WO2018202109A1 - 一种证书请求消息发送方法、接收方法和装置 - Google Patents

一种证书请求消息发送方法、接收方法和装置 Download PDF

Info

Publication number
WO2018202109A1
WO2018202109A1 PCT/CN2018/085528 CN2018085528W WO2018202109A1 WO 2018202109 A1 WO2018202109 A1 WO 2018202109A1 CN 2018085528 W CN2018085528 W CN 2018085528W WO 2018202109 A1 WO2018202109 A1 WO 2018202109A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
request message
vnf
vnf entity
certificate
Prior art date
Application number
PCT/CN2018/085528
Other languages
English (en)
French (fr)
Inventor
门方龙
王宏磊
李方展
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018202109A1 publication Critical patent/WO2018202109A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/34—Signalling channels for network management communication
    • H04L41/342—Signalling channels for network management communication between virtual entities, e.g. orchestrators, SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/34—Signalling channels for network management communication
    • H04L41/344—Out-of-band transfers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity

Definitions

  • the present application relates to the field of wireless communications, and in particular, to a method, a receiving method, and a device for sending a certificate request message.
  • VNF virtual network function
  • a VNF entity includes at least one network function for implementing a particular function in a virtualized environment.
  • PKI public key infrastructure
  • the process of presetting the certificate includes: when producing the software and hardware, the manufacturer builds a unique manufacturer certificate for each network element through its own PKI system, and the manufacturer certificate is bound with the hardware identifier to ensure that The uniqueness of the hardware certificate for the certificate issuance process during production.
  • the NE is applied to the operator's PKI system for a certificate issued by the operator using a certificate management protocol (such as the Certificate Management Protocol (CMP)).
  • CMP Certificate Management Protocol
  • a network element for example, a VNF entity
  • CA Certificate Authority
  • the certificate request message sent by the VNF entity is sent in plaintext because no security mechanism is set, so it is easy to be intercepted and tampered with, so that the CA cannot correctly issue the certificate to the corresponding requester VNF entity.
  • the application provides a method, a receiving method and a device for sending a certificate request message to ensure the security and integrity of the certificate request message transmission.
  • the application provides a method for sending a certificate request message.
  • the method includes the following steps: a virtual network function abbreviated as a VNF entity to obtain a one-time credential and a first credential request message; and then the one-time credential is performed. Parsing the first security key and the first hmac key; processing the first certificate request message by using the first security key and the first hmac key, and generating a second certificate request message, where The second certificate request message includes an identifier for identifying the VNF entity.
  • the method further includes: the VNF entity sending the second certificate request message to the authentication center, so that the authentication center is configured to the VNF entity. The identity is verified.
  • the one-time credentials involved in the method may be random numbers.
  • the first certificate request message may be internally generated by the VNF entity or obtained from other network entities, which is not limited thereto.
  • the VNF entity encrypts the certificate request message by using the security key, which can prevent the message content from being sent in the plaintext, and processing the certificate request message by using the hmac key can prevent the content of the message from being intercepted and tampered, and
  • the identity of the VNF entity is bound to the certificate request message, so that the authentication center can accurately identify the sender VNF entity, which not only realizes the identity verification of the VNF entity that sends the request, but also protects the security and integrity of the request message transmission. Sex.
  • the VNF entity processes, by using the first security key and the first hmac key, the first certificate request message to generate a first
  • the process of the second certificate request message specifically includes: the VNF entity encrypts the first certificate request message by using the first security key, and generates a first request message ciphertext; and then uses the first hmac key pair
  • the first certificate request message is subjected to an HMAC function operation to generate a first hash message verification code, and the first hash message verification code is sent to the authentication center; the VNF entity is combined with the first request message And the first hash message verification code generates the second certificate request message.
  • the HMAC function operation is directly performed on the first certificate request message by using the first hmac key to ensure the security of the original request message content, and the content of the certificate request message encrypted by the first security key is prevented from being falsified.
  • the step of the foregoing method the process for the VNF entity to acquire the one-time credential specifically includes: the VNF entity acquiring management and scheduling the one-time credential forwarded by the MANO entity, Alternatively, the VNF entity acquires the one-time credential sent by the authentication center.
  • each one-time credential can only be applied to one certificate request, so when the certificate authority verifies a certificate request message, the corresponding one-time credential will be invalid, so that one credential can be avoided, or the credential can be avoided. It is used by attackers, resulting in forgery of application certificates and threatening network system security.
  • the method before the VNF entity acquires the one-time credential sent by the authentication center, the method further includes: the VNF entity generates a registration request message. And the registration request message includes an identifier of the VNF entity; and then the registration request message is sent to the authentication center, so that the authentication center generates a one-time credential according to the content of the registration request message.
  • the VNF entity is a VNFA entity
  • the VNFS entity is further included.
  • the process of obtaining the one-time credential by the VNF entity includes: The VNFA entity obtains a one-time credential forwarded by the VNFS entity, where the VNFA entity and the VNFS entity share pre-shared secret information, and the secret information is used to establish security between the VNFA entity and the VNFS entity. Channels, and use this secure channel to communicate, can improve the security of data or information transmission.
  • the process for the VNF entity to send the second certificate request message to the authentication center includes: the VNFA entity sends the second certificate request message to the authentication center by forwarding the VNFS entity.
  • the implementation is applied to a scenario where multiple VNF entities are separated.
  • the VNFS entity is configured to manage and control multiple VNF entities on the front end, and the VNFS entity passes the VNFS entity to the authentication center.
  • the certificate request message is forwarded, and communication between multiple VNF entities or VNFA entities and the MANO entity and the authentication center is implemented.
  • a secure channel is established to send a one-time credential and a certificate request message, thereby ensuring the security of data transmission.
  • the step of the foregoing method the process of the VNF entity acquiring the one-time credential forwarded by the MANO entity specifically includes: between the VNF entity and the MANO entity Establishing a first secure channel, and the VNF entity obtains the one-time credential forwarded by the MANO entity by using the first secure channel.
  • the first secure channel is configured to transmit one-time credentials, and the credential is prevented from being cleared. Send and forward, thus ensuring the security of transferring one-time credentials.
  • the present application provides a method for receiving a certificate request message, which may be applied to an authentication center, and corresponds to a method for sending a certificate request message provided by the first aspect.
  • the method includes the following steps: Obtaining a second certificate request message sent by the VNF entity, where the second certificate request message includes an identity identifier for identifying the VNF entity; the authentication center determines, according to the identity identifier, a one-time credential corresponding to the VNF entity; The identity of the VNF entity is verified according to the one-time credential and the second credential request message.
  • the second certificate request message includes a first hash message verification code; the method in the foregoing method: the authentication center is configured according to the one-time credential and the second The process of verifying the identity of the VNF entity by the certificate request message specifically includes: the authentication center parses the one-time credential to obtain a second security key and a second hmac key; and then using the second security key pair The second certificate request message is decrypted to obtain the content of the second certificate request message; the authentication center uses the second hmac key to perform an HMAC function operation on the content of the second certificate request message, and generates a third a certificate request message; determining that if the third certificate request message is the same as the first hash message verification code, verifying that the VNF entity is legal. Otherwise, the identity is not legal.
  • the method further includes: if the VNF entity is legal, generating a certificate; and the certificate authority issues the certificate to the VNF entity.
  • the method further includes the following steps: the authentication center acquires a registration request message of the VNF entity, where the registration is performed.
  • the request message includes an identity of the VNF entity; the certificate authority generates a one-time credential according to the identity of the VNF entity; the certificate center sends the one-time credential to the VNF entity corresponding to the identity identifier.
  • the process of the sending, by the authentication center, the one-time credential to the VNF entity includes: establishing, by the authentication center, a second secure channel with the MANO entity; The authentication center sends the one-time credential to the VNF entity through the second secure channel to improve the security of transmitting the one-time credential.
  • the process of the registration center acquiring the registration request message of the VNF entity includes: the authentication center acquiring the registration request message of the VNF entity by using the MANO entity.
  • the VNF entity is a VNFA entity
  • the VNFS entity is further included, and the VNFA entity and the VNFS entity share secret information, and the secret information is used.
  • the embodiment further provides a method for sending a registration request message, where the method can be applied to a MANO entity.
  • the method includes the following steps: the MANO entity generates at least one VNF entity after creating at least one VNF entity. Registering a request message; then transmitting a registration request message of the at least one VNF entity to the authentication center, wherein each of the registration request messages includes an identity for identifying a VNF entity.
  • the method further includes: the MANO entity acquiring at least one one-time credential from the authentication center, wherein each of the one-time credential may be according to the registration request The VNF entity identity in the message is generated; the MANO entity sends the at least one one-time credential to the corresponding VNF entity after acquiring the one-time credential.
  • the step of the foregoing method the process for the MANO entity to send the at least one one-time credential to the corresponding VNF entity specifically includes: the MANO entity and the at least one VNF entity Establishing at least one first secure channel between the first security channel; the MANO entity transmitting the at least one one-time credential to the at least one VNF entity through the at least one first secure channel, wherein each first secure channel is for transmitting A one-time credential.
  • the process for the MANO entity to obtain at least one one-time credential from the authentication center specifically includes: establishing at least one second secure channel between the MANO entity and the authentication center; The MANO entity acquires at least one one-time credential sent by the authentication center by using the at least one second secure channel, where each second secure channel is configured to correspondingly send a one-time credential.
  • the embodiment of the present application further provides a certificate request message sending device, where the device is used to execute the module or unit of the method steps in the foregoing various implementation manners of the first aspect, and further, the device includes an acquiring unit, Processing unit, sending unit, etc.
  • the certificate request message transmitting device may be disposed in a VNF entity.
  • the embodiment of the present application further provides a certificate request message receiving device, where the device is used to execute the module or unit of the method steps in the foregoing various implementation manners of the second aspect, and further, the device includes an acquiring unit, Processing unit, sending unit, etc.
  • the certificate request message receiving device may be disposed in a certificate authority.
  • the embodiment of the present application further provides a registration request message sending apparatus, where the apparatus is used to execute a module or a unit of the method steps in the foregoing various implementation manners of the third aspect, and further, the apparatus includes an acquiring unit, Processing unit, sending unit, etc.
  • the registration request message transmitting means may be arranged in the MANO entity.
  • the present application further provides a computer storage medium, where the computer storage medium can store a program, and when the program is executed, the method for transmitting the certificate request message provided by the present application, the part of the receiving method, or All steps.
  • the present application also provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method steps described in the above aspects.
  • the method for sending a certificate request message, the receiving method and the device provided by the embodiment of the present invention, the security key and the hmac key are parsed by a one-time credential, and the certificate request message is encrypted by using the security key, thereby preventing the message content from being plaintext.
  • Sending, processing the certificate request message by using the hmac key can prevent the content of the message from being intercepted and falsified, and by binding the identity of the VNF entity in the certificate request message, the authentication center can accurately identify the sender VNF entity, thereby realizing The authentication center authenticates the VNF entity that sends the request, and protects the security and integrity of the request message transmission.
  • FIG. 1 is a schematic structural diagram of an NFV system according to an embodiment of the present application.
  • FIG. 2 is a flowchart of a method for sending a certificate request message according to an embodiment of the present application
  • FIG. 3 is a flowchart of another method for sending a certificate request message according to an embodiment of the present application
  • FIG. 4 is a flowchart of still another method for sending a certificate request message according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a device for sending a certificate request message according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of a device for receiving a certificate request message according to an embodiment of the present disclosure
  • FIG. 7 is a schematic structural diagram of a device for sending a registration request message according to an embodiment of the present disclosure
  • FIG. 8 is a schematic structural diagram of another NFV system according to an embodiment of the present application.
  • NFV Network Function Virtualization
  • EMS Element Management System
  • NFVI Network Function Virtual Infrastructure
  • CA Certificate Authority
  • the MANO entity includes: NFV Orchestra (NFVO) for interconnecting VNFs in the NFV network; VNF Manager (VNFM) for life on VNF Cycle management; and virtualized infrastructure manager (VIM) for managing virtual infrastructure in the VNF framework, including automatic creation of virtual resources through machine interfaces, creation of VNFs, and network connections required by VNFs.
  • NFVO NFV Orchestra
  • VNFM VNF Manager
  • VNFM virtualized infrastructure manager
  • VNFV virtualized infrastructure manager
  • NFVO NFVO
  • VNFM VIM
  • the VNF entity may be a traditional network element deployed in a virtual environment system, such as a session border controller (SBC), a home subscriber server (HSS), or the like, as a network function entity.
  • SBC session border controller
  • HSS home subscriber server
  • NFV is a collective term for computing, storage, and network resources required for network function virtualization.
  • VIM can manage NFVI through the machine interface.
  • the CA is used to issue credentials that are used to authenticate the identity of the certificate applicant to prove the legality of the VNF entity identity.
  • the credentials include a one-time password (OTP), a token, a certificate, a key, and the like.
  • OTP one-time password
  • the CA may be a standard public key infrastructure (PKI) system, or a small authentication center built by the system itself, for example, only supporting the issuance of digital certificates and updating digital certificates.
