WO2018018459A1

WO2018018459A1 - Policy processing method and device

Info

Publication number: WO2018018459A1
Application number: PCT/CN2016/091861
Authority: WO
Inventors: 朱雷; 杨旭
Original assignee: 华为技术有限公司
Priority date: 2016-07-27
Filing date: 2016-07-27
Publication date: 2018-02-01

Abstract

Disclosed are a policy processing method and device. The method comprises: a network function virtualization orchestrator (NFVO) creating or acquiring a policy group, the policy group comprising an associated policy; the NFVO receiving a first request message from a sending end, the first request message being used for requesting the NFVO to verify or query a policy in the policy group; the NFVO verifying or querying a policy in the policy group; and the NFVO sending a response message to the sending end, the response message comprising a result of the verification or a result of the query. By means of the policy processing method and device provided in the embodiments of the present invention, a policy in a policy group is verified, inconformity between a policy to be executed and other policies in the policy group or an execution failure caused by an error of the policy to be executed is avoided, and based on the querying or verification of the policy group, the speed of querying or verification may be further improved.

Description

Method and device for strategic processing

Technical field

The present invention relates to the field of communications, and in particular, to a method and device for policy processing.

Background technique

Network Function Virtualization (NFV) technology can implement some network functions in software on general-purpose hardware. For example, in telecom networks, NFV technology can be used to implement partial telecommunications in general-purpose cloud servers, switches, and storage. Network capabilities to enable rapid and efficient deployment of network services.

NFV technology implements telecommunication network functions through various strategies, and different policies are not completely independent. For example, when performing elastic scaling operations, new resources may need to be allocated, and thus, the network is based on an automatic elastic scaling policy. When the service operates, an affinity/anti-affinity policy, a location restriction policy, and the like may be triggered. However, the prior art lacks a mechanism for processing the different policies described above, which may cause errors in the execution of these policies.

Summary of the invention

In view of this, the embodiment of the present invention provides a method and a device for processing a policy, which can verify or query a policy based on a policy group, so as to avoid an error when the policy is executed.

In one aspect, an embodiment of the present invention provides a method for policy processing, the method comprising: a network function virtualization orchestrator NFVO creates or acquires a policy group, the policy group includes an associated policy; and the NFVO receives from a sender a first request message, the first request message is used to request the NFVO to verify or query a policy in the policy group; the NFVO performs a verification process or a query process on a policy in the policy group; the NFVO direction The sending end sends a response message, where the response message includes a result of the verification process or a result of the query process.

According to the method for policy processing provided by the embodiment of the present invention, the NFVO may perform verification processing or query processing on the policies in the policy group, thereby avoiding the inconsistency between the to-be-executed policy and other policies in the policy group or the error of the pending execution policy. The execution failed. Policy group-based queries or validation can also increase the speed of queries or validations.

In a possible design, the NFVO performs verification processing or query processing on the policies in the policy group, including: the NFVO sends a second to an execution unit of the policy in the policy group. a request message, the second request message is used to request the execution unit to perform verification processing or query processing on the policy; and the NFVO receives a verification processing result of the policy or a query processing result from the execution unit. By sending the query request information or the verification request information to the execution unit of the policy in the policy group, the request execution unit performs query processing or verification processing on the policy in the policy group, thereby avoiding inconsistency between the pending policy and other policies in the policy group. Or the execution failure caused by the error of the pending policy. Policy group-based queries or validation can also increase the speed of queries or validations.

In a possible design, the NFVO performs verification processing on the policies in the policy group, including: the NFVO performs verification processing or query processing on the policies in the policy group based on a local policy. When the execution unit of the policy in the policy group is NFVO, the NFVO can perform query processing or verification processing on the policy in the policy group locally, so as to avoid inconsistency between the policy to be executed and other policies in the policy group or the policy to be executed. The execution caused by the error failed. Policy group-based queries or validation can also increase the speed of queries or validations.

In a possible design, the first request message includes indication information, policy information, or a group identifier, where the indication information is used to indicate a policy in the policy group, and the policy information refers to the policy. The information of the policy in the group, the group identifier is used to identify the policy group, and before the NFVO performs verification processing or query processing on the policy in the policy group, the method further includes: the NFVO according to the The indication information or the group identification determines the policy group. The method for policy processing provided by the implementation of the present invention can save the signaling overhead by indicating the policy in the policy group, and add an identifier to each policy group, so that the policy in the policy group can be quickly determined according to the request message. Relevance policies are queried or verified to ensure the integrity of policy queries or verifications while avoiding the inefficiencies caused by traversing policies within all functional modules.

In one possible design, the policy group corresponds to a management object, which includes a virtual network function descriptor VNFD, a tenant or a resource. Therefore, the policy group can be flexibly determined according to actual needs.

