WO2018157787A1 - 一种预置账户的密码初始化方法及相关设备 - Google Patents

一种预置账户的密码初始化方法及相关设备 Download PDF

Info

Publication number
WO2018157787A1
WO2018157787A1 PCT/CN2018/077408 CN2018077408W WO2018157787A1 WO 2018157787 A1 WO2018157787 A1 WO 2018157787A1 CN 2018077408 W CN2018077408 W CN 2018077408W WO 2018157787 A1 WO2018157787 A1 WO 2018157787A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
account
preset account
docking
parameter
Prior art date
Application number
PCT/CN2018/077408
Other languages
English (en)
French (fr)
Inventor
李常兴
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018157787A1 publication Critical patent/WO2018157787A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Definitions

  • the present invention relates to the field of network technologies, and in particular, to a password initialization method for a preset account and related devices.
  • the traditional telecommunication system is composed of various dedicated hardware devices, and different applications use different hardware devices.
  • the system becomes more and more complex, which brings many challenges, including the development of new services, the operation and maintenance of the system, and resource utilization.
  • IT Information Technology
  • NFV Network Function Virtualization
  • NFV technology can be simply understood as the migration of the functions of the various network elements used in a telecommunications network from the current dedicated hardware platform to a common commercial-off-the-shelf (COTS) server.
  • COTS commercial-off-the-shelf
  • each network element used in the telecommunication network can be transformed into a stand-alone application, which can be flexibly deployed on a unified infrastructure platform built by other devices such as standards-based servers, storage, and switches, and infrastructure hardware through virtualization technology.
  • Device resource pooling and virtualization providing virtual resources to upper-layer applications, enabling application and hardware decoupling, enabling each application to rapidly increase virtual resources to achieve rapid expansion of system capacity, or to rapidly reduce virtual resources to achieve shrinkage systems
  • the purpose of capacity is to greatly enhance the flexibility of the network.
  • the common COTS server is used to form a shared resource pool. The newly developed services do not need to be separately deployed with hardware devices, which greatly shortens the time for new services to go online.
  • the foundation of NFV technology includes cloud computing technology and virtualization technology.
  • Hardware devices such as general-purpose COTS computing/storage/network can be decomposed into multiple virtual resources through virtualization technology for use by various applications in the upper layers.
  • virtualization technology Through the virtualization technology, the decoupling between the application and the hardware is realized, so that the virtual resource supply speed is greatly increased.
  • the cloud computing technology the elastic scalability of the application can be realized, and the virtual resource is matched with the service load, which not only improves the virtual resource. Utilize efficiency and improve system response rate.
  • the network element in the traditional telecommunication network and the software management system (EMS) software package preset the initial passwords of various preset accounts, and disclose the initial password in the product document. Because the initial password is not confidential, for the security of the network, all the initial passwords must be manually modified before being commercialized.
  • the methods for manual modification include: first login to force the password change; password expired to force modification; the system goes online to manually modify all preset passwords; Set third-party authentication and centrally manage password changes on third-party management and control platforms.
  • the virtual network function (VNF)/EMS completely inherits the initial password modification method in the traditional network, which inevitably leads to the inefficiency of the online service, which cannot meet the requirements of automatic deployment, fast online access, and flexible expansion. The goal of network cloudization, and the security of the system is relatively low.
  • the technical problem to be solved by the embodiments of the present invention is that the service uplink efficiency is low and the system security is low, and a password initialization method and related equipment for the preset account are provided, so as to improve the online efficiency and system security of the service.
  • an embodiment of the present invention provides a password initialization method for a preset account, including:
  • the virtual network function management entity first obtains a virtual network function definition file, where the virtual network function definition file includes password initialization information of the preset account and third party authentication support information; and then obtains or generates an initial password according to the initialization information of the preset account, and according to The third-party authentication support information obtains the connection authentication parameter.
  • the initial password and the connection authentication parameter are injected into the created virtual machine.
  • the virtual network function entity or the network element management system initializes the initial password and the docking. Authentication parameters, complete the password setting of the preset account or the connection parameter setting of the third party authentication.
  • the method utilizes the change of the deployment mode in the NFV scenario, and defines the preset account information in the virtual network function definition file, which is automatically generated randomly by the virtualized network function management entity (VNFM) during instantiation or creation of the VNF/EMS.
  • VNFM virtualized network function management entity
  • the virtual network function management entity generates an initial password according to the password initialization information of the preset account; or after generating the account password according to the initialization information of the preset account, acquires the initial password reset by the user, and the VNFM records the above. Initial password and docking authentication parameters.
  • the virtual network function management entity creates a virtual network function entity or a virtual machine of the network element management system, the initial password and the connection authentication parameter are injected.
  • the account password of the operating system preset account or the third party authentication is first set according to the initial password and the docking connection authentication parameter. Docking; then, when installing the application, set the account password of the application preset account or the third-party authentication docking parameter according to the initial password and the docking authentication parameter.
  • the initial password and the connection authentication parameters are injected into the newly added virtual machine.
  • the application is expanded, according to the initial password and the connection authentication parameter, Set the password of the operating system and the application's preset account or the third-party authentication connection parameters.
  • the virtual network function entity or the network element management system reads the initial password and the connection authentication parameter, and completes the password setting of the preset account or the connection parameter setting of the third party authentication, Set the operation permission for querying the initial password of the preset account on the virtual network function management entity.
  • the virtual network function management entity provides an initial password of the preset account to the user or application having the operation authority after setting the operation authority for querying the initial password of the preset account.
  • the password initialization information of the preset account includes the type of the preset account, the name of the preset account, the password complexity rule of the preset account, the account type of the third party authentication, and the account of the third party authentication.
  • the initial password and the docking authentication parameter are read, and the password initial tool is called to reset the initial password, and according to The connection authentication parameter sets the connection parameters of the third-party authentication.
  • This method is applicable to the application that has been integrated and installed in the image package of the virtual machine OS, and the application is directly started after the virtual machine is created.
  • the initial password and the connection authentication parameter are read, and the password initial tool is called to reset the initial password, and according to the connection authentication.
  • the parameter sets the connection parameters of the third-party authentication.
  • the virtual network function management entity generates a password ciphertext for the initial password according to the account type of the operating system; the virtual network function entity or the network element management system reads the password ciphertext when the operating system is first started. , change the password storage field of the operating system's initial password.
  • an embodiment of the present invention provides a password initialization device for a preset account, where the device is configured to implement the method and function performed by the network function virtualization system in the above first aspect, implemented by hardware/software,
  • the hardware/software includes units corresponding to the above functions.
  • an embodiment of the present invention provides a password initialization device for a preset account, including: a processor, a memory, and a communication bus, wherein the communication bus is configured to implement connection communication between the processor and the memory,
  • the processor executes the program stored in the memory for implementing the steps in the password initialization method of a preset account provided by the above first aspect.
  • FIG. 1 is a schematic structural diagram of a network function virtualization system according to an embodiment
  • FIG. 2 is a schematic flowchart of a method for initializing a password of a preset account according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for initializing a password of a preset account according to another embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a password initializing apparatus for a preset account according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a password initialization device for a preset account according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a network function virtualization system according to an embodiment of the present invention.