  • the CA may be deployed outside the MANO entity, or deployed outside the NFV entity, or may be located on the VNF entity, the MANO entity, or the EMS.
  • the method provided by the embodiments of the present application is used to send a certificate request message to the authentication center to request authentication after the VNF entity obtains the issued certificate from the authentication center after the VNF entity is initialized.
  • the center verifies the identity of the VNF entity and issues the certificate.
  • This embodiment provides a method for sending a certificate request message. Referring to FIG. 1, the method includes the following steps:
  • the MANO entity After the at least one VNF entity is created, the MANO entity generates at least one registration request message or a registration VNF request message, where each of the registration requests includes an identifier for identifying a VNF entity, such as an ID of the VNF entity.
  • Step 101 The MANO entity sends the generated at least one registration request message to the certification center CA.
  • Step 102 The CA receives at least one registration request message from the MANO entity, and generates one-time credentials according to the identity of the VNF entity, for example, generating at least one one-time credential according to each VNF entity ID.
  • the one-time credential may be a One Time Password (OTP), and the OTP is a random number. And each of the one-time credentials corresponds to one VNF entity.
  • OTP One Time Password
  • Step 103 The CA sends the at least one one-time credential to the MANO entity.
  • At least one secure channel such as a second secure channel, is established with the MANO entity before the CA sends the one-time credential, and at least the second secure channel is generated using the second secure channel.
  • a one-time credential is sent to the MANO entity.
  • the manner of establishing the secure channel includes establishing the secure channel by using TLS (Secure Transmission Protocol).
  • Step 104 The MANO entity receives at least one one-time credential sent by the CA, and sends the at least one one-time credential to the corresponding NFV entity.
  • each of the one-time credentials includes an identity of a VNF entity.
  • a secure channel such as a first secure channel, is established between the MANO entity and each VNF entity.
  • the MANO entity sends the one-time credentials to the VNF entity.
  • the MANO entity sends the first-degree credentials to the corresponding VNF entity through the first secure channel.
  • Step 105 A VNF entity receives a corresponding one-time credential sent by the MANO entity, and the VNF entity acquires a first credential request message.
  • the first certificate request message may be internally generated by a VNF entity or obtained from other network entities.
  • the first certificate request message is "I want a certificate.”
  • Step 106 The VNF entity parses the one-time credential to obtain a first security key (key) and a first hmac key.
  • Step 107 The VNF entity processes the first certificate request message by using the first security key and the first hmac key to generate a second certificate request message, where the second certificate request message includes The identity of the VNF entity.
  • the processing manner includes: the VNF entity encrypts the first certificate request message by using the first security key to generate a first request message ciphertext; and the VNF entity uses the first hmac key pair first.
  • the certificate request message is subjected to a HMAC (Hashed Message Authentication Code) function to generate a first hash message verification code or a hmac message verification code.
  • HMAC Hashed Message Authentication Code
  • the first request message ciphertext and the first scatter message are generated.
  • the column message verification code is combined to generate a second certificate request message.
  • the hash function selected by the HMAC function includes but is not limited to the MD5 (Message-Digest Algorithm 5) SHA1 (Secure Hash Algorithm) and the SHA256 algorithm.
  • the HMAC operation is characterized only by The encryption operation can be performed by the key, and the inverse operation, that is, the decryption operation, cannot be performed. Therefore, it can be ensured that the content of the second certificate request message is not decrypted and falsified.
  • the SHA256 algorithm since the SHA256 algorithm has many digits and high security, the SHA256 algorithm can generally be used for encryption operations.
  • the second certificate request message is generated by using the method, and the content of the first certificate request message is encrypted by using the security key, so that the content of the certificate request message is prevented from being sent in the plaintext, and the security of the content of the transmitted message is improved.
  • the HMAC operation is performed on the first certificate request message by using the hmac key to prevent the content of the certificate request message from being tampered with.
  • Another way of processing the second certificate request message is as follows: the VNF entity first encrypts the first certificate request message by using the first security key key, generates a second request message ciphertext, and then uses the first hmac key pair The second request message ciphertext is subjected to an HMAC operation to generate a second certificate request message.
  • Step 108 The VNF entity sends the second certificate request message to the authentication center.
  • step 108 the VNF entity further sends the first hash message verification code and the first request message ciphertext generated in step 107 to the authentication center along with the second certificate request message.
  • Step 109 The CA receives a second certificate request message sent by the VNF entity, where the second certificate request message includes an identifier for identifying the VNF entity, the first request message encryption ciphertext, and the a hash message verification code, the CA determines a one-time credential corresponding to the VNF entity according to the identity identifier, and verifies the identity of the VNF entity according to the one-time credential and the second credential request message.
  • the process of the CA verifying the identity of the VNF entity includes: the CA acquiring the first hash message verification code.
  • the CA parses the one-time credential to obtain a second security key and a second hmac key, and decrypts the second credential request message by using the second security key to obtain the content of the second credential request message;
  • the second hmac key performs an HMAC function operation on the content of the second certificate request message to generate a third certificate request message. Determining whether the third certificate request message is the same as the first hash message verification code. If the same, verifying that the VNF entity is legal; if not, the identity of the VNF entity is invalid.
  • Step 110 If the identity of the VNF entity is verified to be valid, a certificate that needs to be issued is generated, and the certificate is issued to the VNF entity according to the identity of the VNF entity. If the identity of the VNF entity is invalid, the certificate is not issued, and the CA returns the verification result of the certificate request failure to the corresponding VNF entity.
  • the CA After the CA issues a certificate to the VNF entity, the corresponding one-time credentials are invalid.
  • the identity of the CA needs to be verified.
  • the verification process includes: in the foregoing step 108, the second certificate request further includes a challenge random number. If the certificate issued by the CA in step 110 includes the challenge random number, verifying that the identity of the CA is legal; if not including the The random number is challenged, or the challenge random number received by the VNF entity is different from the challenge random number carried in the second request message in step 108, and the CA identity is verified to be invalid.
  • the challenge random number is a challenged random number after being encrypted.
  • the VNF entity receives the certificate and verification result sent by the CA.
  • the method provided in this embodiment by setting a one-time credential, enables the VNF entity to parse the security key and the hmac key according to the one-time credential, and encrypt the certificate request message by using the security key, thereby preventing the message content from being plaintext.
  • Sending, processing the certificate request message by using the hmac key can prevent the content of the message from being intercepted and falsified, and by binding the identity of the VNF entity in the certificate request message, the authentication center can accurately identify the sender VNF entity, thereby realizing
  • the authentication center authenticates the VNF entity that sends the request, and protects the security and integrity of the request message transmission.
  • the process includes: the first VNF entity, the MANO entity, and the CA, wherein the process for the VNF entity to apply for a certificate from the CA includes:
  • the MANO entity first sends a registration request message of the first VNF entity to the CA, where the registration request message includes the identity of the first VNF entity, for example, the identity of the first VNF entity is “Zhang San”.
  • the CA receives the registration request message and generates a one-time credential OTP according to the identity of the first VNF entity ("Zhang San").
  • the one-time credential is a random number.
  • the CA stores the one-time credentials of the first VNF entity and sends it to the first VNF entity through the MANO entity. Moreover, in one embodiment the CA sends a one-time credential to the MANO entity over a secure channel.
  • the VNF entity receives the one-time credentials sent by the MANO entity, assuming DDABE16C82627DEA460FFC1B4A4FE6BFF9673323784A8BFE92E37B1E8D53438F.
  • the random number is parsed to obtain a first encryption key and a hmac key.
  • the VNF entity negotiates with the CA to determine the first encryption key and the hmac key.
  • OTP one-time credentials
  • PBKDF2(OTP) 6F28AEE62D39E8A10827D56AB60DB34383899B76B41AC05982A74C8B0874C366DBCFD07FE2A3EA8D7145986C8D6B05892A5FCC6DCE5CDCE1A03DACCF7144E272.
  • the first 256 bits (6F28AEE62D39E8A10827D56AB60DB34383899B76B41AC05982A74C8B0874C366) of the sequence are negotiated as the first security key, and the 256 bits (DBCFD07FE2A3EA8D7145986C8D6B05892A5FCC6DCE5CDCE1A03DACCF7144E272) following the sequence are used as the hmac key.
  • the VNF entity obtains the first certificate request message, and the content of the first certificate request message is “I want a certificate”, and the VNF entity encrypts the “I want the certificate” by using the first security key to generate the first message ciphertext.
  • the first message ciphertext hides the content of "I want a certificate” to prevent the "I want certificate” content in the first request message from being read in plain text.
  • the VNF entity also uses the hmac key to perform an MD5 operation on the "I want a certificate” to generate a first hash message verification code, which is used to prevent the request message "I want a password" to be stolen and tampered.
  • a second certificate request message is generated in combination with the first message ciphertext and the first hash message verification code. And sending the second certificate request message together with the first hash message verification code to the CA.
  • the CA receives the second certificate request message, and determines the stored one-time credentials according to the VNF entity identity “Zhang San” carried in the second certificate request message.
  • the one-time credentials corresponding to the "Zhang San” are assumed to be DDABE16C82627DEA460FFC1B4A4FE6BFF9673323784A8BFE92E37B1E8D53438F.
  • the one-time credential is parsed to obtain a second security key and a second hmac key.
  • the one-time credential described by the CA is the same as the one-time credential previously generated according to the registration request message, so the parsed second security key is the same as the first security key, and the second hmac key is the same as the first hmac key.
  • the key is also the same.
  • the CA verifies the identity of the VNF entity, including: the CA decrypts the second certificate request message by using the second security key, and obtains the content of the second certificate request message, “I want a certificate”, and uses the second hmac key.
  • the HMAC function operation is performed on the content "I want a certificate” to generate a third request message. Determining whether the third request message is the same as the previously obtained first hash message verification code. If they are the same, it indicates that the identity of the VNF entity is legal; if different, it indicates that the identity is illegal. If the authentication identity is legal, the CA will generate a corresponding certificate and issue the certificate to the corresponding VNF entity.
  • the one-time credentials sent by the CA to the MANO entity and the one-time credentials forwarded by the MANO entity to the VNF entity may be sent through a pre-established secure channel.
  • the one-time credential distribution manner may adopt an HTTPS (Hypertext Transfer Security Protocol) message.
  • the security request key and the hmac key derived by using the one-time credential are used to encrypt the certificate request message, so as to prevent the content of the certificate request message from being sent in plain text, and at the same time, the content of the message is prevented from being tampered, and the message transmission is ensured. Sex and integrity.
  • the certificate request message is bound to the identity of the VNF entity, and the identity authentication is performed when the CA receives.
  • the credentials are not plain text on any channel, and the credentials expire immediately after the application ends.
  • VNF entity that separates functions. That is, since the VNF entity cannot communicate with the MANO entity and the CA, the VNFS entity is added to communicate with the outside and control multiple VNF entities.
  • the VNF entity is divided into a VNFS entity and a VNFA entity. The VNFS entity is used to forward the one-time credentials and forward the certificate request message.
  • the verification of the identity of the VNF entity in this embodiment includes the following steps:
  • Steps 201 to 203 are the same as steps 101 to 103 of the embodiment, and are not described again.
  • Step 2041 After receiving the at least one one-time credential sent by the CA, the MANO entity sends the one-time credential to the VNFS entity.
  • the MANO entity sends at least one one-time credential to the VNFS entity via a pre-established first secure channel.
  • Step 2042 After receiving the one-time credentials, the VNFS entity sends the one-time credentials to each corresponding VNFA entity.
  • each VNFA entity and the VNFS entity share secret information, which can be implemented by preset.
  • the secret information is used to establish a secure channel between each VNFA entity and the VNFS entity, and use these secure channels to send one-time credentials to ensure the security of the transmitted data.
  • the shared secret information may be used to encrypt a one-time credential, may be used to negotiate a session key, or directly used as a PSK (Pre-Shared Key).
  • the manner of sharing secret information between the VNFA entity and the VNFS entity is not limited, and may include multiple manners, for example, preset in a software package, or by out-of-band (out-of-band). Such as U disk, external input, etc.
  • the PSK can be pre-configured to the two ends to be communicated (the VNFA entity and the VNFS entity), and the two ends can ensure mutual trust through the key when mutually authenticating.
  • the pre-shared key may be a symmetric key (ie, the keys held by the two parties are the same), or may be an asymmetric key (the keys held by the two parties are different), such as a public-private key pair.
  • the specific configuration and process of using PSK can be implemented according to existing standard protocols.
  • Step 205 The VNFA entity receives the one-time credential sent by the VNFS entity.
  • Steps 205 to 207 are the same as steps 105 to 107 in the first embodiment. For details, refer to the first embodiment, and details are not described herein again.
  • Step 2081 The VNFA entity sends the second certificate request message in the foregoing Embodiment 1 to the VNFS entity.
  • Step 2082 The VNFS entity receives the second certificate request message sent by the VNFA entity, and forwards the second certificate request message to the CA.
  • the VNFS entity may send the at least one second certificate request message to the CA through a pre-established secure channel.
  • the secure channel can be established based on shared secret information.
  • Step 209 After receiving the second certificate request message sent by the VNFS entity, the CA verifies the identity of the VNFA entity according to the second certificate request message. Further, the verification process is the same as step 109 in the foregoing embodiment, and details are not described herein again.
  • Step 2101 If the identity of the VNFA entity is verified, the CA sends the generated certificate to the VNFS entity.
  • Step 2102 The VNFS entity receives the certificate sent by the CA and the verification result, and sends the certificate to the corresponding VNFA entity according to the identity of each VNFA entity.
  • the functions of the VNF entity are separated, that is, divided into multiple VNFA entities at the front end and VNFS entities at the back end.
  • the backend VNFS entity is configured to communicate with external network elements, such as receiving and forwarding data, and managing multiple VNFA entities, thereby implementing a VNFA entity and an external MANO entity in a separate network element architecture.
  • the CA communicates.
  • the shared secret information between the VNFA entity and the VNFS entity is preset, and a channel with identity authentication and encryption protection is established.
