WO2018120182A1 - 一种秘密信息的分发方法和设备 - Google Patents

一种秘密信息的分发方法和设备 Download PDF

Info

Publication number
WO2018120182A1
WO2018120182A1 PCT/CN2016/113863 CN2016113863W WO2018120182A1 WO 2018120182 A1 WO2018120182 A1 WO 2018120182A1 CN 2016113863 W CN2016113863 W CN 2016113863W WO 2018120182 A1 WO2018120182 A1 WO 2018120182A1
Authority
WO
WIPO (PCT)
Prior art keywords
vtpm
secret information
mano
vnf
nfvi
Prior art date
Application number
PCT/CN2016/113863
Other languages
English (en)
French (fr)
Inventor
门方龙
塞尔维亚⋅米哈伊
李方展
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16925261.6A priority Critical patent/EP3550781B1/en
Priority to PCT/CN2016/113863 priority patent/WO2018120182A1/zh
Priority to CN201680091655.1A priority patent/CN110115012B/zh
Publication of WO2018120182A1 publication Critical patent/WO2018120182A1/zh
Priority to US16/456,065 priority patent/US11025594B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/82—Miscellaneous aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2153—Using hardware token as a secondary aspect

Definitions

  • the present invention relates to the field of communications, and in particular, to a method and a device for distributing secret information.
  • the traditional telecommunication system is composed of various dedicated hardware devices, and different applications use different hardware devices.
  • the system becomes more and more complex, which brings many challenges, including the development of new services, the operation and maintenance of the system, and resource utilization.
  • the world's 13 major telecom operators jointly released the NFV white paper. It also announced the establishment of NFV ISG at ETSI to develop NFV requirements and technical framework to promote the development of NFV.
  • NFV Network Function Virtualization
  • COTS Commercial-off-the- Shelf
  • each network element used in the telecommunication network can be transformed into a stand-alone application, which can be flexibly deployed on a unified infrastructure platform built by standards-based servers, storage, and switches, and through virtualization technology to the infrastructure.
  • Hardware device resource pooling and virtualization providing virtual resources to upper-layer applications, enabling application and hardware decoupling, enabling each application to rapidly increase virtual resources to achieve rapid expansion of system capacity, or to rapidly reduce virtual resources to achieve shrinkage
  • the purpose of system capacity greatly enhances the flexibility of the network.
  • the common COTS server is used to form a shared resource pool. The newly developed services do not need to be separately deployed with hardware devices, which greatly shortens the time for new services to go online.
  • the foundation of NFV technology includes cloud computing technology and virtualization technology.
  • Hardware devices such as general-purpose COTS computing/storage/network can be decomposed into multiple virtual resources through virtualization technology for use by various applications in the upper layers.
  • virtualization technology Through the virtualization technology, the decoupling between the application and the hardware is realized, so that the virtual resource supply speed is greatly increased; through the cloud computing technology, the elastic expansion and contraction of the application can be realized, and the virtual capital is realized. Matching the source with the traffic load not only improves the utilization efficiency of the virtual resources, but also improves the response rate of the system.
  • the NFV management and orchestration system MANO needs to preset some secret information before the VNF is started, such as an FTP password, a DB password or a password encryption key, an SSH public key, and a software package digital signature public key. Etc. Some information is needed during the startup phase. In the existing mode, the passwords, keys, etc. (such as FTP password, DB password, and SSH public key) required during the installation phase are mostly preset in the software package, and these sensitive data are protected by encryption or permission control. A key leak can lead to the disclosure of secret information. If a CD-ROM-like configuration disk is used, once the write is not erasable, for NFVI, the configuration disk data can be viewed directly in plain text.
  • the embodiment of the present invention provides a secret information distribution method, which can reduce the risk of secret information being leaked.
  • An embodiment of the present invention provides a method for secret information distribution, the method comprising: a network function virtualization infrastructure NFVI receiving management and scheduling secret information sent by a MANO; creating a vTPM in the NFVI, and the secret information Writing to the vTPM; the network function virtualization infrastructure NFVI receives the virtual network function VNF initialization command from the management and orchestration MANO and creates a VNF; the VNF obtains the secret information from the vTPM.
  • the embodiment of the invention further provides a system for secret information distribution, the system comprising a management and programming MANO and a network function virtualization infrastructure NFVI: the MANO is used for sending secret information to the NFVI; the sent NFVI is used for Receiving the secret information sent by the MANO and creating a vTPM in the NFVI, and writing the secret information to the vTPM; the sent NFVI is further used to receive the virtual network function VNF initialization command from the sent MANO and create a VNF; Obtaining the secret information from the vTPM.
  • the embodiment of the present invention further provides a network function virtualization infrastructure NFVI, which can implement the functions performed by the NFVI in the method related to the above aspects, and the functions can be implemented by hardware or by executing corresponding software through hardware.
  • the hardware or software includes one or more corresponding units or modules of the above functions.
  • the NFVI structure includes a processor and a communication interface configured to support the NFVI to perform the corresponding functions of the above methods.
  • the communication interface is used to support communication between the NFVI and other network elements.
  • the NFVI can also include a memory for coupling with the processor that holds the necessary program instructions and data for the NFVI.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the NFVI, including a program designed to perform the above aspects.
  • the present application also provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the various aspects above.
  • the secret information does not have a trusted environment, ensures the confidentiality and integrity of the secret information, and prevents the secret information from being leaked during the distribution process.
  • FIG. 1 is a schematic diagram of an NFV-based network architecture to which an embodiment of the present invention is applied;
  • FIG. 2 is a flowchart of a method for distributing secret information according to an embodiment of the present invention
  • FIG. 5A is a schematic structural diagram of a possible NFVI according to an embodiment of the present invention.
  • FIG. 5B is a schematic structural diagram of another possible NFVI according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an NFV system for secret information distribution according to an embodiment of the present invention.
