WO2018040095A1 - 一种生成安全凭证的方法和设备 - Google Patents

一种生成安全凭证的方法和设备 Download PDF

Info

Publication number
WO2018040095A1
WO2018040095A1 PCT/CN2016/098061 CN2016098061W WO2018040095A1 WO 2018040095 A1 WO2018040095 A1 WO 2018040095A1 CN 2016098061 W CN2016098061 W CN 2016098061W WO 2018040095 A1 WO2018040095 A1 WO 2018040095A1
Authority
WO
WIPO (PCT)
Prior art keywords
public key
vnf instance
nfvi
security credential
private key
Prior art date
Application number
PCT/CN2016/098061
Other languages
English (en)
French (fr)
Inventor
王江胜
塞尔维亚米哈伊
伊万 西尔维乌 弗勒斯恰努
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/098061 priority Critical patent/WO2018040095A1/zh
Publication of WO2018040095A1 publication Critical patent/WO2018040095A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of communications, and in particular, to a method and an apparatus for generating a security credential.
  • NFV Network Function Virtualization
  • NFV technology can implement some network functions in software on general-purpose hardware.
  • NFV technology can be used to implement partial telecommunications in general-purpose cloud servers, switches, and storage. Network capabilities to enable rapid and efficient deployment of network services.
  • the NFV technology implements the telecommunication network function through a virtualized network function (VNF).
  • VNF virtualized network function
  • the VNF needs to communicate with other network elements in the network through the security credential after initialization.
  • the existing In the technology after the security credential is generated, multiple network elements can reach the VNF, and the security credential is more likely to be stolen or fraudulently used.
  • the embodiment of the present invention provides a method and a device for generating a security credential, which can reduce the number of network elements through which the security credential passes, thereby reducing the risk of the security credential being stolen or fraudulent.
  • an embodiment of the present invention provides a method for generating a security credential, the method comprising: a network function virtualization infrastructure NFVI receiving a virtual network function VNF initialization command from a management and orchestration MANO; the NFVI according to the VNF initialization command Creating a VNF instance and generating a security credential of the VNF instance, wherein the security credential includes a public key and a private key, the public key is used to encrypt data, and the private key is used to decrypt the public key encrypted data, Alternatively, the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the method for generating a security credential provided by the embodiment of the present invention generates a security credential for the VNF by using the NFVI, which can reduce the network element experienced after the security credential is generated, thereby reducing the risk of leaking the security credential.
  • the method further includes: sending, by the NFVI, the public key and the private key to the VNF instance;
  • the MANO sends the public key and the identification information of the VNF instance, so that the MANO discloses the public key and the identification information of the VNF instance.
  • the method further includes: sending, by the NFVI, the public key and the private key to the VNF instance;
  • the MANO sends the public key and the identification information of the VNF instance, so that the MANO discloses the public key and the identification information of the VNF instance.
  • the MANO can communicate with the VNF instance according to the public key and the identification information.
  • an embodiment of the present invention provides a method for generating a security credential, the method comprising: a network function virtualization infrastructure NFVI receiving a virtual network function VNF initialization command from a management and orchestration MANO; the NFVI is initialized according to the VNF The command creates a VNF instance; the NFVI allocates a trusted environment TE to the VNF instance; the NFVI sends a request message to the TE, where the request message is used to request the TE to generate a security credential of the VNF instance.
  • the security credential includes a public key and a private key, wherein the public key is used to encrypt data and the private key is used to decrypt the public key encrypted data, or the private key is used to sign data and The public key is used to verify the data signed by the private key.
  • the method for generating a security credential provided by the embodiment of the present invention generates a security credential for the VNF instance by using the NFVI requesting TE, which can reduce the network element experienced after the security credential is generated, thereby reducing the risk of leaking the security credential.
  • the method further includes: the NFVI receiving the public key from the TE; the NFVI sending the public key to the MANO The identification information of the VNF instance, so that the MANO discloses the public key and the identification information of the VNF instance.
  • the method further includes: the NFVI receiving the public key from the TE; the NFVI sending the public key to the MANO The identification information of the VNF instance, so that the MANO discloses the public key and the identification information of the VNF instance.
  • the MANO discloses the public key and the identification information of the VNF instance.
  • an embodiment of the present invention provides a method for generating a security credential, the method comprising: a virtualized network function VNF instance generation request message, where the request message is used to request a trusted environment TE to generate a security credential, the security
  • the voucher includes a public key and a private key, wherein the public key is used to encrypt data and the private key is used to decrypt the public key encrypted data, or the private key is used to sign data and the public The key is used to verify data signed by the private key; the VNF instance sends the request message to the TE.
  • the method for generating a security credential provided by the embodiment of the present invention by requesting the TE to generate a security credential for the VNF instance by using the VNF instance, can reduce the network element experienced after the security credential is generated, thereby reducing the risk of leaking the security credential.
  • the method further includes: the VNF instance receiving the public key from the TE; the VNF instance virtualizing an infrastructure to a network function
  • the NFVI sends the public key so that the NFVI sends the public key to the management and orchestration MANO and exposes the public key through the MANO.
  • other VNF instances and the MANO can be performed with the VNF instance according to the public key and the identification information. Communication.
  • an embodiment of the present invention provides a method for generating a security credential, the method comprising: receiving, by a trusted environment TE, a request message from a network function virtualization infrastructure NFVI or a virtual network function VNF instance, the request message being used for Requesting the TE to generate a security credential of the VNF instance; the TE generates the security credential according to the request message, where the security credential includes a public key and a private key, wherein the public key is used to encrypt data and The private key is used to decrypt the data encrypted by the public key, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the TE generates a security credential for the VNF instance according to the request of the VNF instance or the NFVI, which can reduce the network element experienced after the security credential is generated, thereby reducing the risk of the security credential leak.
  • the method further includes: the TE sending the public key to the NFVI, so that the NFVI manages and orchestrate the MANO public office. Said public key; or the TE sends the public key to the VNF instance, so that the VNF instance sends the public key to the NFVI.
  • the TE sends the public key to the VNF instance, so that the VNF instance sends the public key to the NFVI.
  • the embodiment of the present invention provides a network function virtualization infrastructure NFVI, which can implement the functions performed by the NFVI in the method related to the foregoing aspects, and the functions can be implemented by hardware or by hardware.
  • the hardware or software includes one or more corresponding units or modules of the above functions.
  • the NFVI structure includes a processor and a communication interface configured to support the NFVI to perform the corresponding functions of the above methods.
  • the communication interface is used to support communication between the NFVI and other network elements.
  • the NFVI can also include a memory for coupling with the processor that holds the necessary program instructions and data for the NFVI.
  • the embodiment of the present invention provides a trusted environment TE, where the TE can implement the functions performed by the TE in the method related to the foregoing aspects, and the functions can be implemented by using hardware or by executing corresponding software through hardware.
  • the hardware or software includes one or more corresponding units or modules of the above functions.
  • the structure of the TE includes a processor and a communication interface configured to support the TE to perform corresponding functions in the above methods.
  • the communication interface is used to support communication between the TE and other network elements.
  • the TE may also include a memory for processing and processing
  • the device is coupled, which holds the necessary program instructions and data for the TE.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the NFVI, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the TE, including a program designed to perform the above aspects.
  • FIG. 1 is a schematic diagram of a possible network architecture to which an embodiment of the present invention is applied;
  • FIG. 2 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of communication of another method for generating a security credential according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention
  • FIG. 5 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of communication of another method for generating a security credential according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of communication of another method for generating a security credential according to an embodiment of the present invention.
  • FIG. 8A is a schematic structural diagram of a possible NFVI according to an embodiment of the present invention.
  • FIG. 8B is a schematic structural diagram of another possible NFVI according to an embodiment of the present invention.
  • FIG. 9A is a schematic structural diagram of still another possible NFVI according to an embodiment of the present invention.
  • FIG. 9B is a schematic structural diagram of still another possible NFVI according to an embodiment of the present invention.
  • FIG. 10A is a schematic structural diagram of a possible VNF example according to an embodiment of the present disclosure.
  • FIG. 10B is a schematic structural diagram of another possible VNF example according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a possible TE according to an embodiment of the present invention.
  • FIG. 11B is a schematic structural diagram of another possible TE according to an embodiment of the present invention.
  • the network architecture and service scenario described in the embodiments of the present invention are for a clearer description of the present invention.
  • the technical solutions of the embodiments of the present invention are not limited to the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention may be known to those of ordinary skill in the art, as the network architecture evolves and new service scenarios occur. Similar technical issues apply equally.
  • the method of the embodiment of the present invention can be applied to an NFV-based network architecture, and can also be applied to a network architecture based on an application container engine (for example, Docker), a virtual machine monitor (VMM)-based network architecture, and based on openstack.
  • an application container engine for example, Docker
  • VMM virtual machine monitor
  • the VMM may also be referred to as a hypervisor.
  • FIG. 1 is a schematic diagram of an NFV-based network architecture according to an embodiment of the present invention.
  • the network architecture includes: Network Function Virtualization Orchestrator (NFVO), Virtualized Network Function Manager (VNFM), and Virtualized Infrastructure Manager (Virtualized Infrastructure). Manager, VIM), Network Function Virtualization Infrastructure (NFVI), Virtual Machine (VM), Virtualized Network Function (VNF), and Element Manager System (Element Manager System, EMS), where NFVO, VNFM, and VIM belong to the Management and Orchestration (MANO) of the NFV system.
  • the related functions of MANO can be implemented by hardware or by software.
  • a virtualisation container is part of a compute node that provides an isolated virtualized computing environment.
  • An example of a typical virtualization container is a VM.
  • a VM is a virtual device that is simulated on a physical device by virtual machine software. For applications running in virtual machines, these virtual machines work just like real physical devices, which can have operating systems and applications installed on them, and virtual machines can access network resources.
  • VNF also known as virtualized network elements
  • VNF corresponds to physical network functions in traditional non-virtualized networks.
  • the functional behavior and state of the network function is independent of the virtualization of the network function.
  • the VNF can be composed of multiple lower-level components.
  • one VNF can be deployed on multiple VMs, and each VM hosts a Virtualized Network Function Component (VNFC).
  • VNFC Virtualized Network Function Component
  • a VNF can also be deployed on a VM.
  • VNFM is mainly used to: implement lifecycle management of VNF instances, including the beginning of VNF instances. Initialization, expansion or contraction of VNF instances and termination of VNF instances.
  • the EMS is mainly used to perform traditional FCAPS (Fault Management, Configuration Management, Accounting Management, Performance Management and Security Management, fault management, configuration management, billing management, performance management, and security management) functions for the VNF.
  • FCAPS fault Management, Configuration Management, Accounting Management, Performance Management and Security Management, fault management, configuration management, billing management, performance management, and security management
  • the EMS can exist alone or as a VNF with EMS functionality.
  • VIM is mainly responsible for: management, monitoring, and fault reporting of infrastructure layer hardware resources and virtualized resources, and providing virtualized resource pools for upper-layer applications.
  • NFVI is mainly used to provide hardware and virtual resources for the entire system, including hardware resources (including computing, network, and storage), virtualization layer (virtualization of hardware resources into resource pools), and virtual resources (also divided into computing and networking). , storage three parts) composition. From a VNF perspective, the virtualization layer and hardware resources appear to be an entity that provides the required virtual resources.
  • NFVO Network Service Descriptor
  • VNFD Virtualized Network Function Descriptor
  • VNFFG Virtualized Network Function Forwarding Graph
  • NS Network Service, NS Lifecycle management, and global view of resources.
  • Trusted Environment which is used to protect the operating system and software running on a host (for example, a VM).
  • the TE can be implemented in hardware or in software. Regardless of the implementation, for the VNF, Both are modules that provide trusted computing capabilities and interface calls.
  • FIG. 2 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention. As shown in FIG. 2, the method includes:
  • MANO sends a VNF initialization command to the NFVI.
  • the VNF initialization command includes information that triggers the NFVI to create a VNF instance, and Includes information that triggers the NFVI to generate a security credential for the VNF instance.
  • the NVFI creates a VNF instance and generates a security credential of the VNF instance according to the VNF initialization command.
  • the security credential may include a public key and a private key, or the security credential may include a certificate file, or a username and a password.
  • the public key is used to encrypt data and the private key is used to decrypt the public key encrypted data, or the private key is used to sign data and the public key is used to verify the private key Signed data.
  • the MANO may be any one of NFVO, VNFM, and VIM.