  • the network function virtualization system 100 includes an NFV Management and Orchestration (NFV, MANO) 101.
  • NFV Infrastructure (NFVI) 130 Multiple Virtual Network Functions (VNF) 108, Multiple Element Management System (EMS) 122, Network Services, VNF, and Infrastructure Description ( Network Service, VNF and Infrastructure Description) 126, and Operation-Support System/Business Support System (OSS/BSS) 124.
  • NFV NFV Management and Orchestration
  • VNF Multiple Virtual Network Functions
  • EMS Multiple Element Management System
  • Network Services VNF
  • Infrastructure Description Network Service, VNF and Infrastructure Description
  • OSS/BSS Operation-Support System/Business Support System
  • the NFV management and orchestration system 101 includes an NFV Orchestrator (NFVO) 102, one or more VNFM (VNF Manager, VNF) 104, and a Virtualized Infrastructure Manager (VIM) 106; NFVI 130 Computing hardware 112, storage hardware 114, network hardware 116, virtualization layer (VY), virtual computing 110, virtual storage 118, and virtual network 120 are included.
  • NFVO NFV Orchestrator
  • VNF Manager VNF Manager
  • VIP Virtualized Infrastructure Manager
  • NFV MANO 101 is used to perform monitoring and management of VNF 108 and NFVI 130.
  • the NFVO 102 may implement network services (such as L2 and L3VPN services) on the NFVI 130, may also perform resource related requests from one or more VNFMs 104, send configuration information to the VNFM 104, and collect status information for the VNF 108.
  • NFVO 102 can communicate with VIM 106 to enable resource allocation and/or reservation and to exchange configuration and status information for virtualized hardware resources.
  • the VNFM 104 can manage one or more VNFs 108 that can perform various management functions such as instantiating, updating, querying, scaling, and/or terminating the VNF 108 and the like.
  • the VIM 106 can perform resource management functions such as managing the allocation of infrastructure resources (eg, adding resources to virtual containers) and operational functions (eg, collecting NFVI failure information). VNFM 104 and VIM 106 can communicate with each other for resource allocation and exchange of configuration and status information for virtualized hardware resources.
  • resource management functions such as managing the allocation of infrastructure resources (eg, adding resources to virtual containers) and operational functions (eg, collecting NFVI failure information).
  • VNFM 104 and VIM 106 can communicate with each other for resource allocation and exchange of configuration and status information for virtualized hardware resources.
  • NFVI 130 includes hardware resources, software resources, or a combination of both to complete the deployment of the virtualized environment.
  • Hardware resources and virtualization layers are used to provide virtualized resources, such as virtual machines and other forms of virtual containers.
  • Hardware resources include computing hardware 112, storage hardware 114, and network hardware 116.
  • computing hardware 112 may be off-the-shelf hardware and/or user-customized hardware for providing processing and computing resources; storage hardware 114 may be storage capacity provided within the network or storage capacity resident on storage hardware 114 itself (located) Resources within the server), computing hardware 112 and storage hardware 114 resources may be grouped together; network hardware 116 may be switches, routers, and/or any other network device configured to have switching functionality, may span multiple domains And may include multiple networks interconnected by one or more transport networks.
  • the virtualization layer in NFVI 130 can abstract hardware resources from the physical layer and decouple VNF 108 to provide virtualized resources to VNF 108.
  • the virtual resource layer includes virtual computing 110, virtual memory 118, and virtual network 120.
  • Virtual computing 110 and virtual storage 118 may be provided to VNF 108 in the form of virtual machines and/or other virtual containers.
  • one or more VNFs 108 can be deployed on a single Virtual Machine.
  • the virtualization layer abstract network hardware 116 forms a virtual network 120, which may include a virtual switch (Virtual Switch) for providing a connection between the virtual machine and other virtual machines.
  • the transport network in network hardware 116 can be virtualized using a centralized control plane and a separate forwarding plane (eg, a software defined network).
  • VNFM 104 can interact with VNF 108 and EMS 122 to manage the lifecycle of the VNF and exchange configuration and status information;
  • VNF 108 can be configured to virtualize at least one network function performed by a physical network device
  • the VNF 108 can be configured to implement the functions of different network elements in the IP Multimedia Subsystem;
  • the EMS 122 manages the management of the at least one VNF 108.
  • FIG. 2 is a method for initializing a password of a preset account according to a first embodiment of the present invention.
  • the method is applicable to a scenario in which an application is automatically installed and then an application is started after the virtual machine is created. But not limited to the following steps:
  • the virtual network function management entity VNFM acquires a software package uploaded by the user.
  • the virtual network function management entity VNFM obtains the user-uploaded virtual network function definition file VNFD, wherein the virtual network function definition file VNFD includes the VNF/EMS resource requirement and the IP address initial information, and in the embodiment of the present invention, the virtual network function The definition file VNFD adds password initialization information of the VNF/EMS preset account, including the type of the preset account (eg, OS, DB, APP), the name of the preset account, and the password of the preset account. At least one of a complexity rule, a third-party authenticated account type, a third-party authenticated account name, and a definition field of a third-party authentication docking required parameter.
  • the virtual network function management entity VNFM loads the virtual network function definition file VNFD, parses the password initialization information of the preset account defined in the virtual network function definition file VNFD, and generates a password that satisfies the password complexity rule.
  • the virtual network function management entity VNFM acquires or generates an initial password according to the initialization information of the preset account, and obtains a docking authentication parameter according to the third-party authentication support information.
  • the initial password may be generated according to the initialization information of the preset account; or after the account password is generated according to the initialization information of the preset account, the initial password reset by the user is obtained.
  • the generated password may be used as the initial password, or the new password may be regenerated as the initial password, or the new password input by the user may be obtained as an initial.
  • the password is set, and the third-party authentication connection parameter is set according to the third-party authentication support information.
  • the virtual network function management entity VNFM records the initial password and the connection authentication parameter.
  • the virtual network function management entity VNFM creates a virtual machine, and injects the initial password and the interface authentication parameter into the created virtual network function entity or the virtual machine of the network element management system.
  • the GHost image is an image file published by the manufacturer. This image file can include the OS and VNF installed APP, or only the OS.
  • the virtual network function management entity VNFM injects the preset account, the initial password, and the docking authentication parameter into the newly added virtual machine when the virtual machine is created.
  • the virtual network function management entity VNFM sets an operation permission for querying the initial password of the preset account, and the operation authority uses VNFD as an authorization object, and sets a preset account password query authority of the VNFD for the VNFM account.
  • the virtual network function management entity VNFM provides the initial password of the preset account to a user or an application having the operation authority.
  • the virtual network function management entity VNFM provides a human-machine interface and a machine interface of the initial password query, and the user or the third-party application can use the authorized account of the VNFM to log in to the VNFM, and obtain the initial password of the VNFD preset account with the query authority. Other operation and maintenance operations for VNFM/EMS.
  • the preset account information is defined in the VNFD by using the change of the deployment mode, and the initial password of the preset account or the third party is automatically generated and set by the VNFM in the process of instantiating the VNF and the EMS.
  • the authentication information avoids the loss of confidentiality caused by the global disclosure of the initial password of the preset account and the ease of use caused by the later modification of the password, thereby improving the automatic operation and maintenance capability after the network is clouded.
  • FIG. 3 is a schematic diagram of a password initialization method for a preset account according to a second embodiment of the present invention.
  • the method is applicable to a scenario in which an application is integrated in an OS image package, and the method includes but is not limited to the following steps:
  • the virtual network function management entity VNFM acquires a software package uploaded by the user.
  • the virtual network function management entity VNFM obtains a virtual network function definition file VNFD uploaded by the user, where the virtual network function definition file VNFD includes resource requirements and IP address initial information of the VNF/EMS.
  • the virtual network function definition file VNFD adds password initialization information of the VNF/EM preset account, including the type of the preset account (eg, OS, DB, APP), and the preset account. At least one of a name, a password complexity rule of the preset account, a third-party authenticated account type, a third-party authenticated account name, and a definition field of a third-party authentication docking required parameter.
  • the virtual network function management entity VNFM loads the virtual network function definition file VNFD, parses the password initialization information of the preset account defined in the virtual network function definition file VNFD, and generates a password that satisfies the password complexity rule.
