are carried.
  • VNFD VNF Descriptor
  • the VNFM determines, according to information such as the VNFD in the VNF instantiation request, the virtual resource information required to instantiate the VNF, and requests an operation authorization from the NFVO.
  • the NFVO performs a related policy check according to the VNF instantiation operation authorization request of the VNFM, and the virtual resource capacity information of the connected VIM determines which VIM is deployed on the VIM, and performs virtual resource reservation on the VIM.
  • the NFVO determines the authorization information related to the VNFM according to the authorization policy.
  • the NFVO authorization policy is to exempt all VNF exemption authorizations in the T1 to T2 time period, and the NFVO generates the authorization information with the VNFM. All VNF instances managed by the VNFM are exempt from operation authorization during the period from T1 to T2;
  • the NFVO carries the VIM identifier, the resource reservation identifier, and the authorization information of the VNF instance in the operation authorization confirmation message that is returned to the VNFM.
  • the NFVO may push the authorization information to the VNFM through a separate policy management interface
  • the VNFM directly requests the virtual resource allocation to the VIM to apply for the virtual resource required for deploying the VNF, if the direct resource mode is supported;
  • the VNFM performs life-cycle events related to VNF. According to the authorization information, the operation authorization can be exempted, and the VNFM directly executes the VNF lifetime event without To NFVO request operation authorization;
  • the VNFM performs a life-cycle event related to the VNF, and needs authorization to operate the NFVO according to the authorization information;
  • the VNFM requests an operation authorization request from the NFVO for the lifetime operation of the VNF;
  • NFVO confirms to VNFM the operational authorization confirmation of the life cycle operation of the VNF.
  • FIG. 10 illustrates the authorization information by instantiating the VNF request message carrying process:
  • the NFVO receives an instantiation request of the network service NS or the virtual network function VNF from the OSS/BSS.
  • the NFVO determines the authorization information of the VNFM corresponding to the VNF according to the VNF information included in the NS or the information of the instantiated VNF. This embodiment assumes that the NFVO generation and the authorization information of the VNFM are managed by the VNFM in the time period T1 to T2. All VNF instances are exempt from operational authorization;
  • the NFVO sends a VNF instantiation request to the VNFM, and carries the authorization information.
  • the NFVO may push the authorization information to the VNFM through a separate policy management interface
  • the VNFM determines the virtual resource information required to instantiate the VNF according to the information such as the VNFD in the VNF instantiation request, and requests an operation authorization from the NFVO, and the NFVO determines the VIM of the VNF instance and performs virtual resource reservation.
  • the NFVO performs the related policy check according to the VNF instantiation operation authorization request of the VNFM, and the virtual resource capacity information of the connected VIM determines which VIM is deployed on the VIM, and performs virtual resource reservation on the VIM.
  • the NFVO carries the VIM identifier, the resource reservation identifier, and the authorization information of the VNF instance, where the operation authorization confirmation message is returned to the VNFM.
  • the VNFM returns a VIM identifier and a resource reservation identifier according to the authorization confirmation message. If the direct resource mode is supported, the virtual resource allocation is directly requested from the VIM, and the virtual resources required for deploying the VNF are applied;
  • the VNFM performs a life-cycle event related to the VNF, and the operation authorization can be exempted according to the authorization information, and the VNFM directly executes the VNF lifetime event without requesting authorization to the NFVO request operation;
  • the VNFM performs a life-cycle event related to the VNF, and needs authorization to operate the NFVO according to the authorization information;
  • the VNFM requests an operation authorization request from the NFVO for the lifetime operation of the VNF;
  • NFVO confirms to VNFM the operational authorization confirmation of the life cycle operation of the VNF.
  • Figure 11 illustrates an authorization policy for a VNF type exemption authorization process
  • NFVO requests VNFM to instantiate VNF1 and VNF2;
  • the NFVO sets the authorization information to the VNFM according to the authorization policy. This embodiment assumes that the VNF2 type VNF instance is exempt from the operation authorization.
  • VNF1 triggers elastic expansion and contraction
  • the VNFM requests the NFVO to authorize the elastic scaling operation of the VNF1 according to the authorization information, and carries an additional virtual resource requirement, that is, the authorization information requires that the VNF1 type VNF still needs to request an operation authorization from the NFVO.
  • the NFVO performs the related policy check according to the VNF1 elastic scalability operation authorization request of the VNFM, and whether the virtual resource capacity information of the VIM of the VNF1 is deployed to meet the additional virtual resource requirements required by the elastic scalability VNF1, and additional virtual resources are performed on the VIM.
  • the NFVO carries information about deploying an additional virtual resource reservation identifier in the operation authorization confirmation message returned to the VNFM.
  • the VNFM requests an additional virtual resource allocation from the VIM according to the additional virtual resource reservation identifier returned in the authorization confirmation message, and performs elastic scaling on the VNF1.
  • VNF2 triggers elastic expansion and contraction
  • the VNFM directly interacts with the VIM to apply for additional virtual resources according to the authorization information to flexibly flex the VNF2, that is, the authorization information requires the VNF2 type VNF exemption operation authorization.
  • Figure 12 illustrates the NFVO PUSH to VNFM process for authorization information:
  • the OSS/BSS sends a policy management message to the NFVO, where the authorization policy rule is carried;
  • NFVO saves authorization policy rules
  • the NFVO generates authorization information corresponding to each VNFM according to the authorization policy rule and the information of the VNF instance managed by the connected VNFM.
  • the authorization information related to each VNFM is PUSH through the policy management interface to the corresponding VNFM (this example is VNFM1 and VNFM2);
  • VNFM this example is VNFM1 and VNFM2 store authorization information.
  • Figure 13 illustrates the VNFM authorization process flow from NFVO PULL:
  • the OSS/BSS sends a policy management message to the NFVO, where the authorization policy rule is carried;
  • NFVO saves authorization policy rules
  • the VNFM1 requests the NFVO to perform operation authorization on a version update of a VNF managed by the NFVO, and carries the virtual resource update information.
  • the NFVO updates the operation authorization request according to the VNF version of the VNFM, performs related policy check, and whether the virtual resource update information can be provided on the VIM, and the updated virtual resource reservation is performed on the VIM.
  • NFVO returns an operation authorization confirmation message to the VNFM, carrying the updated virtual resource a reservation identifier, and authorization information related to the VNFM generated according to the authorization policy;
  • VNFM saves the authorization information.
  • a storage medium is also provided in an embodiment of the present invention.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the authorization policy that receives the authorization policy includes at least one set of authorization rules.
  • the authorization information is set to the virtual network function manager VNFM according to the authorization policy.
  • the authorization information is used by the VNFM to perform the lifetime operation of the virtual network function VNF instance, and determine whether the lifetime operation is performed by the network function virtualization orchestrator NFVO. Operation authorization.
  • the storage medium is further arranged to store program code for performing the following steps:
  • Receiving an authorization policy includes: receiving an authorization policy through a policy management interface or generating an authorization policy through the configured policy information.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the authorization policy is used by the VNFM to filter the lifetime operations of the VNF instance that meets the preset conditions and to perform operational authorization to the NFVO.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • Authorization rules include one or more of the following: one or more specified time periods, a specific set of operations or operations unrelated to virtual resources, a VNF or a set of VNFs, a type of VNF, an NS, or a group of NSs , a type of NS, or a specific tenant.
  • the storage medium is further arranged to store program code for performing the following steps:
  • Setting authorization information to the virtual network function manager VNFM according to the authorization policy includes:
  • S1 Generate, according to the authorization policy, policy information corresponding to the VNFM, where the policy information includes all VNF managed by the VNFM, and each lifetime operation authorization or exemption of the lifetime operation authorization;
  • the storage medium is further arranged to store program code for performing the following steps:
  • the preset conditions include one or more of the following: a preset time period, a preset one or more sets of operations, an operation independent of a virtual resource, a VNF or a set of VNF identifiers.
  • the storage medium is further arranged to store program code for performing the following steps:
  • Setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes: transmitting the authorization information corresponding to the VNFM to the VNFM through the policy management interface; or, when processing the VNF lifetime operation authorization request requested by the VNFM, in the response message
  • the authorization information is carried to the VNFM; or the authorization information is carried to the VNFM in the instantiated VNF operation sent to the VNFM.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the VNFM determines the VNF lifetime operation to the network function virtualization orchestrator NFVO for operational authorization, it also includes:
  • the storage medium is further arranged to store program code for performing the following steps:
  • the reserved resources include one or more of the following: acceleration resources, resources satisfying affinity requirements, resources of preset resource domains, and VIM domain resources across multiple virtual infrastructure managers.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the reserved resource information includes the virtual resource information to be allocated when the VNF is instantiated or the virtual resource information to be added or decreased when the VNF is flexibly expanded.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • VIM Interact with the virtual infrastructure manager VIM to obtain occupancy information of each VNFM for virtual resources and/or set resource quotas for each VNFM to the VIM.
  • a storage medium is also provided in an embodiment of the present invention.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • Determining whether the lifetime operation to the network function virtualization orchestrator NFVO performs operation authorization includes: filtering the lifetime operation of the VNF instance that satisfies the preset condition and performing operation authorization to the NFVO.
  • the storage medium is further arranged to store program code for performing the following steps:
  • VNF lifetime operation When determining the VNF lifetime operation to NFVO for operational authorization, it also includes:
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs: receiving the authorization policy according to the stored program code in the storage medium, the authorization policy includes at least one set of authorization rules; and setting the authorization information to the virtual network function manager VNFM according to the authorization policy.
  • the authorization information is used by the VNFM to determine whether the lifetime operation is authorized to operate by the network function virtualization orchestrator NFVO when performing the lifetime operation of the VNF instance with the virtual network function.
  • receiving the authorization policy includes: receiving an authorization policy through the policy management interface or generating an authorization policy by using the configured policy information.
  • the processor executes according to the stored program code in the storage medium: the authorization policy is used by the VNFM to filter the lifetime operation of the VNF instance that meets the preset condition and perform operation authorization to the NFVO.
  • the processor executes according to the stored program code in the storage medium: creating a new authorization policy according to the indication information, updating the saved authorization policy, or canceling the set authorization policy.
  • the processor executes according to the stored program code in the storage medium: the authorization rule includes one or more of the following: one or more specified time periods, a specific set of operations, or A virtual resource-independent operation, a VNF or a set of VNFs, a type of VNF, an NS or a group of NSs, a class of NSs, or a specific tenant.
  • setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes: generating policy information corresponding to the VNFM according to the authorization policy, and the policy The information includes all VNF managed by the VNFM for each lifetime operation authorization or exempt life-time operation authorization; the authorization information is set to the VNFM according to the policy information.
  • the processor executes according to the stored program code in the storage medium:
  • the preset condition includes one or more of the following: a preset time period, a preset one or more groups of operations, An operation that is not related to a virtual resource, a VNF, or a set of VNF identifiers.
  • the processor is executed according to the stored program code in the storage medium: setting the authorization information to the virtual network function manager VNFM according to the authorization policy includes: sending the authorization information corresponding to the VNFM through the policy management interface. To the VNFM; or, when processing the VNF lifetime request authorization request of the VNFM request, the authorization information is carried in the response message to the VNFM; or the authorization information is carried to the VNFM in the instantiated VNF operation sent to the VNFM.
  • the processor executes according to the stored program code in the storage medium: when the VNFM determines that the VNF lifetime operation to the network function virtualization orchestrator NFVO performs operation authorization, the method further includes: receiving the operation of the VNFM The authorization request, the operation authorization request carries the reserved resource information; and determines whether to accept or reject the operation authorization request according to the authorization policy and the reserved resource restriction.
  • the processor executes according to the stored program code in the storage medium: the reserved resource includes one or more of the following: an acceleration resource, a resource that meets an affinity requirement, and a preset resource domain. Resources, across multiple virtual infrastructure manager VIM domain resources.
  • the processor executes according to the stored program code in the storage medium: the reserved resource information includes virtual resource information to be allocated when the VNF is instantiated or a virtual resource to be increased or decreased when the VNF is flexibly expanded. information.
  • the processor performs, according to the stored program code in the storage medium, when the receiving operation authorization request carries the reserved resource, performing virtual resource reservation on the reserved resource information carried by the VNFM.
  • the processor executes, according to the stored program code in the storage medium, interacts with the virtual infrastructure manager VIM, acquires occupancy information of each VNFM for the virtual resource, and sets each VNFM to the VIM. Resource quota.
  • the processor executes, according to the stored program code in the storage medium, the receiving authorization information set by the network function virtualization orchestrator according to the authorization policy; and executing the virtual network function VNF instance according to the authorization information.
  • the processor executes, according to the stored program code in the storage medium, the receiving authorization information set by the network function virtualization orchestrator according to the authorization policy; and executing the virtual network function VNF instance according to the authorization information.
  • the lifetime operation it is determined whether the lifetime operation is authorized by the network function virtualization orchestrator NFVO.
  • the processor performs, according to the stored program code in the storage medium, determining whether the lifetime operation to the network function virtualization orchestrator NFVO for performing operation authorization comprises: filtering the VNF instance that meets the preset condition. Lifetime operations and authorization to operate at NFVO.
  • the processor executes according to the stored program code in the storage medium: when determining the VNF lifetime operation to the NFVO for performing the operation authorization, the method further includes: to the NFVO Sending an operation authorization request, the operation authorization request carries the reserved resource information; and receiving the response of the NFVO transmission receiving or rejecting the operation authorization request.
  • VNF-related life events are authenticated and authorized by VNFM to NFVO, and for VNFM, NFVO authorization information is not received, and VNFM is for each life of VNF.
  • the operation of the NFVO is performed by default.
  • a flexible operation authorization mode is adopted between the VNFM and the NFVO to selectively filter the VNF lifetime operation and selectively operate the authorization.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络功能弹性授权的方法和装置，涉及网络功能虚拟化技术领域。所述方法包括：接收授权策略，所述的授权策略包含至少一组授权规则；根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。在VNFM和NFVO之间采用灵活的操作授权方式，对VNF生命期操作进行选择性过滤，选择性进行操作授权。