  • the software package may be pre- The same white box algorithm is used for encryption, thereby ensuring the security and integrity of the one-time credential and the second certificate request message forwarding, and avoiding the one-time credential and the certificate request message being sent in plaintext.
  • the present embodiment is applied to a VNF entity that directly obtains a certificate from a CA.
  • the technical scenario is similar to deploying a CA on a VNFS entity with a separate function.
  • the VNFA entity can directly initiate a certificate request to a V-enabled VAPI entity.
  • the CA on the VNFS entity obtains the certificate.
  • the certificate request message provided in this embodiment includes the following steps:
  • Step 401 The VNF entity generates a registration request message, and sends the registration request message to the CA.
  • Step 402 The CA receives the registration request message, and generates a one-time credential according to the VNF entity identity in the registration request message.
  • Step 403 The CA sends the one-time credential to the VNF entity through a secure channel.
  • the VNF entity and the CA can establish a secure channel by using the shared secret information, and use the secure channel to send one-time credentials, thereby ensuring mutual trust of the VNF entity and the CA and security of credential forwarding, and sharing secrets.
  • Can be used for encryption can be used to negotiate session keys, or used directly as PSK.
  • secret information can be shared in the software package and encrypted using the same white box algorithm.
  • Steps 404 to 406 are the same as steps 105 to 107 in the first embodiment, and are not described again.
  • Step 407 The VNF entity sends the generated second certificate request message to the CA.
  • Step 408 The CA receives the second certificate request message and verifies the identity of the VNF entity.
  • the CA receives the second certificate request message and verifies the identity of the VNF entity.
  • For the specific verification process refer to step 109 in the first embodiment, and details are not described herein.
  • Step 409 The CA generates a certificate according to the verification result, and issues the certificate to the legal VNF entity.
  • the encrypted secure channel is established by presetting the shared secret information, thereby ensuring secure transmission of the certificate request message and the one-time credential.
  • the initial certificate request message is processed by the security key and the hmac key in the one-time credential, and the generated second certificate request message avoids the sent information (one-time credential and the request message) appearing in any channel.
  • the security and integrity of the message transmission is further improved by performing HMAC function operations to prevent the content of the request message from being tampered with.
  • the one-time credential expires immediately after the certificate is issued, avoiding the one-time credential being used twice, further improving the security of the communication.
  • the CA may be a standard PKI or a single-function CA (including only issuing digital certificates, updating, etc.), wherein the CA may be deployed on the MANO entity, the VNFS entity, and the EMS.
  • Credentials include and are not only used for certificate requests, but also for session keys, negotiation PSK, etc.
  • the present application further provides a certificate request sending apparatus, which is applicable to a VNF entity.
  • the apparatus includes: an obtaining unit 501, a processing unit 502, and a transmitting unit 503.
  • the obtaining unit 501 is configured to acquire a one-time credential and a first credential request message.
  • the processing unit 502 is configured to parse the one-time credential to obtain a first security key and a first hmac key; and use the first security key and the first hmac key to perform the first credential request message
  • the process generates a second certificate request message, where the second certificate request message includes an identity for identifying the VNF entity.
  • the sending unit 503 is configured to send the second certificate request message to the authentication center, so that the authentication center verifies the identity of the VNF entity.
  • the processing unit 502 is specifically configured to: use the first security key to perform encryption processing on the first certificate request message to generate a first request message ciphertext; and use the first hmac key The key performs an HMAC function operation on the first certificate request message to generate a first hash message verification code, and generates the second certificate request message by combining the first request message ciphertext and the first hash message verification code.
  • the obtaining unit 501 is further configured to acquire the one-time credential forwarded by the MANO entity, or obtain the one-time credential sent by the authentication center.
  • the processing unit 502 is further configured to generate a registration request message, where the registration request message includes an identity of the VNF entity.
  • the sending unit 503 is further configured to send the registration request message to the authentication center.
  • the device further includes a VNFS entity
  • the obtaining unit 501 is further configured to obtain the one-time credential forwarded by the VNFS entity, where the device shares a secret with the VNFS entity.
  • Information, the secret information is used to establish a secure channel between the device and the VNFS entity.
  • the sending unit 503 is further configured to send the second certificate request message to the authentication center by using the VNFS entity.
  • the processing unit 502 is further configured to establish a first secure channel with the MANO entity.
  • the obtaining unit 501 is further configured to acquire, by using the first secure channel, the one-time credential forwarded by the MANO entity.
  • the embodiment further provides a certificate request message receiving device, which can be applied to an authentication center, and the device includes: an obtaining unit 601, a processing unit 602, and a sending unit 603.
  • the obtaining unit 601 is configured to obtain a second certificate request message sent by the VNF entity, where the second certificate request message includes an identity identifier for identifying the VNF entity.
  • the processing unit 602 is configured to determine, according to the identity identifier, a one-time credential corresponding to the VNF entity, and verify the identity of the VNF entity according to the one-time credential and the second credential request message.
  • the second certificate request message includes a first hash message verification code.
  • the processing unit 602 is further configured to parse the one-time credential to obtain a second security key and a second hmac key, and decrypt the second credential request message by using the second security key to obtain the second credential request
  • the content of the message performing an HMAC function operation on the content of the second certificate request message by using the second hmac key to generate a third certificate request message; and detecting if the third certificate request message and the first hash message If the verification code is the same, the identity of the VNF entity is verified to be legal; otherwise, the identity is invalid and the authentication fails.
  • the apparatus may further include a transmitting unit 603.
  • the processing unit 602 is further configured to generate a certificate if the VNF entity is verified to be legal.
  • the sending unit 603 is configured to issue the certificate to the VNF entity.
  • the obtaining unit 601 is further configured to acquire a registration request message of the VNF entity, where the registration request message includes an identity of the VNF entity.
  • the processing unit 602 is further configured to generate a one-time credential according to the identity of the VNF entity.
  • the sending unit 603 is configured to send the one-time credential to the VNF entity corresponding to the identity identifier.
  • processing unit 602 is further configured to establish a second secure channel with the MANO entity
  • the sending unit 603 is configured to send the one-time credential to the VNF entity by using the second secure channel.
  • the obtaining unit 601 is further configured to acquire a registration request message of the VNF entity by using a MANO entity.
  • the acquiring unit 601 is further configured to obtain the second certificate request message that is forwarded by the VNFS entity by using a secure channel, where the security channel is based on the shared secret information of the VNF entity and the VNFS entity. Established channel.
  • the embodiment further provides a registration request message device, which can be applied to a MANO entity, and the device includes: an obtaining unit 701, a processing unit 702, and a sending unit 703.
  • the processing unit 702 is configured to generate a registration request message of the at least one VNF entity after the at least one VNF entity is created.
  • the sending unit 703 is configured to send a registration request message of the at least one VNF entity to the authentication center, where each of the authentication requests includes an identity identifier for identifying a VNF entity.
  • the obtaining unit 701 is configured to acquire at least one one-time credential from the authentication center, where each of the one-time credentials is generated according to a VNF entity identity identifier in the registration request message. .
  • the sending unit 703 is further configured to send the at least one one-time credential to the corresponding VNF entity.
  • processing unit 702 is further configured to establish at least one first secure channel with the at least one VNF entity.
  • the sending unit 703 is further configured to send the at least one one-time credential to the at least one VNF entity by using the at least one first secure channel.
  • the processing unit 702 is further configured to establish at least one second secure channel with the authentication center;
  • the obtaining unit 701 is further configured to acquire, by using the at least one second secure channel, at least one one-time credential sent by the authentication center.
  • the first security key and the first hmac key are generated by using the one-time credential operation, and the certificate request message sending apparatus encrypts the certificate request message by using the first security key, thereby preventing the message content from being sent in the plaintext.
  • the first hmac key processing certificate request message can prevent the content of the message from being intercepted and tampered, and the authentication center can accurately identify the sender VNF entity by binding the identity of the VNF entity in the certificate request message.
  • the authentication center authenticates the VNF entity that sends the request, and protects the security and integrity of the request message transmission.
  • each one-time credential can only be applied to a certificate request.
  • the corresponding one-time credential will be invalidated, thereby avoiding one credential being used multiple times, or the credential being exploited by the attacker. Forging a certificate of application threatens the security of the network system.
  • the use of secure channels to transfer one-time credentials prevents one-time credentials from being sent in clear text, further enhancing the security of data transmission.
  • the present application further provides a MANO entity, which is used to implement the registration request message sending method in the foregoing embodiment.
  • the MANO entity 80 may be composed of a transceiver 801, a processor 802, a memory 803, and the like.
  • the processor 802 is a control center of the MANO entity, which connects various parts of the entire network device using various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and calling data stored in the memory, Perform various functions and/or process data of the network side device.
  • the processor 802 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 803 may include a volatile memory such as a random access memory (RAM), and may also include a non-volatile memory such as a flash memory.
  • RAM random access memory
  • non-volatile memory such as a flash memory.
  • a hard disk drive (HDD) or a solid state drive (SSD); the memory may also include a combination of the above types of memories.
  • the transceiver 801 can be configured to receive or transmit data, and the transceiver can transmit data to various nodes or other devices in the video network system under the control of the processor, and receive each node or under the control of the processor. Data sent by other devices.
  • the transceiver 801 can be used to implement the functions of sending a registration request message and forwarding a one-time credential to a VNF entity in the foregoing embodiments.
  • the functions to be implemented by the acquisition unit 701 in FIG. 7 of the foregoing apparatus embodiment may be implemented by the transceiver 801 of the MANO entity or by the processor 802 controlling the transceiver 801.
  • the functions to be implemented by the processing unit 702 in FIG. 7 can also be implemented by the processor 802 of the MANO entity.
  • the NFV system provided in this embodiment further includes at least one VNF entity, which is used to implement the certificate request message sending method in the foregoing embodiments.
  • the VNF entity 90 can be composed of a transceiver 901, a processor 902, a memory 903, and the like.
  • the processor 902 is a control center of the VNF entity that connects various parts of the entire VNF entity with various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and recalling data stored in the memory, Perform various functions and/or process data of the network side device.
  • the processor may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 903 may include a volatile memory such as a random access memory (RAM), and may also include a non-volatile memory such as a flash memory.
  • RAM random access memory
  • non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid state drive
  • a program or code may be stored in the memory, and the processor in the network element may implement the function of the network element by executing the program or code.
  • the transceiver 901 can be used to receive or transmit data, the transceiver 901 can transmit data to a certificate authority or other network side device under the control of the processor 902; or the transceiver 901 can receive the MANO entity under the control of the processor 902. Data sent by a certificate authority or other network side device.
  • the transceiver 901 can be used to implement the steps of the certificate request message sending method in FIG. 2 to FIG. 4 of the foregoing embodiment, and the functions of FIG. 5 of the device embodiment.
  • the function to be implemented by the obtaining unit 501 described in FIG. 5 may be implemented by the transceiver 901 of the VNF entity or by the transceiver 901 controlled by the processor 902.
  • the function to be implemented by the sending unit 503 may also be performed by the VNF entity.
  • the transceiver 901 is implemented or may also be implemented by the transceiver 901 controlled by the processor 902; the functions to be implemented by the processing unit 502 may be implemented by the processor 902.
  • the MANO entity described in this embodiment may be a VNF entity or integrate the functions of the MANO entity into the VNF entity.
  • the VNF entity may also be split into a VNFS entity and at least one VNFA entity for forwarding messages and data to implement communication between the separated VNFA entity and the MANO entity and the authentication center.
  • the authentication center is used to implement the certificate request message receiving method in the foregoing embodiments.
  • the authentication center 100 may be composed of a transceiver 1001, a processor 1002, a memory 1003, and the like.
  • the processor 1002 is a control center of the authentication center, and connects various parts of the entire authentication center by using various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and calling data stored in the memory, Perform the issuance of one-time credentials and verify the identity of the VNF entity.
  • the authentication center may be arranged in a server or other network side device.
  • the transceiver 1001 may be used to implement the steps of the certificate request message receiving method in the foregoing embodiments of FIG. 2 to FIG. 4, and the functions of the device embodiment in FIG. 6.
  • the function to be implemented by the obtaining unit 601 of FIG. 6 may be implemented by the transceiver 1001 of the authentication center or by the transceiver 1001 controlled by the processor 1002.
  • the function to be implemented by the sending unit 603 may also be performed by the authentication center.
  • the transceiver 1001 is implemented or can also be implemented by the transceiver 1001 controlled by the processor 1002; the functions to be implemented by the processing unit 602 can be implemented by the processor 1002.
  • the application further provides a computer storage medium, wherein the computer storage medium may store a program, where the program may include a certificate request message sending method, a receiving method, and a registration request message sending method provided by the application. Some or all of the steps in the various embodiments.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
  • the present application also provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method steps described in the various embodiments above.
  • the technology in the embodiments of the present application can be implemented by means of software plus a necessary general hardware platform.
  • the technical solution in the embodiments of the present application may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium such as a ROM/RAM. , a diskette, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开一种证书请求消息发送方法、接收方法和装置，所述方法包括：虚拟网络功能VNF实体获取一次性凭据和第一证书请求消息；解析所述一次性凭据得到第一安全密钥和第一hmac密钥；利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；将所述第二证书请求消息发送给认证中心，以便于所述认证中心对所述VNF实体的身份进行验证。本方法中利用安全密钥和hmac密钥对证书请求消息进行加密处理，既实现了对发送请求的VNF实体的身份验证，又保护了请求消息传输的安全性和完整性。