On the other hand, an embodiment of the present invention provides a method for policy processing, where the method includes: a sending end sends a request message to a network function virtualization orchestrator NFVO, where the request message is used to request the NFVO to be in a policy group. The policy performs verification processing or query processing, wherein the policy group includes an associated policy; the sender receives a response message from the NFVO, the response message including a result of the verification process or the query processing result.

According to the method for policy verification provided by the embodiment of the present invention, the sender requests the NFVO to the policy group. The policy in the verification is performed, thereby avoiding the inconsistency between the policy to be executed and other policies in the policy group or the execution failure caused by the error of the policy to be executed. Policy group-based queries or validation can also increase the speed of queries or validations.

In a possible design, the request message includes indication information, policy information, or a group identifier, where the indication information is used to indicate a policy in the policy group, and the policy information refers to a policy in a policy group. The information of the group identifier is used to identify the policy group. The method for policy processing provided by the implementation of the present invention can save the signaling overhead by indicating the policy in the policy group, and add an identifier to each policy group, so that the policy in the policy group can be quickly determined according to the request message. Relevance policies are queried or verified to ensure the integrity of policy queries or verifications while avoiding the inefficiencies caused by traversing policies within all functional modules.

In a possible design, the sending end includes: a network element management system EMS, an operation support system OSS, a service support system BSS, or an external management unit. The method for policy processing provided by the embodiment of the present invention supports different senders to send service processing requests, thereby adapting to different application scenarios.

In another aspect, the embodiment of the present invention provides an NFVO, which can implement the functions performed by the NFVO in the method related to the foregoing aspects, and the functions can be implemented by using hardware or by executing corresponding software by hardware. The hardware or software includes one or more corresponding units or modules of the above functions.

In one possible design, the NFVO structure includes a processor and a communication interface configured to support the NFVO to perform the corresponding functions of the above methods. The communication interface is used to support communication between the NFVO and other network elements. The NFVO can also include a memory for coupling with the processor that holds the necessary program instructions and data for the NFVO.

In another aspect, the embodiment of the present invention provides a sending end, where the sending end can implement the function performed by the sending end in the method embodiment of the foregoing aspect, and the function can be implemented by hardware or by hardware. Software Implementation. The hardware or software includes one or more modules corresponding to the above functions.

In a possible design, the structure of the transmitting end includes a processor and a communication interface, and the processor is configured to support the transmitting end to perform a corresponding function in the above method. This transceiver is used to support Communication between the sender and other network elements. The sender can also include a memory for coupling with the processor that holds the program instructions and data necessary for the sender.

In a possible design, the foregoing sending end may be a network element management system EMS, an operation support system OSS or a service support system BSS.

In another aspect, an embodiment of the present invention provides a communication system, including the NFVO and the transmitting end described in the foregoing aspects.

In still another aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the NFVO, including a program designed to perform the above aspects.

In still another aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use by the transmitting end, which includes a program designed to perform the above aspects.

Compared with the prior art, according to the method for policy processing provided by the embodiment of the present invention, the NFVO can perform verification processing or query processing on the policies in the policy group, thereby avoiding the inconsistency between the to-be-executed policy and other policies in the policy group. Execution failed due to an error in the execution of the policy. Policy group-based queries or validation can also increase the speed of queries or validations.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. It is obvious that the drawings described below are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

1 is a schematic diagram of a possible network architecture to which an embodiment of the present invention is applied;

2 is a schematic diagram of communication of a method for sending a policy according to an embodiment of the present invention;

3 is a schematic diagram of communication of a method for policy processing according to an embodiment of the present invention;

4 is a schematic diagram of communication of another method for policy processing according to an embodiment of the present invention;

FIG. 5A is a schematic structural diagram of a possible NFVO according to an embodiment of the present invention; FIG.

FIG. 5B is a schematic structural diagram of another possible NFVO according to an embodiment of the present invention; FIG.

6A is a schematic structural diagram of a possible transmitting end according to an embodiment of the present invention;

FIG. 6B is a schematic structural diagram of another possible transmitting end according to an embodiment of the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the following will be combined with the present invention. The technical solutions in the embodiments of the present invention are described in the accompanying drawings in the embodiments.

The network architecture and the service scenario described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and are not limited to the technical solutions provided by the embodiments of the present invention. The technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.

The method of the embodiment of the present invention can be applied to an NFV-based network architecture, and can also be applied to a network architecture based on an application container engine (for example, Docker), a virtual machine monitor (VMM)-based network architecture, or other virtual In the network architecture, the VMM may also be referred to as a hypervisor. The following describes the solution of the embodiment of the present invention by taking an NFV-based network architecture as an example.