  • the virtual network function management entity VNFM acquires or generates an initial password according to the initialization information of the preset account, and obtains a docking authentication parameter according to the third-party authentication support information.
  • the embodiment is similar to the S204 in the foregoing embodiment, and details are not described herein again.
  • the virtual network function management entity VNFM creates a virtual machine, and injects the initial password and the interface authentication parameter into the created virtual network function entity or the virtual machine of the network element management system.
  • the virtual network function management entity VNFM sets the preset account according to the initial password and the connection authentication parameter injected by the VNFM when the operating system where the virtual network function entity VNF or the network element management system EMS is located is started for the first time. Account password or third-party authentication docking parameters.
  • the virtual network function entity VNF or the network element management system EMS reads the initial password and the docking authentication parameter when the operating system is started or the application is started, and invokes the password initial tool to reset the An initial password, and a docking parameter for setting a third-party authentication according to the docking authentication parameter.
  • the application and password initialization tool is integrated in the OS image package.
  • the password initialization tool hard-codes all preset accounts and preset password information.
  • the password initialization function of the password initialization tool is first verified. Whether the password in the application is consistent, and the password initialization tool can be used to reset the initial password of the preset account only when the password is consistent; if the hard-coded password in the password initialization tool is inconsistent with the password in the application, the reset is refused. Password to avoid subsequent illegal password resets.
  • the virtual network function management entity VNFM injects the initial password and the docking authentication parameter into the newly added virtual machine when the virtual machine is created.
  • the virtual network function management entity VNFM sets an operation permission for querying the initial password of the preset account.
  • the operation authority uses VNFD as an authorization object, and different preset permission permissions are granted for preset account initial passwords of different VNFDs.
  • the virtual network function management entity VNFM provides the initial password of the preset account to a user or an application that has the operation authority.
  • the virtual network function management entity VNFM provides a human-machine interface and a machine interface of the initial password query, and the user or the third-party application can use the authorized account of the VNFM to log in to the VNFM, and obtain the initial password of the VNFD preset account with the query authority. Other operation and maintenance operations for VNFM/EM.
  • the transmission of the initial password of the account may be securely extended, including: the virtual network function management entity VNFM conforms the initial password generation to the operating system according to the type of the operating system.
  • the password ciphertext is generally a secure hash algorithm; the virtual network function entity VNF or the network element management system EMS reads the password ciphertext when the operating system is first started, and changes the password of the initial password of the operating system account. Store the field.
  • the security management of the OS account may be extended, including: all operating systems of the operating system image package (part of the software package) issued by the equipment vendor Account, all locked.
  • the VNFM firstly generates an initial password to generate a password ciphertext that meets the requirements of the operating system according to the type of the operating system; then, the password ciphertext is injected into the virtual machine.
  • the password ciphertext format in the /etc/shadow file is fixed.
  • VNFM can use the Linux standard password encryption algorithm (such as: secure hash algorithm) to generate password ciphertexts that meet Linux requirements.
  • the operating system When the operating system starts for the first time, it reads the injected password ciphertext and directly updates the password storage field of the account to unlock the account. For example, for Linux, directly modify the /etc/shadow file and set the password ciphertext to the password storage field of the account. .
  • FIG. 4 is a schematic structural diagram of a password initializing device for a preset account according to an embodiment of the present invention.
  • the password initializing device of the preset account may include an information acquiring module 401, an information generating module 402, and an information injection module. 403 and information setting module 404, wherein the detailed description of each module is as follows:
  • the information obtaining module 401 is configured to acquire a virtual network function definition file, where the virtual network function definition file includes password initialization information of the preset account and third party authentication support information.
  • the information generating module 402 is configured to acquire or generate an initial password according to the initialization information of the preset account, and obtain a docking authentication parameter according to the third party authentication support information of the preset account.
  • the information injection module 403 is configured to inject the initial password and the interface authentication parameter into the created virtual network function entity or the virtual machine of the network element management system when the virtual machine is created.
  • the information setting module 404 is configured to read the initial password and the docking authentication parameter during initialization, and complete the password setting of the preset account or the connection parameter setting of the third party authentication.
  • the information generating module 402 is specifically configured to:
  • the initial password reset by the user is obtained.
  • the information setting module 404 is specifically configured to:
  • the account password of the preset account or the third-party authentication connection parameter is set according to the initial password and the docking authentication parameter.
  • the information injection module 403 is specifically configured to: when the virtual machine is created by the expansion, inject the initial password and the interface authentication parameter into the newly added virtual machine;
  • the information setting module 404 is specifically configured to: when the application is expanded, set an account password of the preset account or a third-party authentication connection parameter according to the initial password and the docking authentication parameter.
  • the information setting module 402 is further configured to set an operation permission for querying the initial password of the preset account.
  • the information setting module 402 is further configured to provide the initial password of the preset account to a user or an application that has the operation authority.
  • the password initialization information of the preset account includes a type of the preset account, a name of the preset account, a password complexity rule of the preset account, a third-party authenticated account type, and a third party. At least one of the authenticated account name and a defined field of parameters required for third party authentication docking.
  • the information setting module 404 is specifically configured to:
  • the initial password and the docking authentication parameter are read, and the password initial tool is invoked to reset the initial password, and the third-party authentication docking parameter is set according to the docking authentication parameter.
  • the information setting module 404 is specifically configured to:
  • the information generating module 402 is further configured to generate the password ciphertext according to the account type of the operating system
  • the information setting module 404 is further configured to: when the operating system is first started, read the Password ciphertext, which changes the password storage field of the initial password of the operating system according to the password ciphertext.
  • each module may also perform the method and function performed by the network function virtualization system in the foregoing embodiment, corresponding to the corresponding descriptions of the method embodiments shown in FIG. 2 and FIG. Let me repeat.
  • FIG. 5 is a schematic structural diagram of a password initialization device for a preset account according to the present application.
  • the device can include at least one processor 501, such as a CPU, at least one network interface 502, at least one memory 503, and at least one communication bus 504.
  • the communication bus 504 is used to implement connection communication between these components.
  • the network interface 502 of the device in the embodiment of the present application is used for signaling or data communication with other node devices.
  • the memory 503 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.
  • the memory 503 can also optionally be at least one storage device located remotely from the processor 501.
  • a set of program codes is stored in the memory 503, and the processor 501 executes the program executed by the above-described source mobility management function entity in the memory 503.
  • the processor is configured to invoke the program code and perform the following operations:
  • the virtual network function definition file includes password initialization information of the preset account and third party authentication support information;
  • the initial password and the docking authentication parameter are injected into the created virtual network function entity or the virtual machine of the network element management system;
  • the initialization password and the docking authentication parameter are read during initialization, and the password setting of the preset account or the connection parameter setting of the third party authentication is completed.
  • the processor can also cooperate with the memory and the network interface to perform the operation of the network function virtualization system in the above embodiment of the present invention.
  • the program can be stored in a computer readable storage medium, when the program is executed
  • the flow of the method embodiments as described above may be included.
  • the foregoing storage medium includes various media that can store program codes, such as a ROM or a random access memory RAM, a magnetic disk, or an optical disk.

