WO2022142555A1 - Vnfm与vnf建立数据安全连接的方法、设备及系统 - Google Patents

Vnfm与vnf建立数据安全连接的方法、设备及系统 Download PDF

Info

Publication number
WO2022142555A1
WO2022142555A1 PCT/CN2021/121787 CN2021121787W WO2022142555A1 WO 2022142555 A1 WO2022142555 A1 WO 2022142555A1 CN 2021121787 W CN2021121787 W CN 2021121787W WO 2022142555 A1 WO2022142555 A1 WO 2022142555A1
Authority
WO
WIPO (PCT)
Prior art keywords
vnf
vnfm
key
content
password
Prior art date
Application number
PCT/CN2021/121787
Other languages
English (en)
French (fr)
Inventor
潘娟
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022142555A1 publication Critical patent/WO2022142555A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying

Definitions

  • the present application relates to the technical field of arrangement and operation of virtualized resources, and in particular, to a method, device and system for establishing a data security connection between a VNFM and a VNF.
  • NFV Network Function Virtualization
  • NFVI Network Function Virtualization
  • MANO management and orchestration
  • VNF Virtualized Network Function
  • NFVI is used to provide the operating environment of VNF, including the required hardware and software resources; control.
  • a data security connection needs to be established between the VNFM and the VNF, and a password needs to be transmitted when establishing a data security connection.
  • the VNFM could send the generated password to the VNF in clear text.
  • the VNFM is required to send the generated password to the VNF in the form of ciphertext.
  • a key can be configured when the VNFM and all VNFs are upgraded at the same time, so that the upgraded VNFM encrypts the password with the key configured during the upgrade, and sends the encrypted ciphertext to the VNF, VNF The ciphertext is decrypted using the key configured during the upgrade to obtain the password.
  • the embodiment of the present application provides a method for establishing a data security connection between a VNFM and a VNF, which is used in the VNFM.
  • the method includes: when the VNF is deployed, sending first encrypted configuration information to the VNF, the first encrypted configuration information
  • the configuration information carries indication information, and the indication information is used to indicate whether the VNFM supports the encryption function; the second encryption configuration information sent by the VNF is received, and the second encryption configuration information is used to indicate whether the VNF supports the encryption function.
  • the password is sent to the VNF in ciphertext; if it is determined that at least one of the VNFM and the VNF does not support the encryption function, the password is sent in plaintext form to send the password to the VNF.
  • the embodiment of the present application also provides a method for establishing a data security connection between a VNFM and a VNF, which is used in a VNF.
  • the method includes: when the VNF is deployed, receiving first encrypted configuration information sent by the VNFM, and the first encrypted configuration information is sent by the VNFM.
  • An encryption configuration information carries indication information, and the indication information is used to indicate whether the VNFM supports the encryption function; the second encryption configuration information is sent to the VNFM, and the second encryption configuration information is used to indicate whether the VNFM supports the encryption function.
  • Embodiments of the present application further provide a VNFM, where the VNFM includes: a first sending unit, configured to send first encrypted configuration information to the VNF when the VNF is deployed, where the first encrypted configuration information carries indication information, the indication information is used to indicate whether the VNFM supports the encryption function; the first receiving unit is used to receive the second encryption configuration information sent by the VNF, and the second encryption configuration information is used to indicate the VNF Whether the encryption function is supported; the first sending unit is further configured to send the password to the VNF in the form of ciphertext if it is determined that both the VNFM and the VNF support the encryption function; the first sending unit is also configured to use If it is determined that at least one of the VNFM and the VNF does not support an encryption function, the password is sent to the VNF in clear text.
  • a first sending unit configured to send first encrypted configuration information to the VNF when the VNF is deployed, where the first encrypted configuration information carries indication information, the indication information is used to indicate whether the VNFM supports the encryption
  • Embodiments of the present application further provide a VNF, where the VNF includes: a second receiving unit, configured to receive first encrypted configuration information sent by the VNFM when the VNF is deployed, where the first encrypted configuration information carries There is indication information, the indication information is used to indicate whether the VNFM supports the encryption function; the second sending unit is used to send the second encryption configuration information to the VNFM, and the second encryption configuration information is used to indicate the VNF Whether the encryption function is supported; the second receiving unit is further configured to receive the password sent by the VNFM in the form of cipher text, and the password is the password used when the VNFM determines that both the VNFM and the VNF support the encryption function. or, the second receiving unit is further configured to receive a password sent by the VNFM in clear text, where the password is determined by the VNFM that at least one of the VNFM and the VNF does not support encryption function, sent in clear text.