Description

一种证书请求消息发送方法、接收方法和装置
本申请要求于2017年5月4日提交中国专利局、申请号为201710307250.3、发明名称为“一种证书请求消息发送方法、接收方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信领域，尤其涉及一种证书请求消息发送方法、接收方法和装置。
背景技术
在网络功能虚拟化(Network Function Virtualization，NFV)系统中，包括至少一个虚拟网络功能(Virtual Network Function，VNF)实体，简称VNF实体。每个VNF实体包括至少一种网络功能，用于实现虚拟化环境中的特定功能。在VNF实体与其他网元实体前，需要在VNF实体上安装证书，以保证数据传输的安全性。一般的，可以通过直接由公共密钥基础设施(Public key infrastructure，PKI)生成证书文件和私钥，然后再将该证书文件和私钥通过拷贝方式下发给各个VNF实体，以供VNF实体安装和使用。
具体地，预置证书的过程包括：在生产软硬件时，生产商通过自己的PKI系统，为每个网元内置一个唯一的生产商证书，此生产商证书与硬件标识绑定，以保证在生产过程中的证书颁发过程硬件证书唯一性。网元上线获取初始配置后，使用证书管理协议(例如证书管理协议(Certificate Management Protocol,CMP))协议向运营商的PKI系统申请运营商颁发的证书。在申请证书过程中，网元(例如VNF实体)需要向认证中心(Certificate Authority，CA)发送请求消息，以请求CA签发证书。
但是，目前VNF实体发送的证书请求消息由于没有设置安全机制，都是明文发送，因此容易被截获和篡改，导致CA不能将证书正确地签发给对应的请求方VNF实体。
发明内容
本申请提供了一种证书请求消息发送方法、接收方法和装置，以保证证书请求消息传输的安全性和完整性。
第一方面，本申请提供了一种证书请求消息发送方法，具体地，所述方法包括如下步骤：虚拟网络功能简称VNF实体获取一次性凭据和第一证书请求消息；然后对该一次性凭据进行解析得到第一安全密钥和第一hmac密钥；再利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理并生成第二证书请求消息，其中，所述第二证书请 求消息中包括用于识别该VNF实体的身份标识；该方法还包括：VNF实体将所述第二证书请求消息发送给认证中心，以便于所述认证中心对该VNF实体的身份进行验证。其中，本方法中涉及的一次性凭据可以为随机数。所述第一证书请求消息可以由VNF实体内部生成或者从其它网络实体中获取，对此不予限制。
采用本方面提供的方法，VNF实体利用安全密钥对证书请求消息进行加密处理，能够防止消息内容被明文发送，利用hmac密钥处理证书请求消息能够防止消息的内容被截获和篡改，并且通过在证书请求消息中绑定VNF实体的身份标识，使得认证中心能够准确地辨认发送方VNF实体，既实现了认证中心对发送请求的VNF实体的身份验证，又保护了请求消息传输的安全性和完整性。
结合第一方面，在一种实现方式中，上述方法中的步骤：所述VNF实体利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息的过程具体包括：VNF实体利用所述第一安全密钥对所述第一证书请求消息做加密处理，并生成第一请求消息密文；然后利用所述第一hmac密钥对所述第一证书请求消息做HMAC函数运算生成第一散列消息验证码，并将所述第一散列消息验证码发送给所述认证中心；所述VNF实体结合所述第一请求消息密文和所述第一散列消息验证码生成所述第二证书请求消息。本方面利用第一hmac密钥直接对第一证书请求消息做HMAC函数运算能够保证原始请求消息内容的安全性，防止先经过第一安全密钥加密后的证书请求消息的内容发生篡改。
结合第一方面，在一种实现方式中，上述方法中的步骤：所述VNF实体获取一次性凭据的过程具体包括：所述VNF实体获取管理和编排简称MANO实体转发的所述一次性凭据，或者，所述VNF实体获取所述认证中心发送的所述一次性凭据。
其中，每个一次性凭据只能应用于一次证书请求，因此当认证中心对一个证书请求消息进行验证之后，该对应的一次性凭据就会失效，从而能够避免一个凭据被多次使用，或者凭据被攻击者利用，导致伪造申请证书，威胁网络系统安全。
结合第一方面，在一种实现方式中，上述方法中的步骤：所述VNF实体获取所述认证中心发送的所述一次性凭据之前，所述方法还包括：所述VNF实体生成注册请求消息，所述注册请求消息中包括所述VNF实体的身份标识；然后向所述认证中心发送该注册请求消息，以使认证中心根据所述注册请求消息的内容生成一次性凭据。
结合第一方面，在一种实现方式中，如果所述VNF实体为VNFA实体，那么还包括VNFS实体，进一步地，在上述方法中的步骤：所述VNF实体获取一次性凭据的过程包括：所述VNFA实体获取VNFS实体转发的一次性凭据，其中，所述VNFA实体与所述VNFS实体之间预先共享有秘密信息，该秘密信息用于建立所述VNFA实体与所述VNFS实体之间的安全通道，并利用该安全通道进行通信，可以提高传输数据或信息的安全性。具体地，所述VNF实体将所述第二证书请求消息发送给认证中心的过程具体包括：VNFA实体通过VNFS实体 转发将所述第二证书请求消息发送给认证中心。
本实现方式应用于分离的多个VNF实体的场景，当多个VNF实体与外部网元进行数据交互时，设置VNFS实体对前端的多个VNF实体进行管理和控制，并通过VNFS实体向认证中心转发证书请求消息，实现了多个VNF实体或VNFA实体与MANO实体和认证中心的通信。此外，通过VNF实体与VNFS实体之间的共享秘密信息，建立安全通道以发送一次性凭据和证书请求消息，进而保证数据传输的安全性。
结合第一方面，在一种实现方式中，上述方法中的步骤：所述VNF实体获取所述MANO实体转发的所述一次性凭据的过程具体包括：所述VNF实体与所述MANO实体之间建立第一安全通道,所述VNF实体通过该第一安全通道获取所述MANO实体转发的所述一次性凭据，本实现方式中由于建立了第一安全通道传输一次性凭据，避免了凭据被明文发送和转发，从而保证了传输一次性凭据的安全性。
第二方面，本申请提供了一种证书请求消息接收方法，该方法可以应用于认证中心，与第一方面提供的证书请求消息发送方法相对应，具体地，该接收方法包括如下步骤：认证中心获取VNF实体发送的第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；认证中心根据所述身份标识确定所述VNF实体对应的一次性凭据；以及根据该一次性凭据和第二证书请求消息对所述VNF实体的身份进行验证。
结合第二方面，在一种实现方式中，所述第二证书请求消息中包括第一散列消息验证码；上述方法中的步骤：所述认证中心根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证的过程具体包括：认证中心解析所述一次性凭据得到第二安全密钥和第二hmac密钥；然后利用所述第二安全密钥对所述第二证书请求消息解密得到所述第二证书请求消息的内容；所述认证中心再利用所述该第二hmac密钥对所述第二证书请求消息的内容做HMAC函数运算，并生成第三证书请求消息；判断如果所述第三证书请求消息与第一散列消息验证码相同，则验证所述VNF实体身份合法。；否则，身份不合法。
结合第二方面，在一种实现方式中，所述方法还包括：如果所述VNF实体身份合法，则生成证书；认证中心将所述证书签发给所述VNF实体。
结合第二方面，在一种实现方式中，在认证中心获取VNF实体发送的第二证书请求消息之前，所述方法还包括如下步骤：认证中心获取所述VNF实体的注册请求消息，所述注册请求消息中包括VNF实体的身份标识；所述认证中心根据所述VNF实体的身份标识生成一次性凭据；所述认证中心将所述一次性凭据发送给与所述身份标识对应的VNF实体。
结合第二方面，在一种实现方式中，上述方法中的步骤：所述认证中心将所述一次性凭据发送给所述VNF实体的过程具体包括：认证中心与MANO实体建立第二安全通道；所述认证中心通过所述第二安全通道将所述一次性凭据发送给所述VNF实体，以提高传输一次性凭据的安全性。
结合第二方面，在一种实现方式中，所述认证中心获取所述VNF实体的注册请求消息的过程具体包括：认证中心通过MANO实体获取所述VNF实体的注册请求消息。
结合第二方面，在一种实现方式中，如果所述VNF实体为VNFA实体，则还包括VNFS实体，并且，所述VNFA实体与所述VNFS实体之间共享有秘密信息，所述秘密信息用于建立所述VNFA实体与所述VNFS实体之间的安全通道；所述认证中心获取VNF实体发送的第二证书请求消息的过程具体包括：所述认证中心获取所述VNFS实体使用所述安全通道转发的所述第二证书请求消息。
第三方面，本实施例还提供一种注册请求消息发送方法，该方法可以应用于MANO实体，具体地，该方法包括如下步骤：MANO实体在创立至少一个VNF实体后，生成至少一个VNF实体的注册请求消息；然后将所述至少一个VNF实体的注册请求消息发送给认证中心，其中每个所述注册请求消息中包括用于识别一个VNF实体的身份标识。
结合第三方面，在一种实现方式中，所述方法还包括：所述MANO实体获取来自所述认证中心的至少一个一次性凭据，其中，每个所述一次性凭据可以根据所述注册请求消息中的VNF实体身份标识生成；所述MANO实体获取一次性凭据之后将所述至少一个一次性凭据发送给对应的VNF实体。
结合第三方面，在一种实现方式中，上述方法中的步骤：MANO实体将所述至少一个一次性凭据发送给对应的VNF实体的过程具体包括：所述MANO实体与所述至少一个VNF实体之间建立至少一个第一安全通道；所述MANO实体将所述至少一个一次性凭据通过所述至少一个第一安全通道发送给所述至少一个VNF实体，其中每个第一安全通道用于发送一个一次性凭据。
结合第三方面，在一种实现方式中，所述MANO实体获取来自所述认证中心的至少一个一次性凭据的过程具体包括：所述MANO实体与认证中心之间建立至少一个第二安全通道；所述MANO实体利用所述至少一个第二安全通道获取所述认证中心发送的至少一个一次性凭据，其中每个第二安全通道用于对应地发送一个一次性凭据。
第四方面，本申请实施例还提供了一种证书请求消息发送装置，该装置用于执行上述第一方面各种实现方式中方法步骤的模块或单元，进一步地，所述装置包括获取单元、处理单元和发送单元等。具体地，所述证书请求消息发送装置可以布置在VNF实体中。
第五方面，本申请实施例还提供了一种证书请求消息接收装置，该装置用于执行上述第二方面各种实现方式中方法步骤的模块或单元，进一步地，所述装置包括获取单元、处理单元和发送单元等。具体地，所述证书请求消息接收装置可以布置在认证中心中。
第六方面，本申请实施例还提供了一种注册请求消息发送装置，该装置用于执行上述第三方面各种实现方式中方法步骤的模块或单元，进一步地，所述装置包括获取单元、处 理单元和发送单元等。具体地，所述注册请求消息发送装置可以布置在MANO实体中。
第七方面，本申请还提供了一种计算机存储介质，该计算机存储介质可存储有程序，该程序执行时可实现包括本申请提供的证书请求消息发送方法、接收方法各实施例中的部分或全部步骤。
第八方面，本申请还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行上述各方面所述的方法步骤。
本申请实施例提供的证书请求消息发送方法、接收方法及装置，通过一次性凭据解析出安全密钥和hmac密钥，并利用安全密钥对证书请求消息进行加密处理，能够防止消息内容被明文发送，利用hmac密钥处理证书请求消息能够防止消息的内容被截获和篡改，并且通过在证书请求消息中绑定VNF实体的身份标识，使得认证中心能够准确地辨认发送方VNF实体，既实现了认证中心对发送请求的VNF实体的身份验证，又保护了请求消息传输的安全性和完整性。
附图说明
为了更清楚地说明本申请的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种NFV系统的结构示意图；
图2为本申请实施例提供的一种证书请求消息发送方法的流程图；
图3为本申请实施例提供的另一种证书请求消息发送方法的流程图；
图4为本申请实施例提供的又一种证书请求消息发送方法的流程图；
图5为本申请实施例提供的一种证书请求消息发送装置的结构示意图；
图6为本申请实施例提供的一种证书请求消息接收装置的结构示意图；
图7为本申请实施例提供的一种注册请求消息发送装置的结构示意图；
图8为本申请实施例提供的另一种NFV系统的结构示意图。
具体实施方式
本申请应用于网络功能虚拟化(Network Function Virtualization，NFV)系统，该 系统目的在于制定一套在虚拟化环境下部署网络的标准。所述NFV系统中包括：管理和编排(Management and orchestration，MANO)、至少一个虚拟化网络功能(Virtualized network function)实体、网元管理系统(Element Management System，EMS)、NFV的基础设施(Network Function Virtual Infrastructure，NFVI)、证书颁发中心或认证中心(Certificate Authority，CA)。
如图1所示，MANO实体中包括：NFV编排器(NFV Orchestra，NFVO)，用于将NFV网络中的VNF相互连接组网；VNF管理器(VNF Manager，VNFM)，用于对VNF进行生命周期管理；以及虚拟基础设施管理器(virtualized infrastructure manager，VIM)，用于对VNF框架中的虚拟基础设施进行管理，包括通过机机接口自动创建虚拟资源，创建VNF以及VNF需要的网络连接等。
在本申请的各个实施例中，NFVO、VNFM、VIM统称为NFVO。所述VNF实体可以是部署在虚拟环境系统中的传统网元，例如SBC(session border controller，会话边界控制器)、HSS(home subscriber server，归属用户服务器)等，作为一个网络功能实体。NFV是网络功能虚拟化所需的计算、存储和网络资源的统称，VIM可以通过机机接口管理NFVI。CA用于签发凭据，所述凭据用于对证书申请者的身份进行认证，以证明VNF实体身份的合法性。在一种实施方式中，凭据包括一次性口令(one time password，OTP)，token，证书，密钥等。