Abstract

本发明实施例公开了一种预置账户的密码初始化方法及相关设备，包括：虚拟网络功能管理实体获取虚拟网络功能定义文件，虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；虚拟网络功能管理实体根据预置账户的初始化信息获取或生产初始密码，并根据预置账户的第三方认证的支持信息获取对接认证参数；虚拟网络功能管理实体在创建虚拟机时，将初始密码和对接认证参数注入到创建的虚拟机中；虚拟网络功能实体或网元管理系统在初始化时读取注入的初始密码和对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。采用本发明实施例，提高了系统安全性和业务上线的效率。

Description

一种预置账户的密码初始化方法及相关设备
本申请要求于2017年3月3日提交中国专利局、申请号为201710123935.2、发明名称为“一种预置账户的密码初始化方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络技术领域，尤其涉及一种预置账户的密码初始化方法及相关设备。
背景技术
传统的电信系统通过各种专用的硬件设备组成，不同的应用采用不同的硬件设备。随着网络规模的增长，系统越来越复杂，带来了诸多的挑战，包括新增业务的开发上线、系统的运维、资源利用率等。为了应对这些挑战及利用信息技术(Information Technology，IT)业界的虚拟化技术及云计算技术，制定了网络功能虚拟化(Network Function Virtualization，NFV)的需求及技术框架，推动NFV的发展。
NFV技术可以简单地理解为将电信网络中使用的各个网元的功能从目前的专用硬件平台迁移至通用的商用货架产品(COTS，Commercial-off-the-shelf)服务器上。通过NFV技术将电信网络中使用的各个网元转变成为独立的应用，可以灵活部署在基于标准的服务器、存储以及交换机等其他设备构建的统一基础设施平台上，并通过虚拟化技术对基础设施硬件设备资源池化及虚拟化，对上层应用提供虚拟资源，实现应用、硬件解耦，使得每一个应用能够快速增加虚拟资源以实现快速扩展系统容量的目的，或者能够快速减少虚拟资源以实现收缩系统容量的目的，大大提升网络的弹性。采用通用的COTS服务器组成共享的资源池，新开发的业务，不需要单独部署硬件设备，大大缩短新业务上线时间。
NFV技术的基础包含云计算技术和虚拟化技术。通用的COTS计算/存储/网络等硬件设备通过虚拟化技术可以分解为多种虚拟资源，以供上层各种应用使用。通过虚拟化技术，实现应用与硬件之间的解耦，使得虚拟资源供给速度大大增加；通过云计算技术，可以实现应用的弹性伸缩，实现虚拟资源与业务负荷相匹配，不仅提升了虚拟资源的利用效率，而且改善了系统的响应速率。
在现有技术方案中，传统的电信网络中的网元与网络管理系统(Element Management System，EMS)的软件包预置各类预置账户的初始密码，并在产品文档中公开初始密码。由于初始密码不具备机密性，为了网络的安全，所有初始密码在商用前必须手动修改，保证手动修改的方法包括：首次登录强制修改密码；密码过期强制修改；系统上线手工修改所有预置密码；设置第三方认证，在第三方管控平台上集中管理修改密码。在电信网络云化场景下，虚拟网络功能(Virtual Network Function，VNF)/EMS完全继承了传统网络中初始密码修改方式，必然导致业务上线效率不高，无法满足自动部署、快速上线、弹性扩容等网络云化的目标，并且系统的安全性也比较低。
发明内容
本发明实施例所要解决的技术问题在于业务上线效率低且系统安全性低，提供一种预置 账户的密码初始化方法及相关设备，实现提高业务的上线效率和系统安全性。
第一方面，本发明实施例提供了一种预置账户的密码初始化方法，包括：
虚拟网络功能管理实体首先获取虚拟网络功能定义文件，虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；然后根据预置账户的初始化信息获取或生成初始密码，并根据第三方认证的支持信息获取对接认证参数；在创建虚拟机时，将初始密码和对接认证参数注入到创建的虚拟机中；最后虚拟网络功能实体或网元管理系统初始化时读取初始密码和对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。该方法利用NFV场景下部署方式的变化，在虚拟网络功能定义文件中定义预置账户信息，由虚拟化网络功能管理实体(VNFM)在实例化或创建VNF/EMS的过程中，自动随机生成或设置预置账户的初始密码或第三方认证信息，从而避免VNF/EMS预置账户初始密码的公开带来的机密性丧失及后期修改密码导致易用性降低问题，提高了业务运行的效率。
在一种可能的设计中，虚拟网络功能管理实体根据预置账户的密码初始化信息生成初始密码；或在根据预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码，VNFM记录上述初始密码及对接认证参数。在虚拟网络功能管理实体创建虚拟网络功能实体或网元管理系统的虚拟机时，注入所述初始密码及对接认证参数。
在另一种可能的设计中，虚拟网络功能实体或网元管理系统所在的操作系统首次启动时，首先根据初始密码和对接对接认证参数，设置操作系统预置账户的账户密码或第三方认证的对接；然后在对应用进行安装时，根据初始密码和对接认证参数，设置应用预置账户的账户密码或第三方认证的对接参数。
在另一种可能的设计中，在对虚拟机进行扩容处理时，将初始密码和对接认证参数注入到新增的虚拟机中，在对应用进行扩容处理时，根据初始密码和对接认证参数，设置操作系统和应用的预置账户的密码或第三方认证的对接参数。
在另一种可能的设计中，虚拟网络功能管理实体当虚拟网络功能实体或网元管理系统读取初始密码和对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置之后，在虚拟网络功能管理实体上设置查询预置账户的初始密码的操作权限。
在另一种可能的设计中，虚拟网络功能管理实体在设置查询预置账户的初始密码的操作权限之后，向具备操作权限的用户或应用提供预置账户的初始密码。
在另一种可能的设计中，预置账户的密码初始化信息包括预置账户的类型、预置账户的名称、预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
在另一种可能的设计中，当所述虚拟网络功能实体或所述网元管理系统中的应用启动时，读取初始密码和对接认证参数，并调用密码初始工具重新设置初始密码、以及根据对接认证参数设置第三方认证的对接参数，该方法适用于虚拟机OS的镜像包中已经集成安装后的应用、虚拟机创建后应用直接启动的场景。
在另一种可能的设计中，当虚拟网络功能实体或网元管理系统中的应用进行扩容处理时，读取初始密码和对接认证参数，并调用密码初始工具重新设置初始密码、以及根据对接认证参数设置第三方认证的对接参数。
在另一种可能的设计中，虚拟网络功能管理实体根据操作系统的账户类型，针对初始密码生成密码密文；虚拟网络功能实体或网元管理系统在操作系统首次启动时，读取密码密文，更改操作系统的初始密码的密码存储字段。
第二方面，本发明实施例提供了一种预置账户的密码初始化装置，该装置被配置为实现上述第一方面中网络功能虚拟化系统所执行的方法和功能，由硬件/软件实现，其硬件/软件包括与上述功能相应的单元。
第三方面，本发明实施例提供了一种预置账户的密码初始化设备，包括：处理器、存储器和通信总线，其中，所述通信总线用于实现所述处理器和存储器之间连接通信，处理器执行所述存储器中存储的程序用于实现上述第一方面提供的一种预置账户的密码初始化方法中的步骤。
附图说明
为了更清楚地说明本发明实施例或背景技术中的技术方案，下面将对本发明实施例或背景技术中所需要使用的附图进行说明。
图1是实施例提供的一种网络功能虚拟化系统的架构示意图；
图2是本发明实施例提供的一种预置账户的密码初始化方法的流程示意图；
图3是本发明另一实施例提供的一种预置账户的密码初始化方法的流程示意图；
图4是本发明实施例提供的一种预置账户的密码初始化装置的结构示意图；
图5是本发明实施例提供的一种预置账户的密码初始化设备的结构示意图。
具体实施方式
下面结合本发明实施例中的附图对本发明实施例进行描述。