  • the network architecture and the service scenario described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and are not limited to the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.
  • the method of the embodiment of the present invention can be applied to an NFV-based network architecture, and can also be applied to a network architecture based on an application container engine (for example, Docker), a virtual machine monitor (VMM)-based network architecture, and based on openstack.
  • an application container engine for example, Docker
  • VMM virtual machine monitor
  • the VMM may also be referred to as a hypervisor.
  • FIG. 1 is a schematic diagram of an NFV-based network architecture according to an embodiment of the present invention.
  • the network architecture includes: Network Function Virtualization Orchestrator (NFVO), Virtualized Network Function Manager (VNFM), and Virtualized Infrastructure Manager (Virtualized Infrastructure). Manager, VIM), Network Function Virtualization Infrastructure (NFVI), Virtual Machine (VM), Virtualized Network Function (VNF), and Element Manager System (Element Manager System, EMS), where NFVO, VNFM, and VIM belong to the Management and Orchestration (MANO) of the NFV system.
  • the related functions of MANO can be implemented by hardware or by software.
  • a virtualisation container is part of a compute node that provides an isolated virtualized computing environment.
  • An example of a typical virtualization container is a VM.
  • a VM is a virtual device that is simulated on a physical device by virtual machine software. For applications running in virtual machines, these virtual machines work just like real physical devices, which can have operating systems and applications installed on them, and virtual machines can access network resources.
  • VNF also known as virtualized network elements
  • VNF corresponds to physical network functions in traditional non-virtualized networks.
  • the functional behavior and state of the network function is independent of the virtualization of the network function.
  • the VNF can be composed of multiple lower-level components.
  • one VNF can be deployed on multiple VMs, and each VM hosts a Virtualized Network Function Component (VNFC).
  • VNFC Virtualized Network Function Component
  • a VNF can also be deployed on a VM.
  • the VNFM is mainly used to implement the lifecycle management of the VNF instance, including the initialization of the VNF instance, the expansion or contraction of the VNF instance, and the termination of the VNF instance.
  • EMS is mainly used to perform traditional FCAPS (Fault Management, Configuration Management, Accounting Management, Performance Management for VNF). And Security Management, fault management, configuration management, billing management, performance management, security management).
  • FCAPS fault Management, Configuration Management, Accounting Management, Performance Management for VNF.
  • Security Management fault management, configuration management, billing management, performance management, security management.
  • the EMS can exist alone or as a VNF with EMS functionality.
  • VIM is mainly responsible for: management, monitoring, and fault reporting of infrastructure layer hardware resources and virtualized resources, and providing virtualized resource pools for upper-layer applications.
  • NFVI is mainly used to provide hardware and virtual resources for the entire system, including hardware resources (including computing, network, and storage), virtualization layer (virtualization of hardware resources into resource pools), and virtual resources (also divided into computing and networking). , storage three parts) composition. From a VNF perspective, the virtualization layer and hardware resources appear to be an entity that provides the required virtual resources.
  • NFVO Network Service Descriptor
  • VNFD Virtualized Network Function Descriptor
  • VNFFG Virtualized Network Function Forwarding Graph
  • NS Network Service, NS Lifecycle management, and global view of resources.
  • FIG. 2 is a flowchart of a method for distributing secret information according to an embodiment of the present invention. As shown in FIG. 2, the method includes:
  • the network function virtualization infrastructure NFVI receives the secret information sent by the MANO;
  • the MANO will assign secret information to the VNF during the VNF pre-installation phase, which is used for subsequent VNF creation or request to use related services.
  • the secret information includes sensitive information such as access authentication and key.
  • the access authentication including a username/password, a public key, etc., is used to connect to a server to obtain a service, such as FTP/DB/SSH, etc.; the negotiation key includes a key for transmitting encrypted data, and a TLS PSK mode. Pre-shared key, digitally signed public key, and key used for message integrity.
  • the information sent together with the secret information may further include identity information of the VNF to be created, and the identity information of the VNF may be ID information of the VNF or the like, for uniquely identifying the VNF;
  • the identity information may be sent by the MANO separately or may be sent together with the secret information, as long as the association between the secret information and the VNF to be created can be established, that is, the secret information is only bound to have a one-to-one correspondence.
  • the relationship of VNF is used. According to the following steps, after the creation of the VNF to be created is completed, the VNF obtains the secret information and is used in subsequent other service requests.
  • vTPM Virtual Trust
  • vTPM is one of the TPM virtualization solutions, which enables complete virtualized computing functions for each virtual machine in a virtualized environment.
  • TPM secure storage and encryption functions can be used in VNF.
  • the vTPM instance is a TPM in the VNF.
  • Each VNF that requires the TPM function is associated with a unique vTPM instance throughout the lifetime, that is, one-to-one correspondence.
  • the vTPM O&M agent located in the NFVI creates a corresponding vTPM and writes the secret information to the vTPM when the vTPM AIK/EK is assigned.
  • the TPM/vTPM is defined by TCG (Trusted Computing Group), and can refer to related prior art or protocol.
  • the network function virtualization infrastructure NFVI receives the virtual network function VNF initialization command from the management and orchestration MANO and creates the VNF.
  • the MANO After the secret information is written to the vTPM, the MANO sends an initialization command to create a VNF to the NFVI, where the command includes the VNF identity information to be created as described in the above S210, so that the created VNF identity information is consistent with the identity information of the S210. .
  • the VNF acquires the secret information from the vTPM.
  • the VNF sends a request message to its corresponding vTPM, and the vTPM sends secret information to the VNF.
  • the secret information since only the vTPM knows the secret information of the VNF, the secret information does not exist in a trusted environment, the confidentiality and integrity of the secret information are ensured, and the secret information is prevented from being leaked during the distribution process.
  • the MANO may be any one of NFVO, VNFM, and VIM.
  • the VNF initialization command may be sent to the NFVI through the VIM, and the NFVI creates the VNF after receiving the VNF initialization command.