Description

一种网络功能弹性授权的方法和装置 技术领域
本发明涉及网络功能虚拟化技术领域，具体涉及一种网络功能弹性授权的方法和装置。
背景技术
随着电信网功能和业务的发展，网络中部署的网元种类和数量也越来越多。网元种类和数量的增加随之也带来了很多问题，诸如硬件平台类型繁多，维护复杂；硬件无法共享，资源浪费；新业务需要新硬件平台支持，增加了业务上市时间(TTM，Time To Market)等。
近几年云计算技术发展迅猛，云计算支持异构资源和动态扩展、强调资源共享和按需分配，通过云计算技术可以有效的降低建设和运维成本。云计算硬件平台一般采用通用或者定制化的服务器，硬件差异性小，资源充分共享，降低设备采购成本(CAPEX，CAPital Expenditure)；硬件设备集中化建设、部署、和维护，降低运维管理成本(OPEX，OPerating EXpense)；虚拟化技术实现软件与硬件的解耦，资源按需分配，提升资源利用率，并根据业务负荷动态调整资源，满足网络功能的业务处理能力。同时，利用虚拟化技术，能够实现资源的灵活分配、镜像的自动分发，提升业务部署效率等。
网络功能虚拟化(NFV，Network Function Virtualization)技术的最终目标是通过在基于行业标准的高容量的服务器、高容量的存储和和高容量的交换设备上提供网络功能，取代传统电信设备制造商所提供的专用硬件设备。由此带来的好处是，一方面基于标准的IT(Internet Technology，互联网技术)设备成本低廉，能够为运营商节省巨大的投资成本；另一方面提供开放的API(Application Programming Interface，应用程序编程接口)，也能帮助运营商开放更多的电信基础网络能力，提高投资回报率(RIO，return on investment)；资源统一调度，灵活分配资源和部署网络，确保服 务质量，提升资源利用效率；网络部署实现快速、灵活的调整，满足系统动态、实时扩容和缩容需求。
电信运营商在采用虚拟化和云计算等IT技术实现网络功能虚拟化的同时，也要求能够提供安全的管理方式，保证虚拟网络功能部署时不影响其他业务的部署和运行，对系统的资源不会过渡的消耗，符合NFV平台的策略控制，如采用操作授权的方式，对所有与VNF生命期相关的事件(如VNF的实例化、弹性伸缩、版本更新升级，VNF迁移以及VNF释放等)进行集中控制，确保任何与VNF生命期相关的操作都在统一监控之下。
图1示例NFV架构框架图。该模型图中包括运营/业务管理系统101(OSS/BSS，Operation support system/Business support system)，为运营商提供业务的管理功能支持，包括网络服务(NS，Network service)和虚拟网络功能(VNF)的注册，NS和VNF的生命期管理，性能和错误的处理，策略管理等；网元管理系统102(EMS，Element Management System)，负责运行在VNF上的应用相关的错误、配置、计费、性能和安全方面的FCAPS(Fault Configuration Accounting Performance and Security)管理等；虚拟网络功能103(VNF)，使用基础设施层提供的虚拟计算、虚拟存储和虚拟网络资源部署的网络功能；网络功能虚拟化基础设施层104(NFVI，NFV Infrastructure)，负责为NS实例和VNF实例的部署提供虚拟计算、虚拟存储和虚拟网络等基础设施资源；网络功能虚拟化编排器(NFVO，Network Functions Virtualisation Orchestration)105，负责NS和VNF的注册，服务和资源的编排，NS和VNF实例的生命期管理等；虚拟网络功能管理器106(VNFM，Network Functions Virtualisation Management)，负责为VNF的实例化和相关的生命期管理，以及与应用无关的配置，即对虚拟资源进行配置；虚拟基础设施管理器107(VIM，Virtualised Infrastructure Manager)，负责对运营商的基础设施域的虚拟计算、虚拟存储和网络资源的控制和管理，以及VNF包注册时镜像文件的存放和管理。网络服务，VNF和基础设施描述108，负责网络服务注册时的描述信息记录，VNF 包注册时的描述信息记录，网络服务和VNF实例化的信息记录，以及NFVI资源容量信息记录。
图2示例VNF实例化时的授权流程图，具体包括：
201，VNFM接收到来自于NFVO，EM或其他功能实体的VNF实例化请求消息，要求VNFM根据请求消息中指示的VNF模板创建VNF实例；
202，VNFM处理VNF实例化请求消息，并根据VNF模板包含的相关资源信息向NFVO请求操作授权，其中包含实例化该VNF所需的虚拟资源信息和对应的本次操作(VNF实例化)；
203，NFVO根据配置的策略进行相关的限制性检查，根据所连接的VIM的可用虚拟资源信息，确定选择哪个VIM进行该VNF实例的部署，并根据携带的部署VNF所需的虚拟资源信息到该VIM进行虚拟资源预留；
204，NFVO向VNFM返回操作授权确认消息，并携带部署该VNF实例的VIM信息，以及在该VIM上预留的虚拟资源的标识信息；
205，VNFM根据操作授权返回的VIM信息以及预留的虚拟资源标识与VIM交互，请求VIM分配VNF实例所需的虚拟资源。
图3示例VNF弹性伸缩时的流程图，具体包括：
301，VNFM根据从NFVO，EM，VNF或其他功能实体收到的信息确定VNF实例需要进行弹性伸缩；
302，VNFM处理VNF弹性伸缩，并向NFVO请求操作授权，其中包含弹性伸缩该VNF所需的额外虚拟资源信息和对应的本次操作(VNF弹性伸缩)；
303，NFVO根据配置的策略进行相关的限制性检查，根据VNF实例弹性伸缩所需的额外虚拟资源信息向部署该VNF实例的VIM进行相关的虚拟资源预留；
304，NFVO向VNFM返回操作授权确认消息，并携带预留的虚拟资源的标识信息；
305，VNFM根据操作授权返回的在VIM上预留的虚拟资源标识与VIM交互，请求VIM分配VNF弹性伸缩所需的虚拟资源。
在网络功能虚拟化环境下，目前的标准讨论要求对VNF相关的所有生命期事件都需要到NFVO进行操作授权，但是在一个复杂的商用系统环境下，部署的VNF可能很多，并且VNF的状态也经常变化，会有大量的VNF相关的生命期事件需要通过VNFM到NFVO进行认证授权，这将导致NFVO成为处理瓶颈，而且NFVO可能只处理与VNF相关的一部分生命期操作，这也会导致系统资源的浪费和操作处理的时延，另外NFVO如果出现异常的情况下，也将会对运行在虚拟基础设施上的网络功能产生影响。
发明内容
本发明实施例为了实现VNF相关的生命期事件通过VNFM到NFVO进行认证授权，提供一种网络功能弹性授权的方法和装置。
为了实现上述发明目的，本发明实施例采取的技术方案如下：
一种网络功能弹性授权的方法，包括：
接收授权策略，所述的授权策略包含至少一组授权规则；
根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，接收授权策略包括：
通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
可选地，所述授权策略用于VNFM过滤满足预设条件的VNF实例的 生命期操作并到NFVO进行操作授权。
可选地，所述的方法还包括：根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
可选地，所述授权规则包括以下的一项或多项：
指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
可选地，根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
根据所述策略信息向所述VNFM设置授权信息。
可选地，所述预设条件包括以下一种或多种：
预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
可选地，根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
可选地，当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：
接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
可选地，所述预留资源包括以下的一项或者多项：
加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源
可选地，所述预留资源信息包括所述VNF实例化时待分配的虚拟资源信息或所述VNF弹性伸缩时待增加或减少的虚拟资源信息。
可选地，当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
可选地，与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