需要说明的是，CA可以是标准的公共密钥基础设施(public key infrastructure，PKI)系统，也可以是系统自行搭建的小型认证中心，例如仅支持签发数字证书，更新数字证书。其中，所述CA可以部署在MANO实体外部，或者部署在NFV实体的外部，也可以位于VNF实体，MANO实体或EMS上。
本申请各实施例提供的方法，用于在VNF实体初始化之后，在VNF实体从认证中心获取签发的证书之前，利用认证中心下发的一次性凭据来向认证中心发送证书请求消息，以请求认证中心对VNF实体的身份进行验证和证书下发。
实施例一
本实施例提供了一种证书请求消息发送方法，参见图1，该方法包括如下步骤：
MANO实体在创建至少一个VNF实体后，生成至少一个注册请求消息或者注册VNF请求消息，其中，每个所述注册请求中包括用于识别一个VNF实体的身份标识，例如VNF实体的ID。
步骤101：MANO实体将生成的至少一个注册请求消息发送给认证中心CA。
步骤102：CA接收来自MANO实体的至少一个注册请求消息，并根据所述VNF实体的身份标识生成一次性凭据，例如，根据每个VNF实体ID生成至少一个一次性凭据。
其中，所述一次性凭据可以为一次性口令(One Time Password，OTP)，所述OTP为随机数。并且每个所述一次性凭据对应一个VNF实体。
步骤103：CA将所述至少一个一次性凭据发送给MANO实体。
在一种实施方式中，为了提高传输一次性凭据的安全性，在CA发送一次性凭据之前与MANO实体建立至少一个安全通道，例如第二安全通道，并使用该第二安全通道将生成的至少一个一次性凭据发送给MANO实体。具体的，所述安全通道的建立方式包括利用TLS(安全传输协议)建立所述安全通道。
步骤104：MANO实体接CA发送的至少一个一次性凭据，并将所述至少一个一次性凭据发送给对应的NFV实体。其中，每个所述一次性凭据中包括一个VNF实体的身份标识。
在一种实施方式中，为了提高发送一次性凭据的安全性，MANO实体与每个VNF实体之间建立一个安全通道，例如第一安全通道。MANO实体将一次性凭据发送给VNF实体包括：MANO实体将所述第一性凭据通过第一安全通道发送给对应的VNF实体。
步骤105：一个VNF实体接收MANO实体发送的对应的一个一次性凭据，并且，所述VNF实体获取第一证书请求消息。
在一种实施方式中，所述第一证书请求消息可以是由VNF实体内部生成的，或者从其它网络实体中获取。例如，所述第一证书请求消息为“我要证书”。
步骤106：VNF实体解析所述一次性凭据得到第一安全密钥(key)和第一hmac密钥。
步骤107：VNF实体利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识。
具体地，一种处理方式包括：VNF实体利用第一安全密钥对第一证书请求消息做加密处理生成第一请求消息密文(ciphertext)；同时，VNF实体利用第一hmac密钥对第一证书请求消息做HMAC(Hashed Message Authentication code，散列消息认证码)函数运算生成第一散列消息验证码或者hmac消息验证码，最后，将所述第一请求消息密文和所述第一散列消息验证码相结合生成第二证书请求消息。
其中，所述HMAC函数选取的散列函数包括但不限于MD5(Message-Digest Algorithm5，信息-摘要算法5)SHA1(Secure Hash Algorithm，安全哈希算法)和SHA256算法等，HMAC运算的特点是只能通过密钥进行加密运算，不能进行逆运算，即解密运算。所以能够保证第二证书请求消息的内容不被解密和篡改。在一种实施方式中，由于SHA256算法的数位较多，安全性较高，所以一般可以采用SHA256算法进行加密运算。
采用本方式的生成第二证书请求消息，使用安全密钥对第一证书请求消息的内容进行加密，防止证书请求消息的内容被明文发送，提高了传输消息内容的安全性。利用hmac密钥对第一证书请求消息做HMAC运算，以防止证书请求消息的内容被篡改。
另一种处理生成第二证书请求消息的方式包括：VNF实体首先利用第一安全密钥key对第一证书请求消息进行加密，生成第二请求消息密文，然后利用第一hmac密钥对所述第二请求消息密文做HMAC运算，生成第二证书请求消息。
步骤108：VNF实体将所述第二证书请求消息发送给认证中心。
其中，在步骤108中，VNF实体还将步骤107中生成的第一散列消息验证码和第一请求消息密文随所述第二证书请求消息一起发送给认证中心。
步骤109：CA接收所述VNF实体发送的第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识、所述第一请求消息加密密文和所述第一散列消息验证码，CA根据所述身份标识确定所述VNF实体对应的一次性凭据；并根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证。
具体地，CA对VNF实体的身份进行验证的过程包括：CA获取第一散列消息验证码。CA解析所述一次性凭据得到第二安全密钥和第二hmac密钥，利用所述第二安全密钥对第二证书请求消息解密得到所述第二证书请求消息的内容；CA利用所述第二hmac密钥对第二证书请求消息的内容做HMAC函数运算，生成第三证书请求消息。判断所述第三证书请求消息与第一散列消息验证码是否相同，如果相同，则验证该VNF实体身份合法；如果不相同，则VNF实体的身份不合法。
步骤110：如果验证所述VNF实体的身份合法，则生成需要签发的证书，并根据该VNF实体的身份标识，将证书签发给该VNF实体。如果验证VNF实体的身份不合法，则不签发证书，CA反馈证书请求失败的验证结果给对应的VNF实体。
其中，CA签发证书给VNF实体后，对应的一次性凭据失效。
在一种实施方式中，为了使VNF实体发送的证书请求消息能够正确地发送给CA，还需要对CA的身份进行验证。具体地验证过程包括：在上述步骤108中，在第二证书请求中还包括挑战随机数，如果步骤110中CA签发的证书中包括该挑战随机数，则验证CA的身份合法；如果不包括该挑战随机数，或者VNF实体接收的挑战随机数与步骤108中第二请求消息中携带的挑战随机数不同，则验证CA身份不合法。其中，为提高传输安全性，所述挑战随机数是被加密后的挑战随机数。
VNF实体接收CA发送的证书和验证结果。
本实施例提供的方法，通过设置一次性凭据，使VNF实体根据该一次性凭据解析出安 全密钥和hmac密钥，并利用安全密钥对证书请求消息进行加密处理，能够防止消息内容被明文发送，利用hmac密钥处理证书请求消息能够防止消息的内容被截获和篡改，并且通过在证书请求消息中绑定VNF实体的身份标识，使得认证中心能够准确地辨认发送方VNF实体，既实现了认证中心对发送请求的VNF实体的身份验证，又保护了请求消息传输的安全性和完整性。
在一个具体的实施例中，包括第一VNF实体、MANO实体和CA，其中，VNF实体向CA申请证书的过程包括：
MANO实体首先向CA发送第一VNF实体的注册请求消息，所述注册请求消息中包括第一VNF实体的身份标识，例如所述第一VNF实体的身份标识为“张三”。
CA接收该注册请求消息，根据第一VNF实体的身份标识(“张三”)生成一次性凭据OTP。在一种实施方式中，该一次性凭据为随机数。
假设为 DDABE16C82627DEA460FFC1B4A4FE6BFF9673323784A8BFE92E37B1E8D53438F。CA存储该第一VNF实体的一次性凭据，并将其通过MANO实体发送给第一VNF实体。此外，在一种实施方式中CA将一次性凭据通过安全通道发送给MANO实体。
VNF实体接收MANO实体发送的一次性凭据，假设为 DDABE16C82627DEA460FFC1B4A4FE6BFF9673323784A8BFE92E37B1E8D53438F。对该随机数进行解析运算得到第一加密密钥和hmac密钥。在一种实施方式中，VNF实体与CA通过协商确定第一加密密钥和hmac密钥。假设，解析一次性凭据(OTP)生成一串数列，
PBKDF2(OTP)＝6F28AEE62D39E8A10827D56AB60DB34383899B76B41AC05982A74C8B0874C366DBCFD07FE2A3EA8D7145986C8D6B05892A5FCC6DCE5CDCE1A03DACCF7144E272….
协商将该数列的前256bits(6F28AEE62D39E8A10827D56AB60DB34383899B76B41AC05982A74C8B0874C366)作为第一安全密钥key，将该数列后面的256bits(DBCFD07FE2A3EA8D7145986C8D6B05892A5FCC6DCE5CDCE1A03DACCF7144E272)作为hmac密钥。
VNF实体获取第一证书请求消息，假设该第一证书请求消息内容为“我要证书”，VNF实体利用第一安全密钥key对“我要证书”进行加密，生成第一消息密文，该第一消息密文隐藏了“我要证书”的内容，防止第一请求消息中的“我要证书”内容被明文读取。同时，VNF实体还利用hmac密钥对“我要证书”做MD5运算生成第一散列消息验证码，该第一散列消息验证码用于防止请求消息“我要密码”被窃取和篡改。例如可以防止“我要密码”被其它网元或攻击者篡改为“我不要密码”。最后结合第一消息密文和第一散列消息 验证码生成第二证书请求消息。并将该第二证书请求消息和第一散列消息验证码一起发送给CA。
CA接收该第二证书请求消息，并根据该第二证书请求消息中所携带的VNF实体身份标识“张三”确定其存储的一次性凭据。例如，该“张三”所对应的一次性凭据为假设DDABE16C82627DEA460FFC1B4A4FE6BFF9673323784A8BFE92E37B1E8D53438F。解析该一次性凭据得到第二安全密钥和第二hmac密钥。其中，CA所述一次性凭据与之前根据注册请求消息生成的一次性凭据相同，所以，解析的第二安全密钥与所述第一安全密钥相同，第二hmac密钥与第一hmac密钥也相同。
进一步地，CA对VNF实体的身份进行验证，包括：CA利用第二安全密钥对第二证书请求消息进行解密，得到第二证书请求消息的内容“我要证书”，使用第二hmac密钥对该内容“我要证书”做HMAC函数运算，生成第三请求消息。判断该第三请求消息与之前获取的第一散列消息验证码是否相同，如果相同，则表明VNF实体的身份合法；如果不同，则表明身份不合法。如果验证身份合法，则CA将生成对应的证书，并将该证书签发给对应的VNF实体。
其中，本实施例中，CA向MANO实体发送的一次性凭据，以及MANO实体向VNF实体转发的所述一次性凭据都可以通过预先建立的安全通道发送。在一种实施方式中，所述一次性凭据的分发方式可以采用HTTPS(超文本传输安全协议)消息。
本实施例中利用一次性凭据导出的安全密钥和hmac密钥对证书请求消息进行加密处理，避免证书请求消息的内容被明文发送，同时还能防止消息内容被篡改，保证了消息传输的安全性和完整性。并且，所述证书请求消息绑定VNF实体的身份标识，为CA接收时做了身份认证。另外，在凭据分发的过程中，凭据没有明文出现在任何通道上，并且凭据在申请结束后立即失效。
实施例二
本实施应用于分离功能的VNF实体的技术场景，即由于VNF实体不能与MANO实体和CA进行通信，因此，增设VNFS实体与外部进行通信，以及控制多个VNF实体。在本实施例中，将VNF实体分为VNFS实体和VNFA实体。其中，VNFS实体用于对一次性凭据进行转发，以及转发证书请求消息。
具体地，如图3所示，本实施例中对VNF实体身份的验证包括如下步骤：
步骤201至步骤203与实施例一种的步骤101至步骤103相同，不再赘述。
步骤2041：MANO实体接收CA发送的至少一个一次性凭据之后，将这些一次性凭据发送给VNFS实体。在一种实施方式中，MANO实体通过预先建立的第一安全通道将至少一个一次性凭据发送给VNFS实体。
步骤2042：VNFS实体接收这些一次性凭据之后，将这些一次性凭据发送给对应的每个VNFA实体。
在一种实施方式中，在发送一次性凭据之前，每个VNFA实体与VNFS实体之间都共享有秘密信息，可以通过预置实现。所述秘密信息用于建立每个VNFA实体与VNFS实体之间的安全通道，并利用这些安全通道发送一次性凭据，以保证传输数据的安全性。其中，所述共享秘密信息可以用于对一次性凭据进行加密，可以用于协商会话密钥，或者是直接作为PSK(Pre-Shared Key，预共享密钥)使用。
本实施例中对VNFA实体与VNFS实体之间共享秘密信息的方式不做限制，可以包括很多种方式，例如，预置在软件包里面，或者是通过out-of-band(带外)的方式，如U盘，外部输入等。
其中，在具体实现中，可以预先配置PSK给要通信的两端(VNFA实体和VNFS实体)，两端在相互认证时可以通过此密钥保证相互可信。预共享密钥可以是对称密钥(即双方持有的密钥是相同的)，也可以是非对称密钥(双方持有的密钥不同)，例如公私钥对。具体的配置和使用PSK的过程可以根据现有的标准协议来实现。
步骤205：VNFA实体接收所述VNFS实体发送的一次性凭据。
步骤205至步骤207与实施例一中的步骤105至步骤107相同，具体实现参见实施例一，此处不再赘述。
步骤2081：VNFA实体将上述实施例一中的所述第二证书请求消息发送给VNFS实体。
步骤2082：VNFS实体接收VNFA实体发送的第二证书请求消息，并将该第二证书请求消息转发给CA。
在一种实施方式中，VNFS实体可以通过预先建立的安全通道发送所述至少一个第二证书请求消息给CA。所述安全通道可根据共享秘密信息建立。
步骤209：CA接收VNFS实体发送的第二证书请求消息之后，根据第二证书请求消息中对VNFA实体的身份进行验证。进一步地，验证过程与前述实施例中的步骤109相同，不再赘述。
步骤2101：如果验证VNFA实体的身份合法，则CA将生成的证书下发给VNFS实体。
步骤2102：VNFS实体接收CA发送的证书以及验证结果，并根据每个VNFA实体的身份标识，将证书发送给对应的VNFA实体。
本实施例中，将VNF实体的功能分离，即分为前端的多个VNFA实体和后端的VNFS实体。其中，后端的VNFS实体用于与外部的网元进行通信，例如接收并转发数据，以及对 多个VNFA实体进行管理，从而实现了在分离的网元架构中，VNFA实体与外部的MANO实体和CA进行通信。