  • An embodiment of the present application provides a system, where the system includes a VNFM and a VNF; the VNFM is the above-mentioned VNFM; and the VNF is the above-mentioned VNF.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned method for establishing a data security connection between a VNFM and a VNF is implemented.
  • FIG. 1 is a flowchart of a method for establishing a data security connection between a VNFM and a VNF according to Embodiment 1 of the present application;
  • FIG. 2 is a flowchart of a negotiated key update between a VNFM and a VNF according to Embodiment 2 of the present application;
  • FIG. 3 is a flow chart of the VNFM provided in Embodiment 3 of the present application carrying the ciphertext in the lifecycle operation request and sending it to the VNF;
  • FIG. 4 is a flow chart of the VNFM provided in Embodiment 3 of the present application carrying the ciphertext in the response message and sending it to the VNF;
  • FIG. 5 is a flowchart of the VNF provided in Embodiment 3 of the present application carrying the ciphertext in the lifecycle operation request and sending it to the VNFM;
  • FIG. 6 is a schematic structural diagram of a VNFM provided in Embodiment 4 of the present application.
  • FIG. 7 is a schematic structural diagram of a VNF provided by Embodiment 5 of the present application.
  • FIG. 8 is a schematic structural diagram of a system provided in Embodiment 6 of the present application.
  • the main purpose of the embodiments of the present application is to provide a method, device and system for establishing a data security connection between a VNFM and a VNF, which can realize a smooth transition between the VNFM and the VNF from not supporting the encryption function to supporting the encryption function, so that the system has a relatively high performance.
  • Good compatibility can also solve the problems of long-term change of keys and loss of keys.
  • the first embodiment of the present application provides a method for establishing a data security connection between a VNFM and a VNF.
  • the method can be applied to a system including a VNFM and a VNF, and the method includes the following steps:
  • Step S101 when the VNF is deployed, the VNFM sends first encryption configuration information to the VNF, where the first encryption configuration information carries indication information, and the indication information is used to indicate whether the VNFM supports the encryption function.
  • VNFM can create a VNF first, and then deploy the VNF.
  • the VNFM can first determine whether it supports the encryption function according to its own configuration. If the VNFM itself supports the encryption function, it generates indication information for indicating that the VNFM supports the encryption function, and carries the indication information in the first encryption configuration. The information is sent to the VNF; if the VNFM itself does not support the encryption function, the indication information for indicating that the VNFM does not support the encryption function is generated, and the indication information is carried in the first encryption configuration information and sent to the VNF.
  • the key used to encrypt the password for the first time when the VNF is deployed is called the first key, and the first key is usually preconfigured.
  • the first key is configured in the VNFM. Then, the VNFM needs to add the first key to the first encryption configuration information and send it to the VNF. In this case, at least Including indication information and the first key.
  • the first key can be configured in the configuration file of the VNFM and the configuration file of the VNF respectively. Then, the VNFM does not need to add the first key to the first encryption configuration information and send it to the VNF.
  • the first encryption configuration information includes at least indication information.
  • Step S102 the VNF receives the first encrypted configuration information sent by the VNFM.
  • the VNF receives the first encrypted configuration information sent by the VNFM, and stores the first encrypted configuration information.
  • the VNF may store the first encrypted configuration information in a database.
  • Step S103 the VNF sends second encryption configuration information to the VNFM, where the second encryption configuration information is used to indicate whether the VNF supports the encryption function.
  • the VNF can first determine whether it supports the encryption function according to its own configuration. If the VNF itself supports the encryption function, it generates second encryption configuration information for indicating that the VNF supports the encryption function, and sends the second encryption configuration information to the VNFM; If the VNF itself does not support the encryption function, the second encryption configuration information for indicating that the VNF does not support the encryption function is generated, and the second encryption configuration information is sent to the VNFM.
  • Step S104 the VNFM receives the second encrypted configuration information sent by the VNF.
  • the VNFM receives the second encrypted configuration information sent by the VNF, and stores the second encrypted configuration information.
  • the VNFM may store the second encrypted configuration information in a database.
  • the VNFM can continue to deploy the VNF.