FIG. 1 is a schematic diagram of an NFV-based network architecture according to an embodiment of the present invention. As shown in Figure 1, the network architecture includes: Network Function Virtualization Orchestrator (NFVO), Virtualized Network Function Manager (VNFM), and Virtualized Infrastructure Manager (Virtualized Infrastructure). Manager, VIM), Network Function Virtualization Infrastructure (NFVI), Virtualized Network Function (VNF), and Element Manager System (EMS), where NFVO, VNFM, and VIM belongs to the Management and Orchestration (MANO) architecture of the NFV system. In addition, the Operation Support System/Business Support System (OSS/BSS) in the network architecture shown in FIG. 1 is an existing OSS or BSS of the operator.

In order to facilitate the understanding of the embodiments of the present invention, the above-described devices and elements related to the present invention will be briefly described below.

A virtualisation container is part of a compute node that provides an isolated virtualized computing environment. An example of a typical virtualized container is a virtual machine. A virtual machine (VM) refers to a virtual device that is simulated on a physical device by virtual machine software. For applications running in virtual machines, these virtual machines work just like real physical devices, which can have operating systems and applications installed on them, and virtual machines can access network resources.

VNF, also known as virtualized network elements, corresponds to physical network functions in traditional non-virtualized networks. The functional behavior and state of the network function is independent of the virtualization of the network function. VNF It can be composed of multiple lower-level components. Optionally, one VNF can be deployed on multiple VMs, and each VM hosts a Virtualized Network Function Component (VNFC). Optionally, a VNF can also be deployed on a VM.

The Virtualized Network Function Descriptor (VNFD) is a deployment template for the VNF. Optionally, the VNFD and the VNF are in one-to-one correspondence, and the VNFD describes the virtual resource parameters and requirements required to implement the VNF, and is mainly used to establish a VNF instance and manage the life cycle of the VNF.

The VNFM is mainly used to implement the lifecycle management of the VNF instance, including the initialization of the VNF instance, the expansion or contraction of the VNF instance, and the termination of the VNF instance.

The EMS is mainly used to perform traditional FCAPS (Fault Management, Configuration Management, Accounting Management, Performance Management and Security Management, fault management, configuration management, billing management, performance management, and security management) functions for the VNF. The EMS can exist alone or as a VNF with EMS functionality.

VIM is mainly responsible for: management, monitoring, and fault reporting of infrastructure layer hardware resources and virtualized resources, and providing virtualized resource pools for upper-layer applications.

NFVI: Provides hardware and virtual resources for the entire system, consisting of hardware resources (including computing, networking, and storage), virtualization layers (virtualizing hardware resources into resource pools), and virtual resources (also divided into computing, networking, and storage). Part) composition. From a VNF perspective, the virtualization layer and hardware resources appear to be an entity that provides the required virtual resources.

NFVO is used to implement Network Service Descriptor (NSD), VNFD, Virtualized Network Function Forwarding Graph (VNFFG) management, Network Service (NS) lifecycle management, and resources. The global view feature.

Optionally, the network architecture shown in FIG. 1 may further include a Policy Management Function (PMF) unit. The physical implementation of the PMF unit can be a separate manager. When the PMF unit is a separate manager, the PMF unit can be connected to the OSS/BSS, NFVO, VNFM, and VIM respectively, and the reference point can be used to manage the reference point with NFVO, VNFM, and VIM connection. The PMF unit may also be a manager co-located with the NFVO in physical implementation, or it may be understood that the PMF unit and the NFVO are deployed on the same physical computer system. In this case, the PMF unit is respectively connected to the VNFM and the VIM. Optionally, in some embodiments, the PMF unit may also be deployed in the OSS or the BSS.

Operators can use NFV technology to build an Evolved Packet Core (EPC). For example, deploy a virtual Mobility Management Entity (MME) and a virtual Packet Data Network Gateway (PGW). ), a virtual Serving Gateway (SGW). The operator can send policies to the MANO system through the OSS/BSS, for example, configuring the lifecycle management policy of the NS and the lifecycle management policy of the VNF.

Depending on the execution entity, different policies need to be saved to different MANO entities (ie, NFVO, VNFM, or VIM) to facilitate local execution of the policy. Policy delivery can be done in the instantiation process or through policy management. The interface is completed. Below, the two cases are described separately. It is to be understood that the following description of the embodiments of the present invention is not intended to limit the scope of the present invention.

In the first case, the policy is delivered during the instantiation request. Figure 2 shows a schematic diagram of the completion of policy delivery during the instantiation request process. The process of policy delivery includes:

S201. The sending end (for example, an OSS/BSS or an external management unit) sends a request message for instantiating the VNF to the NFVO. The external management unit refers to an external entity connected to the NFVO, and the external management unit and the NFVO can interact with each other. For example, the external management unit may be a management terminal or a management network element connected to the NFVO.