为解决上述技术问题，本发明实施例还提供一种网络功能弹性授权的方法，包括：
接收网络功能虚拟化编排器根据授权策略设置的授权信息；
根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，当确定所述VNF生命期操作到所述NFVO进行操作授权时，还包括：
向所述NFVO发送操作授权请求，所述操作授权请求携带预留资源信息；
并接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
为解决上述技术问题，本发明实施例还提供一种网络功能弹性授权的 装置，包括：
第一接收模块，设置为接收授权策略，所述的授权策略包含至少一组授权规则；
设置模块，设置为根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，所述第一接收模块通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
可选地，所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，所述的装置还包括：更新模块，设置为根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
可选地，所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
根据所述策略信息向所述VNFM设置授权信息。
可选地，所述预设条件包括以下一种或多种：
预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
可选地，所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时， 在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
可选地，当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，
所述第一接收模块还设置为接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
所述设置模块还设置为根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
可选地，所述设置模块还设置为当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
可选地，所述第一接收模块还设置为与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
为解决上述技术问题，本发明实施例还提供一种网络功能弹性授权的装置，包括：
第二接收模块，设置为接收网络功能虚拟化编排器根据授权策略设置的授权信息；
操作模块，设置为根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，所述操作模块确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，当确定所述VNF生命期操作到所述NFVO进行操作授权时，所述操作模块还设置为：向所述NFVO发送操作授权请求，所述操作授权 请求携带预留资源信息；
所述第二接收模块还设置为：接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
为解决上述技术问题，本发明实施例中还提供一种存储介质，该存储介质设置为存储用于执行以下步骤的程序代码：接收授权策略，所述的授权策略包含至少一组授权规则；根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：接收授权策略包括：通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：所述授权规则包括以下的一项或多项：指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；根据所述策略信息向所述VNFM设置授权信息。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：所述预设条件包括以下一种或多种：预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：所述预留资源包括以下的一项或者多项：加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：所述预留资源信息包括所述VNF实例化时待分配的虚拟资源信息或所述VNF弹性伸缩时待增加或减少的虚拟资源信息。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
为解决上述技术问题，本发明实施例中还提供一种存储介质，该存储 介质设置为存储用于执行以下步骤的程序代码：接收网络功能虚拟化编排器根据授权策略设置的授权信息；根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：当确定所述VNF生命期操作到所述NFVO进行操作授权时，还包括：向所述NFVO发送操作授权请求，所述操作授权请求携带预留资源信息；并接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
本发明实施例和现有技术相比，具有如下有益效果：
本发明实施例提供的方案在多个VNF，在VNF相关的生命期事件通过VNFM到NFVO进行认证授权，对于VNFM没有收到NFVO授权信息的情况，VNFM对VNF的每个生命期操作都缺省执行到NFVO进行操作授权，对于VNFM收到NFVO授权信息的情况，在VNFM和NFVO之间采用灵活的操作授权方式，对VNF生命期操作进行选择性过滤，选择性进行操作授权。
附图说明
图1是相关技术网络功能虚拟化框架示意图；
图2是相关技术VNF实例化操作授权流程图；
图3是相关技术VNF弹性伸缩操作授权流程图；
图4是本发明实施例的一种网络功能弹性授权的方法的流程图；
图5是本发明实施例的另一种网络功能弹性授权的方法的流程图；
图6是本发明实施例的一种网络功能弹性授权的装置的结构示意图；
图7是本发明实施例的另一种网络功能弹性授权的装置的结构示意 图；
图8是本发明实施例的网络功能弹性授权的实施流程图；
图9是本发明实施例的授权信息通过授权操作确认消息携带流程图；
图10是本发明实施例的授权信息通过实例化VNF请求消息携带流程图；
图11是本发明实施例的授权策略为某种VNF类型免除操作授权流程图；
图12是本发明实施例的NFVO将授权信息PUSH到VNFM流程图；
图13是本发明实施例的VNFM从NFVO PULL授权信息流程图。
具体实施方式
为使本发明实施例的发明目的、技术方案和有益效果更加清楚明了，下面结合附图对本发明的实施例进行说明，需要说明的是，在不冲突的情况下，本申请中的实施例和实施例中的特征可以相互任意组合。
如图4所示，本发明实施例提供一种网络服务部署方法，应用于网络功能虚拟化编排器NFVO侧，包括：
接收授权策略，所述的授权策略包含至少一组授权规则；
根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
接收授权策略包括：
通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
授权策略可以是OSS/BSS通过调用NFVO提供的API接口，也可以是管理用户在NFVO的管理界面上配置生成的。
授权策略用于VNFM过滤与特定VNF实例相关的、需要到NFVO进行操作授权的生命期操作。
所述方法还包括：根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
所述授权规则包括以下的一项或多项：
指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
根据所述策略信息向所述VNFM设置授权信息。
所述的每次生命期操作授权是指VNFM在每次执行VNF的生命期操作时都必须到NFVO进行操作授权；所述的免除生命期操作授权是指NFVO指示VNFM对满足特定条件的VNF的生命期操作直接执行而不需要到NFVO进行操作授权。
所述预设条件包括以下一种或多种：
预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM 发送的实例化VNF操作中将授权信息携带给所述VNFM。
VNF实例的生命期操作包括VNF实例化、VNF弹性伸缩、VNF更新、VNF升级、VNF迁移、VNF自愈等。
NFVO在接收到或在配置生成授权策略时，根据配置确定主动通过策略管理接口将策略信息主动发送给VNFM，或者等待VNFM的授权操作请求，在授权响应消息中将授权信息发送给VNFM；
可选地，VNFM在执行VNF相关的生命期操作时，根据授权信息中规定的条件确定操作是否需要到NFVO进行授权。