  • the VNFM can determine whether both the VNFM and the VNF support the encryption function according to the first encryption configuration information and the stored second encryption configuration information; when both the VNFM and the VNF support the encryption function , perform step S105; when the VNFM does not support the encryption function, and the VNF supports the encryption function, or, when the VNF does not support the encryption function, and the VNFM supports the encryption function, or, when both the VNFM and the VNF support the encryption function, step S107 is performed.
  • Step S105 if it is determined that both the VNFM and the VNF support the encryption function, the VNFM sends the password to the VNF in the form of cipher text, and step S106 is executed.
  • the VNFM obtains the first key from the first encryption configuration information; or, when the VNFM configuration file includes the first key, obtains the first key from the VNFM's configuration file. Obtain the first key from the configuration file; then encrypt the password with the first key to obtain the first ciphertext; send the first ciphertext to the VNF.
  • encryption algorithms for encrypting the password by using the first key and this embodiment does not limit the specific algorithm.
  • Step S106 the VNF receives the password sent by the VNFM in the form of cipher text, and the process ends.
  • the VNF Since the VNF does not know whether the VNFM sends the password in cipher text or in plain text, the VNF can first determine whether both the VNFM and the VNF support the encryption function according to the stored first encryption configuration information and second encryption configuration information. In the current scenario, both the VNFM and the VNF support the encryption function. The VNF determines that it has received the first ciphertext and needs to decrypt the first ciphertext to obtain the password.
  • the VNF obtains the first key from the first encryption configuration information; or, when the VNF configuration file includes the first key, the VNF obtains the first key from the VNF
  • the first key is obtained from the configuration file of the device; the first ciphertext is decrypted with the first key to obtain the password.
  • the decryption algorithm for decrypting the first ciphertext by using the first key corresponds to the encryption algorithm in step S105.
  • Step S107 if it is determined that at least one of the VNFM and the VNF does not support the encryption function, the VNFM sends the password to the VNF in plain text, and step S108 is executed.
  • the VNFM can send the password directly to the VNF.
  • Step S108 the VNF receives the password sent by the VNFM in clear text.
  • the VNF can first determine whether both the VNFM and the VNF support the encryption function according to the stored first encryption configuration information and second encryption configuration information. In the current scenario, the VNFM does not support the encryption function, but the VNF supports the encryption function, or the VNF does not support the encryption function, but the VNFM supports the encryption function, or the VNFM and the VNF do not support the encryption function, and the VNF determines that the password in plain text is received.
  • step S101, step S104, step S105, and step S107 can be independently implemented as VNFM side embodiments, and step S102, step S103, step S106 and step S108 can be independently implemented as VNF side embodiments.
  • the VNFM in the process of deploying the VNF, sends the first encryption configuration information to the VNF, and the first encryption configuration information carries the information used to indicate whether the VNFM supports the encryption function.
  • the VNF sends the second encryption configuration information to the VNFM
  • the second encryption configuration information is used to indicate whether the VNF supports the encryption function, when it is determined according to the first encryption configuration information and the second encryption configuration information that both the VNFM and the VNF support the encryption function , send the password to the VNF in cipher text; when it is determined according to the first encryption configuration information and the second encryption configuration information that at least one of the VNFM and the VNF does not support the encryption function, send the password to the VNF in plain text.
  • the system can include both devices that support encryption (ie, upgraded devices) and devices that do not support encryption (ie, devices before the upgrade). It is not required that all devices in the system be upgraded at the same time. The smooth transition from not supporting encryption function to supporting encryption function makes the system have better compatibility.
  • the second embodiment of the present application provides a method for establishing a data security connection between a VNFM and a VNF.
  • the VNFM and the VNF can also generate a second key through negotiation, and use the second key to generate a second key.
  • the purpose of updating the key can be achieved, and the problem that the key remains unchanged for a long time or the loss of the key affects the secure connection of the data can be solved.
  • the method may include:
  • Step S201 the VNF sends a key exchange request to the VNFM, where the key exchange request carries the first key exchange number.
  • the first key exchange number is generated by the VNF according to a predetermined algorithm.
  • the predetermined algorithm may be a Diffie-Hellman algorithm.
  • the VNF may send a key exchange request to the VNFM in the following three situations, and the three situations will be described below.
  • the VNF After the VNF deployment is completed, the VNF sends a key exchange request to the VNFM.