另外，本实施例中，预置VNFA实体和VNFS实体之间的共享秘密信息，建立带身份认证和加密保护的通道，例如在预置共享秘密信息时，对于纯软件环境，可以在软件包预置，并采用相同的白盒算法进行加密，进而保证了一次性凭据以及第二证书请求消息转发的安全性和完整性，避免了一次性凭据和证书请求消息被明文发送。
实施例三
本实施例应用于VNF实体直接向CA获取证书的技术场景，该技术场景类似于将CA部署在分离功能的VNFS实体上，VNFA实体可以直接向具有CA功能的VNFS实体发起证书请求，并从该VNFS实体上的CA获取证书。
具体地，如图4所示，本实施例提供的证书请求消息包括如下步骤：
步骤401：VNF实体生成注册请求消息，并将该注册请求消息发送给CA。
步骤402：CA接收该注册请求消息，并根据该注册请求消息中的VNF实体身份标识生成一次性凭据。
步骤403：CA将该一次性凭据通过安全通道发送给该VNF实体。
在一种实施方式中，VNF实体和CA可通过预置共享秘密信息建立安全通道，并使用该安全通道发送一次性凭据，从而保证了VNF实体和CA的互信以及凭据转发的安全性，共享秘密可以用于加密，可以用于协商会话密钥，或者是直接作为PSK使用。其中，对于纯软件环境，可以在软件包预置共享秘密信息，并采用相同的白盒算法进行加密。
步骤404至步骤406与前述实施例一中的步骤105至步骤107相同，不再赘述。
步骤407：VNF实体将生成的第二证书请求消息发送给CA。
步骤408：CA接收该第二证书请求消息，并对VNF实体的身份进行验证。其中，具体的验证过程详见实施例一中的步骤109，不再赘述。
步骤409：CA根据验证结果生成证书，并将证书签发给身份合法的VNF实体。
本实施例在VNF实体与CA直接交互的场景中，通过预置共享秘密信息，建立了加密的安全通道，从而保证证书请求消息以及一次性凭据的安全传输。并且，通过一次性凭据中的安全密钥和hmac密钥对初始的证书请求消息进行了处理，生成的第二证书请求消息，避免发送的信息(一次性凭据和请求消息)明文出现在任何通道上，并且通过进行HMAC函数运算防止请求消息内容被篡改，进一步地提高了消息传输的安全性和完整性。
另外，一次性凭据在证书签发后立即失效，避免一次性凭据被二次利用，进一步地提高了通信的安全性。
需要说明的是，本申请上述各实施例适用于所有虚拟化场景下的凭据管理，包括但不限于NFV实体，还可以扩展到openstack等平台内。所述CA可以是标准的PKI，也可以是单一功能的CA(仅包含签发数字证书，更新等功能)，其中，CA可以部署放在MANO实体、VNFS实体、EMS上。凭据包括且不仅仅用于证书申请，还可以用于会话密钥，协商PSK等。
与本申请上述各实施例所提供证书请求消息发送方法的相对应，本申请还提供了一种证书请求发送装置，该装置可应用于VNF实体。
如图5所示，该装置包括：获取单元501、处理单元502和发送单元503。
其中，获取单元501，用于获取一次性凭据和第一证书请求消息。
处理单元502，用于解析所述一次性凭据得到第一安全密钥和第一hmac密钥；利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识。
发送单元503，用于将所述第二证书请求消息发送给认证中心，以便于所述认证中心对所述VNF实体的身份进行验证。
在一种具体的实施方式中，处理单元502，具体用于利用所述第一安全密钥对所述第一证书请求消息做加密处理生成第一请求消息密文；利用所述第一hmac密钥对所述第一证书请求消息做HMAC函数运算生成第一散列消息验证码；结合所述第一请求消息密文和所述第一散列消息验证码生成所述第二证书请求消息。
在一种具体的实施方式中，获取单元501，还用于获取所述MANO实体转发的所述一次性凭据，或者，获取所述认证中心发送的所述一次性凭据。
在一种具体的实施方式中，处理单元502，还用于生成注册请求消息，所述注册请求消息中包括所述VNF实体的身份标识。
发送单元503，还用于向所述认证中心发送所述注册请求消息。
在一种具体的实施方式中，所述装置还包括VNFS实体，获取单元501，还用于获取VNFS实体转发的所述一次性凭据，其中，所述装置与所述VNFS实体之间共享有秘密信息，所述秘密信息用于建立所述装置与所述VNFS实体之间的安全通道。
发送单元503，还用于通过所述VNFS实体将所述第二证书请求消息发送给认证中心。
在一种实施方式中，处理单元502还用于与所述MANO实体之间建立第一安全通道。
获取单元501，还用于通过所述第一安全通道获取所述MANO实体转发的所述一次性凭据。
如图6所示，本实施例还提供了一种证书请求消息接收装置，该装置可以应用于认证中心，所述装置包括：获取单元601、处理单元602和发送单元603。
其中，获取单元601，用于获取VNF实体发送的第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识。
处理单元602，用于根据所述身份标识确定所述VNF实体对应的一次性凭据，并根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证。
在一种具体的实施方式中，所述第二证书请求消息中包括第一散列消息验证码。
处理单元602，还用于解析所述一次性凭据得到第二安全密钥和第二hmac密钥，利用所述第二安全密钥对所述第二证书请求消息解密得到所述第二证书请求消息的内容，利用所述第二hmac密钥对所述第二证书请求消息的内容做HMAC函数运算，生成第三证书请求消息；以及检测如果所述第三证书请求消息与第一散列消息验证码相同，则验证所述VNF实体身份合法；否则身份不合法，认证失败。
在一种具体的实施方式中，该装置还可以包括发送单元603。
处理单元602，还用于如果验证所述VNF实体身份合法则生成证书。
发送单元603，用于将所述证书签发给所述VNF实体。
在一种具体的实施方式中，获取单元601，还用于获取所述VNF实体的注册请求消息，所述注册请求消息中包括VNF实体的身份标识。
处理单元602，还用于根据所述VNF实体的身份标识生成一次性凭据。
发送单元603，用于将所述一次性凭据发送给与所述身份标识对应的VNF实体。
在一种具体的实施方式中，处理单元602，还用于与MANO实体建立第二安全通道；
发送单元603，用于通过所述第二安全通道将所述一次性凭据发送给所述VNF实体。
在一种具体的实施方式中，获取单元601，还用于通过MANO实体获取所述VNF实体的注册请求消息。
在一种具体的实施方式中，获取单元601，还用于获取VNFS实体使用安全通道转发的所述第二证书请求消息，所述安全通道为所述VNF实体与VNFS实体根据共享的秘密信息所建立的通道。
如图7所示，本实施例还提供一种注册请求消息装置，该装置可以应用于MANO实体，所述装置包括：获取单元701、处理单元702和发送单元703。
其中，处理单元702，用于在创立至少一个VNF实体后，生成至少一个VNF实体的注册请求消息。
发送单元703，用于将所述至少一个VNF实体的注册请求消息发送给认证中心，其中每个所述认证请求中包括用于识别一个VNF实体的身份标识。
在一种具体的实施方式中，获取单元701，用于获取来自所述认证中心的至少一个一次性凭据，所述每个所述一次性凭据根据所述注册请求消息中的VNF实体身份标识生成。
发送单元703，还用于将所述至少一个一次性凭据发送给对应的VNF实体。
在一种具体的实施方式中，处理单元702，还用于与所述至少一个VNF实体之间建立至少一个第一安全通道。
发送单元703，还用于将所述至少一个一次性凭据通过所述至少一个第一安全通道发送给所述至少一个VNF实体。
处理单元702，还用于与所述认证中心之间建立至少一个第二安全通道；
获取单元701，还用于利用所述至少一个第二安全通道获取所述认证中心发送的至少一个一次性凭据。
在本实施例中，利用一次性凭据运算生成第一安全密钥和第一hmac密钥，证书请求消息发送装置利用第一安全密钥对证书请求消息进行加密处理，能够防止消息内容被明文发送，利用第一hmac密钥处理证书请求消息能够防止消息的内容被截获和篡改，并且通过在证书请求消息中绑定VNF实体的身份标识，使得认证中心能够准确地辨认发送方VNF实体，既实现了认证中心对发送请求的VNF实体的身份验证，又保护了请求消息传输的安全性和完整性。
另外，每个一次性凭据只能应用于一次证书请求，当对证书请求消息进行验证之后，该对应的一次性凭据就会失效，从而避免了一个凭据被多次使用，或者凭据被攻击者利用，伪造申请证书威胁网络系统安全。此外，利用安全通道传输一次性凭据，能够防止一次性凭据被明文发送，进一步提高了数据传输的安全性。
在具体硬件实现层面，本申请还提供了一种MANO实体，用于实现前述实施例中的注册请求消息发送方法。参见图8，该MANO实体80可以由收发器801、处理器802及存储器803等组成。
处理器802为MANO实体的控制中心，利用各种接口和线路连接整个网络设备的各个 部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储器内的数据，以执行网络侧设备的各种功能和/或处理数据。
处理器802可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器803可以包括易失性存储器(volatile memory)，例如随机存取内存(random access memory，RAM)，还可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合。
收发器801可以用于接收或发送数据，所述收发器可以在所述处理器的控制下向视频网络系统中的各个节点或其他设备发送数据，以及所述处理器的控制下接收各个节点或其他设备发送的数据。
在本申请实施例中，收发器801可以用于实现前述各实施例中的向VNF实体发送注册请求消息和转发一次性凭据等功能。前述装置实施例图7中的获取单元701所要实现的功能可以由所述MANO实体的收发器801实现，或者由处理器802控制收发器801实现。图7中的处理单元702所要实现的功能也可以由MANO实体的处理器802实现。
如图8所示，在本实施例提供的NFV系统中还包括至少一个VNF实体，用于实现前述各实施例中的证书请求消息发送方法。其中，该VNF实体90可以由收发器901、处理器902和存储器903等组成。
处理器902为VNF实体的控制中心，利用各种接口和线路连接整个VNF实体的各个部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储器内的数据，以执行网络侧设备的各种功能和/或处理数据。
所述处理器可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器903可以包括易失性存储器(volatile memory)，例如随机存取内存(random access memory，RAM)；还可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合。所述存储器中可以存储有程序或代码，网元中的处理器通过执行所述程序或代码可以实现所述网元的功能。
收发器901可以用于接收或发送数据，收发器901可以在处理器902的控制下向认证中心或其他网络侧设备发送数据；或者收发器901在处理器902的控制下接收MANO实体。认证中心或其他网络侧设备发送的数据。
在本申请实施例中，收发器901可以用于实现前述实施例图2至图4中的证书请求消息发送方法的步骤，以及装置实施例图5所具有的功能。其中，图5所述的获取单元501所要实现的功能可以由VNF实体的收发器901实现，或者由处理器902控制的收发器901实现；发送单元503所要实现的功能也可以由该VNF实体的收发器901实现，或者也可以由处理器902控制的收发器901实现；所述处理单元502所要实现的功能则可以由所述处理器902实现。
需要说明的是，本实施例所述的MANO实体可以是一种VNF实体，或者将MANO实体的功能集成在VNF实体中。所述VNF实体还可以拆分成VNFS实体和至少一个VNFA实体，所述VNFS实体用于对消息和数据进行转发，以实现分离功能的VNFA实体与MANO实体和认证中心之间的通信。
如图8所示，认证中心用于实现前述各实施例中的证书请求消息接收方法。其中，所述认证中心100可以由收发器1001、处理器1002和存储器1003等组成。
处理器1002为认证中心的控制中心，利用各种接口和线路连接整个认证中心的各个部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储器内的数据，以执行一次性凭据的下发和对VNF实体身份进行验证。
在一种可能的实施方式中，认证中心可以布置在服务器或者其它网络侧设备中。
在本申请实施例中，收发器1001可以用于实现前述实施例图2至图4中的证书请求消息接收方法的步骤，以及装置实施例图6所具有的功能。其中，图6所述的获取单元601所要实现的功能可以由认证中心的收发器1001实现，或者由处理器1002控制的收发器1001实现；发送单元603所要实现的功能也可以由该认证中心的收发器1001实现，或者也可以由处理器1002控制的收发器1001实现；处理单元602所要实现的功能则可以由所述处理器1002实现。
具体实现中，本申请还提供一种计算机存储介质，其中，该计算机存储介质可存储有程序，该程序执行时可包括本申请提供的证书请求消息发送方法、接收方法、注册请求消 息发送方法的各实施例中的部分或全部步骤。所述的存储介质可为磁碟、光盘、只读存储记忆体(read-only memory，ROM)或随机存储记忆体(random access memory，RAM)等。
另外，本申请还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各实施例中所述的方法步骤。
本领域的技术人员可以清楚地了解到本申请实施例中的技术可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本申请实施例中的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中各个实施例之间相同相似的部分互相参见即可。尤其，对于上述实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例中的说明即可。
以上所述的本发明实施方式并不构成对本发明保护范围的限定。