  • FIG. 3 is a detailed flowchart of secret information distribution according to an embodiment of the present invention.
  • the secret information is distributed by MANO and sent by vTPM O&M in MANO to the vTPM O&M agent in the NFVI.
  • the specific steps are as follows:
  • the secret information that MANO will assign to the VNF during the VNF pre-installation phase and the The VNF identity information to be created is passed to the vTPM O&M; wherein the vTPM O&M is located in the MANO, for example, in the VIM of the MANO.
  • vTPM O&M forwards the secret information to the vTPM O&M agent in the NFVI.
  • the vTPM O&M agent creates a vTPM for the VNF to be created, and writes the secret information to the NVROM (read-only) of the vTPM when the vTPM AIK/EK is allocated.
  • MANO initiates a "VNF Initialization" command to the NFVI, which creates a VNF command.
  • NFVI instantiates the VNF, that is, creates a VNF whose identity information is consistent with the VNF identity information in step 1.
  • the process in the VNF reads the secret information of the NVROM in the vTPM.
  • FIG. 4 is another detailed flowchart of secret information distribution according to an embodiment of the present invention.
  • the secret information is obtained by MANO from other VNFs (VNF A) and sent by vTPM O&M in MANO to NFVI.
  • VNF A VNFs
  • vTPM O&M agent the specific steps are as follows:
  • MANO pre-creates the VNF A phase and initiates a notification message to the VNF S, including the VNF A identity information.
  • VNF S is a virtual server that can be used to provide related services to VNF A, where the letters S and A are used to distinguish different VNFs.
  • VNF S needs to preset secret information to VNF A, insert secret information into the MANO response message.
  • MANO passes the secret information that needs to be assigned and the VNF identity information to vTPM O&M, then skips to step 5.
  • the VNF S needs to send the secret information directly to the vTPM O&M; otherwise the step does not exist.
  • vTPM O&M forwards the information to the vTPM O&M agent.
  • the vTPM O&M agent creates a vTPM for the VNF to be created, and writes the secret information to the NVROM (read-only) of the vTPM when the vTPM AIK/EK is allocated.
  • MANO initiates a "VNF A Initialization" command to the NFVI.
  • NFVI instantiates VNFA, that is, creates VNF A, and the identity information of the VNF is consistent with the VNF identity information in step 1.
  • VNF A reads the secret information of the NVROM in the vTPM.
  • VNF A uses the secret information to request services from VNF S, such as FTP, SSH, DB, and the like.
  • the VNF identity information to be created or the identity information of the VNF A in the foregoing embodiments may be carried in the secret information, or may be sent separately from the secret information, which is not limited in this embodiment.
  • the vTPM O&M in the foregoing embodiments is a centralized or distributed vTPM management module, and is used for vTPM creation, deletion, and the like, and may be located at locations such as VIM, VNFM, and NFVO; and the vTPM O&M agent is distributed. Or centralized vTPM O&M agent process for vTPM to create, delete, and assign information such as vTPM AIK/EK.
  • the vTPM O&M agent is located in the NFVI and can be understood as a TPM proxy process on the I layer.
  • the vTPM knows the secret information of the VNF, and the secret information does not exist in a trusted environment, which ensures the confidentiality and integrity of the secret information, and also prevents the secret information from being leaked during the distribution process.
  • the embodiments of the present invention may perform functional unit division on the NFVI and VNF instances according to the foregoing method.
  • each functional unit may be divided according to each function, or two or more functions may be integrated into one processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 5A shows a possible structural diagram of the NFVI involved in the above embodiment.
  • the NFVI 500 includes a processing unit 502 and a communication unit 503.
  • the processing unit 502 is configured to control and manage the actions of the NFVI 500.
  • the processing unit 502 is configured to support the NFVI 500 to perform the actions or steps of the NFVI in any of the embodiments shown in FIGS. 2-4, and/or for the purposes described herein.
  • Other processes of technology are for supporting communication between the NFVI 500 and other network elements, for example, with the MANO shown in FIG. NFVI 500
  • a storage unit 801 for storing program code and data of the NFVI 500 may also be included.
  • the communication unit 503 is configured to receive secret information from the MANO;
  • the processing unit 502 is configured to create a virtual trusted platform module vTPM, and write the secret information into the vTPM;
  • the communication unit 503 is further configured to receive a virtual network function VNF initialization command from the management and orchestration MANO;
  • the processing unit 502 is further configured to create the VNF
  • the communication unit 503 is further configured to send secret information to the created VNF.
  • the processing unit 502 can be a processor or a controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application specific integrated circuit (Application). -Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 503 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, and the communication interface can also refer to an interface between software or programs.
  • the storage unit 501 can be a memory.
  • the processing unit 502 is a processor
  • the communication unit 503 is a communication interface
  • the storage unit 501 is a memory
  • the NFVI involved in the embodiment of the present invention may be the NFVI shown in FIG. 5B.
  • the NFVI 510 includes a processor 512, a communication interface 513, and a memory 511.
  • the NFVI 510 can also include a bus 514.
  • the communication interface 513, the processor 512, and the memory 511 may be connected to each other through a bus 514.
  • the bus 514 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on.
  • the bus 514 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 5B, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a system for secret information distribution.
  • the system includes managing and orchestrating MANO and network function virtualization infrastructure NFVI.
  • the MANO is configured to send secret information to the NFVI;
  • the sent NFVI is used to receive the secret information sent by MANO and create a vTPM in the NFVI. And writing the secret information to the vTPM;
  • the sent NFVI is further used to receive a virtual network function VNF initialization command from the sent MANO and create a VNF;
  • the VNF is configured to acquire the secret information from the vTPM.
  • the steps of the method or algorithm described in connection with the disclosure of the embodiments of the present invention may be implemented by means of hardware, or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • the ASIC can be located in the NFVI and VNF instances.
  • the processor and storage medium can also exist as discrete components in the NFVI and VNF instances.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种秘密信息分发的方法，所述方法包括：网络功能虚拟化基础设施NFVI接收管理和编排MANO发送的秘密信息；在所述NFVI中创建vTPM，并将所述秘密信息写入到vTPM中；网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令并创建VNF；所述VNF从所述vTPM获取所述秘密信息。由于只有vTPM获知VNF的秘密信息，秘密信息不出可信环境，保证了秘密信息的机密性和完整性，也防止秘密信息在分发过程中泄露。