  • the VNFM After the VNF deployment is completed, the VNFM will send a deployment completion notification message to the VNF, and the VNF receives the deployment completion notification message sent by the VNFM, and sends a key exchange request to the VNFM triggered by the notification message.
  • the notification message may be a post-instantiation extension request.
  • the VNF After receiving the lifecycle operation request sent by the VNFM, the VNF sends a key exchange request to the VNFM.
  • the life cycle operation request is an operation request used to control the life cycle of the VNF, which can be sent by the VNFM to the VNF, such as the life cycle operation request of adding a virtual machine in the VNF, the life cycle operation request of modifying the VNF capacity, etc. etc.; it can also be sent by the VNF to the VNFM, for example, a lifecycle operation request for self-healing, a lifecycle operation request for system restart, and so on.
  • the VNF can be set to send a key exchange request after receiving any life cycle operation request, or the VNF can be set to send a key exchange request after receiving some specific life cycle operation requests, and can also be set to receive No key exchange request is sent after any lifecycle operation request.
  • the life cycle operation request that triggers the VNF to send the key exchange request is referred to as the fourth life cycle operation request.
  • the VNFM sends a fourth life cycle operation request to the VNF, and the VNF receives the fourth life cycle operation request sent by the VNFM, and sends a key exchange request to the VNFM under the trigger of the fourth life cycle operation request.
  • the VNF After a predetermined lifecycle operation occurs in the VNF, the VNF sends a key exchange request to the VNFM.
  • a key exchange request is sent to the VNFM under the trigger of the predetermined life cycle operation.
  • the predetermined life cycle operation may be preset. For example, if the predetermined life cycle operation is set to system restart, the VNF sends a key exchange request to the VNFM after the system restarts.
  • the VNF after the system restarts, the VNF also needs to send a life cycle operation request for system restart to the VNFM, and the order of sending the life cycle operation request and the key exchange request is not limited in this embodiment.
  • Step S202 the VNFM receives a key exchange request sent by the VNF, where the key exchange request carries the first key exchange number.
  • Step S203 the VNFM generates a second key exchange number according to the key exchange request, and sends the second key exchange number to the VNF.
  • the VNFM may generate the second key exchange number according to a predetermined algorithm after receiving the key exchange request.
  • the predetermined algorithm may be a Diffie-Hellman algorithm.
  • Step S204 the VNFM generates a second key according to the first key exchange number.
  • the VNFM can input the first key exchange number into a predetermined algorithm to obtain the second key.
  • the predetermined algorithm may be a Diffie-Hellman algorithm.
  • the VNFM stores the generated second key encrypted in the database.
  • Step S205 the VNF receives the second key exchange number sent by the VNFM.
  • this embodiment does not limit the sequential execution order of step S204 and step S205.
  • Step S206 the VNF generates a second key according to the second key exchange number.
  • the VNF can input the second key exchange number into a predetermined algorithm to obtain the second key.
  • the predetermined algorithm may be a Diffie-Hellman algorithm.
  • the VNF stores the generated second key encrypted in the database.
  • the predetermined algorithm can generate the same output (second key) according to different inputs (the first key exchange number and the second key exchange number).
  • step S202, step S203 and step S204 may be independently implemented as VNFM side embodiments, and step S201, step S205 and step S206 may be independently implemented as VNF side embodiments.
  • the third embodiment of the present application provides a method for establishing a data security connection between a VNFM and a VNF. After the second key is generated, the VNFM and the VNF can use the second key for ciphertext transmission. The following three types of transmission scenarios are explained.
  • the VNFM carries the ciphertext in the lifecycle operation request and sends it to the VNF.
  • Step S301 the VNFM uses the second key to encrypt the first content to obtain a second ciphertext, where the first content is the password in the request content in the first lifecycle operation request, or the first content is in the request content. password and other information.
  • the VNFM determines that it needs to send the first life cycle operation request to the VNF, it reads the second key from the database, and then obtains the first content in the request content in the first life cycle request, and uses the second key to pair the first key.
  • the content is encrypted to obtain the second ciphertext.
  • the VNFM may only determine the password as the first content, and at this time, the VNFM only encrypts the password in the request content without encrypting other information in the request content; or , the VNFM can determine both the password and other information as the first content, and at this time, the VNFM encrypts the password and other information in the requested content.