Claims (34)

  1. 一种证书请求消息发送方法，其特征在于，所述方法包括：
    虚拟网络功能VNF实体获取一次性凭据和第一证书请求消息；
    所述VNF实体解析所述一次性凭据得到第一安全密钥和第一hmac密钥；
    所述VNF实体利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；
    所述VNF实体将所述第二证书请求消息发送给认证中心，以便于所述认证中心对所述VNF实体的身份进行验证。
  2. 根据权利要求1所述的方法，其特征在于，所述VNF实体利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，包括：
    所述VNF实体利用所述第一安全密钥对所述第一证书请求消息做加密处理生成第一请求消息密文；
    所述VNF实体利用所述第一hmac密钥对所述第一证书请求消息做HMAC函数运算生成第一散列消息验证码；
    所述VNF实体结合所述第一请求消息密文和所述第一散列消息验证码生成所述第二证书请求消息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述VNF实体获取一次性凭据，包括：
    所述VNF实体获取管理和编排MANO实体转发的所述一次性凭据，或者，
    所述VNF实体获取所述认证中心发送的所述一次性凭据。
  4. 根据权利要求3所述的方法，其特征在于，所述VNF实体获取所述认证中心发送的所述一次性凭据之前，所述方法还包括：
    所述VNF实体生成注册请求消息，所述注册请求消息中包括所述VNF实体的身份标识；
    所述VNF实体向所述认证中心发送所述注册请求消息。
  5. 根据权利要求1所述的方法，其特征在于，所述VNF实体为VNFA实体，还包括VNFS实体，
    所述VNF实体获取一次性凭据包括：所述VNFA实体获取VNFS实体转发的所述一次性凭据，其中，所述VNFA实体与所述VNFS实体之间共享有秘密信息，所述秘密信息用于建立所述VNFA实体与所述VNFS实体之间的安全通道；
    所述VNF实体将所述第二证书请求消息发送给认证中心，包括：
    所述VNFA实体通过所述VNFS实体将所述第二证书请求消息发送给认证中心。
  6. 根据权利要求3所述的方法，其特征在于，所述VNF实体获取所述MANO实体转发的所述一次性凭据，包括：
    所述VNF实体与所述MANO实体之间建立第一安全通道；
    所述VNF实体通过所述第一安全通道获取所述MANO实体转发的所述一次性凭据。
  7. 一种证书请求消息接收方法，其特征在于，所述方法包括：
    认证中心获取VNF实体发送的第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；
    所述认证中心根据所述身份标识确定所述VNF实体对应的一次性凭据；
    所述认证中心根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证。
  8. 根据权利要求7所述的方法，其特征在于，所述第二证书请求消息中包括第一散列消息验证码；
    所述认证中心根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证，包括：
    所述认证中心解析所述一次性凭据得到第二安全密钥和第二hmac密钥；
    所述认证中心利用所述第二安全密钥对所述第二证书请求消息解密得到所述第二证书请求消息的内容；
    所述认证中心利用所述第二hmac密钥对所述第二证书请求消息的内容做HMAC函数运算，生成第三证书请求消息；
    如果所述第三证书请求消息与第一散列消息验证码相同，则验证所述VNF实体身份合法。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    如果所述VNF实体身份合法，则生成证书；
    所述认证中心将所述证书签发给所述VNF实体。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，所述认证中心获取VNF实体发送的第二证书请求消息之前，所述方法还包括：
    所述认证中心获取所述VNF实体的注册请求消息，所述注册请求消息中包括VNF实体的身份标识；
    所述认证中心根据所述VNF实体的身份标识生成一次性凭据；
    所述认证中心将所述一次性凭据发送给与所述身份标识对应的VNF实体。
  11. 根据权利要求10所述的方法，其特征在于，所述认证中心将所述一次性凭据发送给所述VNF实体，包括：
    所述认证中心与MANO实体建立第二安全通道；
    所述认证中心通过所述第二安全通道将所述一次性凭据发送给所述VNF实体。
  12. 根据权利要求10所述的方法，其特征在于，所述认证中心获取所述VNF实体的注册请求消息，包括：
    所述认证中心通过MANO实体获取所述VNF实体的注册请求消息。
  13. 根据权利要求7所述的方法，其特征在于，所述VNF实体为VNFA实体，还包括VNFS实体，并且，所述VNFA实体与所述VNFS实体之间共享有秘密信息，所述秘密信息用于建立所述VNFA实体与所述VNFS实体之间的安全通道；
    所述认证中心获取VNF实体发送的第二证书请求消息，包括：
    所述认证中心获取所述VNFS实体使用所述安全通道转发的所述第二证书请求消息。
  14. 一种注册请求消息发送方法，其特征在于，所述方法包括：
    MANO实体在创立至少一个VNF实体后，生成至少一个VNF实体的注册请求消息；
    所述MANO实体将所述至少一个VNF实体的注册请求消息发送给认证中心，其中每个所述注册请求消息中包括用于识别一个VNF实体的身份标识。
  15. 根据权利要求14所述的方法、其特征在于，所述方法还包括：
    所述MANO实体获取来自所述认证中心的至少一个一次性凭据，所述每个所述一次性凭据根据所述注册请求消息中的VNF实体身份标识生成；
    所述MANO实体将所述至少一个一次性凭据发送给对应的VNF实体。
  16. 根据权利要求15所述的方法，其特征在于，所述MANO实体将所述至少一个一次性凭据发送给对应的VNF实体，包括：
    所述MANO实体与所述至少一个VNF实体之间建立至少一个第一安全通道；
    所述MANO实体将所述至少一个一次性凭据通过所述至少一个第一安全通道发送给所述至少一个VNF实体。
  17. 根据权利要求15所述的方法，其特征在于，所述MANO实体获取来自所述认证中心的至少一个一次性凭据，包括：
    所述MANO实体与所述认证中心之间建立至少一个第二安全通道；
    所述MANO实体利用所述至少一个第二安全通道获取所述认证中心发送的至少一个一次性凭据。
  18. 一种证书请求消息发送装置，其特征在于，应用于VNF实体，所述装置包括：
    获取单元，用于获取一次性凭据和第一证书请求消息；
    处理单元，用于解析所述一次性凭据得到第一安全密钥和第一hmac密钥；
    所述处理单元，还用于利用所述第一安全密钥和所述第一hmac密钥对所述第一证书请求消息进行处理生成第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；
    发送单元，用于将所述第二证书请求消息发送给认证中心，以便于所述认证中心对所述VNF实体的身份进行验证。
  19. 根据权利要求18所述的装置，其特征在于，
    所述处理单元，具体用于利用所述第一安全密钥对所述第一证书请求消息做加密处理生成第一请求消息密文；利用所述第一hmac密钥对所述第一证书请求消息做HMAC函数运算生成第一散列消息验证码；结合所述第一请求消息密文和所述第一散列消息验证码生成所述第二证书请求消息。
  20. 根据权利要求18或19所述的装置，其特征在于，
    所述获取单元，还用于获取所述MANO实体转发的所述一次性凭据，或者，获取所述认证中心发送的所述一次性凭据。
  21. 根据权利要求20所述的装置，其特征在于，
    所述处理单元，还用于生成注册请求消息，所述注册请求消息中包括所述VNF实体的身份标识；
    所述发送单元，还用于向所述认证中心发送所述注册请求消息。
  22. 根据权利要求18所述的装置，其特征在于，还包括VNFS实体，
    所述获取单元，还用于获取VNFS实体转发的所述一次性凭据，其中，所述装置与所述VNFS实体之间共享有秘密信息，所述秘密信息用于建立所述装置与所述VNFS实体之间的安全通道；
    所述发送单元，还用于通过所述VNFS实体将所述第二证书请求消息发送给认证中心。
  23. 根据权利要求20所述的装置，其特征在于，
    所述处理单元，还用于与所述MANO实体之间建立第一安全通道；
    所述获取单元，还用于通过所述第一安全通道获取所述MANO实体转发的所述一次性凭据。
  24. 一种证书请求消息接收装置，其特征在于，应用于认证中心，所述装置包括：
    获取单元，用于获取VNF实体发送的第二证书请求消息，所述第二证书请求消息中包括用于识别所述VNF实体的身份标识；
    处理单元，用于根据所述身份标识确定所述VNF实体对应的一次性凭据，并根据所述一次性凭据和所述第二证书请求消息对所述VNF实体的身份进行验证。
  25. 根据权利要求24所述的装置，其特征在于，所述第二证书请求消息中包括第一散列消息验证码；
    所述处理单元，还用于解析所述一次性凭据得到第二安全密钥和第二hmac密钥，利用所述第二安全密钥对所述第二证书请求消息解密得到所述第二证书请求消息的内容，利用所述第二hmac密钥对所述第二证书请求消息的内容做HMAC函数运算，生成第三证书请求消息；
    所述处理单元，还用于如果所述第三证书请求消息与第一散列消息验证码相同，则验证所述VNF实体身份合法。
  26. 根据权利要求25所述的装置，其特征在于，还包括发送单元，
    所述处理单元，还用于如果验证所述VNF实体身份合法则生成证书；
    所述发送单元，用于将所述证书签发给所述VNF实体。
  27. 根据权利要求24-26任一项所述的装置，其特征在于，
    所述获取单元，还用于获取所述VNF实体的注册请求消息，所述注册请求消息中包括VNF实体的身份标识；
    所述处理单元，还用于根据所述VNF实体的身份标识生成一次性凭据；
    所述发送单元，用于将所述一次性凭据发送给与所述身份标识对应的VNF实体。
  28. 根据权利要求27所述的装置，其特征在于，
    所述处理单元，还用于与MANO实体建立第二安全通道；
    所述发送单元，用于通过所述第二安全通道将所述一次性凭据发送给所述VNF实体。
  29. 根据权利要求27所述的装置，其特征在于，
    所述获取单元，还用于通过MANO实体获取所述VNF实体的注册请求消息。
  30. 根据权利要求24所述的装置，其特征在于，
    所述获取单元，还用于获取VNFS实体使用安全通道转发的所述第二证书请求消息， 所述安全通道为所述VNF实体与VNFS实体根据共享的秘密信息所建立的通道。
  31. 一种注册请求消息发送装置，其特征在于，应用于MANO实体，所述装置包括：
    处理单元，用于在创立至少一个VNF实体后，生成至少一个VNF实体的注册请求消息；
    发送单元，用于将所述至少一个VNF实体的注册请求消息发送给认证中心，其中每个所述认证请求中包括用于识别一个VNF实体的身份标识。
  32. 根据权利要求31所述的装置、其特征在于，还包括获取单元，
    所述获取单元，用于获取来自所述认证中心的至少一个一次性凭据，所述每个所述一次性凭据根据所述注册请求消息中的VNF实体身份标识生成；
    所述发送单元，还用于将所述至少一个一次性凭据发送给对应的VNF实体。
  33. 根据权利要求32所述的装置，其特征在于，
    所述处理单元，还用于与所述至少一个VNF实体之间建立至少一个第一安全通道；
    所述发送单元，还用于将所述至少一个一次性凭据通过所述至少一个第一安全通道发送给所述至少一个VNF实体。
  34. 根据权利要求32所述的装置，其特征在于，
    所述处理单元，还用于与所述认证中心之间建立至少一个第二安全通道；
    所述获取单元，还用于利用所述至少一个第二安全通道获取所述认证中心发送的至少一个一次性凭据。
PCT/CN2018/085528 2017-05-04 2018-05-04 一种证书请求消息发送方法、接收方法和装置 WO2018202109A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710307250.3A CN108809907B (zh) 2017-05-04 2017-05-04 一种证书请求消息发送方法、接收方法和装置
CN201710307250.3 2017-05-04