VNFM在执行VNF相关的操作时，即使根据授权信息确定可以免除操作授权，但是如果需要预留特定的资源也允许主动到NFVO进行操作授权：
当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：
接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
VNFM请求授权操作并携带虚拟资源信息时，NFVO根据授权策略、资源配额限制和可用的资源容量等信息确定接受或拒绝VNFM的操作授权请求。
所述预留资源包括以下的一项或者多项：
加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源。
对于VNFM没有收到NFVO授权信息的情况，VNFM对VNF的每个生命期操作都缺省执行到NFVO进行操作授权。
所述预留资源信息包括所述VNF实例化时待分配的虚拟资源信息或 所述VNF弹性伸缩时待增加或减少的虚拟资源信息。
当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
如图5所示，本发明实施例还提供一种网络服务部署方法，应用于虚拟网络功能管理器VNFM侧，包括：
接收网络功能虚拟化编排器根据授权策略设置的授权信息；
根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
当确定所述VNF生命期操作到所述NFVO进行操作授权时，还包括：
向所述NFVO发送操作授权请求，所述操作授权请求携带预留资源信息；
并接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
如图6所示，本发明实施例还提供一种网络服务部署装置，设置于网络功能虚拟化编排器NFVO侧，包括：
第一接收模块，设置为接收授权策略，所述的授权策略包含至少一组授权规则；
设置模块，设置为根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
所述第一接收模块通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
所述的装置还包括：更新模块，设置为根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
根据所述策略信息向所述VNFM设置授权信息。
所述预设条件包括以下一种或多种：
预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，
所述第一接收模块还设置为接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
所述设置模块还设置为根据所述授权策略和预留资源限制，确定接收 或者拒绝所述操作授权请求。
所述设置模块还设置为当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
所述第一接收模块还设置为与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
如图7所示，本发明实施例还提供一种网络服务部署装置，设置于虚拟网络功能管理器VNFM侧，包括：
第二接收模块，设置为接收网络功能虚拟化编排器根据授权策略设置的授权信息；
操作模块，设置为根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
所述操作模块确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
当确定所述VNF生命期操作到所述NFVO进行操作授权时，所述操作模块还设置为：向所述NFVO发送操作授权请求；
所述第二接收模块还设置为：接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
实施例1
图8示例网络功能弹性授权的实施步骤。该实施步骤包括：
401，NFVO通过策略管理接口从OSS/BSS接收授权策略，或者根据门户界面配置生存授权策略。
402，NFVO根据接收或生成的授权策略向VNFM设置授权信息。
403，VNFM在执行与VNF生命期相关的操作时，根据授权信息确定操作是否需要向NFVO进行授权。
实施例2
图9示例授权信息通过授权操作确认消息携带流程：
501，NFVO向VNFM发起VNF实例化请求，其中会携带参考的VNF描述符(VNF Descriptor,VNFD)等信息；
502，VNFM根据VNF实例化请求中的VNFD等信息，确定实例化VNF所需的虚拟资源信息，并向NFVO请求操作授权；
503，NFVO根据VNFM的VNF实例化操作授权请求，进行相关的策略检查，所连接的VIM的虚拟资源容量信息确定在哪个VIM上部署该VNF，并在该VIM上进行虚拟资源预留；
504，NFVO根据授权策略确定与该VNFM相关的授权信息，本实施例假定NFVO的授权策略是在T1～T2时间段内对所有的VNF免除操作授权，则NFVO生成与该VNFM的授权信息为在T1～T2时间段内该VNFM所管理的所有VNF实例都免除操作授权；
505，NFVO在返回给VNFM的操作授权确认消息中携带部署该VNF实例的VIM标识、资源预留标识，和授权信息；
如果操作授权确认消息不支持携带授权信息，NFVO可通过单独的策略管理接口将授权信息推送给VNFM；
506，VNFM根据授权确认消息中返回的VIM标识、资源预留标识，如果支持直接资源模式，则直接向VIM请求虚拟资源分配，申请部署VNF所需的虚拟资源；
507a～507b，T1～T2时间段内VNFM执行与VNF相关的生命期事件，根据授权信息可免除操作授权，VNFM直接执行VNF生命期事件而无需 到NFVO请求操作授权；
508，T1～T2时间段外VNFM执行与VNF相关的生命期事件，根据授权信息需要到NFVO进行操作授权；
509，VNFM向NFVO请求VNF的生命期操作的操作授权请求；
510，NFVO向VNFM确认VNF的生命期操作的操作授权确认。
实施例3
图10示例授权信息通过实例化VNF请求消息携带流程：
601，NFVO从OSS/BSS接收到网络服务NS或者虚拟网络功能VNF的实例化请求；
602，NFVO根据NS里包含的VNF信息或者实例化VNF的信息，确定VNF对应的VNFM的授权信息，本实施例假定NFVO生成与该VNFM的授权信息为在T1～T2时间段内对VNFM所管理的所有VNF实例都免除操作授权；
603，NFVO向VNFM发送VNF实例化请求，并携带授权信息；
如果VNF实例化请求消息不支持携带授权信息，NFVO可通过单独的策略管理接口将授权信息推送给VNFM；
604，VNFM根据VNF实例化请求中的VNFD等信息，确定实例化VNF所需的虚拟资源信息，并向NFVO请求操作授权，由NFVO确定部署VNF实例的VIM和进行虚拟资源预留；
605，NFVO根据VNFM的VNF实例化操作授权请求，进行相关的策略检查，所连接的VIM的虚拟资源容量信息确定在哪个VIM上部署该VNF，并在该VIM上进行虚拟资源预留；
606，NFVO在返回给VNFM的操作授权确认消息中携带部署该VNF实例的VIM标识、资源预留标识，和授权信息等；
607，VNFM根据授权确认消息中返回的VIM标识、资源预留标识， 如果支持直接资源模式，则直接向VIM请求虚拟资源分配，申请部署VNF所需的虚拟资源；
608a～608b，T1～T2时间段内VNFM执行与VNF相关的生命期事件，根据授权信息可免除操作授权，VNFM直接执行VNF生命期事件而无需到NFVO请求操作授权；
609，T1～T2时间段外VNFM执行与VNF相关的生命期事件，根据授权信息需要到NFVO进行操作授权；
610，VNFM向NFVO请求VNF的生命期操作的操作授权请求；
611，NFVO向VNFM确认VNF的生命期操作的操作授权确认。
实施例4
图11示例授权策略为某种VNF类型免除操作授权流程：
701，NFVO请求VNFM实例化VNF1和VNF2；
702，NFVO根据授权策略向VNFM设置授权信息，本实施例假定对VNF2类型的VNF实例都免除操作授权；
703，VNF1触发弹性伸缩；
704，VNFM根据授权信息向NFVO请求对VNF1的弹性伸缩操作进行授权并携带额外虚拟资源需求，即授权信息要求VNF1类型的VNF仍然需要向NFVO请求操作授权；
705，NFVO根据VNFM的VNF1弹性伸缩操作授权请求，进行相关的策略检查，部署VNF1的VIM的虚拟资源容量信息是否满足弹性伸缩VNF1所需的额外虚拟资源需求，并在该VIM上进行额外虚拟资源预留；
706，NFVO在返回给VNFM的操作授权确认消息中携带部署额外虚拟资源预留标识等信息；
707，VNFM根据授权确认消息中返回的额外虚拟资源预留标识向VIM请求额外虚拟资源分配，对VNF1进行弹性伸缩；
708，VNF2触发弹性伸缩；
709，VNFM根据授权信息直接与VIM交互申请额外的虚拟资源以对VNF2进行弹性伸缩，即授权信息要求VNF2类型的VNF免除操作授权。