  • the VNFM may determine the password as the first content, and at this time, the VNFM encrypts the password in the request content.
  • Step S302 the VNFM carries the second ciphertext in the first lifecycle operation request and sends it to the VNF.
  • Step S303 the VNF receives the first lifecycle operation request sent by the VNFM, where the first lifecycle operation request carries the second ciphertext.
  • Step S304 the VNF uses the second key to decrypt the second ciphertext to obtain the first content.
  • the VNF can read the second ciphertext from the first lifecycle operation request, then read the second key from the database, and decrypt the second ciphertext by using the second key to obtain the first content.
  • the decryption algorithm for decrypting the second ciphertext by using the second key corresponds to the encryption algorithm in step S301.
  • step S301 and step S302 may be independently implemented as an embodiment on the VNFM side, and step S303 and step S304 may be independently implemented as an embodiment on the VNF side.
  • the VNFM carries the ciphertext in a response message and sends it to the VNF, and the response message is used to respond to the lifecycle operation request sent by the VNF.
  • Step S401 the VNF sends a second lifecycle operation request to the VNFM.
  • Step S402 the VNFM receives the second lifecycle operation request sent by the VNF.
  • Step S403 the VNFM uses the second key to encrypt the second content to obtain a third ciphertext, where the second content is the password in the response content in the response message, or the second content is the password in the response content and other content. information, and the response message is used to respond to the second lifecycle operation request.
  • the VNFM After the VNFM receives the second life cycle operation request, it needs to send a response message to the VNF. At this time, the VNFM reads the second key from the database, and then obtains the second content in the response content in the response message. The key encrypts the second content to obtain the third ciphertext.
  • the VNFM may only determine the password as the second content, and at this time, the VNFM only encrypts the password in the response content without encrypting other information in the response content; or , the VNFM can determine the password and other information as the second content, and at this time, the VNFM encrypts the password and other information in the response content.
  • the VNFM may determine the password as the second content, and at this time, the VNFM encrypts the password in the response content.
  • Step S404 the VNFM carries the third ciphertext in the response message and sends it to the VNF.
  • Step S405 the VNF receives a response message sent by the VNFM, where the response message carries the third ciphertext.
  • Step S406 the VNF uses the second key to decrypt the third ciphertext to obtain the second content.
  • the VNF can read the third ciphertext from the response message, then read the second key from the database, and use the second key to decrypt the third ciphertext to obtain the second content.
  • the decryption algorithm for decrypting the third ciphertext by using the second key corresponds to the encryption algorithm in step S403.
  • step S402, step S403 and step S404 may be independently implemented as VNFM side embodiments
  • step S401, step S405 and step S406 may be independently implemented as VNF side embodiments.
  • the VNF carries the ciphertext in the lifecycle operation request and sends it to the VNFM.
  • Step S501 the VNF uses the second key to encrypt the third content to obtain a fourth ciphertext, where the third content is the password in the request content in the third life cycle operation request, or the third content is in the request content. password and other information.
  • the VNF When the VNF determines that it needs to send the third life cycle operation request to the VNFM, it reads the second key from the database, and then obtains the third content in the request content in the third life cycle request, and uses the second key to pair the third The content is encrypted to obtain the fourth ciphertext.
  • the VNF may only determine the password as the third content, and at this time, the VNF only encrypts the password in the request content and does not encrypt other information in the request content; or , the VNF can determine the password and other information as the third content, and at this time, the VNF encrypts the password and other information in the requested content.
  • the VNF may determine the password as the third content, and at this time, the VNF encrypts the password in the request content.
  • Step S502 the VNF carries the fourth ciphertext in the third lifecycle operation request and sends it to the VNFM.
  • Step S503 the VNFM receives the third lifecycle operation request sent by the VNF, where the third lifecycle operation request carries the fourth ciphertext.
  • Step S504 the VNFM uses the second key to decrypt the fourth ciphertext to obtain the third content.
  • the VNFM can read the fourth ciphertext from the third life cycle operation request, then read the second key from the database, and use the second key to decrypt the fourth ciphertext to obtain the third content.
  • the decryption algorithm for decrypting the fourth ciphertext by using the second key corresponds to the encryption algorithm in step S501.
  • step S503 and step S504 may be independently implemented as an embodiment on the VNFM side, and step S501 and step S502 may be independently implemented as an embodiment on the VNF side.