  • the VNF initialization command may be sent to the NFVI through the VIM.
  • the NFVI After receiving the VNF initialization command, the NFVI creates the VNF instance and generates the VNF instance. Security credentials.
  • the NFVI creates a VNF instance according to the VNF initialization command is well known in the art and will not be described here.
  • the NFVI can generate a public key and a private key by using various methods in the prior art, and details are not described herein again.
  • the foregoing method further includes:
  • the NFVI sends the security credential to the VNF instance.
  • the foregoing method may further include:
  • the NFVI sends the public key and the identification information of the VNF instance to the MANO, so that the MANO discloses the public key and the identification information of the VNF instance.
  • the VNF instance can use the public key and the private key to communicate with other network elements.
  • the NFVI can send the public key and the identification information of the VNF instance to the MANO, and the MANO can send to other network elements (for example, The other VNF instance transmits the public key and the identification information, so that the MANO and other network elements can communicate with the VNF instance according to the public key and the identification information.
  • the method for generating a security credential after the NFVI creates the VNF instance and generates the security credential of the VNF instance, sends the security credential to the VNF instance, and the VNF instance can directly use the security credential to communicate with other network elements, thereby The network element experienced after the generation of the security credential is reduced, and the risk of leaking the security credential is reduced.
  • FIG. 3 is a schematic diagram of communication of a method for policy processing according to an embodiment of the present invention. As shown in FIG. 3, the method includes:
  • MANO sends a VNF initialization command to the NFVI.
  • the VNF initialization command is used to trigger or instruct the NFVI to create a VNF instance and generate a security credential for the VNF instance.
  • the NFVI sends an acknowledgement (ACK) message to the MANO.
  • ACK acknowledgement
  • the ACK message is used to feed back the NFVI to the MANO to receive the VNF initialization command.
  • the NFVI creates a VNF instance according to the VNF initialization command and generates a security credential of the VNF instance.
  • the VNF instance runs in the VM created by the NFVI.
  • the security credential pair generated by the NFVI includes a public key and a private key.
  • the NFVI can also create a VM according to the initialization command, and create a VNF instance in the newly created VM.
  • the NFVI sends the security credential to the VNF instance.
  • the security credential includes a public key and a private key.
  • the VNF instance can communicate with other network elements according to the public key and the private key pair. Since the public key is public, the VNF instance can use the private key to sign the data. The other network element may use the public key to verify the data signed by the private key, and other network elements may also use the public key to encrypt the data, and the VNF instance may use the private key to decrypt the data encrypted by the public key, so that the VNF instance may Establish trust relationships with other network elements.
  • the NFVI sends a VNF initialization success message to the MANO.
  • the VNF initialization success message carries the identification information of the VNF instance and the public key of the VNF instance.
  • the MANO verifies the security of the VNF instance according to the public key and communicates with the VNF instance.
  • the MANO broadcasts the public key to other network elements, so that other network elements verify the security of the VNF instance according to the public key and communicate with the VNF instance.
  • VNF instances can be VNF instances.
  • the NFVI creates a VNF instance according to the VNF initialization command sent by the MANO and generates a public key and a private key of the VNF instance, wherein the public key is public, any network element is available, and the NFVI public key and After the private key is sent to the VNF instance, the private key saved by the VNF instance can be deleted, so that only the VNF instance stores the private key, and the network element (including the MANO device) that obtains the public key can The public key is used to encrypt the information and sent to the VNF instance. After receiving the information encrypted by the public key, the VNF instance can use the private key to decrypt. In addition, the VNF instance can also use the private key to sign the information to ensure that the signed information is sent by the VNF instance, and other network elements can be verified by the public key.
  • a key pair is generated by the NVFI and sent to the VNF instance, thereby reducing the network experienced after the private key is generated. Yuan, which reduces the risk of private key disclosure.
  • FIG. 4 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention. As shown in FIG. 4, the method includes:
  • the MANO sends a VNF initialization command to the NFVI.
  • the NFVI creates a VNF instance according to the VNF initialization command.
  • the NFVI allocates a TE to the VNF instance.
  • the NFVI sends a request message to the TE, where the request message is used to request the TE to generate a security credential of the VNF instance.
  • the security credential may include a public key and a private key, the public key is used to encrypt data, and the private key is used to decrypt the public key. Key-encrypted data, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the virtualization system supports the TE, and the TE may be implemented in hardware or in software. Regardless of the implementation manner, for the VNF instance, the module can provide a trusted computing function and an interface call.
  • the carrier VM of the VNF instance directly accesses the TE through the hardware interface and is not perceived by the NFVI.
  • the NFVI is only responsible for managing the correspondence between the TE and the VNF instance.
  • the NFVI cannot access the hardware TE data or use the hardware TE.
  • Service, the hardware TE can be located in the same device as the NFVI, or it can exist separately.
  • the TE is part of the VM.
  • the NFVI creates the TE while creating the VM that carries the VNF instance.
  • the accessed TE is the TE assigned by the NFVI to the VNF instance. Similar to the hardware TE, NFVI cannot access the data stored by the software TE, nor can it use the function of the software TE.
  • the MANO may be any one of NFVO, VNFM, and VIM.
  • the VNF initialization command may be sent to the NFVI through the VIM.
  • the VNF is initially The initialization command includes information that triggers the NFVI to create a VNF instance, and also includes information that triggers the NFVI to generate a security credential for the VNF instance.
  • the NFVI receives the VNF initialization command, it creates a VNF instance and generates a security credential for the VNF instance.
  • the NFVI creates a VNF instance according to the VNF initialization command is a well-known technology in the art, and details are not described herein.
  • the NFVI can generate a public key and a private key by using various methods in the prior art, and details are not described herein again.
  • the security credential of the VNF instance generated by the TE can only be used by the VNF instance.
  • the security credential can include a public and private key pair, and can also include a certificate file, and can also include a username and a password. limited.
  • the method further includes: the VNF instance can invoke the security credential through a data interface with the TE.
  • the VNF instance when the VNF instance needs to use the private key to decrypt the ciphertext (that is, the data encrypted by the public key), the ciphertext can be sent to the TE, and the TE decrypts the ciphertext using the private key to generate the plaintext, and sends the plaintext to the VNF.
  • the VNF instance needs to use the private key to sign the data
  • the data to be signed can be sent to the TE.
  • the TE uses the private key to sign the data and then sends the data to the VNF instance.
  • the security credential After the security credential is generated, it is always stored in the TE. Other network elements cannot obtain the security credential. Only the VNF instance can use the security credential, thereby reducing the network element experienced after the security credential is generated, and reducing the risk of the security credential leaking.
  • the method further includes: after the TE generates the public key and the private key, sending the public key to the NFVI, and the NFVI sends the public key and the VNF instance to the MANO.
  • Identification information MANO discloses the public key and the identification information. For example, MANO sends the public key and the identification information to other network elements (eg, other VNF instances), such that MANO and other network elements can communicate with the VNF instance based on the public key and the identification information.
  • FIG. 5 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention. As shown in FIG. 5, the method includes:
  • MANO sends a VNF initialization command to the NFVI.
  • the VNF initialization command is used to trigger or instruct the NFVI to create a VNF instance and generate a security credential of the VNF instance.
  • the VNF initialization command includes indicating that the TE is generated by the TE.
  • the indication information of the full credential the NFVI may request the TE to generate a security credential according to the indication information.
  • the NFVI sends an ACK message to the MANO.
  • the ACK message may be used by the NFVI to feed back to the MANO that the NFVI has received the VNF initialization command.
  • the NFVI sends a request message to the TE.
  • the request message is used to request the TE to generate a security credential.
  • the security credential refer to the related description in the embodiment shown in FIG. 2.
  • the security credential may include a public key and a private key.
  • the TE generates the security credential.
  • the above method further includes steps S550-S590.
  • the TE sends the public key to the NFVI.
  • the NFVI creates a VNF instance and allocates the TE for the VNF instance.
  • the data to be decrypted or the data to be signed may be sent to the TE, and the TE decrypts the data to be decrypted or the data to be signed by using the private key stored in the TE, and The decrypted data or the signed data is sent to the VNF instance.
  • the NFVI sends a VNF initialization success message to the MANO, where the message carries the identification information of the VNF instance and the public key of the VNF instance.
  • the MANO verifies the security of the VNF instance according to the public key and communicates with the VNF instance.
  • the MANO device sends the public key to other network elements, so that other network elements verify the security of the VNF instance according to the public key and communicate with the VNF instance.
  • the virtualization system supports the TE, and the TE may be implemented in hardware or in software. Regardless of the implementation manner, for the VNF instance, the module can provide a trusted computing function and an interface call.
  • the carrier VM of the VNF instance directly accesses the TE through the hardware interface and is not perceived by the NFVI.
  • the NFVI is only responsible for managing the correspondence between the TE and the VNF instance.
  • the NFVI cannot access the hardware TE data or use the hardware TE.
  • Service, the hardware TE can be located in the same device as the NFVI, or it can exist separately.
  • the TE is part of the VM.
  • the NFVI creates the TE while creating the VM hosting the VNF instance.
  • the accessed TE is It is the TE assigned by the NFVI to the VNF instance. Similar to the hardware TE, the NFVI cannot access the data stored by the software TE, nor can it use the function of the software TE.
  • the request message sent by the NFVI to the TE may carry the identifier of the VNF instance, or may not carry the identifier.
  • the NFVI creates a VNF instance according to the VNF initialization command sent by the MANO and requests the TE to generate a security credential of the VNF instance pair.
  • the security credential may include a public key and a private key, wherein the public key is public, any network element is available, the TE stores the public key and the private key, and when the VNF instance needs to use the public key and When the private key is used, you can access the TE to obtain the public and private keys.
  • the network element including the MANO device
  • the network element that obtains the public key can be sent to the VNF instance by using the public key encryption information.
  • the VNF instance can be decrypted using the private key stored by the TE.
  • the VNF instance can also use the TE storage.
  • the private key signs the information to ensure that the signed information is sent by the VNF instance, and other network elements can use the public key for verification.
  • the NVFI sends a key generation request message to the TE, requesting the TE to generate a key pair of the VNF instance, where The private key is only stored in the TE, which reduces the network element experienced by the private key and reduces the risk of private key leakage.
  • FIG. 6 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention. As shown in FIG. 6, the method includes:
  • the VNF instance generates a request message.
  • the request message is used to request the TE to generate a security credential.
  • the security credentials can be referred to the related description in the embodiment shown in FIG. 2.
  • the security credential includes a public key and a private key, wherein the public key is used to encrypt data and the private key is used to decrypt the public key encrypted data, or the private key is used to sign data and The public key is used to verify data signed by the private key.
  • the VNF instance sends the request message to the TE.
  • the virtualization system supports the TE, and the TE may be implemented in hardware or in software. Regardless of the implementation manner, for the VNF instance, the module can provide a trusted computing function and an interface call.
  • TE is implemented in hardware
  • the carrier VM of the VNF instance is directly accessed through hardware.
  • TE is not perceived by NFVI; NFVI is only responsible for managing the correspondence between TE and VNF instances. NFVI cannot access hardware TE data or hardware TE services.
  • the hardware TE can be located in the same device as NFVI. Alone.
  • the TE is part of the VM.
  • the NFVI creates the TE while creating the VM that carries the VNF instance.
  • the accessed TE is the TE assigned by the NFVI to the VNF instance. Similar to the hardware TE, NFVI cannot access the data stored by the software TE, nor can it use the function of the software TE.
  • the VNF instance can invoke the security credential through the data interface with the TE.
  • the VNF instance needs to use the private key to decrypt the ciphertext (ie, the public key encrypted data)
  • the ciphertext is sent to the TE
  • the TE uses the private key to decrypt the ciphertext and generates the plaintext, and sends the plaintext to the VNF instance.
  • the TE can send the data to be signed to the TE.
  • the TE uses the private key to sign the data and then sends it to the VNF instance.
  • the security credential is generated, it is always stored in the TE. Other NEs cannot obtain the security credential. Only the VNF instance can use the security credential, which reduces the network element experienced after the security credential is generated and reduces the risk of the security credential leak.
  • the method further includes: the VNF instance receives the public key from the TE, and the VNF instance sends the public key to the NFVI.
  • the VNF instance is forwarded to the NFVI after receiving the public key sent by the TE, and the NFVI sends the public key and the identification information of the VNF instance to the MANO, and the MANO can broadcast and send the public to other network elements (for example, other VNF instances).
  • the key and the identification information such that the MANO and other network elements can communicate with the VNF instance according to the public key and the identification information.
  • FIG. 7 is a schematic diagram of communication of a method for generating a security credential according to an embodiment of the present invention. As shown in FIG. 7, the method includes:
  • MANO sends a VNF initialization command to the NFVI.
  • the VNF initialization command is used to trigger or instruct the NFVI to create a VNF instance and generate a security credential of the VNF instance.