Description

一种秘密信息的分发方法和设备 技术领域
本发明涉及通信领域，尤其涉及一种秘密信息的分发方法和设备。
背景技术
传统的电信系统通过各种专用的硬件设备组成，不同的应用采用不同的硬件设备。随着网络规模的增长，系统越来越复杂，带来了诸多的挑战，包括新增业务的开发上线、系统的运维、资源利用率等。为了应对这些挑战及利用IT业界的虚拟化技术及云计算技术，在2012年10月22日召开的“SDN and OpenFlow World Congress”会议上，全球主要的13个电信运营商联合发布了NFV白皮书，并宣布在ETSI成立NFV ISG，制定NFV的需求及技术框架，推动NFV的发展。
网络功能虚拟化(Network Function Virtualization，NFV)技术可以简单地理解为将电信网络中使用的各个网元的功能从目前的专用硬件平台迁移至通用的商用货架产品(COTS,Commercial-off-the-shelf)服务器上。通过NFV技术将电信网络中使用的各个网元转变成为独立的应用，可以灵活部署在基于标准的服务器、存储以及交换机等其他设备构建的统一基础设施平台上，并通过虚拟化技术，对基础设施硬件设备资源池化及虚拟化，对上层应用提供虚拟资源，实现应用、硬件解耦，使得每一个应用能够快速增加虚拟资源以实现快速扩展系统容量的目的，或者能够快速减少虚拟资源以实现收缩系统容量的目的，大大提升网络的弹性。采用通用的COTS服务器组成共享的资源池，新开发的业务，不需要单独部署硬件设备，大大缩短新业务上线时间。
NFV技术的基础包含云计算技术和虚拟化技术。通用的COTS计算/存储/网络等硬件设备通过虚拟化技术可以分解为多种虚拟资源，以供上层各种应用使用。通过虚拟化技术，实现应用与硬件之间的解耦，使得虚拟资源供给速度大大增加；通过云计算技术，可以实现应用的弹性伸缩，实现虚拟资 源与业务负荷相匹配，不仅提升了虚拟资源的利用效率，而且改善了系统的响应速率。
具体地，NFV管理和编排系统MANO在安装虚拟网络功能VNF时，需要在VNF启动前预置一些秘密信息，比如FTP口令，DB口令或者口令加密密钥，SSH公钥，软件包数字签名公钥等，有些信息是启动阶段需要使用。在现有模式中，安装阶段需要的口令、密钥等(如FTP口令、DB口令、SSH公钥)大多预置在软件包内，通过加密或者权限控制对这些敏感数据进行保护，如果根密钥泄露，会导致秘密信息泄露。如果采用类似CD-ROM的配置盘方式，一旦写入不可擦除，对于NFVI，可以直接明文查看配置盘数据。
发明内容
有鉴于此，本发明实施例提供了一种秘密信息分发方法，能够减少秘密信息被泄露的风险。
本发明实施例提供了一种秘密信息分发的方法，所述方法包括：网络功能虚拟化基础设施NFVI接收管理和编排MANO发送的秘密信息；在所述NFVI中创建vTPM，并将所述秘密信息写入到vTPM中；网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令并创建VNF；所述VNF从所述vTPM获取所述秘密信息。
本发明实施例还提供了一种秘密信息分发的系统，所述系统包括管理和编排MANO和网络功能虚拟化基础设施NFVI：所述MANO用于向所述NFVI发送秘密信息；所送NFVI用于接收MANO发送的秘密信息并在NFVI中创建vTPM，并将所述秘密信息写入到vTPM中；所送NFVI进一步用于从所送MANO接收虚拟网络功能VNF初始化命令并创建VNF；所述VNF用于从所述vTPM获取所述秘密信息。
本发明实施例还提供了一种网络功能虚拟化基础设施NFVI，该NFVI可以实现上述方面所涉及方法中NFVI所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的单元或模块。
在一种可能的设计中，该NFVI的结构中包括处理器和通信接口，该处理器被配置为支持该NFVI执行上述方法中相应的功能。该通信接口用于支持该NFVI与其他网元之间的通信。该NFVI还可以包括存储器，该存储器用于与处理器耦合，其保存该NFVI必要的程序指令和数据。
另一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述NFVI所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
本申请还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
由于上述方案中仅vTPM获知VNF的秘密信息，秘密信息不出可信环境，保证了秘密信息的机密性和完整性，也防止秘密信息在分发过程中泄露。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是适用本发明实施例的一种基于NFV的网络架构示意图；
图2是本发明实施例提供的一种秘密信息分发的方法流程图；
图3是本发明实施例提供的一种秘密信息分发的详细流程图；
图4是本发明实施例提供的另一种秘密信息分发的详细流程图；
图5A是本发明实施例提供的一种可能的NFVI的结构示意图；
图5B是本发明实施例提供的另一种可能的NFVI的结构示意图；
图6是本发明实施例提供的一种秘密信息分发的NFV系统示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本发明实施例的技术方案，并不构成对本发明实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
本发明实施例的方法可以应用于基于NFV的网络架构，此外还可以应用于基于应用容器引擎(例如Docker)的网络架构、基于虚拟机监视器(Virtual Machine Monitor，VMM)的网络架构、基于openstack的网络架构或者其它虚拟化技术的网络架构中，其中VMM也可以称为hypervisor，下面，以基于NFV的网络架构为例，对本发明实施例的方案进行说明。
图1为本发明实施例提供的一种基于NFV的网络架构的示意图。如图1所示，该网络架构包括：网络功能虚拟化编排器(Network Function Virtualization Orchestrator，NFVO)、虚拟化网络功能管理器(Virtualized Network Function Manager，VNFM)、虚拟化基础设施管理器(Virtualized Infrastructure Manager，VIM)、网络功能虚拟化基础设施(Network Function Virtualization Infrastructure，NFVI)、虚拟机(Virtual Machine，VM)、虚拟化网络功能(Virtualized Network Function，VNF)和网元管理系统(Element Manager System，EMS)，其中，NFVO、VNFM和VIM属于NFV系统的管理编排(Management and Orchestration，MANO)，MANO的相关功能可以通过硬件实现，也可以通过软件实现。