  • the fourth embodiment of the present application provides a VNFM, and the VNFM may include:
  • the first sending unit 601 is configured to send first encryption configuration information to the VNF when the VNF is deployed, where the first encryption configuration information carries indication information, and the indication information is used to indicate whether the VNFM supports the encryption function.
  • the first receiving unit 602 is configured to receive second encryption configuration information sent by the VNF, where the second encryption configuration information is used to indicate whether the VNF supports an encryption function.
  • the first sending unit 601 is further configured to send the password to the VNF in the form of cipher text if it is determined that both the VNFM and the VNF support the encryption function.
  • the first sending unit 601 is further configured to send the password to the VNF in plain text if it is determined that at least one of the VNFM and the VNF does not support the encryption function.
  • the VNFM may further include: a first processing unit 603, configured to obtain the first key from the first encryption configuration information when the first encryption configuration information also includes the first key; When the configuration file includes the first key, the first key is obtained from the configuration file of the VNFM.
  • the first processing unit 603 is further configured to encrypt the password by using the first key to obtain the first ciphertext.
  • the first sending unit 601 is configured to send the first ciphertext to the VNF.
  • the first processing unit 603 is further configured to: after the first receiving unit 602 receives the second encrypted configuration information sent by the VNF, store the second encrypted configuration information.
  • the password needs to be transmitted, it is determined whether the VNFM and the VNF both support the encryption function according to the first encryption configuration information and the stored second encryption configuration information.
  • the first receiving unit 602 is further configured to receive a key exchange request sent by the VNF after the first sending unit 601 sends the password to the VNF in ciphertext, where the key exchange request carries the first key. number of exchanges.
  • the first processing unit 603 is further configured to generate a second key exchange number according to the key exchange request.
  • the first sending unit 601 is further configured to send the second key exchange number to the VNF, where the second key exchange number is used for the VNF to generate a second key, and the second key is used to update the first key.
  • the first processing unit 603 is further configured to generate a second key according to the first key exchange number.
  • the first processing unit 603 is further configured to use the second key to encrypt the first content after generating the second key according to the first key exchange number to obtain a second ciphertext, where the first content is: The password in the request content in the first life cycle operation request, or the first content is the password and other information in the request content.
  • the first sending unit 601 is further configured to carry the second ciphertext in the first lifecycle operation request and send it to the VNF, where the second ciphertext is decrypted by the VNF using the second key to obtain the first content.
  • the first receiving unit 602 is further configured to receive the second lifecycle operation request sent by the VNF after the first processing unit 603 generates the second key according to the first key exchange number;
  • the first processing unit 603 is further configured to use the second key to encrypt the second content to obtain a third ciphertext, where the second content is the password in the response content in the response message, or the second content is in the response content. password and other information, the response message is used to respond to the second life cycle operation request;
  • the first sending unit 601 is further configured to carry the third ciphertext in the response message and send it to the VNF, where the third ciphertext is decrypted by the VNF using the second key to obtain the second content.
  • the first receiving unit 602 is further configured to receive the third lifecycle operation request sent by the VNF after the first processing unit 603 generates the second key according to the first key exchange number, the third lifecycle operation
  • the request carries a fourth ciphertext, and the fourth ciphertext is obtained by the VNF using the second key to encrypt the third content, and the third content is the password in the request content in the third lifecycle operation request, or,
  • the third content is the password and other information in the requested content;
  • the first processing unit 603 is further configured to use the second key to decrypt the fourth ciphertext to obtain the third content.
  • the first sending unit 601 is further configured to send a notification message of deployment completion to the VNF before the first receiving unit 602 receives the key exchange request sent by the VNF, where the VNF is configured to send the key exchange request triggered by the notification message. a key exchange request; or, send a fourth life cycle operation request to the VNF, where the VNF is used to send a key exchange request under the trigger of the fourth life cycle operation request; or,
  • a key exchange request is sent after a predetermined lifecycle operation occurs in the VNF.
  • the fifth embodiment of the present application provides a VNF, and the VNF may include:
  • the second receiving unit 701 is configured to receive the first encryption configuration information sent by the VNFM when the VNF is deployed, where the first encryption configuration information carries indication information, and the indication information is used to indicate whether the VNFM supports the encryption function.
  • the second sending unit 702 is configured to send second encryption configuration information to the VNFM, where the second encryption configuration information is used to indicate whether the VNF supports the encryption function.