实施例5
图12示例NFVO将授权信息PUSH到VNFM流程：
801，OSS/BSS向NFVO发送策略管理消息，其中携带授权策略规则；
802，NFVO保存授权策略规则；
803，NFVO根据授权策略规则和所连接的VNFM所管理的VNF实例的信息，生成对应于各个VNFM的授权信息；
804、806，NFVO根据配置的模式(PUSH模式)，将与各个VNFM相关的授权信息通过策略管理接口PUSH到对应的VNFM(本实例为VNFM1和VNFM2)；
805、807，VNFM(本实例为VNFM1和VNFM2)保存授权信息。
实施例6
图13示例VNFM从NFVO PULL授权信息流程：
901，OSS/BSS向NFVO发送策略管理消息，其中携带授权策略规则；
902，NFVO保存授权策略规则；
903，VNFM1向NFVO请求对其管理的某个VNF的版本更新进行操作授权，并携带虚拟资源更新信息；
904，NFVO根据VNFM的VNF版本更新操作授权请求，进行相关的策略检查，虚拟资源更新信息是否能够在VIM上提供，并在该VIM上进行更新的虚拟资源预留；
905，NFVO向VNFM返回操作授权确认消息，携带更新的虚拟资源 的预留标识，以及根据授权策略生成的与该VNFM相关的授权信息；
906，VNFM保存授权信息。
实施例7
本发明的实施例中还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，接收授权策略，的授权策略包含至少一组授权规则；
S1，根据授权策略向虚拟网络功能管理器VNFM设置授权信息；授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
接收授权策略包括：通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
授权规则包括以下的一项或多项：指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
根据授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
S1，根据授权策略生成与VNFM对应的策略信息，策略信息包括VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
S2，根据策略信息向VNFM设置授权信息。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
预设条件包括以下一种或多种：预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
根据授权策略向虚拟网络功能管理器VNFM设置授权信息包括：通过策略管理接口将与VNFM对应的授权信息发送给VNFM；或者，在处理VNFM请求的VNF生命期操作授权请求时，在响应消息中将的授权信息携带给VNFM；或者，向VNFM发送的实例化VNF操作中将授权信息携带给VNFM。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
当VNFM确定VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：
S1，接收VNFM的操作授权请求，操作授权请求携带预留资源信息；
S2，根据授权策略和预留资源限制，确定接收或者拒绝操作授权请求。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
预留资源包括以下的一项或者多项：加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
预留资源信息包括VNF实例化时待分配的虚拟资源信息或VNF弹性伸缩时待增加或减少的虚拟资源信息。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
当接收操作授权请求携带预留资源时，对VNFM携带的预留资源信 息进行虚拟资源预留。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和/或向VIM设置每个VNFM的资源配额。
本发明的实施例中还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，接收网络功能虚拟化编排器根据授权策略设置的授权信息；
S2，根据授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
当确定VNF生命期操作到NFVO进行操作授权时，还包括：
S1，向NFVO发送操作授权请求，操作授权请求携带预留资源信息；
S2，并接收NFVO发送的接收或者拒绝操作授权请求的响应。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收授权策略，的授权策略包含至少一组授权规则；根据授权策略向虚拟网络功能管理器VNFM设置授权信息；授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收授权策略包括：通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：授权规则包括以下的一项或多项：指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：根据授权策略向虚拟网络功能管理器VNFM设置授权信息包括：根据授权策略生成与VNFM对应的策略信息，策略信息包括VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；根据策略信息向VNFM设置授权信息。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：预设条件包括以下一种或多种：预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：根据授权策略向虚拟网络功能管理器VNFM设置授权信息包括：通过策略管理接口将与VNFM对应的授权信息发送给VNFM；或者，在处理VNFM请求的VNF生命期操作授权请求时，在响应消息中将的授权信息携带给VNFM；或者，向VNFM发送的实例化VNF操作中将授权信息携带给VNFM。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：当VNFM确定VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：接收VNFM的操作授权请求，操作授权请求携带预留资源信息；根据授权策略和预留资源限制，确定接收或者拒绝操作授权请求。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：预留资源包括以下的一项或者多项：加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：预留资源信息包括VNF实例化时待分配的虚拟资源信息或VNF弹性伸缩时待增加或减少的虚拟资源信息。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：当接收操作授权请求携带预留资源时，对VNFM携带的预留资源信息进行虚拟资源预留。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向VIM设置每个VNFM的资源配额。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收网络功能虚拟化编排器根据授权策略设置的授权信息；根据授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：当确定VNF生命期操作到NFVO进行操作授权时，还包括：向NFVO 发送操作授权请求，操作授权请求携带预留资源信息；并接收NFVO发送的接收或者拒绝操作授权请求的响应。虽然本发明实施例所揭示的实施方式如上，但其内容只是为了便于理解本发明实施例的技术方案而采用的实施方式，并非用于限定本发明实施例。任何本发明实施例所属技术领域内的技术人员，在不脱离本发明实施例所揭示的核心技术方案的前提下，可以在实施的形式和细节上做任何修改与变化，但本发明实施例所限定的保护范围，仍须以所附的权利要求书限定的范围为准。
工业实用性
基于本发明提供的上述技术方案，在多个VNF的情况下，在VNF相关的生命期事件通过VNFM到NFVO进行认证授权，对于VNFM没有收到NFVO授权信息的情况，VNFM对VNF的每个生命期操作都缺省执行到NFVO进行操作授权，对于VNFM收到NFVO授权信息的情况，在VNFM和NFVO之间采用灵活的操作授权方式，对VNF生命期操作进行选择性过滤，选择性进行操作授权，解决了相关技术中对VNF相关的所有生命期事件到NFVO进行操作授权存在系统资源浪费和操作处理时延的问题，达到了节省系统资源，提高操作处理效率的效果。