  • the VNF initialization command includes indication information indicating that the TE generates a security credential, and the NFVI can create a VNF according to the indication information.
  • the instance writes a command to instruct the TE to generate a security credential after the VNF instance starts.
  • NFVI sends an ACK message to MANO.
  • the ACK message is used to feed back the NFVI to the MANO to receive the VNF initialization command.
  • the NFVI creates a VNF instance according to the VNF initialization command and allocates a TE for the VNF instance.
  • the NFVI can write a command in the VNF instance to create a VNF instance, and instruct the TE to generate a security credential after the VNF instance starts.
  • the VNF instance sends a request message to the TE.
  • the request message is used to request the TE to generate a security credential.
  • security credential refer to the related description of the embodiment shown in FIG. 2, and details are not described herein.
  • the foregoing method further includes steps S750-S791.
  • the TE generates a public key and a private key.
  • the TE sends the public key to the VNF instance.
  • the VNF instance sends the public key to the NFVI.
  • the NFVI sends a VNF initialization success message to the MANO.
  • the message carries the identification information of the VNF instance and the public key corresponding to the VNF instance.
  • the MANO verifies the security of the VNF instance according to the public key and communicates with the VNF instance.
  • the MANO broadcasts the public key to other network elements, so that other network elements verify the security of the VNF instance according to the public key and communicate with the VNF instance.
  • the virtualization system supports the TE, and the TE can be implemented by using a hardware method or a software implementation.
  • the implementation manner of the TE is the same as that of the method corresponding to FIG. 4 or FIG. Narration.
  • the NFVI can directly write a VNF instance to the VNF instance to send a key generation request message to the TE after the VNF instance is started. After the TE generates the key pair, the public key is sent to the VNF instance. And sent by the VNF instance to the NFVI, the NFVI sends the public key to the MANO, and the MANO discloses the public key and the identification information of the VNF instance, so that the MANO and other network elements can perform security according to the public key and the VNF instance. Communication.
  • the VNF instance sends a request message to the TE, requesting the TE to generate the VNF.
  • the security credential of the instance may include a public key and a private key, wherein the private key is only stored in the TE, thereby reducing the network element experienced after the private key is generated, and reducing the risk of the private key being compromised.
  • the embodiments of the present invention may perform functional unit division on NFVI, TE, and VNF instances according to the foregoing method.
  • each functional unit may be divided according to each function, or two or more functions may be integrated into one processing unit. in.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 8A shows a possible structural diagram of the NFVI involved in the above embodiment.
  • the NFVI 800 includes a processing unit 802 and a communication unit 803.
  • the processing unit 802 is configured to control and manage the actions of the NFVI 800.
  • the processing unit 802 is configured to support the NFVI 800 to perform the actions or steps of the NFVI in any of the embodiments shown in FIGS. 2-5 and 7, and/or for the purposes described herein.
  • Communication unit 803 is used to support communication of NFVI 800 with other network elements, such as communication with the MANO shown in FIG.
  • the NFVI 800 may also include a storage unit 801 for storing program code and data of the NFVI 800.
  • the communication unit 803 is configured to receive a VNF initialization command from the MANO.
  • the processing unit 802 is configured to create a VNF instance according to the VNF initialization command received by the communication unit 803 and generate a security credential of the VNF instance.
  • the security credential may refer to the related description of the embodiment shown in FIG. 2, for example, may include a public key and a private key, the public key is used to encrypt data, and the private key is used to decrypt the public key. Encrypted data, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the communication unit 803 is further configured to: send the security credential to the VNF instance.
  • the communication unit is further configured to: send the public key and the identification information of the VNF instance to the MANO, so that the MANO discloses the public key and the The identification information of the VNF instance.
  • the processing unit 802 can be a processor or a controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application specific integrated circuit (Application- Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 803 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, and the communication interface can also refer to an interface between software or programs.
  • the storage unit 801 can be a memory.
  • the processing unit 802 is a processor
  • the communication unit 803 is a communication interface
  • the storage unit 801 is a memory
  • the NFVI involved in the embodiment of the present invention may be the NFVI shown in FIG. 8B.
  • the NFVI 810 includes a processor 812, a communication interface 813, and a memory 811.
  • the NFVI 810 can also include a bus 814.
  • the communication interface 813, the processor 812, and the memory 811 may be connected to each other through a bus 814.
  • the bus 814 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus 814 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 8B, but it does not mean that there is only one bus or one type of bus.
  • the above embodiments are only examples, and the embodiments of the present invention are not limited thereto.
  • the NFVI for generating security credentials provided by the embodiments of the present invention in addition to the features of the present invention, all other features conform to the European Telecommunication Standards Institute (European Telecommunication Standards Institute).
  • ETSI European Telecommunication Standards Institute
  • the NFVI for generating a security credential provided by the embodiment of the present invention meets the following The definition of NFVI in [1] and [2],
  • ETSI GS NFV 002 "Network Functions Virtualisation (NFV); Architectural Framework,
  • ETSI GS NFV 003 Network Functions Virtualisation (NFV); Terminology for main concepts in NFV.
  • the NFVI provided by the embodiment of the present invention generates a security credential of the VNF instance through the NFVI and sends the VNF instance to the VNF instance, which can reduce the network element experienced after the security credential is generated, and reduces the risk of the security credential leakage.
  • FIG. 9A shows a possible structural diagram of the NFVI involved in the above embodiment.
  • the NFVI 900 includes a processing unit 902 and a communication unit 903.
  • the processing unit 902 is configured to control and manage the actions of the NFVI 900.
  • the processing unit 902 is configured to support the NFVI 900 to perform the actions or steps of the NFVI in any of the embodiments shown in FIGS. 2-5 and 7, and/or for use in this document. Other processes of the described technology.
  • Communication unit 903 is used to support communication of NFVI 900 with other network elements, such as communication with the MANO shown in FIG.
  • the NFVI 900 may also include a storage unit 901 for storing program code and data of the NFVI 900.
  • the communication unit 903 is configured to receive a VNF initialization command from the MANO.
  • the processing unit 902 is configured to allocate a TE to the VNF instance.
  • the communication unit 903 is further configured to send a request message to the TE, where the request message is used to request the TE to generate a security credential of the VNF instance.
  • the security credential may include a public key and a private key, where the public key is used to encrypt data and the private key.
  • the data encrypted by the public key is decrypted, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the communication unit 903 is further configured to: receive the public key from the TE; send the public key and the identifier information of the VNF instance to the MANO, so as to facilitate The MANO discloses the public key and identification information of the VNF instance.
  • processing unit 902 can be a processor or controller, such as a CPU, general purpose processor, DSP, ASIC, FPGA or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 903 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, and the communication interface can also refer to an interface between software or programs.
  • the storage unit 901 can be a memory.
  • the processing unit 902 is a processor
  • the communication unit 903 is a communication interface
  • the storage unit 901 is a memory
  • the NFVI involved in the embodiment of the present invention may be the NFVI shown in FIG. 9B.
  • the NFVI 910 includes a processor 912, a communication interface 913, and a memory 911.
  • the NFVI 910 may also include a bus 914.
  • the communication interface 913, the processor 912, and the memory 911 may be connected to each other through a bus 914; the bus 914 may be a PCI bus or an EISA bus or the like.
  • the bus 914 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 9B, but it does not mean that there is only one bus or one type of bus.
  • the foregoing embodiments are merely illustrative, and the embodiments of the present invention are not limited thereto.
  • the NFVI for generating security credentials provided by the embodiments of the present invention in addition to the features involved in the present invention, all the features comply with the relevant provisions of the ETSI, for example, the present invention.
  • the NFVI for generating security credentials provided by the embodiment conforms to the definition of NFVI in the file [1] and the file [2].
  • the NFVI provided by the embodiment of the present invention can reduce the risk of the security credential leakage by requesting the TE to generate the security credential of the VNF instance, which can reduce the network element experienced after the security credential is generated.
  • FIG. 10A shows a possible structural diagram of the VNF example involved in the above embodiment.
  • the VNF instance 1000 includes a processing unit 1002 and a communication unit 1003.
  • the processing unit 1002 is configured to perform control management on the action of the VNF instance 1000.
  • the processing unit 1002 is configured to support the VNF instance 1000 by the communication unit 1003 to perform the action or step of the VNF in any of the embodiments shown in FIG. 3, 5-7. And/or other processes for the techniques described herein.
  • the communication unit 1003 is for supporting communication between the VNF instance 1000 and other network elements, such as communication with the MANO shown in FIG.
  • the VNF instance 1000 can also include a storage unit 1001 for storing program code and data of the VNF instance 1000.
  • the processing unit 1002 is configured to generate a request message, where the request message is used to request TE A security credential for the VNF instance.
  • the security credential can refer to the related description in the embodiment shown in FIG. 7.
  • the security credential can include a public key and a private key, wherein the public key is used to encrypt data and the private key is used for decryption.
  • the public key encrypted data, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the communication unit 1003 is configured to send the request message generated by the processing unit 1002 to the TE.
  • the communication unit 1003 is further configured to: receive the public key from the TE; send the public key to the NFVI, so that the NFVI sends the The public key and the public key are disclosed by the MANO.
  • processing unit 1002 may be a processor or controller, such as a CPU, general purpose processor, DSP, ASIC, FPGA or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 803 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, and the communication interface can also refer to an interface that interacts with software or a program.
  • the storage unit 801 can be a memory.
  • the VNF instance involved in the embodiment of the present invention may be the VNF instance shown in FIG. 10B.
  • the VNF instance 1010 includes a processor 1012, a communication interface 1013, and a memory 1011.
  • the VNF instance 1010 may further include a bus 1014.
  • the communication interface 1013, the processor 1012, and the memory 1011 may be connected to each other through a bus 1014; the bus 1014 may be a PCI bus or an EISA bus or the like.
  • the bus 1014 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10B, but it does not mean that there is only one bus or one type of bus.
  • the VNF instance provided by the requesting TE generates the security credential of the VNF instance, which can reduce the network element experienced after the security credential is generated, and reduces the risk of the security credential leaking.
  • FIG. 11A shows a possible structural diagram of the TE involved in the above embodiment.
  • the TE 1100 includes a processing unit 1102 and a communication unit 1103.
  • the processing unit 1102 is configured to perform control management on the action of the TE1100.
  • the processing unit 1102 is configured to support the TE1100 to perform the actions or steps of the TE in any of the embodiments shown in FIG. 4-7, and/or for the techniques described herein. Other processes.
  • the communication unit 1103 is for supporting communication between the TE1100 and other network entities, such as communication with the NFVI shown in FIG.
  • the TE 1100 may further include a storage unit 1101 for storing program codes and data of the TE 1100.
  • the communication unit 1103 is configured to receive a request message from the network function virtualization infrastructure NFVI or the virtual network function VNF instance.
  • the request message is used to request the TE to generate a security credential of the VNF instance.
  • the processing unit 1102 is configured to generate the security credential according to the request message received by the communication unit 1103.
  • the security credential includes a public key and a private key, wherein the public key is used to encrypt data and the private key is used for decryption.
  • the data encrypted by the public key, or the private key is used to sign the data and the public key is used to verify the data signed by the private key.
  • the communication unit 1103 is further configured to: send the public key to the NFVI, so that the NFVI exposes the public key by MANO; or The VNF instance sends the public key to facilitate the VNF instance to send the public key to the NFVI.
  • the processing unit 1102 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1103 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces.
  • the storage unit 1101 may be a memory.
  • the processing unit 1102 is a processor
  • the communication unit 1103 is a communication interface
  • the storage unit 1101 When it is a memory, the TE involved in the embodiment of the present invention may be the TE shown in FIG. 11B.
  • the TE 1110 includes a processor 1112, a communication interface 1113, and a memory 1111.
  • the TE 1110 may further include a bus 1114.
  • the communication interface 1113, the processor 1112, and the memory 1111 may be connected to each other through a bus 1114; the bus 1114 may be a PCI bus or an EISA bus or the like.
  • the bus 1114 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 11B, but it does not mean that there is only one bus or one type of bus.
  • the TE provided by the embodiment of the present invention generates a security credential according to the request message sent by the VNF instance or the NFVI, which can reduce the network element experienced after the security credential is generated, and reduces the risk of leaking the security credential.
  • sequence number of each process does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be limited to the implementation process of the embodiment of the present invention.
  • the steps of the method or algorithm described in connection with the disclosure of the embodiments of the present invention may be implemented by means of hardware, or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • the ASIC can be bit In the NFVI, TE or VNF examples.
  • the processor and the storage medium can also exist as discrete components in an NFVI, TE or VNF instance.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例公开了一种生成安全凭证的方法和设备，该方法包括：网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令；所述NFVI根据所述VNF初始化命令创建VNF实例以及生成所述VNF实例的安全凭证，其中，所述安全凭证包括公钥和私钥。根据本发明实施例提供的生成安全凭证的方法和设备，可以减少安全凭证生成后经历的网元的数量，从而降低安全凭证泄露的风险。