  • the second receiving unit 701 is further configured to receive the password sent by the VNFM in the form of cipher text, and the password is sent in the form of cipher text when the VNFM determines that both the VNFM and the VNF support the encryption function; or, the second receiving unit 701 is also configured to use When receiving the password sent by the VNFM in clear text, the password is sent in clear text when the VNFM determines that at least one of the VNFM and the VNF does not support the encryption function.
  • the VNF may further include: a second processing unit 703 configured to store the first encrypted configuration information after the second receiving unit 701 receives the first encrypted configuration information sent by the VNFM.
  • a second processing unit 703 configured to store the first encrypted configuration information after the second receiving unit 701 receives the first encrypted configuration information sent by the VNFM.
  • the second processing unit 703 is further configured to, after the second receiving unit 701 receives the password sent by the VNFM in cipher text, determine whether both the VNFM and the VNF support the encryption function according to the second encryption configuration information and the stored first encryption configuration information; If it is determined that both the VNFM and the VNF support the encryption function, when the first encryption configuration information also includes the first key, the first key is obtained from the first encryption configuration information; or, when the configuration file of the VNF includes the first key When the key is obtained, the first key is obtained from the configuration file of the VNF; the first key is used to decrypt the first cipher text sent in the form of cipher text to obtain the password.
  • the second sending unit 702 is further configured to send a key exchange request to the VNFM after the second receiving unit 701 receives the password sent by the VNFM in ciphertext, where the key exchange request carries the first key.
  • the exchange number, the first key exchange number is used for the VNFM to generate a second key, and the second key is used to update the first key.
  • the second receiving unit 701 is further configured to receive a second key exchange number sent by the VNFM, where the second key exchange number is generated by the VNFM according to the key exchange request.
  • the second processing unit 703 is further configured to generate a second key according to the second key exchange number.
  • the second receiving unit 701 is further configured to receive the first lifecycle operation request sent by the VNFM after the second processing unit 703 generates the second key according to the second key exchange number, the first lifecycle operation
  • the request carries the second ciphertext
  • the second ciphertext is obtained by the VNFM encrypting the first content with the second key
  • the first content is the password in the request content in the first lifecycle operation request, or,
  • the first content is the password and other information in the requested content.
  • the second processing unit 703 is further configured to use the second key to decrypt the second ciphertext to obtain the first content.
  • the second sending unit 702 is further configured to send the second lifecycle operation request to the VNFM after the second processing unit 703 generates the second key according to the second key exchange number.
  • the second receiving unit 701 is further configured to receive a response message sent by the VNFM, where the response message is used to respond to the second lifecycle operation request, and the response message carries a third ciphertext, and the third ciphertext is the second ciphertext adopted by the VNFM.
  • the second content is obtained by encrypting the second content with the key, and the second content is the password in the response content in the response message, or the second content is the password and other information in the response content.
  • the second processing unit 703 is further configured to use the second key to decrypt the third ciphertext to obtain the second content.
  • the second processing unit 703 is further configured to use the second key to encrypt the third content after generating the second key according to the second key exchange number to obtain a fourth ciphertext, where the third content is: The password in the request content in the third life cycle operation request, or the third content is the password and other information in the request content.
  • the second sending unit 702 is further configured to carry the fourth ciphertext in the third life cycle operation request and send it to the VNFM, where the fourth ciphertext is decrypted by the VNFM using the generated second key to obtain the third content.
  • the second receiving unit 701 before sending the key exchange request to the VNFM, the second receiving unit 701 is further configured to receive a notification message of deployment completion sent by the VNFM, and the second sending unit 702 is further configured to perform sending to the VNFM under the trigger of the notification message.
  • the step of the key exchange request; or, the second receiving unit 701 is further configured to receive the fourth lifecycle operation request sent by the VNFM, and the second sending unit 702 is further configured to perform sending to the VNFM under the trigger of the fourth lifecycle operation request
  • the step of key exchange request; or, the second sending unit 702 is further configured to execute the step of sending a key exchange request to the VNFM under the trigger of the predetermined life cycle operation after the predetermined life cycle operation occurs in the VNF.
  • the sixth embodiment of the present application provides a system, which includes a VNFM801 and a VNF802, and the VNFM801 may be the VNFM shown in FIG. 6 , and the VNF802 may be the VNF shown in FIG. 7 .