请参见图1，图1是本发明实施例提供的一种网络功能虚拟化系统的架构示意图，该网络功能虚拟化系统100包括一个NFV管理和编排系统(NFV Management and Orchestration,NFV，MANO)101、NFV基础设施层(NFV Infrastructure，NFVI)130、多个虚拟网络功能(Virtual Network Function，VNF)108、多个网元管理(Element Management System，EMS)122、网络服务、VNF和基础设施描述(Network Service,VNF and Infrastructure Description)126，以及业务支持管理系统(Operation-Support System/Business Support System，OSS/BSS)124。其中，NFV管理和编排系统101包括NFV编排器(NFV Orchestrator，NFVO)102、一个或多个VNFM(VNF Manager，VNF)104和虚拟化基础设施管理器(Virtualized Infrastructure Manager，VIM)106；NFVI 130包括计算硬件112、存储硬件114、网络硬件116、虚拟化层(Virtualization Layer，VY)、虚拟计算110、虚拟存储118和虚拟网络120。
其中，NFV MANO 101用于执行对VNF 108和NFVI 130的监视和管理。NFVO 102可以实现在NFVI 130上的网络服务(如L2和L3VPN服务)，也可以执行来自一个或多个VNFM 104的资源相关请求，发送配置信息到VNFM 104，并收集VNF 108的状态信息。另外，NFVO 102可以与VIM 106通信，实现资源的分配和/或预留以及交换虚拟化硬件资源的配置和状态信息。VNFM 104可以管理一个或多个VNF 108，VNFM 104可以执行各种管理功能，如：实例化、更新、查询、缩放和/或终止VNF 108等。VIM 106可以执行资源管理的功能，例如:管理基础设施资源的分配(如：增加资源到虚拟容器)和操作功能(如：收集NFVI故障信息)。VNFM 104和VIM 106可以相互通信进行资源分配和交换虚拟化硬件资源的配置和状态信息。
另外，NFVI 130包括硬件资源、软件资源或两者的组合来完成虚拟化环境的部署。硬件资源和虚拟化层用于提供虚拟化的资源，例如：作为虚拟机和其它形式的虚拟容器。硬件资 源包括计算硬件112、存储硬件114和网络硬件116。其中，计算硬件112可以是现成的硬件和/或用户定制的硬件，用来提供处理和计算资源；存储硬件114可以是网络内提供的存储容量或驻留在存储硬件114本身的存储容量(位于服务器内的本地存储器)，计算硬件112和存储硬件114的资源可以被集中在一起；网络硬件116可以是交换机、路由器和/或配置成具有交换功能的任何其他网络设备，可以横跨多个域，并且可以包括多个由一个或一个以上传输网络互连的网络。
其中，NFVI 130中的虚拟化层可以从物理层抽象硬件资源和解耦VNF 108，以便向VNF 108提供虚拟化资源。虚拟资源层包括虚拟计算110，虚拟存储器118和虚拟网络120。虚拟计算110和虚拟存储118可以以虚拟机和/或其他虚拟容器的形式提供给VNF 108。例如，一个或多个VNF 108可以部署在一个虚拟机(Virtual Machine)上。虚拟化层抽象网络硬件116形成虚拟网络120，虚拟网络120可以包括虚拟交换机(Virtual Switch)，虚拟交换机用于提供虚拟机和其他虚拟机之间的连接。此外，网络硬件116中的传输网络，可以采用集中式控制平面和一个单独的转发平面(如：软件定义网络)虚拟化。
综上所述，VNFM 104可以与VNF 108和EMS 122进行交互实现对VNF的生命周期进行管理以及交换配置和状态信息；VNF 108可以被配置为通过一个物理网络设备执行的至少一个网络功能的虚拟化，例如，VNF 108可以通过配置实现IP多媒体子系统中的不同网元的功能；EMS 122通过配置实现对至少一个VNF 108进行管理。
请参见图2，图2是本发明第一实施例提供的一种预置账户的密码初始化方法，该方法适用于虚拟机创建后、先自动进行应用的安装然后启动应用的场景，该方法包括但不限于如下步骤：
S201,虚拟网络功能管理实体VNFM获取用户上传的软件包。
S202，虚拟网络功能管理实体VNFM获取用户上传的虚拟网络功能定义文件VNFD，其中，虚拟网络功能定义文件VNFD包括VNF/EMS的资源要求和IP地址初始信息，在本发明实施例中，虚拟网络功能定义文件VNFD新增了VNF/EMS预置账户的密码初始化信息，包括所述预置账户的类型(如：OS、DB、APP)、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
S203，虚拟网络功能管理实体VNFM加载虚拟网络功能定义文件VNFD，解析虚拟网络功能定义文件VNFD中定义的预置账户的密码初始化信息，生成满足密码复杂度规则的密码。
S204，虚拟网络功能管理实体VNFM根据所述预置账户的初始化信息获取或生产初始密码，并根据所述第三方认证支持信息获取对接认证参数。
具体实现中，可以根据所述预置账户的初始化信息生成初始密码；或在根据所述预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码。例如，在将上述生成的密码复杂度规则的密码提示给用户查看之后，可以将上述生成的密码作为初始密码，也可以重新生成新的密码作为初始密码，也可以获取用户输入的新密码作为初始密码，并根据所述第三方认证支持信息设置第三方认证的对接参数，最后虚拟网络功能管理实体VNFM记录上述初始密码和对接认证参数。
S205，虚拟网络功能管理实体VNFM创建虚拟机，并将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中。
例如，可以通过GHost镜像文件重新克隆一个OS，在NFV场景下，GHost镜像是厂商发布的镜像文件，这个镜像文件可以包括OS和VNF安装后的APP，也可以只包括OS。
S206，虚拟网络功能实体VNF或网元管理系统EMS所在的操作系统首次启动时，根据VNFM注入的所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
S207，当虚拟网络功能实体VNF或网元管理系统EMS的应用在OS自动后安装时，读取虚拟网络功能管理实体VNFM注入的所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
S208，虚拟网络功能管理实体VNFM在扩容创建所述虚拟机时，将所述预置账户、初始密码以及所述对接认证参数注入到新增的虚拟机中。
S209，当虚拟网络功能实体VNF或网元管理系统EMS中的应用在扩容处理时，读取虚拟网络功能管理实体VNFM注入的所述初始密码和所述对接认证参数，设置扩容后新增的所述预置账户的账户密码或第三方认证的对接参数。
S210，虚拟网络功能管理实体VNFM设置查询所述预置账户的所述初始密码的操作权限，该操作权限以VNFD作为授权对象，针对VNFM账户设置所能管理VNFD的预置账户密码查询权限。
S211，虚拟网络功能管理实体VNFM向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码。
具体实现中，虚拟网络功能管理实体VNFM提供初始密码查询的人机接口和机机接口，用户或第三方应用可以使用VNFM的授权账户登录VNFM，获取有查询权限的VNFD预置账户的初始密码，用于VNFM/EMS的其他运维操作。
在图2所描述的方法中，利用部署方式的变化，在VNFD中定义预置账户信息，由VNFM在实例化VNF及EMS的过程中，自动随机生成并设置预置账户的初始密码或第三方认证信息，避免预置账户初始密码的全球公开带来的机密性丧失及后期修改密码导致的易用性降低问题，提升了网络云化后的自动化运维能力。
请参见图3，图3是本发明第二实施例提供的一种预置账户的密码初始化方法，该方法适用于OS镜像包中集成应用的场景，该方法包括但不限于如下步骤：
S301,虚拟网络功能管理实体VNFM获取用户上传的软件包。
S302，虚拟网络功能管理实体VNFM获取用户上传的虚拟网络功能定义文件VNFD，其中，虚拟网络功能定义文件VNFD包括VNF/EMS的资源要求和IP地址初始信息。在本发明实施例中，虚拟网络功能定义文件VNFD新增VNF/EM预置账户的密码初始化信息，包括所述预置账户的类型(如：OS、DB、APP)、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