S202. The NFVO verifies the correctness of the request message.

S203, the NFVO checks the resource availability and performs resource reservation (optional step). For example, the NFVO sends a resource query request message to the VIM, requests to query the currently available resources, and the VIM sends the query result to the NFVO.

S204, the NFVO obtains the VNF lifecycle management and resource management related strategies from the VNFD;

S205, the NFVO sends an instantiation request message to the VNFM, informing the VNFM to perform the VNF instantiation, and the NFVO sends the VNF lifecycle management policy to the VNFM. If the S203 is performed, the instantiation request message carries the reserved resource information.

S206, the VNFM verifies the instantiation request message and performs VNF instantiation processing, for example, modifying the instantiation parameter and the completion information, and at the same time, the VNFM stores the received VNF lifecycle management policy;

S207. The VNFM sends a request message for requesting allocation of resources to the NFVO, and sends an acknowledgement message to the NFVO, where the acknowledgement message is used to notify the NFVO, and the VNF lifecycle management policy has been obtained. Reason

S208. The NFVO performs a pre-processing operation, for example, verifying the instantiation parameter, selecting a resource location (ie, selecting a VIM), and checking the dependency;

S209. The NFVO sends a request message for requesting a virtual resource to the VIM, and sends a resource management policy related to the VNF to the VIM.

S210. The VIM stores the resource management policy after receiving the resource management policy.

S211, the VIM establishes a virtual network;

S212: The VIM allocates a virtual machine and a storage resource, and mounts the virtual machine to the virtual network.

S213, the VIM sends an acknowledgement message to the NFVO, notifying that the NFVO resource allocation has been completed, and the resource management policy has been processed;

S214, the NFVO notifies that the VNFM resource allocation is completed, the VNFM and the EM configure the VNF, and the VNFM notifies the NFVO to complete the instantiation;

S215, the NFVO notifies the sender that the instantiation is completed.

In the second case, the policy is delivered through the policy management interface. In addition to the policy of issuing policies along with the VNF instantiation process, operations such as adding and deleting policies can be implemented through independent policy management interfaces.

There are independent policy management interfaces between different network elements or units, for example: i) policy group management interface between OSS and NFVO, which is mainly responsible for the establishment, deletion, query, modification, etc. of the policy group; ii) EMS and The policy management interface between VNFM is mainly responsible for adding, deleting, and modifying VNF lifecycle management policies. iii) The policy management interface that VIM is open to administrators, which is mainly responsible for adding, deleting, and modifying virtual resource policies; The policy management interface between NFVO and VNFM is responsible for adding, deleting, modifying, querying, and verifying policy information to NFVO to VNFM. VNFM forwards the policy query/verification request initiated by EMS to NFVO, and VNFM sends policy update notification to NFVO; v) Policy management interface between NFVO and VIM, responsible for adding, deleting, modifying, querying, and verifying policy information to NFVO to VIM, VIM sending policy update notifications to NFVO, etc.; vi) Policy management interface between VNFM and VIM, responsible for NFVO authorization VNFM adds, deletes, modifies, queries, and validates policy information to VIM.

After the NFVO reads the VNFD to obtain the relevant policy information, the NFVO can issue and store the VNF lifecycle management policy and the resource management policy to the VNFM and VIM respectively through the policy management interface between the VNFM and the VIM. In addition, the OSS and the VIM are provided. Administrators, EMS, etc. can also manage the policy information in MANO through the corresponding policy management interface.

After the various strategies are issued, these strategies are not completely independent, but in the prior art. There is a lack of mechanisms for dealing with associated policies, which can lead to errors in their implementation. In view of this, the embodiment of the present invention provides a policy group-based solution, where the policy group includes an associated policy, so that different policies can be processed based on the policy group to prevent errors in the execution of these policies.

In a possible implementation manner, an NFVO or PMF unit or the like may create a policy group, and the policy group includes an associated policy. Exemplarily, a policy group can be created according to different management objects. For example, the NFVO or PMF unit can index related policies according to different management objects to form a policy group. The NFVO or PMF unit can also add an identifier to each policy group, so that the policies in the policy group can be quickly determined according to the request message, and a group of related policies can be queried or verified to ensure the integrity of the policy query or verification. Avoid the inefficiencies caused by traversing the policies within all functional modules.

Here are a few examples of creating policy groups based on different management objects.

The management object is VNFD. The VNFD includes some policy information. After reading the policy defined in the VNFD, the NFVO can use all the policies read as a policy group, and use the VNFD identifier or the automatically generated identifier as the group identifier of the group policy.