为了方便理解本发明实施例，下面，分别对上述网元以及与本发明相关的要素进行简要介绍。
虚拟化容器(virtualisation container)是计算节点的一部分，用于提供隔离的虚拟化计算环境，一个典型的虚拟化容器的例子是VM。VM指通过虚拟机软件在物理设备上模拟出的虚拟设备。对于在虚拟机中运行的应用程序而言，这些虚拟机就像真正的物理设备那样进行工作，虚拟机上可以安装操作系统和应用程序，虚拟机还可访问网络资源。
VNF，也可称之为虚拟化网元，对应于传统的非虚拟化网络中的物理网络功能。网络功能的功能性行为和状态与网络功能的虚拟化与否无关。VNF可以由多个更低级别的组件组成，可选的，一个VNF可以部署在多个VM上，每个VM承载(host)一个虚拟网络功能组件(Virtualized Network Function Component，VNFC)。可选的，一个VNF也可以部署在一个VM上。
VNFM主要用于：实现VNF实例的生命周期管理，包括VNF实例的初始化、VNF实例的扩容或缩容以及VNF实例的终止。
EMS主要用于：针对VNF执行传统的FCAPS(Fault Management，Configuration Management，Accounting Management，Performance Management  and Security Management，故障管理，配置管理，计费管理，性能管理，安全管理)功能。EMS可以单独存在，也可以是具有EMS功能的VNF。
VIM主要负责：基础设施层硬件资源和虚拟化资源的管理、监控和故障上报，面向上层应用提供虚拟化资源池。
NFVI主要用于：提供整个系统运行的硬件和虚拟资源，由硬件资源(包括计算、网络、存储三部分)、虚拟化层(将硬件资源虚拟化成资源池)和虚拟资源(同样分成计算、网络、存储三部分)组成。从VNF的角度来说，虚拟化层和硬件资源看起来是一个能够提供所需虚拟资源的实体。
NFVO用于实现网络服务描述符(Network Service Descriptor，NSD)、虚拟网络功能描述符(Virtualized Network Function Descriptor，VNFD)、虚拟网络功能转发图(Virtualized Network Function Forwarding Graph，VNFFG)的管理，网络服务(Network Service，NS)生命周期的管理，和资源的全局视图功能。
下面，将结合附图对本发明实施例进行详细描述。
图2为本发明实施例提供的一种秘密信息分发的方法的流程图，如图2所示，该方法包括：
S210，网络功能虚拟化基础设施NFVI接收MANO发送的秘密信息；
MANO在VNF预安装阶段将为所述VNF分配秘密信息，所述秘密信息用于后续VNF创建或请求使用相关服务时使用。所述秘密信息包括接入认证，密钥等敏感信息。其中，所述接入认证，包括用户名/口令，公钥等，用于连接服务器获取服务，如FTP/DB/SSH等；所述协商密钥，包括传递加密数据的密钥，TLS PSK方式的pre-shared key，数字签名公钥，以及用于消息完整性的密钥等。
其中，和所述秘密信息一起发送的信息还可以包括待创建的VNF的身份信息，所述VNF的身份信息可以是VNF的ID信息或类似信息，用于唯一标识VNF；所述待创建VNF的身份信息可以由MANO单独发送，也可以跟所述秘密信息一起发送，只要能够建立所述秘密信息和待创建的VNF的关联关系即可，即所述秘密信息只供与其有一一对应绑定关系的VNF使用。根据下面的步骤，当所述待创建VNF创建完成后，所述VNF会获取所述秘密信息，并用于后续的其他业务请求中。
S220，在所述NFVI中创建虚拟可信平台模块vTPM(Virtual Trust  Platform Module)，并将所述秘密信息写入到vTPM中。
vTPM是TPM虚拟化解决方案之一，它使得在虚拟化环境里每一个虚拟机都能获得完整的可信计算功能，通过虚拟可信平台模块，TPM的安全存储与加密功能能够在VNF中使用，从而支持在虚拟化环境中建立可信，特别是对软件完整性的远程证实。其中vTPM实例是一个VNF中的TPM，每个需要TPM功能的VNF在整个生命期内都与一个唯一的vTPM实例关联，也就是一一对应。
位于NFVI中的vTPM O&M agent创建相应的vTPM，并在分配vTPM AIK/EK时，将所述秘密信息写入到vTPM中。其中，TPM/vTPM由TCG(Trusted Computing Group)定义，可参考相关现有技术或协议。
S230，网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令并创建所述VNF。
当秘密信息被写入vTPM后，MANO向NFVI发送创建VNF的初始化命令，所述命令包括上述S210中所述的待创建的VNF身份信息，从而该创建后的VNF身份信息与S210的身份信息一致。
S240，所述VNF从所述vTPM获取所述秘密信息。
VNF向与其对应的vTPM发送请求消息，vTPM发送秘密信息给VNF。
在上述实施例中，由于仅vTPM获知VNF的秘密信息，秘密信息不出可信环境，保证了秘密信息的机密性和完整性，也防止秘密信息在分发过程中泄露。
在本发明实施例中，MANO可以是NFVO、VNFM和VIM中的任一个，可选地，VNF初始化命令可以通过VIM发送给NFVI，NFVI接收到该VNF初始化命令后创建VNF。
NFVI如何根据VNF初始化命令创建VNF是本领域的公知技术，在此不再赘述。
下面将基于上面所述的本发明涉及的共性方面，对本发明实施例进一步详细说明。
图3为本发明实施例提供的一种秘密信息分发的详细流程图，该实施例中秘密信息由MANO分配并由MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent，具体步骤如下：
1.MANO在VNF预安装阶段将为所述VNF分配的秘密信息以及所述 待创建的VNF身份信息传递给vTPM O&M；其中，vTPM O&M位于MANO中，例如可位于MANO的VIM中。