S303，虚拟网络功能管理实体VNFM加载虚拟网络功能定义文件VNFD，解析虚拟网络功能定义文件VNFD中定义的预置账户的密码初始化信息，生成满足密码复杂度规则的密码。
S304，虚拟网络功能管理实体VNFM根据所述预置账户的初始化信息获取或生产初始密码，并根据所述第三方认证支持信息获取对接认证参数。具体实施方式与上述实施例的S204类似，本发明实施例的不再赘述。
S305，虚拟网络功能管理实体VNFM创建虚拟机，并将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中。
S306，虚拟网络功能管理实体VNFM当虚拟网络功能实体VNF或网元管理系统EMS所在的操作系统首次启动时，根据VNFM注入的所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
S307，虚拟网络功能实体VNF或网元管理系统EMS在应用上线前的操作系统启动或应用启动时，读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
其中，应用和密码初始化工具集成在OS镜像包中，该密码初始化工具硬编码所有预置账户及的预置密码信息，在密码初始化工具执行时，首先校验该密码初始化工具硬编码的密码与应用中的密码是否一致，只有在确定密码一致时，才可以利用该密码初始化工具重新设置预置账户的初始密码；如果该密码初始化工具中硬编码的密码与应用中的密码不一致，拒绝重置密码，从而避免后续非法的密码重置。
S308，虚拟网络功能管理实体VNFM在扩容创建所述虚拟机时，将所述初始密码和所述对接认证参数注入到新增的所述虚拟机中；
S309，虚拟网络功能实体VNF或网元管理系统EMS中的应用进行扩容处理时，读取VNFM注入的所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
S310，虚拟网络功能管理实体VNFM设置查询所述预置账户的所述初始密码的操作权限，该操作权限以VNFD作为授权对象，针对不同VNFD的预置账户初始密码授予不同的查询权限。
S311，虚拟网络功能管理实体VNFM向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码
具体实现中，虚拟网络功能管理实体VNFM提供初始密码查询的人机接口和机机接口，用户或第三方应用可以使用VNFM的授权账户登录VNFM，获取有查询权限的VNFD预置账户的初始密码，用于VNFM/EM的其他运维操作。
另外，结合上述实施例的预置账户的密码初始化方案，可以对账户初始密码的传输进行安全扩展，包括：虚拟网络功能管理实体VNFM根据操作系统的类型，将所述初始密码生成符合操作系统要求密码密文，一般是安全的散列算法；虚拟网络功能实体VNF或网元管理系统EMS在所述操作系统首次启动时，读取所述密码密文，更改操作系统账户所述初始密码的密码存储字段。
另外，结合上述实施例的预置账户的密码初始化方案，可以对OS账户的安全管理进行扩展，包括：设备商发布的操作系统镜像包(软件包的一部分)中，对预置的所有操作系统账户，全部锁定。VNFM首先根据操作系统的类型，将初始密码直接生成符合操作系统要求的密码密文；然后将该密码密文注入到虚拟机中。例如，对Linux系统，/etc/shadow文件中的密码密文格式是固定的，VNFM可以使用Linux标准的密码加密算法(如：安全散列算法)，生成符合Linux要求的密码密文；最后在操作系统首次启动时，读取注入的密码密文，直接更新账户的密码存储字段，进而解锁账户，例如，对Linux，直接修改/etc/shadow文件，将密码密文设置到账户的密码存储字段。
上述详细阐述了本发明实施例的方法，下面提供了本发明实施例的装置。
请参见图4，图4是本发明实施例提供的一种预置账户的密码初始化装置的结构示意图，该预置账户的密码初始化装置可以包括信息获取模块401、信息生成模块402、信息注入模块403和信息设置模块404，其中，各个模块的详细描述如下：
信息获取模块401，用于获取虚拟网络功能定义文件，所述虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息。
信息生成模块402，用于根据所述预置账户的初始化信息获取或生产初始密码，并根据所述预置账户的第三方认证的支持信息获取对接认证参数。
信息注入模块403，用于在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中。
信息设置模块404，用于在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。
可选的，信息生成模块402具体用于：
根据所述预置账户的初始化信息生成初始密码；或
在根据所述预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码。
可选的，信息设置模块404具体用于：
在操作系统首次启动时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数；
在对应用进行安装时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
可选的，信息注入模块403具体用于：在扩容创建所述虚拟机时，将所述初始密码和所述对接认证参数注入到新增的所述虚拟机中；
信息设置模块404具体用于：在对应用进行扩容处理时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
可选的，信息设置模块402，还用于设置查询所述预置账户的所述初始密码的操作权限。
可选的，信息设置模块402，还用于向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码。
可选的，所述预置账户的密码初始化信息包括所述预置账户的类型、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
可选的，信息设置模块404具体用于：
在应用启动时，读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
可选的，信息设置模块404具体用于：
在对应用进行扩容处理时，读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
可选的，信息生成模块402，还用于根据操作系统的账户类型，将所述初始密码生成密码密文；信息设置模块404，还用于在所述操作系统首次启动时，读取所述密码密文，根据所述密码密文更改操作系统的初始密码的密码存储字段。
需要说明的是，各个模块的实现还可以对应参照图2和图3所示的方法实施例的相应描述，执行上述实施例中网络功能虚拟化系统所执行的方法和功能，本发明实施例不再赘述。
请继续参考图5，图5是本申请提出的一种预置账户的密码初始化设备的结构示意图。如图所示，该设备可以包括：至少一个处理器501，例如CPU，至少一个网络接口502，至少一个存储器503和至少一个通信总线504。其中，通信总线504用于实现这些组件之间的连接通信。其中，本申请实施例中设备的网络接口502用于与其他节点设备进行信令或数据的通信。存储器503可以是高速RAM存储器，也可以是非不稳定的存储器(non-volat i le memory)，例如至少一个磁盘存储器。存储器503可选的还可以是至少一个位于远离前述处理器501的存储装置。存储器503中存储一组程序代码，且处理器501执行存储器503中上述源移动性管理功能实体所执行的程序。
具体的，处理器用于调用所述程序代码，执行以下操作：
获取虚拟网络功能定义文件，所述虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；
根据所述预置账户的初始化信息获取或生产初始密码，并根据所述预置账户的第三方认证的支持信息获取对接认证参数；
在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中；
在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。
进一步的，处理器还可以与存储器和网络接口相配合，执行本发明上述实施例中网络功能虚拟化系统的操作。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储程序代码的介质。