Description

一种生成安全凭证的方法和设备 技术领域
本发明涉及通信领域，尤其涉及一种生成安全凭证的方法和设备。
背景技术
网络功能虚拟化(Network Function Virtualization，NFV)技术可以将部分网络功能以软件方式在通用硬件上实现，例如，在电信网络中，利用NFV技术可以在通用的云服务器、交换机和存储中实现部分电信网络功能，从而实现网络服务的快速、高效部署。
NFV技术通过虚拟化网络功能(Virtualized Network Function，VNF)来实现电信网络功能，为了防止伪冒者攻击网络，VNF在初始化之后需要通过安全凭证与网络中的其它网元进行通信，然而，现有技术中安全凭证生成后经过多个网元才能到达VNF，安全凭证被窃取或者被冒用的可能性较大。
发明内容
有鉴于此，本发明实施例提供了一种生成安全凭证的方法和设备，能够减少安全凭证所经过的网元的数量，从而降低了安全凭证被窃取或者被冒用的风险。
一方面，本发明实施例提供了一种生成安全凭证的方法，该方法包括：网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令；所述NFVI根据所述VNF初始化命令创建VNF实例以及生成所述VNF实例的安全凭证，其中，所述安全凭证包括公钥和私钥，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
本发明实施例提供的生成安全凭证的方法，通过NFVI为VNF生成安全凭证，可以减少安全凭证生成后经历的网元，从而降低了安全凭证泄密的风险。
可选地，所述NFVI创建所述VNF实例以及生成所述公钥后，所述方法还包括：所述NFVI向所述VNF实例发送所述公钥和所述私钥；所述NFVI向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。从而其它VNF实例和 所述MANO可以根据所述公钥和所述标识信息与所述VNF实例进行通信。
另一方面，本发明实施例提供了一种生成安全凭证的方法，该方法包括：网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令；所述NFVI根据所述VNF初始化命令创建VNF实例；所述NFVI为所述VNF实例分配可信环境TE；所述NFVI向所述TE发送请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
本发明实施例提供的生成安全凭证的方法，通过NFVI请求TE为VNF实例生成安全凭证，可以减少安全凭证生成后经历的网元，从而降低了安全凭证泄密的风险。
可选地，所述NFVI向所述TE发送所述请求消息之后，所述方法还包括：所述NFVI从所述TE接收所述公钥；所述NFVI向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。从而其它VNF实例和所述MANO可以根据所述公钥和所述标识信息与所述VNF实例进行通信。
再一方面，本发明实施例提供了一种生成安全凭证的方法，该方法包括：虚拟化网络功能VNF实例生成请求消息，所述请求消息用于请求可信环境TE生成安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据；所述VNF实例向所述TE发送所述请求消息。
本发明实施例提供的生成安全凭证的方法，通过VNF实例请求TE为该VNF实例生成安全凭证，可以减少安全凭证生成后经历的网元，从而降低了安全凭证泄密的风险。
可选地，所述VNF实例向所述TE发送所述请求消息之后，所述方法还包括：所述VNF实例从所述TE接收所述公钥；所述VNF实例向网络功能虚拟化基础设施NFVI发送所述公钥，以便于所述NFVI向管理和编排MANO发送所述公钥以及通过所述MANO公开所述公钥。从而其它VNF实例和所述MANO可以根据所述公钥和所述标识信息与所述VNF实例进行 通信。
再一方面，本发明实施例提供了一种生成安全凭证的方法，该方法包括：可信环境TE从网络功能虚拟化基础设施NFVI或者虚拟网络功能VNF实例接收请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证；所述TE根据所述请求消息生成所述安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
本发明实施例提供的生成安全凭证的方法，TE根据VNF实例或者NFVI的请求为该VNF实例生成安全凭证，可以减少安全凭证生成后经历的网元，从而降低了安全凭证泄密的风险。
可选地，所述TE生成所述公钥和所述私钥之后，所述方法还包括：所述TE向所述NFVI发送所述公钥，以便于所述NFVI通过管理和编排MANO公开所述公钥；或者，所述TE向所述VNF实例发送所述公钥，以便于所述VNF实例向所述NFVI发送所述公钥。从而其它VNF实例和所述MANO可以根据所述公钥和所述标识信息与所述VNF实例进行通信。
再一方面，本发明实施例提供了一种网络功能虚拟化基础设施NFVI，该NFVI可以实现上述方面所涉及方法中NFVI所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的单元或模块。
在一种可能的设计中，该NFVI的结构中包括处理器和通信接口，该处理器被配置为支持该NFVI执行上述方法中相应的功能。该通信接口用于支持该NFVI与其他网元之间的通信。该NFVI还可以包括存储器，该存储器用于与处理器耦合，其保存该NFVI必要的程序指令和数据。
再一方面，本发明实施例提供了一种可信环境TE，该TE可以实现上述方面所涉及方法中TE所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的单元或模块。
在一种可能的设计中，该TE的结构中包括处理器和通信接口，该处理器被配置为支持该TE执行上述方法中相应的功能。该通信接口用于支持该TE与其他网元之间的通信。该TE还可以包括存储器，该存储器用于与处理 器耦合，其保存该TE必要的程序指令和数据。
再一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述NFVI所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
再一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述TE所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是适用本发明实施例的一种可能的网络架构的示意图；
图2是本发明实施例提供的一种生成安全凭证的方法的通信示意图；
图3是本发明实施例提供的另一种生成安全凭证的方法的通信示意图；
图4是本发明实施例提供的再一种生成安全凭证的方法的通信示意图；
图5是本发明实施例提供的再一种生成安全凭证的方法的通信示意图；
图6是本发明实施例提供的再一种生成安全凭证的方法的通信示意图；
图7是本发明实施例提供的再一种生成安全凭证的方法的通信示意图；
图8A是本发明实施例提供的一种可能的NFVI的结构示意图；
图8B是本发明实施例提供的另一种可能的NFVI的结构示意图；
图9A是本发明实施例提供的再一种可能的NFVI的结构示意图；
图9B是本发明实施例提供的再一种可能的NFVI的结构示意图；
图10A是本发明实施例提供的一种可能的VNF实例的结构示意图；
图10B是本发明实施例提供的另一种可能的VNF实例的结构示意图；
图11A是本发明实施例提供的一种可能的TE的结构示意图；
图11B是本发明实施例提供的另一种可能的TE的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本 发明实施例的技术方案，并不构成对本发明实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
本发明实施例的方法可以应用于基于NFV的网络架构，此外还可以应用于基于应用容器引擎(例如Docker)的网络架构、基于虚拟机监视器(Virtual Machine Monitor，VMM)的网络架构、基于openstack的网络架构或者其它虚拟化技术的网络架构中，其中VMM也可以称为hypervisor，下面，以基于NFV的网络架构为例，对本发明实施例的方案进行说明。
图1为本发明实施例提供的一种基于NFV的网络架构的示意图。如图1所示，该网络架构包括：网络功能虚拟化编排器(Network Function Virtualization Orchestrator，NFVO)、虚拟化网络功能管理器(Virtualized Network Function Manager，VNFM)、虚拟化基础设施管理器(Virtualized Infrastructure Manager，VIM)、网络功能虚拟化基础设施(Network Function Virtualization Infrastructure，NFVI)、虚拟机(Virtual Machine，VM)、虚拟化网络功能(Virtualized Network Function，VNF)和网元管理系统(Element Manager System，EMS)，其中，NFVO、VNFM和VIM属于NFV系统的管理编排(Management and Orchestration，MANO)，MANO的相关功能可以通过硬件实现，也可以通过软件实现。
为了方便理解本发明实施例，下面，分别对上述网元以及与本发明相关的要素进行简要介绍。
虚拟化容器(virtualisation container)是计算节点的一部分，用于提供隔离的虚拟化计算环境，一个典型的虚拟化容器的例子是VM。VM指通过虚拟机软件在物理设备上模拟出的虚拟设备。对于在虚拟机中运行的应用程序而言，这些虚拟机就像真正的物理设备那样进行工作，虚拟机上可以安装操作系统和应用程序，虚拟机还可访问网络资源。
VNF，也可称之为虚拟化网元，对应于传统的非虚拟化网络中的物理网络功能。网络功能的功能性行为和状态与网络功能的虚拟化与否无关。VNF可以由多个更低级别的组件组成，可选的，一个VNF可以部署在多个VM上，每个VM承载(host)一个虚拟网络功能组件(Virtualized Network Function Component，VNFC)。可选的，一个VNF也可以部署在一个VM上。
VNFM主要用于：实现VNF实例的生命周期管理，包括VNF实例的初 始化、VNF实例的扩容或缩容以及VNF实例的终止。
EMS主要用于：针对VNF执行传统的FCAPS(Fault Management，Configuration Management，Accounting Management，Performance Management and Security Management，故障管理，配置管理，计费管理，性能管理，安全管理)功能。EMS可以单独存在，也可以是具有EMS功能的VNF。
VIM主要负责：基础设施层硬件资源和虚拟化资源的管理、监控和故障上报，面向上层应用提供虚拟化资源池。
NFVI主要用于：提供整个系统运行的硬件和虚拟资源，由硬件资源(包括计算、网络、存储三部分)、虚拟化层(将硬件资源虚拟化成资源池)和虚拟资源(同样分成计算、网络、存储三部分)组成。从VNF的角度来说，虚拟化层和硬件资源看起来是一个能够提供所需虚拟资源的实体。
NFVO用于实现网络服务描述符(Network Service Descriptor，NSD)、虚拟网络功能描述符(Virtualized Network Function Descriptor，VNFD)、虚拟网络功能转发图(Virtualized Network Function Forwarding Graph，VNFFG)的管理，网络服务(Network Service，NS)生命周期的管理，和资源的全局视图功能。
可信环境(Trusted Environment，TE)，用于保护主机(例如，VM)上运行的操作系统和软件，TE可以以硬件实现，也可以以软件实现，无论哪种实现方式，对于VNF来说，都是提供可信任计算功能以及接口调用的模块。
VNF与EMS或VNFM建立管理通道时，双方需要进行身份认证，以防止伪冒者攻击网络，例如，可以采用安全传输层协议(Transport Layer Security，TLS)、安全外壳协议(Secure Shell，SSH)进行身份认证，然而VNF初始化后实际上是一个信任孤岛，它与其它任何网元间都不存在信任关系，因此，有必要在VNF实例化后为VNF实例生成信任凭据和信任其它网元的检验凭据(即，安全凭据)。下面，将结合附图对本发明实施例进行详细描述。
图2为本发明实施例提供的一种生成安全凭证的方法的通信示意图，如图2所示，该方法包括：
S210，MANO向NFVI发送VNF初始化命令。
可选地，该VNF初始化命令包括触发NFVI创建VNF实例的信息，还 包括触发NFVI生成该VNF实例的安全凭证的信息。
S220，NVFI根据该VNF初始化命令，创建VNF实例以及生成该VNF实例的安全凭证。
本发明实施例中，所述安全凭证可以包括公钥和私钥，或者，所述安全凭证可以包括证书文件，或者，用户名和密码。
其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
在本发明实施例中，MANO可以是NFVO、VNFM和VIM中的任一个，可选地，VNF初始化命令可以通过VIM发送给NFVI，NFVI接收到该VNF初始化命令后创建VNF实例以及生成该VNF实例的安全凭证。
NFVI如何根据VNF初始化命令创建VNF实例是本领域的公知技术，在此不再赘述。在本发明实施例中，NFVI可以采用现有技术的多种方法生成公钥和私钥，在此也不再赘述。
可选地，上述方法还包括：
S230，NFVI向VNF实例发送所述安全凭证。