Claims (29)

  1. 一种网络功能弹性授权的方法，包括：
    接收授权策略，所述的授权策略包含至少一组授权规则；
    根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
  2. 如权利要求1所述的方法，其中，接收授权策略包括：
    通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
  3. 如权利要求1所述的方法，其中，所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
  4. 如权利要求1所述的方法，其中，还包括：根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
  5. 如权利要求1所述的方法，其中，所述授权规则包括以下的一项或多项：
    指定的一个或多个时间段、特定的一组操作或与虚拟资源无关的操作，一个VNF或一组VNF、一类VNF、一个NS或一组NS、一类NS、或者特定租户等。
  6. 如权利要求1所述的方法，其中，根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
    根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除 生命期操作授权；
    根据所述策略信息向所述VNFM设置授权信息。
  7. 如权利要求3所述的方法，其中，所述预设条件包括以下一种或多种：
    预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
  8. 如权利要求3所述的方法，其中，根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
    通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
  9. 如权利要求1所述的方法，其中，当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，还包括：
    接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
    根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
  10. 如权利要求9所述的方法，其中，所述预留资源包括以下的一项或者多项：
    加速资源、满足亲和性要求的资源、预设资源域的资源、跨多个虚拟基础设施管理器VIM域资源。
  11. 如权利要求9所述的方法，其中，所述预留资源信息包括所 述VNF实例化时待分配的虚拟资源信息或所述VNF弹性伸缩时待增加或减少的虚拟资源信息。
  12. 如权利要求9所述的方法，其中，当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
  13. 如权利要求1或9所述的方法，其中，与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
  14. 一种网络功能弹性授权的方法，包括：
    接收网络功能虚拟化编排器根据授权策略设置的授权信息；
    根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
  15. 如权利要求14所述的方法，其中，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
    过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
  16. 如权利要求14所述的方法，其中，当确定所述VNF生命期操作到所述NFVO进行操作授权时，还包括：
    向所述NFVO发送操作授权请求，所述操作授权请求携带预留资源信息；
    并接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
  17. 一种网络功能弹性授权的装置，包括：
    第一接收模块，设置为接收授权策略，所述的授权策略包含至少一组授权规则；
    设置模块，设置为根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息；所述授权信息用于VNFM在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
  18. 如权利要求17所述的装置，其中，所述第一接收模块通过策略管理接口接收授权策略或通过配置的策略信息生成授权策略。
  19. 如权利要求17所述的装置，其中，所述授权策略用于VNFM过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
  20. 如权利要求17所述的装置，其中，还包括：更新模块，设置为根据指示信息创建新的授权策略、更新已经保存的授权策略，或者是取消已设置的授权策略。
  21. 如权利要求17所述的装置，其中，所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
    根据所述授权策略生成与所述VNFM对应的策略信息，所述策略信息包括所述VNFM管理的全部VNF每次生命期操作授权或免除生命期操作授权；
    根据所述策略信息向所述VNFM设置授权信息。
  22. 如权利要求19所述的装置，其中，所述预设条件包括以下一种或多种：
    预设的时间段、预设的一组或多组操作、与虚拟资源无关的操作、一个VNF或一组VNF标识。
  23. 如权利要求19所述的装置，其中，所述设置模块根据所述授权策略向虚拟网络功能管理器VNFM设置授权信息包括：
    通过策略管理接口将与所述VNFM对应的授权信息发送给所述VNFM；或者，在处理所述VNFM请求的VNF生命期操作授权请求时，在响应消息中将所述的授权信息携带给所述VNFM；或者，向所述VNFM发送的实例化VNF操作中将授权信息携带给所述VNFM。
  24. 如权利要求17所述的装置，其中，当VNFM确定所述VNF生命期操作到网络功能虚拟化编排器NFVO进行操作授权时，
    所述第一接收模块还设置为接收所述VNFM的操作授权请求，所述操作授权请求携带预留资源信息；
    所述设置模块还设置为根据所述授权策略和预留资源限制，确定接收或者拒绝所述操作授权请求。
  25. 如权利要求24所述的装置，其中，所述设置模块还设置为当接收所述操作授权请求携带预留资源时，对所述VNFM携带的预留资源信息进行虚拟资源预留。
  26. 如权利要求17或24所述的装置，其中，所述第一接收模块还设置为与虚拟基础设施管理器VIM交互，获取每个VNFM对虚拟资源的占用信息和或向所述VIM设置每个VNFM的资源配额。
  27. 一种网络功能弹性授权的装置，包括：
    第二接收模块，设置为接收网络功能虚拟化编排器根据授权策略设置的授权信息；
    操作模块，设置为根据所述授权信息在执行与虚拟网络功能VNF实例的生命期操作时，确定该生命期操作是否到网络功能虚拟化编排器NFVO进行操作授权。
  28. 如权利要求27所述的装置，其中，所述操作模块确定该生 命期操作是否到网络功能虚拟化编排器NFVO进行操作授权包括：
    过滤满足预设条件的VNF实例的生命期操作并到NFVO进行操作授权。
  29. 如权利要求27所述的装置，其中，当确定所述VNF生命期操作到所述NFVO进行操作授权时，所述操作模块还设置为：向所述NFVO发送操作授权请求，所述操作授权请求携带预留资源信息；
    所述第二接收模块还设置为：接收所述NFVO发送的接收或者拒绝所述操作授权请求的响应。
PCT/CN2016/105107 2015-11-09 2016-11-08 一种网络功能弹性授权的方法和装置 WO2017080439A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510758185.7A CN106681789A (zh) 2015-11-09 2015-11-09 一种网络功能弹性授权的方法和装置
CN201510758185.7 2015-11-09