Claims (30)

  1. 一种预置账户的密码初始化方法，所述方法应用于网络功能虚拟化系统，所述网络功能虚拟化系统包括虚拟网络功能实体、网元管理系统以及虚拟网络功能管理实体，其特征在于，所述方法包括：
    所述虚拟网络功能管理实体获取虚拟网络功能定义文件，所述虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；
    所述虚拟网络功能管理实体根据所述预置账户的初始化信息获取或生产初始密码，并根据所述预置账户的第三方认证的支持信息获取对接认证参数；
    所述虚拟网络功能管理实体在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中；
    所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。
  2. 如权利要求1所述的方法，其特征在于，所述虚拟网络功能管理实体根据所述预置账户的初始化信息获取或生成初始密码包括：
    根据所述预置账户的初始化信息生成初始密码；或
    在根据所述预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码。
  3. 如权利要求1所述的方法，其特征在于，所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置包括：
    在操作系统首次启动时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数；
    在对应用进行安装时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  4. 如权利要求3所述的方法，其特征在于，所述虚拟网络功能管理实体在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中包括：
    在扩容创建所述虚拟机时，将所述初始密码和所述对接认证参数注入到新增的所述虚拟机中；
    所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置包括：
    在对应用进行扩容处理时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  5. 如权利要求1所述的方法，其特征在于，所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置之后，还包括：
    所述虚拟网络功能管理实体设置查询所述预置账户的所述初始密码的操作权限。
  6. 如权利要求5所述的方法，其特征在于，所述虚拟网络功能管理实体设置查询所述预置账户的所述初始密码的操作权限之后，还包括：
    所述虚拟网络功能管理实体向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码。
  7. 如权利要求1-6任意一项所述的方法，其特征在于，所述预置账户的密码初始化信息包括所述预置账户的类型、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
  8. 如权利要求1所述的方法，其特征在于，所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置包括：
    当所述虚拟网络功能实体或所述网元管理系统中的应用启动时，读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  9. 如权利要求8所述的方法，其特征在于，所述虚拟网络功能实体或所述网元管理系统在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置包括：
    当所述虚拟网络功能实体或所述网元管理系统中的应用进行扩容处理时，读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  10. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    根据操作系统的账户类型，将所述初始密码生成密码密文；
    在所述操作系统首次启动时，读取所述密码密文，更改所述操作系统的初始密码的密码存储字段。
  11. 一种预置账户的密码初始化装置，其特征在于，包括：
    信息获取模块，用于获取虚拟网络功能定义文件，所述虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；
    信息生成模块，用于根据所述预置账户的初始化信息获取或生产初始密码，并根据所述预置账户的第三方认证的支持信息获取对接认证参数；
    信息注入模块，用于在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中；
    信息设置模块，用于在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。
  12. 如权利要求11所述的装置，其特征在于，所述信息生成模块具体用于：
    根据所述预置账户的初始化信息生成初始密码；或
    在根据所述预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码。
  13. 如权利要求11所述的装置，其特征在于，所述信息设置模块具体用于：
    在操作系统首次启动时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数；
    在对应用进行安装时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  14. 如权利要求13所述的装置，其特征在于，所述信息注入模块具体用于：
    在扩容创建所述虚拟机时，将所述初始密码和所述对接认证参数注入到新增的虚拟机中；
    所述信息设置模块具体用于：
    在对应用进行扩容处理时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  15. 如权利要求11所述的装置，其特征在于，
    所述信息生成模块，还用于设置查询所述预置账户的所述初始密码的操作权限。
  16. 如权利要求15所述的装置，其特征在于，
    所述信息生成模块，还用于向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码。
  17. 如权利要求11-16任意一项所述的装置，其特征在于，所述预置账户的密码初始化信息包括所述预置账户的类型、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
  18. 如权利要求11所述的装置，其特征在于，所述信息设置模块具体用于：
    当应用启动时读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  19. 如权利要求18所述的装置，其特征在于，所述信息设置模块具体用于：
    当应用进行扩容处理时读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  20. 如权利要求11所述的装置，其特征在于，所述装置包括：
    所述信息生成模块，还用于根据操作系统的账户类型，将所述初始密码生成密码密文；
    所述信息设置模块，还用于在所述操作系统首次启动时，读取所述密码密文，根据所述密码密文更改所述操作系统的初始密码的密码存储字段。
  21. 一种预置账户的密码初始化设备，其特征在于，包括：存储器、通信总线以及处理器，其中，所述存储器用于存储程序代码，所述处理器用于调用所述程序代码，执行以下操作：
    获取虚拟网络功能定义文件，所述虚拟网络功能定义文件包括预置账户的密码初始化信息和第三方认证的支持信息；
    根据所述预置账户的初始化信息获取或生产初始密码，并根据所述预置账户的第三方认证的支持信息获取对接认证参数；
    在创建虚拟机时，将所述初始密码和所述对接认证参数注入到创建的所述虚拟网络功能实体或所述网元管理系统的虚拟机中；
    在初始化时读取所述初始密码和所述对接认证参数，完成预置账户的密码设置或第三方认证的对接参数设置。
  22. 如权利要求21的所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    根据所述预置账户的初始化信息生成初始密码；或
    在根据所述预置账户的初始化信息生成账户密码后，获取用户重新设置的初始密码。
  23. 如权利要求21的所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    在操作系统首次启动时，根据所述初始密码和所述对接认证参数，设置所述预置账户的 账户密码或第三方认证的对接参数；
    在对应用进行安装时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  24. 如权利要求23的所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    在扩容创建所述虚拟机时，将所述初始密码和所述对接认证参数注入到新增的所述虚拟机中；
    在对应用进行扩容处理时，根据所述初始密码和所述对接认证参数，设置所述预置账户的账户密码或第三方认证的对接参数。
  25. 如权利要求21的所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    设置查询所述预置账户的所述初始密码的操作权限。
  26. 如权利要求25的所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    向具备所述操作权限的用户或应用提供所述预置账户的所述初始密码。
  27. 如权利要求21-26任意一项所述的设备，其特征在于，所述预置账户的密码初始化信息包括所述预置账户的类型、所述预置账户的名称、所述预置账户的密码复杂度规则、第三方认证的账户类型、第三方认证的账户名称以及第三方认证对接所需参数的定义字段中的至少一种。
  28. 如权利要求21所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    当应用启动时读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  29. 如权利要求28所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    当对应用进行扩容处理时读取所述初始密码和所述对接认证参数，并调用所述密码初始工具重新设置所述初始密码、以及根据所述对接认证参数设置第三方认证的对接参数。
  30. 如权利要求21所述的设备，其特征在于，所述处理器还用于执行如下操作步骤：
    根据操作系统的账户类型，将所述初始密码生成密码密文；
    在所述操作系统首次启动时，读取所述密码密文，更改所述操作系统的初始密码的密码存储字段。
PCT/CN2018/077408 2017-03-03 2018-02-27 一种预置账户的密码初始化方法及相关设备 WO2018157787A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710123935.2A CN108540301B (zh) 2017-03-03 2017-03-03 一种预置账户的密码初始化方法及相关设备
CN201710123935.2 2017-03-03