当所述安全凭证包括公钥和所述私钥时，上述方法还可以包括：
S240，NFVI向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
其中，VNF实例可以使用该公钥和该私钥与其它网元进行通信，具体地，NFVI可以向MANO发送所述公钥和所述VNF实例的标识信息，MANO可以向其它网元(例如，其它VNF实例)发送该公钥和该标识信息，从而，MANO和其它网元可以根据该公钥和该标识信息与所述VNF实例进行通信。
根据本发明实施例的生成安全凭证的方法，NFVI创建VNF实例和生成该VNF实例的安全凭证后，向VNF实例发送该安全凭证，VNF实例可以直接使用该安全凭证与其它网元进行通信，从而减少了安全凭证生成后经历的网元，降低了安全凭证泄密的风险。
下面将基于上面所述的本发明涉及的共性方面，对本发明实施例进一步详细说明。
图3为本发明实施例提供的一种策略处理的方法的通信示意图，如图3所示，该方法包括：
S310，MANO向NFVI发送VNF初始化命令。
其中，该VNF初始化命令用于触发或指示NFVI创建VNF实例并生成该VNF实例的安全凭证。
S320，NFVI向MANO发送确认(ACK)消息。
其中，所述ACK消息用于向MANO反馈该NFVI收到了所述VNF初始化命令。
S330，NFVI根据该VNF初始化命令，创建VNF实例并生成该VNF实例的安全凭证。
其中，VNF实例运行在NFVI创建的VM中，NFVI生成的安全凭证对包括公钥和私钥，可选地，NFVI也可以根据该初始化命令创建VM，并在新创建的VM中创建VNF实例。
S340，NFVI向VNF实例发送所述安全凭证。
其中，该安全凭证包括公钥和私钥，VNF实例可以根据该公钥和该私钥对与其它网元进行通信，由于公钥是公开的，VNF实例可以使用所述私钥对数据进行签名，其它网元可以利用公钥验证所述私钥签名的数据，其它网元也可以使用公钥对数据进行加密，VNF实例可以使用私钥对公钥加密的数据进行解密，从而，VNF实例可以与其它网元建立信任关系。
S350，NFVI向MANO发送VNF初始化成功消息。
其中，该VNF初始化成功消息携带VNF实例的标识信息以及该VNF实例的公钥。
S360，MANO根据该公钥，验证所述VNF实例的安全性并与所述VNF实例通信。
S370，MANO向其它网元广播发送所述公钥，以使得其它网元根据该公钥验证所述VNF实例的安全性并与所述VNF实例通信。
例如，其它网元可以是VNF实例。
在本发明实施例中，NFVI根据MANO发送的VNF初始化命令创建VNF实例并生成该VNF实例的公钥和私钥，其中，公钥是公开的，任何网元都可以获得，NFVI将公钥和私钥发送给VNF实例后可以删除自己保存的私钥，这样就只有VNF实例保存有私钥，获得公钥的网元(包括MANO设备)可 以使用公钥加密信息发送给VNF实例，VNF实例接收到使用该公钥加密的信息后可以使用私钥解密。此外，VNF实例也可以使用私钥对信息进行签名，以担保被签名的信息是该VNF实例发送的，其它网元可以通过公钥进行验证。
上述实施例仅是举例说明，本发明实施例不限于此，根据本发明实施例的生成安全凭证的方法，通过NVFI生成密钥对并发送给VNF实例，减少了私钥生成后所经历的网元，从而降低了私钥泄密的风险。
图4为本发明实施例提供的一种生成安全凭证的方法的通信示意图，如图4所示，该方法包括：
S410，MANO向NFVI发送VNF初始化命令。
S420，NFVI根据该VNF初始化命令创建VNF实例。
S430，NFVI为所述VNF实例分配TE。
S440，NFVI向所述TE发送请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证。
其中，所述安全凭证可以参见图2所示实施例中的相关描述，例如，安全凭证可以包括公钥和私钥，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
本发明实施例中，虚拟化系统支持TE，TE可以以硬件实现，也可以以软件实现，无论哪种实现方式，对于VNF实例来说，都是可以提供可信任计算功能以及接口调用的模块。
如果TE通过硬件实现，那么VNF实例的载体VM则通过硬件接口直接访问TE，不被NFVI感知，NFVI仅负责管理TE与VNF实例的对应关系，NFVI不能访问硬件TE的数据，也不能使用硬件TE的服务，该硬件TE可以与NFVI位于同一个设备中，也可以单独存在。
如果TE通过软件实现，则TE是VM的一部分，NFVI在创建承载VNF实例的VM的同时创建了TE，这样，当VNF实例启动后，访问到的TE就是NFVI为该VNF实例分配的TE，与硬件TE类似，NFVI不能访问软件TE存储的数据，也不能使用软件TE的功能。
在本发明实施例中，MANO可以是NFVO、VNFM和VIM中的任一个，可选地，VNF初始化命令可以通过VIM发送给NFVI，可选地，该VNF初 始化命令包括触发NFVI创建VNF实例的信息，还包括触发NFVI生成该VNF实例的安全凭证的信息。NFVI接收到该VNF初始化命令后创建VNF实例以及生成该VNF实例的安全凭证。
其中，NFVI如何根据VNF初始化命令创建VNF实例是本领域的公知技术，在此不再赘述。在本发明实施例中，NFVI可以通过现有技术的多种方法生成公钥和私钥，在此也不再赘述。
需要说明的是，TE生成的VNF实例的安全凭证仅可以被该VNF实例使用，该安全凭证可以包括公私钥对，还可以包括证书文件，还可以包括用户名和密码，本发明实施例对此不作限定。
可选地，上述方法还包括：VNF实例可以通过与TE之间的数据接口调用该安全凭证。
具体地，当VNF实例需要使用私钥解密密文(即公钥加密的数据)时，可以将该密文发送给TE，TE使用私钥解密该密文生成明文，并将该明文发送给VNF实例；当VNF实例需要使用私钥对数据进行签名时，可以将待签名的数据发送给TE，TE使用私钥对数据签名之后发送给VNF实例。
安全凭证生成后始终存储在TE中，其它网元无法获取安全凭证，只有所述VNF实例能够使用安全凭证，从而减少了安全凭证生成后经历的网元，降低了安全凭证泄密的风险。
可选地，当安全凭证包括公钥和私钥时，上述方法还包括：TE生成公钥和私钥后向NFVI发送所述公钥，NFVI向MANO发送所述公钥和所述VNF实例的标识信息，MANO公开该公钥和该标识信息。例如，MANO将该公钥和该标识信息发送给其它网元(例如，其它VNF实例)，从而，MANO和其它网元可以根据该公钥和该标识信息与所述VNF实例进行通信。
下面将基于上面所述的本发明涉及的共性方面，对本发明实施例进一步详细说明。
图5为本发明实施例提供的一种生成安全凭证的方法的通信示意图，如图5所示，该方法包括：
S510，MANO向NFVI发送VNF初始化命令。
其中，该VNF初始化命令用于触发或指示NFVI创建VNF实例并生成该VNF实例的安全凭证，例如，该VNF初始化命令包括指示由TE生成安 全凭证的指示信息，NFVI可以根据该指示信息请求TE生成安全凭证。
S520，NFVI向MANO发送ACK消息。
其中，所述ACK消息可以用于NFVI向MANO反馈该NFVI收到了所述VNF初始化命令。
S530，NFVI向TE发送请求消息。
其中，该请求消息用于请求TE生成安全凭证。
其中，该安全凭证可以参见图2所示实施例中的相关描述，例如，该安全凭证可以包括公钥和私钥。
S540，TE生成所述安全凭证。
可选地，当安全凭证包含公钥和私钥时，上述方法还包括步骤S550-S590。
S550，TE向NFVI发送所述公钥。
S560，NFVI创建VNF实例，并为该VNF实例分配所述TE。
具体地，VNF实例需要使用私钥时可以将待解密的数据或者待签名的数据发送给TE，TE利用存储在该TE中的私钥解密待解密的数据或者对待签名的数据进行签名，并将解密后的数据或签名后的数据发送给VNF实例。
S570，NFVI向MANO发送VNF初始化成功消息，该消息携带VNF实例的标识信息以及与该VNF实例的公钥。
S580，MANO根据该公钥验证所述VNF实例的安全性并与所述VNF实例通信。
S590，MANO设备向其它网元发送所述公钥，以使得其它网元根据该公钥验证所述VNF实例的安全性并与所述VNF实例通信。
本发明实施例中，虚拟化系统支持TE，TE可以以硬件实现，也可以以软件实现，无论哪种实现方式，对于VNF实例来说，都是可以提供可信任计算功能以及接口调用的模块。
如果TE通过硬件实现，那么VNF实例的载体VM则通过硬件接口直接访问TE，不被NFVI感知，NFVI仅负责管理TE与VNF实例的对应关系，NFVI不能访问硬件TE的数据，也不能使用硬件TE的服务，该硬件TE可以与NFVI位于同一个设备中，也可以单独存在。
如果TE通过软件实现，则TE是VM的一部分，NFVI在创建承载VNF实例的VM的同时创建了TE，这样，当VNF实例启动后，访问到的TE就 是NFVI为该VNF实例分配的TE，与硬件TE类似，NFVI不能访问软件TE存储的数据，也不能使用软件TE的功能。
可选地，NFVI向TE发送的请求消息可以携带VNF实例的标识，也可以不携带该标识。
在本发明实施例中，NFVI根据MANO发送的VNF初始化命令创建VNF实例并请求TE生成该VNF实例对的安全凭证。
进一步地，该安全凭证可以包括公钥和私钥，其中，公钥是公开的，任何网元都可以获得，TE存储有所述公钥和所述私钥，当VNF实例需要使用公钥和私钥时，可以访问TE获取公钥和私钥。获得公钥的网元(包括MANO设备)可以使用公钥加密信息发送给VNF实例，VNF实例接收到使用该公钥加密的信息后可以使用TE存储的私钥解密，VNF实例也可以使用TE存储的私钥对信息进行签名，以担保被签名的信息是该VNF实例发送的，其它网元可以使用公钥进行验证。
上述实施例仅是举例说明，本发明实施例不限于此，根据本发明实施例的生成安全凭证的方法，NVFI向TE发送密钥生成请求消息，请求TE生成VNF实例的密钥对，其中，私钥仅存储于TE中，从而减少了私钥生成后所经历的网元，降低了私钥泄密的风险。
图6为本发明实施例提供的一种生成安全凭证的方法的通信示意图，如图6所示，该方法包括：
S610，VNF实例生成请求消息。
其中，所述请求消息用于请求TE生成安全凭证。所述安全凭证可以参见图2所示实施例中的相关描述。
例如，安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
S620，所述VNF实例向TE发送所述请求消息。
本发明实施例中，虚拟化系统支持TE，TE可以以硬件实现，也可以以软件实现，无论哪种实现方式，对于VNF实例来说，都是可以提供可信任计算功能以及接口调用的模块。
如果TE通过硬件实现，那么VNF实例的载体VM则通过硬件直接访 问TE，不被NFVI感知；NFVI仅负责管理TE与VNF实例的对应关系，NFVI不能访问硬件TE的数据，也不能使用硬件TE的服务，该硬件TE可以与NFVI位于同一个设备中，也可以单独存在。
如果TE通过软件实现，则TE是VM的一部分，NFVI在创建承载VNF实例的VM的同时创建了TE，这样，当VNF实例启动后，访问到的TE就是NFVI为该VNF实例分配的TE，与硬件TE类似，NFVI不能访问软件TE存储的数据，也不能使用软件TE的功能。
NFVI创建VNF实例和生成安全凭证后，VNF实例可以通过与TE之间的数据接口调用该安全凭证，例如，当VNF实例需要使用私钥解密密文(即，公钥加密的数据)时，可以将该密文发送给TE，TE使用私钥解密该密文生成明文，并将该明文发送给VNF实例；当VNF实例需要使用私钥对数据进行签名时，可以将待签名的数据发送给TE，TE使用私钥对数据签名之后发送给VNF实例。安全凭证生成后始终存储在TE中，其它网元无法获取安全凭证，只有VNF实例能够使用安全凭证，从而减少了安全凭证生成后经历的网元，降低了安全凭证泄密的风险。
可选地，当安全凭证包括公钥和私钥时，上述方法还包括：VNF实例从TE接收所述公钥，VNF实例向NFVI发送该公钥。
具体地，VNF实例从接收到TE发送的公钥后转发给NFVI，NFVI向MANO发送该公钥和该VNF实例的标识信息，MANO可以向其它网元(例如，其它VNF实例)广播发送该公钥和该标识信息，从而，MANO和其它网元可以根据该公钥和该标识信息与所述VNF实例进行通信。
下面将基于上面所述的本发明涉及的共性方面，对本发明实施例进一步详细说明。
图7为本发明实施例提供的一种生成安全凭证的方法的通信示意图，如图7所示，该方法包括：
S710，MANO向NFVI发送VNF初始化命令。
其中，该VNF初始化命令用于触发或指示NFVI创建VNF实例并生成该VNF实例的安全凭证，例如，该VNF初始化命令包括指示由TE生成安全凭证的指示信息，NFVI可以根据该指示信息在创建VNF实例时写入命令，指示VNF实例启动后请求TE生成安全凭证。
S720，NFVI向MANO发送ACK消息。
其中，所述ACK消息用于向MANO反馈该NFVI收到了所述VNF初始化命令。
S730，NFVI根据所述VNF初始化命令创建VNF实例并为该VNF实例分配TE。
其中，NFVI在创建VNF实例时可以在VNF实例中写入命令，指示VNF实例启动后请求TE生成安全凭证。
S740，VNF实例向所述TE发送请求消息。
其中，该请求消息用于请求TE生成安全凭证，该安全凭证可以参见图2所示实施例的相关描述，不再赘述。
可选地，当安全凭证包括公钥和私钥时，上述方法还包括步骤S750-S791。
S750，TE生成公钥和私钥。
S760，TE向VNF实例发送所述公钥。
S770，VNF实例向NFVI发送该公钥。
S780，NFVI向MANO发送VNF初始化成功消息。
其中，该消息携带VNF实例的标识信息以及与该VNF实例对应的公钥。
S790，MANO根据该公钥验证所述VNF实例的安全性并与所述VNF实例通信。
S791，MANO向其它网元广播发送所述公钥，以使得其它网元根据该公钥验证所述VNF实例的安全性并与所述VNF实例通信。