2.vTPM O&M将秘密信息转发给NFVI中的vTPM O&M agent。
3.vTPM O&M agent为待创建的VNF创建vTPM，在分配vTPM AIK/EK时，将秘密信息写入到vTPM的NVROM(只读)中。
4.MANO向NFVI发起“VNF初始化”命令，即创建VNF命令。
5.NFVI实例化VNF，即创建VNF，该VNF的身份信息和步骤1中的VNF身份信息一致。
6.VNF中的进程，读取vTPM中NVROM的秘密信息。
7.通过所述秘密信息向MANO请求服务，如FTP、SSH、DB等。
图4为本发明实施例提供的秘密信息分发的另一种详细流程图，该实施例中所述秘密信息由MANO从其他VNF(VNF A)获取并由MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent，具体步骤如下：
1.MANO预创建VNF A阶段，向VNF S发起通知消息，包括VNF A身份信息。
VNF S为一种虚拟服务器，可用于向VNF A提供相关服务，这里字母S和A用于区分不同的VNF。
2.如果VNF S需要向VNF A预置秘密信息，在MANO响应信息中插入秘密信息。
3.MANO将需要分配的秘密信息以及VNF身份信息传递给vTPM O&M，然后跳到第5步。
4.如果所述第2和第3步中不传递秘密信息，则VNF S需要直接向vTPM O&M发送秘密信息；否则该步骤不存在。
5.vTPM O&M将信息转发给vTPM O&M agent。
6.vTPM O&M agent为待创建的VNF创建vTPM，在分配vTPM AIK/EK时，将秘密信息写入到vTPM的NVROM(只读)中。
7.MANO向NFVI发起“VNF A初始化”命令。
8.NFVI实例化VNFA，即创建VNF A，该VNF的身份信息和步骤1中的VNF身份信息一致。
8.VNF A读取vTPM中NVROM的秘密信息。
9.VNF A使用所述秘密信息向VNF S请求服务，如FTP、SSH、DB等。
其中，上述各个实施例中的待创建的VNF身份信息或VNF A的身份信息可以携带在秘密信息中发送，也可以独立于秘密信息单独发送，本实施例不作限制。
上述各个实施例中的vTPM O&M，其为集中式或分布式的vTPM管理模块，用于vTPM创建、删除等，可以位于VIM、VNFM、NFVO等位置；所述vTPM O&M agent(代理进程)为分布式或者集中式的vTPM O&M代理进程，用于vTPM创建、删除以及分配vTPM AIK/EK等信息。vTPM O&M agent位于NFVI中，可以理解为I层上的一个TPM代理进程。
上述各个实施例中，仅vTPM获知VNF的秘密信息，秘密信息不出可信环境，保证了秘密信息的机密性和完整性，也防止秘密信息在分发过程中泄露。
上述实施例主要从各个网元之间交互的角度对本发明实施例的方案进行了介绍。可以理解的是，各个网元，例如NFVI和VNF实例为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对NFVI和VNF实例进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本发明实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图5A示出了上述实施例中所涉及的NFVI的一种可能的结构示意图。NFVI 500包括：处理单元502和通信单元503。
处理单元502用于对NFVI 500的动作进行控制管理，例如，处理单元502用于支持NFVI 500执行图2-4所示任一实施例中NFVI的动作或步骤，和/或用于本文所描述的技术的其它过程。通信单元503用于支持NFVI 500与其它网元的通信，例如，与图3中示出的MANO之间的通信。NFVI 500 还可以包括存储单元801，用于存储NFVI 500的程序代码和数据。
其中，通信单元503用于从MANO接收秘密信息；
处理单元502用于创建虚拟可信平台模块vTPM，并将所述秘密信息写入到vTPM中；
所述通信单元503还用于从管理和编排MANO接收虚拟网络功能VNF初始化命令；
所述处理单元502还用于创建所述VNF；
所述通信单元503还用于向创建后的VNF发送秘密信息。
NFVI 500中，处理单元502可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元503可以是通信接口、收发器、收发电路等，其中，通信接口是统称，可以包括一个或多个接口，通信接口还可以指软件或程序之间交互的接口。存储单元501可以是存储器。
当处理单元502为处理器，通信单元503为通信接口，存储单元501为存储器时，本发明实施例所涉及的NFVI可以为图5B所示的NFVI。
参阅图5B所示，该NFVI 510包括：处理器512、通信接口513、存储器511。可选的，NFVI510还可以包括总线514。其中，通信接口513、处理器512以及存储器511可以通过总线514相互连接；总线514可以是外设部件互连标准(Peripheral Component Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。所述总线514可以分为地址总线、数据总线、控制总线等。为便于表示，图5B中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供一种秘密信息分发的系统，具体参考图6，所述系统包括管理和编排MANO和网络功能虚拟化基础设施NFVI，
所述MANO用于向所述NFVI发送秘密信息；
所送NFVI用于接收MANO发送的秘密信息并在NFVI中创建vTPM， 并将所述秘密信息写入到vTPM中；
所送NFVI进一步用于从所送MANO接收虚拟网络功能VNF初始化命令并创建VNF；
所述VNF用于从所述vTPM获取所述秘密信息。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元以及系统的具体工作过程，可以参考前述图2到图4所描述的实施例中NFVI的对应过程，在此不再赘述。
结合本发明实施例公开内容所描述的方法或者算法的步骤可以通过硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于NFVI和VNF实例中。当然，处理器和存储介质也可以作为分立组件存在于NFVI和VNF实例中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (11)