Publications (1)

Publication Number Publication Date
WO2018157787A1 true WO2018157787A1 (zh) 2018-09-07

Family

ID=63370594

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077408 WO2018157787A1 (zh) 2017-03-03 2018-02-27 一种预置账户的密码初始化方法及相关设备

Country Status (2)

Country Link
CN (1) CN108540301B (zh)
WO (1) WO2018157787A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3906633A4 (en) * 2019-01-02 2022-08-17 Nokia Solutions and Networks Oy METHOD, SYSTEM AND DEVICE FOR UNIFIED SECURITY CONFIGURATION MANAGEMENT
CN110263531B (zh) * 2019-05-31 2023-03-31 创新先进技术有限公司 一种初始化账号的密码处理方法、系统以及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8959510B2 (en) * 2009-03-19 2015-02-17 Red Hat, Inc. Providing a trusted environment for provisioning a virtual machine
CN105589722A (zh) * 2015-12-23 2016-05-18 浪潮集团有限公司 一种基于虚拟机模板的初始化虚拟机用户名密码的方法
CN105991734A (zh) * 2015-02-16 2016-10-05 广东亿迅科技有限公司 一种云平台管理方法及系统
CN106201513A (zh) * 2016-07-08 2016-12-07 深圳前海微众银行股份有限公司 在运维平台中创建服务号的方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101051934A (zh) * 2006-04-05 2007-10-10 大唐移动通信设备有限公司 在网络管理系统中的权限控制方法
US20080244689A1 (en) * 2007-03-30 2008-10-02 Curtis Everett Dalton Extensible Ubiquitous Secure Operating Environment
BR112016026035B1 (pt) * 2014-05-08 2023-04-18 Huawei Technologies Co., Ltd Dispositivo e métodos de aquisição de certificado
CN105530246B (zh) * 2015-12-04 2018-10-09 华为技术有限公司 虚拟机管理的方法、装置和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8959510B2 (en) * 2009-03-19 2015-02-17 Red Hat, Inc. Providing a trusted environment for provisioning a virtual machine
CN105991734A (zh) * 2015-02-16 2016-10-05 广东亿迅科技有限公司 一种云平台管理方法及系统
CN105589722A (zh) * 2015-12-23 2016-05-18 浪潮集团有限公司 一种基于虚拟机模板的初始化虚拟机用户名密码的方法
CN106201513A (zh) * 2016-07-08 2016-12-07 深圳前海微众银行股份有限公司 在运维平台中创建服务号的方法和装置

Also Published As

Publication number Publication date
CN108540301A (zh) 2018-09-14
CN108540301B (zh) 2021-01-12

Similar Documents

Publication Publication Date Title
US11706205B2 (en) Extending single-sign-on to relying parties of federated logon providers
US10609560B2 (en) Using derived credentials for enrollment with enterprise mobile device management services
US11343235B2 (en) Secure device notifications from remote applications
US20220014515A1 (en) Secure Authentication Of A Device Through Attestation By Another Device
US10579363B2 (en) Cloud service automation of common image management
US9619216B2 (en) Modifying an application for managed execution
US9270674B2 (en) Validating the identity of a mobile application for mobile application management
US20180034822A1 (en) Computer network providing secure mobile device enrollment features and related methods
KR20160005112A (ko) 콘텍스트와 모바일 디바이스 로킹
US11522847B2 (en) Local mapped accounts in virtual desktops
US11770454B2 (en) Native application integration for enhanced remote desktop experiences
WO2018157787A1 (zh) 一种预置账户的密码初始化方法及相关设备
AU2019433629B2 (en) Tracking image senders on client devices
US11722461B2 (en) Connecting client devices to anonymous sessions via helpers
WO2019015563A1 (zh) 一种虚拟网络功能vnf的初始化凭据生成方法及设备
WO2018120182A1 (zh) 一种秘密信息的分发方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18760448

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18760448

Country of ref document: EP

Kind code of ref document: A1