本发明实施例中，虚拟化系统支持TE，TE的可以通过硬件方式实现，也可以通过软件方式实现，具体实现方式与图4或图5对应的方法中TE的实现方式相同，在此不再赘述。
需要说明的是，NFVI创建VNF实例时可以直接在VNF实例中写入命令，指示VNF实例启动后向TE发送密钥生成请求消息，TE生成密钥对后将其中的公钥发送给VNF实例，并由VNF实例发送至NFVI，NFVI将该公钥发送至MANO，MANO公开该公钥以及所述VNF实例的标识信息，从而该MANO和其它网元可以根据该公钥与所述VNF实例进行安全通信。
上述实施例仅是举例说明，本发明实施例不限于此，根据本发明实施例的生成安全凭证的方法，VNF实例向TE发送请求消息，请求TE生成该VNF 实例的安全凭证；此外，安全凭证可以包括公钥和私钥，其中，私钥仅存储于TE中，从而减少了私钥生成后所经历的网元，降低了私钥泄密的风险。
上述实施例主要从各个网元之间交互的角度对本发明实施例的方案进行了介绍。可以理解的是，各个网元，例如NFVI、TE和VNF实例为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对NFVI、TE、和VNF实例进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本发明实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图8A示出了上述实施例中所涉及的NFVI的一种可能的结构示意图。NFVI800包括：处理单元802和通信单元803。
处理单元802用于对NFVI800的动作进行控制管理，例如，处理单元802用于支持NFVI800执行图2-5和7所示任一实施例中NFVI的动作或步骤，和/或用于本文所描述的技术的其它过程。通信单元803用于支持NFVI800与其它网元的通信，例如，与图3中示出的MANO之间的通信。NFVI800还可以包括存储单元801，用于存储NFVI800的程序代码和数据。
其中，通信单元803用于从MANO接收VNF初始化命令；
处理单元802用于根据通信单元803接收的所述VNF初始化命令创建VNF实例以及生成所述VNF实例的安全凭证。
其中，VNF初始化命令，安全凭证可以参见图2所示实施例的相关描述，例如，可以包括公钥和私钥，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
可选地，通信单元803还用于：向所述VNF实例发送所述安全凭证。
进一步地，当安全凭证包括公钥和私钥时，通信单元还用于：向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
NFVI800中，处理单元802可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元803可以是通信接口、收发器、收发电路等，其中，通信接口是统称，可以包括一个或多个接口，通信接口还可以指软件或程序之间交互的接口。存储单元801可以是存储器。
当处理单元802为处理器，通信单元803为通信接口，存储单元801为存储器时，本发明实施例所涉及的NFVI可以为图8B所示的NFVI。
参阅图8B所示，该NFVI810包括：处理器812、通信接口813、存储器811。可选的，NFVI810还可以包括总线814。其中，通信接口813、处理器812以及存储器811可以通过总线814相互连接；总线814可以是外设部件互连标准(Peripheral Component Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。所述总线814可以分为地址总线、数据总线、控制总线等。为便于表示，图8B中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述图2或图3所描述的实施例中NFVI的对应过程，在此不再赘述。
上述实施例仅是举例说明，本发明实施例不限于此，本发明实施例提供的生成安全凭证的NFVI，除了本发明所涉及的特征外，其它特征均符合欧洲电信标准协会(European Telecommunication Standards Institute，ETSI)的相关规定，例如，本发明实施例提供的生成安全凭证的NFVI符合下述的文 件【1】和文件【2】中关于NFVI的定义，
【1】ETSI GS NFV 002:"Network Functions Virtualisation(NFV)；Architectural Framework，
【2】ETSI GS NFV 003:"Network Functions Virtualisation(NFV)；Terminology for main concepts in NFV"。
因此，本发明实施例提供的NFVI，通过NFVI生成VNF实例的安全凭证，并发送给VNF实例，可以减少安全凭证生成后所经历的网元，降低了安全凭证泄密的风险。
在采用集成的单元的情况下，图9A示出了上述实施例中所涉及的NFVI的一种可能的结构示意图。NFVI900包括：处理单元902和通信单元903。
处理单元902用于对NFVI900的动作进行控制管理，例如，处理单元902用于支持NFVI900执行图图2-5和7所示任一实施例中NFVI的动作或步骤，和/或用于本文所描述的技术的其它过程。通信单元903用于支持NFVI900与其它网元的通信，例如与图5中示出的MANO之间的通信。NFVI900还可以包括存储单元901，用于存储NFVI900的程序代码和数据。
其中，通信单元903用于从MANO接收VNF初始化命令；
处理单元902，用于为所述VNF实例分配TE；
通信单元903，还用于向所述TE发送请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证。
其中，所述安全凭证和VNF初始化命令可以参见图2示实施例中的相关描述，例如，安全凭证可以包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
可选地，当安全凭证包含公钥和私钥时，通信单元903还用于：从所述TE接收所述公钥；向MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
NFVI900中，处理单元902可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。
处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元903可以是通信接口、收发器、收发电路等，其中，通信接口是统称，可以包括一个或多个接口，通信接口还可以指软件或程序之间交互的接口。存储单元901可以是存储器。
当处理单元902为处理器，通信单元903为通信接口，存储单元901为存储器时，本发明实施例所涉及的NFVI可以为图9B所示的NFVI。
参阅图9B所示，该NFVI910包括：处理器912、通信接口913、存储器911。可选的，NFVI910还可以包括总线914。其中，通信接口913、处理器912以及存储器911可以通过总线914相互连接；总线914可以是PCI总线或EISA总线等。所述总线914可以分为地址总线、数据总线、控制总线等。为便于表示，图9B中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述图4或图5所描述的实施例中NFVI的对应过程，在此不再赘述。
上述实施例仅是举例说明，本发明实施例不限于此，本发明实施例提供的生成安全凭证的NFVI，除了本发明所涉及的特征外，其它特征均符合ETSI的相关规定，例如，本发明实施例提供的生成安全凭证的NFVI符合文件【1】和文件【2】中关于NFVI的定义。
因此，本发明实施例提供的NFVI，通过请求TE生成VNF实例的安全凭证，可以减少安全凭证生成后所经历的网元，降低了安全凭证泄密的风险。
在采用集成的单元的情况下，图10A示出了上述实施例中所涉及的VNF实例的一种可能的结构示意图。VNF实例1000包括：处理单元1002和通信单元1003。处理单元1002用于对VNF实例1000的动作进行控制管理，例如，处理单元1002用于通过通信单元1003支持VNF实例1000执行图3，5-7所示任一实施例中VNF的动作或步骤，和/或用于本文所描述的技术的其它过程。通信单元1003用于支持VNF实例1000与其它网元的通信，例如与图7中示出的MANO之间的通信。VNF实例1000还可以包括存储单元1001，用于存储VNF实例1000的程序代码和数据。
其中，处理单元1002用于生成请求消息，所述请求消息用于请求TE生 成所述VNF实例的安全凭证。
其中，请求消息，安全凭证可以参见图7所示实施例中的相关描述，例如，安全凭证可以包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
通信单元1003，用于向所述TE发送处理单元1002生成的所述请求消息。
可选地，当安全凭证包括公钥和私钥时，通信单元1003还用于：从所述TE接收所述公钥；向NFVI发送所述公钥，以便于所述NFVI向MANO发送所述公钥以及通过所述MANO公开所述公钥。
VNF实例1000中，处理单元1002可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元803可以是通信接口、收发器、收发电路等，其中，通信接口是统称，可以包括一个或多个接口，通信接口还可以指与软件或程序之间交互的接口。存储单元801可以是存储器。
当处理单元1002为处理器，通信单元1003为通信接口，存储单元1001为存储器时，本发明实施例所涉及的VNF实例可以为图10B所示的VNF实例。
参阅图10B所示，该VNF实例1010包括：处理器1012、通信接口1013、存储器1011。可选的，VNF实例1010还可以包括总线1014。其中，通信接口1013、处理器1012以及存储器1011可以通过总线1014相互连接；总线1014可以是PCI总线或EISA总线等。总线1014可以分为地址总线、数据总线、控制总线等。为便于表示，图10B中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述图6或图7所描述的实施例中的VNF实例的对应过程，在此不再赘述。
上述实施例仅是举例说明，本发明实施例不限于此，因此，本发明实施 例提供的VNF实例，通过请求TE生成VNF实例的安全凭证，可以减少安全凭证生成后所经历的网元，降低了安全凭证泄密的风险。
在采用集成的单元的情况下，图11A示出了上述实施例中所涉及的TE的一种可能的结构示意图。TE1100包括：处理单元1102和通信单元1103。处理单元1102用于对TE1100的动作进行控制管理，例如，处理单元1102用于支持TE1100执行图4-7所示任一实施例中TE的动作或步骤，和/或用于本文所描述的技术的其它过程。通信单元1103用于支持TE1100与其它网络实体的通信，例如与图7中示出的NFVI之间的通信。TE1100还可以包括存储单元1101，用于存储TE1100的程序代码和数据。
其中，通信单元1103，用于从网络功能虚拟化基础设施NFVI或者虚拟网络功能VNF实例接收请求消息。
其中，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证。
处理单元1102，用于根据通信单元1103接收的所述请求消息生成所述安全凭证。
其中，请求消息和安全凭证可以参见图7所示实施例中的相关描述，例如，安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
可选地，当安全凭证包括公钥和私钥时，通信单元1103还用于：向所述NFVI发送所述公钥，以便于所述NFVI通过MANO公开所述公钥；或者，向所述VNF实例发送所述公钥，以便于所述VNF实例向所述NFVI发送所述公钥。
其中，处理单元1102可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1103可以是通信接口、收发器、收发电路等，其中，通信接口是统称，可以包括一个或多个接口。存储单元1101可以是存储器。
当处理单元1102为处理器，通信单元1103为通信接口，存储单元1101 为存储器时，本发明实施例所涉及的TE可以为图11B所示的TE。
参阅图11B所示，该TE1110包括：处理器1112、通信接口1113、存储器1111。可选的，TE1110还可以包括总线1114。其中，通信接口1113、处理器1112以及存储器1111可以通过总线1114相互连接；总线1114可以是PCI总线或EISA总线等。总线1114可以分为地址总线、数据总线、控制总线等。为便于表示，图11B中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中TE的对应过程，在此不再赘述。
因此，本发明实施例提供的TE，根据VNF实例或NFVI发送的请求消息生成安全凭证，可以减少安全凭证生成后所经历的网元，降低了安全凭证泄密的风险。
在本发明实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
另外，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
结合本发明实施例公开内容所描述的方法或者算法的步骤可以通过硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位 于NFVI、TE或VNF实例中。当然，处理器和存储介质也可以作为分立组件存在于NFVI、TE或VNF实例中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (16)