  1. 一种秘密信息分发的方法，其特征在于，所述方法包括：
    网络功能虚拟化基础设施NFVI接收管理和编排MANO发送的秘密信息；
    在所述NFVI中创建vTPM，并将所述秘密信息写入到vTPM中；
    网络功能虚拟化基础设施NFVI从管理和编排MANO接收虚拟网络功能VNF初始化命令并创建VNF；
    所述VNF从所述vTPM获取所述秘密信息。
  2. 根据权利要求1所述的方法，其特征在于，所述秘密信息由MANO分配并由MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent。
  3. 根据权利要求1所述的方法，其特征在于，所述秘密信息由MANO从其他VNF获取并由MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent。
  4. 根据权利要求3所述的方法，其特征在于，MANO向所述其他VNF发起通知消息，所述通知消息包括所述VNF身份信息；
    所述其他VNF在发送给MANO的响应信息中插入秘密信息。
  5. 根据权利要求2到4任一项所述的方法，其特征在于，所述创建vTPM，并将所述秘密信息写入到vTPM中具体包括：
    vTPM O&M agent创建vTPM，并在分配vTPM AIK/EK时，将所述秘密信息写入到vTPM中。
  6. 一种秘密信息分发的系统，所述系统包括管理和编排MANO和网络功能虚拟化基础设施NFVI,其特征在于：
    所述MANO用于向所述NFVI发送秘密信息；
    所送NFVI用于接收MANO发送的秘密信息并在NFVI中创建vTPM，并将所述秘密信息写入到vTPM中；
    所送NFVI进一步用于从所送MANO接收虚拟网络功能VNF初始化命令并创建VNF；
    所述VNF用于从所述vTPM获取所述秘密信息。
  7. 根据权利要求6所述的系统，其特征在于，所述MANO包括vTPM O&M，NFVI包括vTPM O&M Agent，所述秘密信息由MANO分配并由 MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent。
  8. 根据权利要求6所述的系统，其特征在于，所述MANO包括vTPM O&M，NFVI包括vTPM O&M Agent,所述秘密信息由MANO从其他VNF获取并由MANO中的vTPM O&M发送给NFVI中的vTPM O&M agent。
  9. 根据权利要求7或8所述的系统，其特征在于，所述创建vTPM，并将所述秘密信息写入到vTPM中具体包括：vTPM O&M agent创建vTPM，并在分配vTPM AIK/EK时，将所述秘密信息写入到vTPM中。
  10. 一种网络功能虚拟化基础设施NFVI，其特征在于，包括：处理单元和通信单元，
    所述通信单元用于从管理和编排MANO接收秘密信息；
    所述处理单元用于创建虚拟可信平台模块vTPM，并将所述秘密信息写入到vTPM中；
    所述通信单元还用于从MANO接收虚拟网络功能VNF初始化命令；
    所述处理单元还用于创建所述VNF；
    所述通信单元还用于向所述VNF发送秘密信息。
  11. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1-5任意一项所述的方法。
PCT/CN2016/113863 2016-12-30 2016-12-30 一种秘密信息的分发方法和设备 WO2018120182A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP16925261.6A EP3550781B1 (en) 2016-12-30 2016-12-30 Private information distribution method and device
PCT/CN2016/113863 WO2018120182A1 (zh) 2016-12-30 2016-12-30 一种秘密信息的分发方法和设备
CN201680091655.1A CN110115012B (zh) 2016-12-30 2016-12-30 一种秘密信息的分发方法和设备
US16/456,065 US11025594B2 (en) 2016-12-30 2019-06-28 Secret information distribution method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/113863 WO2018120182A1 (zh) 2016-12-30 2016-12-30 一种秘密信息的分发方法和设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/456,065 Continuation US11025594B2 (en) 2016-12-30 2019-06-28 Secret information distribution method and device