The management object is a tenant. Different tenants can use or manage different VNFs or virtual resources to share MANO management and infrastructure. Some policies can be set up by tenants as managed objects, such as resource usage restriction policies for different tenants. NFVO can use the tenant ID to create a policy group as a group ID. When adding a policy for a tenant, if the tenant ID is the same as the group ID of the policy group, NFVO can add the policy to the policy group, if the tenant ID and policy group The group IDs are inconsistent, and NFVO can create a new policy group for the policy.

The management object is a resource. The NFV system includes a plurality of different types of resources, such as computing resources, network resources, storage resources, and acceleration resources. The system can set policies for different kinds of resources. In addition, the system can also target resource groups (for example, resource zones). ), reserve a resource pool (reservation pool) to set a special strategy. The NFVO may create a policy group according to the category or identifier of the resource. When adding a policy for the resource, if the resource corresponding to the policy belongs to a type of resource or a resource group, the NFVO may add the policy to the policy group if the policy The corresponding resource has nothing to do with the existing resource or resource group. NFVO can create a new policy group for the policy.

The above example is only an example, and the embodiment of the present invention is not limited thereto. Alternatively, after the PMF unit or other unit creates a policy group, the NFVO may also obtain the policy from the PMF unit or other unit. group.

The embodiments of the present invention will be further described in detail below based on the common aspects of the invention described above.

FIG. 3 is a schematic diagram of communication of a method 300 for policy processing according to an embodiment of the present invention. As shown in FIG. 3, the method 300 includes:

S310. The NFVO creates or acquires a policy group, where the policy group includes an associated policy.

In one example, NFVO can create a policy group. For example, NFVO may create a policy group according to a management object, where the management object may include a VNFD, a tenant or a resource, and the like. For details about how to create a method, refer to the above detailed description of an example of creating a policy group based on different management objects, which is not described here. Therefore, the embodiment of the present invention can flexibly determine a policy group according to actual needs.

In another example, NFVO can acquire a policy group. For example, NFVO can obtain a policy group from a PMF unit, OSS, or BSS. The PMF unit, the OSS, or the BSS may send the policy group to the NFVO according to the management object, where the management object may include a VNFD, a tenant, or a resource. For details about how to create a method, refer to the above detailed description of an example of creating a policy group based on different management objects, which is not described here.

S320. The sending end sends a first request message to the NFVO, where the first request message is used to request the NFVO to perform verification processing or query processing on the policy in the policy group.

In one example, the first request message may be an authentication request message for requesting at least one of consistency, correctness, and enforceability of the policies in the NFVO verification policy group. The consistency means that the policy information saved by the NFVO is the same or not contradictory to the policy information saved in the policy execution unit; the correctness means that the policy information has no semantic and grammatical errors in expression; the executable The policy information may be executed by the policy execution unit, that is, the policy information is not an invalid policy (the invalid policy means that the policy is not applicable to the execution of the policy execution unit in which it is located, for example, the policy includes operations that are not supported by the policy execution unit) or Redundancy policy (the redundancy policy means that the policy information can be replaced by other one or more policy information so as not to be actually executed). Alternatively, the first request message may also be a query request message, where the query request message is used to request a policy in the NFVO query policy group, so that the sender performs verification.

The sending end may be an EMS, an OSS or a BSS, or an external management unit, wherein the administrator may initiate a query request or an authentication request to the NFVO through the external management unit. Therefore, the embodiment of the present invention can support service processing requests sent by different sending ends, so that it can adapt to different application scenarios.

S330. The NFVO performs verification processing or query processing on the policies in the policy group.

In an example, the verification process may be to check whether the policy stored in the NFVM or VIM is consistent with the policy stored in the NFVO (ie, verify the consistency of the policy), or may generate a trigger related policy by simulating the event (ie, verifying the policy) The correctness and enforceability); the query processing may be to request the VNFM or VIM to send the locally stored related policies to the NFVO.

In one example, the method of verification processing and query processing may be different depending on the execution unit of the policy.

For example, the S330 may include: S331. The NFVO performs a verification process or a query process on the policy in the policy group locally, where the execution unit of the policy is NFVO.

For example, the S330 may include: S332, the NFVO sends a second request message to the VNFM or the VIM, where the second request message is used to request the execution unit to perform verification processing or query processing on the policy, where the execution unit of the policy is VNFM or VIM; S333, NFVO receives the result of the verification process sent by the VNFM or VIM or the result of the query process.

The method for policy processing provided by the embodiment of the present invention sends a query request information or a verification request information to an execution unit of a policy in a policy group, and requests the execution unit to perform query processing or verification processing on the policy in the policy group, thereby avoiding waiting for the policy in the policy group. Execution policy fails with other policies in the policy group or the execution of the pending policy fails.