Publications (1)

Publication Number Publication Date
WO2018202109A1 true WO2018202109A1 (zh) 2018-11-08

Family

ID=64016837

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/085528 WO2018202109A1 (zh) 2017-05-04 2018-05-04 一种证书请求消息发送方法、接收方法和装置

Country Status (2)

Country Link
CN (1) CN108809907B (zh)
WO (1) WO2018202109A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110995659A (zh) * 2019-11-12 2020-04-10 广州大白互联网科技有限公司 一种网证数据的生成方法及系统
CN112688904A (zh) * 2019-10-18 2021-04-20 中兴通讯股份有限公司 一种安全通道建立方法、电子设备及存储介质
TWI749892B (zh) * 2020-11-23 2021-12-11 中華電信股份有限公司 安全傳輸系統及其方法
US12088578B2 (en) 2019-04-15 2024-09-10 Siemens Aktiengesellschaft Cryptographically protected provision of a digital certificate

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113037782A (zh) * 2021-05-20 2021-06-25 中兴通讯股份有限公司 证书获取方法和系统、电子设备、计算机可读存储介质
WO2023278851A1 (en) * 2021-07-02 2023-01-05 Commscope Technologies Llc Systems and methods for secure virtualized base station orchestration
CN117997543A (zh) * 2022-11-06 2024-05-07 华为技术有限公司 通信方法、装置和系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015168914A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
CN105577381A (zh) * 2014-10-24 2016-05-11 中兴通讯股份有限公司 虚拟化下的证书管理方法和装置
CN106302394A (zh) * 2016-07-26 2017-01-04 京信通信技术(广州)有限公司 安全通道建立方法和系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105450601B (zh) * 2014-08-19 2019-05-07 华为技术有限公司 共享许可证的方法和装置
EP3183679A4 (en) * 2014-08-22 2018-03-07 Nokia Technologies Oy A security and trust framework for virtualized networks
CN105808316B (zh) * 2014-12-31 2019-04-23 杭州华为数字技术有限公司 虚拟网络加载方法和装置
US9893887B2 (en) * 2015-01-30 2018-02-13 Ciena Corporation Dynamic licensing for applications and plugin framework for virtual network systems

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015168914A1 (zh) * 2014-05-08 2015-11-12 华为技术有限公司 一种证书获取方法和设备
CN105577381A (zh) * 2014-10-24 2016-05-11 中兴通讯股份有限公司 虚拟化下的证书管理方法和装置
CN106302394A (zh) * 2016-07-26 2017-01-04 京信通信技术(广州)有限公司 安全通道建立方法和系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12088578B2 (en) 2019-04-15 2024-09-10 Siemens Aktiengesellschaft Cryptographically protected provision of a digital certificate
CN112688904A (zh) * 2019-10-18 2021-04-20 中兴通讯股份有限公司 一种安全通道建立方法、电子设备及存储介质
CN110995659A (zh) * 2019-11-12 2020-04-10 广州大白互联网科技有限公司 一种网证数据的生成方法及系统
CN110995659B (zh) * 2019-11-12 2022-02-22 广州大白互联网科技有限公司 一种网证数据的生成方法及系统
TWI749892B (zh) * 2020-11-23 2021-12-11 中華電信股份有限公司 安全傳輸系統及其方法

Also Published As

Publication number Publication date
CN108809907A (zh) 2018-11-13
CN108809907B (zh) 2021-05-11

Similar Documents

Publication Publication Date Title
EP3761588B1 (en) Data access rights control method and device
US11533297B2 (en) Secure communication channel with token renewal mechanism
US11849029B2 (en) Method of data transfer, a method of controlling use of data and cryptographic device
US10951423B2 (en) System and method for distribution of identity based key material and certificate
WO2018202109A1 (zh) 一种证书请求消息发送方法、接收方法和装置
CN111416807B (zh) 数据获取方法、装置及存储介质
US10050955B2 (en) Efficient start-up for secured connections and related services
JP6896940B2 (ja) 第１のアプリケーションと第２のアプリケーションとの間の対称型相互認証方法
WO2019041802A1 (zh) 基于服务化架构的发现方法及装置
US11044082B2 (en) Authenticating secure channel establishment messages based on shared-secret
WO2022100356A1 (zh) 身份认证系统、方法、装置、设备及计算机可读存储介质
US11399019B2 (en) Failure recovery mechanism to re-establish secured communications
US9998287B2 (en) Secure authentication of remote equipment
US11818268B2 (en) Hub-based token generation and endpoint selection for secure channel establishment
US20210392004A1 (en) Apparatus and method for authenticating device based on certificate using physical unclonable function
TWI804179B (zh) 量子安全金鑰交換方案
JP2005175992A (ja) 証明書配布システムおよび証明書配布方法
WO2022109941A1 (zh) 应用于WiFi的安全认证的方法和装置
JP6609212B2 (ja) 暗号化通信チャネル確立システム、方法、プログラム及びコンピュータ読取り可能なプログラム記録媒体
CN117728958A (zh) 一种通信方法、装置和系统
CN113037782A (zh) 证书获取方法和系统、电子设备、计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18795156

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18795156

Country of ref document: EP

Kind code of ref document: A1