  1. 一种生成安全凭证的方法，其特征在于，所述方法包括：
    网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令；
    所述NFVI根据所述VNF初始化命令创建VNF实例以及生成所述VNF实例的安全凭证；
    其中，所述安全凭证包括公钥和私钥，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  2. 根据权利要求1所述的方法，其特征在于，所述NFVI创建所述VNF实例以及生成所述公钥后，所述方法还包括：
    所述NFVI向所述VNF实例发送所述公钥和所述私钥；
    所述NFVI向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
  3. 一种生成安全凭证的方法，其特征在于，所述方法包括：
    网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令；
    所述NFVI根据所述VNF初始化命令创建VNF实例；
    所述NFVI为所述VNF实例分配可信环境TE；
    所述NFVI向所述TE发送请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  4. 根据权利要求3所述的方法，其特征在于，所述NFVI向所述TE发送所述请求消息之后，所述方法还包括：
    所述NFVI从所述TE接收所述公钥；
    所述NFVI向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
  5. 一种生成安全凭证的方法，其特征在于，所述方法包括：
    虚拟化网络功能VNF实例生成请求消息，所述请求消息用于请求可信 环境TE生成安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据；
    所述VNF实例向所述TE发送所述请求消息。
  6. 根据权利要求5所述的方法，其特征在于，所述VNF实例向所述TE发送所述请求消息之后，所述方法还包括：
    所述VNF实例从所述TE接收所述公钥；
    所述VNF实例向网络功能虚拟化基础设施NFVI发送所述公钥，以便于所述NFVI向管理和编排MANO发送所述公钥以及通过所述MANO公开所述公钥。
  7. 一种生成安全凭证的方法，其特征在于，所述方法包括：
    可信环境TE从网络功能虚拟化基础设施NFVI或者虚拟网络功能VNF实例接收请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证；
    所述TE根据所述请求消息生成所述安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  8. 根据权利要求7所述的方法，其特征在于，所述TE生成所述公钥和所述私钥之后，所述方法还包括：
    所述TE向所述NFVI发送所述公钥，以便于所述NFVI通过管理和编排MANO公开所述公钥；或者，
    所述TE向所述VNF实例发送所述公钥，以便于所述VNF实例向所述NFVI发送所述公钥。
  9. 一种网络功能虚拟化基础设施NFVI，其特征在于，包括：处理单元和通信单元，
    所述通信单元用于从管理和编排MANO接收虚拟网络功能VNF初始化命令；
    所述处理单元用于根据所述通信单元接收的所述VNF初始化命令创建VNF实例以及生成所述VNF实例的安全凭证，其中，所述安全凭证包括公钥和私钥，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数 据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  10. 根据权利要求9所述的NFVI，其特征在于，所述处理单元创建所述VNF实例以及生成所述公钥后，所述通信单元还用于：
    向所述VNF实例发送所述公钥和所述私钥；
    向所述MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
  11. 一种网络功能虚拟化基础设施NFVI，其特征在于，包括：处理单元和通信单元，
    所述通信单元用于从管理和编排MANO接收虚拟网络功能VNF初始化命令；
    所述处理单元用于根据所述通信单元接收的所述VNF初始化命令创建VNF实例；
    所述处理单元还用于为所述VNF实例分配可信环境TE；
    所述通信单元还用于向所述TE发送请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  12. 根据权利要求11所述的NFVI，其特征在于，所述通信单元向所述TE发送所述请求消息之后，所述通信单元还用于：
    从所述TE接收所述公钥；
    向MANO发送所述公钥和所述VNF实例的标识信息，以便于所述MANO公开所述公钥和所述VNF实例的标识信息。
  13. 一种虚拟网络功能VNF实例，其特征在于，包括：处理单元和通信单元，
    所述处理单元用于生成请求消息，所述请求消息用于请求可信环境TE生成所述VNF实例的安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据；
    所述通信单元用于向所述TE发送所述处理单元生成的所述请求消息。
  14. 根据权利要求13所述的VNF实例，其特征在于，所述通信单元向所述TE发送所述请求消息之后，所述通信单元还用于：
    从所述TE接收所述公钥；
    向网络功能虚拟化基础设施NFVI发送所述公钥，以便于所述NFVI向管理和编排MANO发送所述公钥以及通过所述MANO公开所述公钥。
  15. 一种可信环境TE，其特征在于，包括：处理单元和通信单元，
    所述通信单元用于从网络功能虚拟化基础设施NFVI或者虚拟网络功能VNF实例接收请求消息，所述请求消息用于请求所述TE生成所述VNF实例的安全凭证；
    所述处理单元用于根据所述通信单元接收的所述请求消息生成所述安全凭证，所述安全凭证包括公钥和私钥，其中，所述公钥用于加密数据以及所述私钥用于解密所述公钥加密的数据，或者，所述私钥用于对数据进行签名以及所述公钥用于验证所述私钥签名的数据。
  16. 根据权利要求15所述的TE，其特征在于，所述处理单元生成所述公钥和所述私钥后，所述通信单元还用于：
    向所述NFVI发送所述公钥，以便于所述NFVI通过管理和编排MANO公开所述公钥；或者，
    向所述VNF实例发送所述公钥，以便于所述VNF实例向所述NFVI发送所述公钥。
PCT/CN2016/098061 2016-09-05 2016-09-05 一种生成安全凭证的方法和设备 WO2018040095A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/098061 WO2018040095A1 (zh) 2016-09-05 2016-09-05 一种生成安全凭证的方法和设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/098061 WO2018040095A1 (zh) 2016-09-05 2016-09-05 一种生成安全凭证的方法和设备