When the execution unit of the policy in the policy group is NFVO, the NFVO can perform query processing or verification processing on the policy in the policy group locally, so as to avoid inconsistency between the policy to be executed and other policies in the policy group or the policy to be executed. The execution caused by the error failed. Policy group-based queries or validation can also increase the speed of queries or validations.

After the NFVO completes the query processing or the verification processing according to the first request message, the method 300 further includes:

S340. The NFVO sends a response message to the sender, where the response message includes a result of the verification process or a result of the query process.

According to the method 300 of the policy processing according to the embodiment of the present invention, the NFVO can verify or query the policy in the policy group, thereby avoiding the inconsistency between the policy to be executed and other policies in the policy group or the execution failure caused by the error of the policy to be executed. . Policy group-based queries or validation can also increase the speed of queries or validations.

FIG. 4 is a schematic flowchart of another method 400 for policy processing according to an embodiment of the present invention. The method 400 includes three steps: S410, initiating a query/verification request; S420, query verification Certificate process; S430, result feedback. Hereinafter, a method of policy processing according to an embodiment of the present invention will be described in detail with reference to FIG.

S410, the NFVO receives the request message sent by the sending end, where the request message may be an authentication request message, and is used to request at least one of consistency, correctness, and enforceability of the policy in the NFVO verification policy group, and the request message is also It may be a query request message for requesting a policy in the NFVO query policy group. The S410 includes the following three cases according to different senders of the query/verification request.

In the first case, the sender is OSS. The OSS can directly send a policy query/authentication request message to the NFVO, and after receiving the request message, the NFVO performs query processing or verification processing on the corresponding policy group.

In the second case, the sender is EMS. The EMS may send a policy query/authentication request message to the VNFM, and the VNFM forwards the request message to the NFVO, so that the NFVO performs query processing or verification processing on the corresponding policy group according to the request message.

In the third case, the sender is an external management unit. The administrator can directly send a policy query/authentication request message to the NFVO through the external management unit, and after receiving the request message, the NFVO performs query processing or verification processing on the corresponding policy group.

The method for policy processing provided by the implementation of the present invention can support different senders to send service processing requests, thereby adapting to different application scenarios.

S420: The NFVO performs a verification process or a query process on the policy in the policy group according to the request message. According to the specific execution unit of the strategy, the verification process is divided into the following three cases.

In the first case, the policy execution unit is NFVO, and the NFVO locally performs verification processing or query processing on the policies in the policy group.

In the second case, if the policy execution unit is a VIM, the NFVO sends a query/verification request message to the VIM, requesting the VIM to perform verification processing or query processing on the policies in the policy group.

In the third case, the policy execution unit is a VNFM, and the NFVO sends a query/verification request message to the VNFM, requesting the VNFM to perform verification processing or query processing on the policies in the policy group.

The request message sent by the sending end to the NFVO may carry the indication information of the policy information, may also carry the group identifier of the policy group, and may also carry the policy information, and the NFVO may determine the policy according to the indication information, the policy information, or the group identifier carried in the request message. a group, wherein the indication information is used to indicate a policy in the policy group, the group identifier is used to identify the policy group, and the policy information refers to information of a policy in a policy group. NFVO can be based on the execution unit of the policy in the policy group. Similarly, the verification/query request message is sent to different execution units respectively, and the execution unit is requested to perform verification processing or query processing on the corresponding policy. If the execution unit of the policy is NFVO, the verification/query request message does not need to be sent, and the local execution may be performed locally. Verification processing or query processing.

The method for policy processing provided by the implementation of the present invention can save the signaling overhead by indicating the policy in the policy group, and add an identifier to each policy group, so that the policy in the policy group can be quickly determined according to the request message. Relevance policies are queried or verified to ensure the integrity of policy queries or verifications while avoiding the inefficiencies caused by traversing policies within all functional modules.

The verification process may be to check whether the policy stored in the NFVM or VIM is consistent with the policy stored in the NFVO (ie, verify the consistency of the policy), or may generate a trigger related policy by simulating the event (ie, verifying the correctness of the policy and Execution), for example, sends VNF monitoring information to the VNFM "Central processor CPU load exceeds 85%" to verify whether the VNF's auto-elastic scaling policy can be triggered, thereby avoiding errors in the execution of the policy.

The query processing may be to request the VNFM or VIM to send the locally stored related policies to the NFVO.

S430, the result feedback.

The NFVO sends the result of the verification processing or the query processing to the sender. The sender can determine whether to execute the policy according to the result of the verification process, or the sender verifies the policy obtained by the query to determine whether to execute the policy.

According to the policy processing method of the embodiment of the present invention, the NFVO can query or verify the policy in the policy group, thereby avoiding the inconsistency between the policy to be executed and other policies in the policy group or the execution failure caused by the error of the policy to be executed. Policy group-based queries or validation can also increase the speed of queries or validations.