Publications (1)

Publication Number Publication Date
WO2018120182A1 true WO2018120182A1 (zh) 2018-07-05

Family

ID=62706732

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/113863 WO2018120182A1 (zh) 2016-12-30 2016-12-30 一种秘密信息的分发方法和设备

Country Status (4)

Country Link
US (1) US11025594B2 (zh)
EP (1) EP3550781B1 (zh)
CN (1) CN110115012B (zh)
WO (1) WO2018120182A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114760048A (zh) * 2020-12-28 2022-07-15 中兴通讯股份有限公司 Vnfm与vnf建立数据安全连接的方法、设备及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102110197A (zh) * 2009-12-25 2011-06-29 中国科学院计算技术研究所 多核处理器的计算环境中实现tmp的方法及其系统
WO2016045082A1 (zh) * 2014-09-26 2016-03-31 华为技术有限公司 一种策略实现方法和装置以及系统
CN105468435A (zh) * 2015-12-25 2016-04-06 赛特斯信息科技股份有限公司 Nfv动态资源分配方法
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5063777B2 (ja) 2008-03-10 2012-10-31 三菱電機株式会社 秘密情報管理装置及び情報処理装置及び秘密情報管理システム
CN105103507B (zh) * 2014-01-28 2018-01-05 华为技术有限公司 网络功能虚拟化的方法及装置
US9652631B2 (en) * 2014-05-05 2017-05-16 Microsoft Technology Licensing, Llc Secure transport of encrypted virtual machines with continuous owner access
KR101942412B1 (ko) 2014-05-08 2019-01-25 후아웨이 테크놀러지 컴퍼니 리미티드 증서 획득 방법 및 장치
CN105634782B (zh) * 2014-11-06 2019-03-01 华为技术有限公司 一种实例化vnf的方法及网元管理设备
US20160134607A1 (en) * 2014-11-07 2016-05-12 Telefonaktiebolaget L M Ericsson (Publ) Method of rsvp authentication with non-directly connected neighbor
US10489178B2 (en) * 2015-04-28 2019-11-26 Altera Corporation Network functions virtualization platforms with function chaining capabilities
CN112948059A (zh) * 2015-05-07 2021-06-11 华为技术有限公司 用于动态管理虚拟网络功能描述符的系统和方法
US9854048B2 (en) * 2015-06-29 2017-12-26 Sprint Communications Company L.P. Network function virtualization (NFV) hardware trust in data communication systems
US9667606B2 (en) * 2015-07-01 2017-05-30 Cyphermatrix, Inc. Systems, methods and computer readable medium to implement secured computational infrastructure for cloud and data center environments

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102110197A (zh) * 2009-12-25 2011-06-29 中国科学院计算技术研究所 多核处理器的计算环境中实现tmp的方法及其系统
WO2016045082A1 (zh) * 2014-09-26 2016-03-31 华为技术有限公司 一种策略实现方法和装置以及系统
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术
CN105468435A (zh) * 2015-12-25 2016-04-06 赛特斯信息科技股份有限公司 Nfv动态资源分配方法

Also Published As

Publication number Publication date
US20190319931A1 (en) 2019-10-17
EP3550781A1 (en) 2019-10-09
EP3550781A4 (en) 2020-01-22
CN110115012B (zh) 2020-12-25
CN110115012A (zh) 2019-08-09
EP3550781B1 (en) 2021-02-17
US11025594B2 (en) 2021-06-01

Similar Documents

Publication Publication Date Title
US10171432B2 (en) Systems to implement security in computer systems
US10380346B2 (en) Technologies for secure bootstrapping of virtual network functions
US11483405B2 (en) Private cloud as a service
US10205719B2 (en) Network function virtualization-based certificate configuration method, apparatus, and system
US11469964B2 (en) Extension resource groups of provider network services
US10356128B1 (en) Tag-based policy architecture
US9935937B1 (en) Implementing network security policies using TPM-based credentials
US20180060572A1 (en) Tracking and Managing Virtual Desktops Using Signed Tokens
US11575672B2 (en) Secure accelerator device pairing for trusted accelerator-to-accelerator communication
US11522847B2 (en) Local mapped accounts in virtual desktops
US12032979B2 (en) Automated host attestation for secure run-time environments
US20170279806A1 (en) Authentication in a Computer System
US10673827B1 (en) Secure access to user data
EP3288235A1 (en) System and apparatus for enforcing a service level agreement (sla) in a cloud environment using digital signatures
US11507408B1 (en) Locked virtual machines for high availability workloads
WO2018120182A1 (zh) 一种秘密信息的分发方法和设备
CN110121857B (zh) 一种凭据分发的方法和设备
WO2018157787A1 (zh) 一种预置账户的密码初始化方法及相关设备
CN109286494B (zh) 一种虚拟网络功能vnf的初始化凭据生成方法及设备
WO2018040095A1 (zh) 一种生成安全凭证的方法和设备
JP7212158B2 (ja) プロバイダネットワークサービス拡張
CN110392033B (zh) 一种密码管理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16925261

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2016925261

Country of ref document: EP

Effective date: 20190704