Publications (1)

Publication Number Publication Date
WO2018040095A1 true WO2018040095A1 (zh) 2018-03-08

Family

ID=61299800

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098061 WO2018040095A1 (zh) 2016-09-05 2016-09-05 一种生成安全凭证的方法和设备

Country Status (1)

Country Link
WO (1) WO2018040095A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023246287A1 (zh) * 2022-06-23 2023-12-28 中兴通讯股份有限公司 安全通道建立方法、系统及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104580208A (zh) * 2015-01-04 2015-04-29 华为技术有限公司 一种身份认证方法及装置
WO2015168914A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
WO2015168913A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术
CN105577381A (zh) * 2014-10-24 2016-05-11 中兴通讯股份有限公司 虚拟化下的证书管理方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015168914A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
WO2015168913A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
CN105577381A (zh) * 2014-10-24 2016-05-11 中兴通讯股份有限公司 虚拟化下的证书管理方法和装置
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术
CN104580208A (zh) * 2015-01-04 2015-04-29 华为技术有限公司 一种身份认证方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023246287A1 (zh) * 2022-06-23 2023-12-28 中兴通讯股份有限公司 安全通道建立方法、系统及存储介质

Similar Documents

Publication Publication Date Title
US10977372B2 (en) Technologies for secure bootstrapping of virtual network functions
US9509692B2 (en) Secured access to resources using a proxy
JP2019526993A (ja) ネットワーク機能仮想化システム及び検証方法
US10601590B1 (en) Secure secrets in hardware security module for use by protected function in trusted execution environment
JP2016519540A (ja) 分散環境の安全通信認証方法及びシステム
KR102020357B1 (ko) Nfv 환경에서 보안 통신 방법 및 그 시스템
US11487867B2 (en) Method and apparatus for creating virtualized network function instance
EP3720042B1 (en) Method and device for determining trust state of tpm, and storage medium
US11032708B2 (en) Securing public WLAN hotspot network access
WO2018040095A1 (zh) 一种生成安全凭证的方法和设备
Robinson Cryptography as a service
WO2018120042A1 (zh) 一种凭据分发的方法和设备
CN104717235B (zh) 一种虚拟机资源检测方法
US11025594B2 (en) Secret information distribution method and device
CN109286494B (zh) 一种虚拟网络功能vnf的初始化凭据生成方法及设备
CN114329574B (zh) 基于域管平台的加密分区访问控制方法、系统及计算设备
WO2022206811A1 (zh) 一种云服务系统以及基于云服务的数据处理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16914660

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16914660

Country of ref document: EP

Kind code of ref document: A1