The foregoing embodiment mainly introduces the solution of the embodiment of the present invention from the perspective of interaction between the network elements. It can be understood that each network element, such as NFVO, OSS/BSS, EMS, etc., in order to implement the above functions, includes corresponding hardware structures and/or software modules for performing various functions. Those skilled in the art will readily appreciate that the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The embodiments of the present invention may perform functional unit division on the NFVO, the transmitting end (for example, OSS, BSS, or EMS) according to the foregoing method. For example, each functional unit may be divided according to each function, or two or more of the functional units may be divided. The functions are integrated in one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.

In the case of employing an integrated unit, FIG. 5A shows a possible structural diagram of the NFVO involved in the above embodiment. The NFVO 500 includes a processing unit 502 and a communication unit 503. The processing unit 502 is configured to perform control management on the actions of the NFVO 500. For example, the processing unit 502 is configured to support the NFVO 500 to perform S310, S330, and S340 of FIG. 3. The processing unit 502 is further configured to support the NFVO 500 to perform S420 and S430 of FIG. 4, and / or other processes for the techniques described herein. Communication unit 503 is used to support communication of NFVO 500 with other network entities, such as with the sender shown in FIG. The NFVO 500 may also include a storage unit 501 for storing program codes and data of the NFVO 500.

The processing unit 502 can be a processor or a controller, and can be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 503 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces. The storage unit 501 can be a memory.

When the processing unit 502 is a processor, the communication unit 503 is a communication interface, and the storage unit 501 is a memory, the NFVO involved in the embodiment of the present invention may be the NFVO shown in FIG. 5B.

Referring to FIG. 5B, the NFVO 510 includes a processor 512, a communication interface 513, and a memory 511. Alternatively, the NFVO 510 can also include a bus 514. The communication interface 513, the processor 512, and the memory 511 may be connected to each other through a bus 514. The bus 514 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on. The bus 514 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 5B, but it does not mean that there is only one bus or one type of bus.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

Therefore, the NFVO provided by the embodiment of the present invention can verify or query the policy in the policy group, thereby avoiding the inconsistency between the policy to be executed and other policies in the policy group or the execution failure caused by the error of the policy to be executed. Policy group-based queries or validation can also increase the speed of queries or validations.

In the case of employing an integrated unit, FIG. 6A shows a possible structural diagram of a transmitting end (for example, EMS, OSS, or BSS) involved in the above embodiment. The transmitting end 600 includes a processing unit 602 and a communication unit 603. The processing unit 602 is configured to perform control and management on the action of the sending end 600. For example, the processing unit 602 is configured to support the sending end 600 to execute S320 of FIG. 3, and the processing unit 602 is further configured to support the sending end 600 to execute S410 of FIG. 4, and / or other processes for the techniques described herein. Communication unit 603 is used to support communication between sender 600 and other network entities, such as communication with the NFVO shown in FIG. The transmitting end 600 may further include a storage unit 601 for storing program codes and data of the transmitting end 600.

The processing unit 602 can be a processor or a controller, and can be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 603 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces. The storage unit 601 can be a memory.

When the processing unit 602 is a processor, the communication unit 603 is a communication interface, and the storage unit 601 is a memory, the transmitting end of the embodiment of the present invention may be the transmitting end shown in FIG. 6B.

Referring to FIG. 6B, the transmitting end 610 includes a processor 612, a communication interface 613, and a memory 611. Optionally, the transmitting end 610 may further include a bus 614. Among them, the communication interface 613, at The processor 612 and the memory 611 may be connected to each other through a bus 614. The bus 614 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus 614 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 6B, but it does not mean that there is only one bus or one type of bus.

Therefore, the sender provided by the embodiment of the present invention may send a query request message or an authentication request message, requesting the NFVO to query or verify the policy in the policy group, thereby avoiding the inconsistency between the policy to be executed and other policies in the policy group. Execution failed due to an error in the execution of the policy. Policy group-based queries or validation can also increase the speed of queries or validations.

In the embodiment of the present invention, the sequence number of each process does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be limited to the implementation process of the embodiment of the present invention.

In addition, the term "and/or" herein is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A and B exist at the same time. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

The steps of the method or algorithm described in connection with the disclosure of the embodiments of the present invention may be implemented in a hardware manner, or may be implemented by a processor executing software instructions. The software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in NFVO or NM. Of course, the processor and the storage medium can also exist as discrete components in NFVO or NM.

Those skilled in the art will appreciate that in one or more examples described above, the functions described herein can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. The scope of the protection, any modifications, equivalent substitutions, improvements, etc., which are made on the basis of the technical solutions of the present invention, are included in the scope of the present invention.