Publications (1)

Publication Number Publication Date
WO2017080439A1 true WO2017080439A1 (zh) 2017-05-18

Family

ID=58694504

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105107 WO2017080439A1 (zh) 2015-11-09 2016-11-08 一种网络功能弹性授权的方法和装置

Country Status (2)

Country Link
CN (1) CN106681789A (zh)
WO (1) WO2017080439A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107948006A (zh) * 2018-01-09 2018-04-20 重庆邮电大学 一种虚拟化网络功能的编排方法及装置
CN114978912A (zh) * 2021-02-23 2022-08-30 中国电信股份有限公司 资源授权方法、nfvo、网络系统以及存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107493176B (zh) * 2017-09-25 2019-08-27 中国联合网络通信集团有限公司 一种计费方法及系统
CN107483217B (zh) * 2017-09-25 2019-11-08 中国联合网络通信集团有限公司 一种在线计费方法及系统
CN109639449B (zh) * 2017-10-09 2021-09-03 中兴通讯股份有限公司 虚拟化流镜像策略自动化管理的方法、设备及介质
CN110046044B (zh) * 2018-01-16 2021-06-22 中国电信股份有限公司 基于nfv的虚拟资源配置方法以及系统
CN110213064B (zh) * 2018-02-28 2022-07-19 中国移动通信有限公司研究院 一种vnf的扩缩容方法、装置及设备
CN115529589A (zh) * 2021-06-24 2022-12-27 中移(成都)信息通信科技有限公司 一种能力开放方法、装置、通信设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104170323A (zh) * 2014-04-09 2014-11-26 华为技术有限公司 基于网络功能虚拟化的故障处理方法及装置、系统
WO2015100611A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种网络功能虚拟化nfv故障管理装置、设备及方法
WO2015167595A1 (en) * 2014-04-30 2015-11-05 Hewlett Packard Development Company, L.P. Network infrastructure management
WO2015165802A1 (en) * 2014-04-30 2015-11-05 Ntt Docomo, Inc. Automated configuration of virtual infrastructure manager access for the virtual network function manager

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015100611A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种网络功能虚拟化nfv故障管理装置、设备及方法
CN104170323A (zh) * 2014-04-09 2014-11-26 华为技术有限公司 基于网络功能虚拟化的故障处理方法及装置、系统
WO2015167595A1 (en) * 2014-04-30 2015-11-05 Hewlett Packard Development Company, L.P. Network infrastructure management
WO2015165802A1 (en) * 2014-04-30 2015-11-05 Ntt Docomo, Inc. Automated configuration of virtual infrastructure manager access for the virtual network function manager

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107948006A (zh) * 2018-01-09 2018-04-20 重庆邮电大学 一种虚拟化网络功能的编排方法及装置
CN107948006B (zh) * 2018-01-09 2021-04-16 重庆邮电大学 一种虚拟化网络功能的编排方法及装置
CN114978912A (zh) * 2021-02-23 2022-08-30 中国电信股份有限公司 资源授权方法、nfvo、网络系统以及存储介质

Also Published As

Publication number Publication date
CN106681789A (zh) 2017-05-17

Similar Documents

Publication Publication Date Title
WO2017080439A1 (zh) 一种网络功能弹性授权的方法和装置
EP3461087B1 (en) Network-slice resource management method and apparatus
EP3313023B1 (en) Life cycle management method and apparatus
US11265222B2 (en) MLA based distributed management and orchestration (MANO) system and method
EP3800926B1 (en) Alarm method and device
US20170373931A1 (en) Method for updating network service descriptor nsd and apparatus
CN111587601A (zh) 网络切片供应及操作
CN108370328B (zh) 一种nfv mano策略描述符的管理方法及装置
CN109964449B (zh) 网络服务生命周期管理的许可方法和装置
WO2017080391A1 (zh) 一种网络服务部署方法和装置
EP3455728A1 (en) Orchestrator for a virtual network platform as a service (vnpaas)
JP2020510384A (ja) ネットワークスライス管理方法、ユニット、及びシステム
CN107005426B (zh) 一种虚拟网络功能的生命周期管理方法及装置
EP3413511B1 (en) Vnfm determining method and network function virtualization orchestrator
CN111245634B (zh) 一种虚拟化管理方法及装置
JP7377965B2 (ja) ネットワークリソース管理方法、システム、ネットワーク機器と可読記憶媒体
US20230261950A1 (en) Method of container cluster management and system thereof
CN109358967A (zh) 一种me平台app实例化迁移方法及服务器
CN109213567B (zh) 一种管理vnf实例化的方法和设备
WO2017070954A1 (zh) 资源预留的方法及vnfm、vim、nfvo
CN109933959B (zh) 一种许可证控制方法及相关设备
GB2591521A (en) Improvements in and relating to a multi-access edge computing (MEC) network
CN109257201B (zh) 一种License的发送方法和装置
Badmus et al. Achieving Network Slice Communication Service Distribution across 5G Micro-Operator Multi-tenants
WO2022110944A1 (zh) 网络切片规划的方法以及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16863615

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16863615

Country of ref document: EP

Kind code of ref document: A1