Claims

A method for policy processing, the method comprising:

The network function virtualization orchestrator NFVO creates or acquires a policy group, the policy group including an associated policy;

The first request message received by the NFVO from the sending end, where the first request message is used to request the NFVO verification or query a policy in the policy group;

The NFVO performs verification processing or query processing on the policies in the policy group;

The NFVO sends a response message to the sender, the response message including a result of the verification process or a result of the query process.
The method according to claim 1, wherein the NFVO performs verification processing or query processing on the policies in the policy group, including:

The NFVO sends a second request message to the execution unit of the policy in the policy group, where the second request message is used to request the execution unit to perform verification processing or query processing on the policy;

The NFVO receives a verification processing result of the policy or a query processing result from the execution unit.
The method according to claim 1, wherein the NFVO performs verification processing on the policies in the policy group, including:

The NFVO performs verification processing or query processing on the policies in the policy group based on a local policy.
The method according to any one of claims 1 to 3, wherein the first request message includes indication information, policy information or a group identifier, wherein the indication information is used to indicate the policy group. a policy, where the policy information refers to information of a policy in the policy group, where the group identifier is used to identify the policy group, and before the NFVO performs verification processing or query processing on a policy in the policy group, The method further includes:

The NFVO determines the policy group according to the indication information or the group identifier.
The method according to any one of claims 1 to 4, wherein the policy group corresponds to a management object, the management object comprising a virtual network function descriptor VNFD, a tenant or a resource.
A method for policy processing, the method comprising:

The sending end sends a request message to the network function virtualization orchestrator NFVO, where the request message is used Requesting, by the NFVO, to perform verification processing or query processing on a policy in a policy group, where the policy group includes an associated policy;

The transmitting end receives a response message from the NFVO, and the response message includes a result of the verification process or a result of the query process.
The method according to claim 6, wherein the request message includes indication information, policy information or a group identifier, wherein the indication information is used to indicate a policy in the policy group, and the policy information is Refers to information of a policy in the policy group, where the group identifier is used to identify the policy group.
The method according to claim 6 or 7, wherein the policy group corresponds to a management object, and the management object comprises a virtual network function descriptor VNFD, a tenant or a resource.
The method according to any one of claims 6 to 8, wherein the transmitting end comprises: a network element management system EMS, an operation support system OSS, a service support system BSS or an external management unit.
A network function virtualization orchestrator NFVO, comprising: a processing unit and a communication unit,

The processing unit is configured to create or acquire a policy group, the policy group includes an associated policy, and configured to receive, by the communication unit, a first request message from a sending end, where the first request message is used to request the NFVO validating or querying a policy in the policy group; and performing verification processing or query processing on the policy in the policy group; and transmitting, by the communication unit, a response message to the sender, the response The message includes the result of the verification process or the result of the query process.
The NFVO according to claim 10, wherein the processing unit is specifically configured to send, by the communication unit, a second request message to an execution unit of a policy in the policy group, where the second request message is used Requesting the execution unit to perform verification processing or query processing on the policy; and receiving, by the communication unit, a verification processing result of the policy or a result of the query processing from the execution unit.
The NFVO according to claim 10, wherein the processing unit is specifically configured to perform verification processing or query processing on the policies in the policy group based on a local policy.
The NFVO according to any one of claims 10 to 12, wherein the first request message includes indication information, policy information, or a group identifier, wherein the indication information is used to indicate the policy group. Policy, the policy information refers to a letter of the policy in the policy group The group identifier is used to identify the policy group, and the processing unit is further configured to determine, according to the indication information or the group identifier, before performing verification processing or query processing on the policy in the policy group. The strategy group.
The NFVO according to any one of claims 10 to 13, characterized in that the policy group corresponds to a management object, the management object comprising a virtual network function descriptor VNFD, a tenant or a resource.
A transmitting end, comprising: a processing unit and a communication unit,

The processing unit is configured to send, by using the communication unit, a request message to the network function virtualization orchestrator NFVO, where the request message is used to request the NFVO to perform verification processing or query processing on a policy in a policy group, where The policy group includes an associated policy; and is configured to receive, by the communication unit, a response message from the NFVO, the response message including a result of the verification process or a result of the query process.
The sender according to claim 15, wherein the request message includes indication information, policy information, or a group identifier, where the indication information is used to indicate a policy in the policy group, and the policy information is Refers to the information of the policy in the policy group, where the group identifier is used to identify the policy group.
The transmitting end according to claim 15 or 16, wherein the policy group corresponds to a management object, and the management object includes a virtual network function descriptor VNFD, a tenant or a resource.
The transmitting end according to any one of claims 15 to 17, wherein the transmitting end comprises: a network element management system EMS, an operation support system OSS, a service support system BSS or an external management unit.