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may Executed cooperatively by several physical components.
  • Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • Computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .
  • modulated data signal such as a carrier wave or other transport mechanism

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种VNFM与VNF建立数据安全连接的方法、设备及系统，涉及虚拟化资源编排和操作技术领域。该方法包括：在部署VNF时，向VNF发送第一加密配置信息，第一加密配置信息中的指示信息用于指示VNFM是否支持加密功能；接收VNF发送的第二加密配置信息，第二加密配置信息用于指示VNF是否支持加密功能；若确定VNFM和VNF都支持加密功能，则以密文形式向VNF发送密码；若确定VNFM和VNF中的至少一个不支持加密功能，则以明文形式向VNF发送密码。

Description

VNFM与VNF建立数据安全连接的方法、设备及系统
交叉引用
本申请基于申请号为“202011576431.4”、申请日为2020年12月28日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请涉及虚拟化资源编排和操作技术领域，尤其涉及一种VNFM与VNF建立数据安全连接的方法、设备及系统。
背景技术
网络功能虚拟化(Network Function Virtualization，简称NFV)架构的目的是取代通信网络中私有、专用和封闭的网元，实现统一通用硬件平台+业务逻辑软件的开放架构。NFV架构中包括网络功能虚拟化基础设施(NFV infrastructure，简称NFVI)，管理与编排(Management and Orchestration，简称MANO)和多个虚拟网络功能(Virtualized Network Function,简称VNF)。其中，NFVI用来提供VNF的运行环境，包括所需的硬件及软件资源；MANO中的VNF管理器(VNF Manager，简称VNFM)用来对VNF的生命周期(实例化、配置、关闭等)进行控制。
VNFM与VNF之间需要建立数据安全连接，而在建立数据安全连接时需要传输密码。过去，在安全性要求不高的情况下，VNFM可以采用明文形式将生成的密码发送给VNF。近年来，随着安全性需求的提高，要求VNFM采用密文形式将生成的密码发送给VNF。为了满足这一要求，可以在VNFM和所有的VNF同时升级时配置密钥，以使升级后的VNFM采用升级时配置的密钥对密码进行加密，将加密后得到的密文发送给VNF，VNF采用升级时配置的密钥对该密文进行解密，从而得到密码。
由于只有在VNFM和所有的VNF同时升级后才可以得到密钥，所以，要求VNFM和所有的VNF同时升级，而同时升级会导致系统短时间内无法正常工作，从而影响业务的正常运行，且同时升级VNFM和所有的VNF对运维要求较高，实施难度较大。
发明内容
本申请的实施例提供了一种VNFM与VNF建立数据安全连接的方法，用于VNFM中，所述方法包括：在部署VNF时，向所述VNF发送第一加密配置信息，所述第一加密配置信 息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；接收所述VNF发送的第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；若确定所述VNFM和所述VNF都支持加密功能，则以密文形式向所述VNF发送密码；若确定所述VNFM和所述VNF中的至少一个不支持加密功能，则以明文形式向所述VNF发送密码。
本申请的实施例还提供了一种VNFM与VNF建立数据安全连接的方法，用于VNF中，所述方法包括：在部署所述VNF时，接收VNFM发送的第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；向所述VNFM发送第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；接收所述VNFM以密文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF都支持加密功能时，以密文形式发送的；或者，接收所述VNFM以明文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF中的至少一个不支持加密功能时，以明文形式发送的。
本申请的实施例还提供了一种VNFM，所述VNFM包括：第一发送单元，用于在部署VNF时，向所述VNF发送第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；第一接收单元，用于接收所述VNF发送的第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；所述第一发送单元，还用于若确定所述VNFM和所述VNF都支持加密功能，则以密文形式向所述VNF发送密码；所述第一发送单元，还用于若确定所述VNFM和所述VNF中的至少一个不支持加密功能，则以明文形式向所述VNF发送密码。
本申请的实施例还提供了一种VNF，所述VNF包括：第二接收单元，用于在部署所述VNF时，接收VNFM发送的第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；第二发送单元，用于向所述VNFM发送第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；所述第二接收单元，还用于接收所述VNFM以密文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF都支持加密功能时，以密文形式发送的；或者，所述第二接收单元，还用于接收所述VNFM以明文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF中的至少一个不支持加密功能时，以明文形式发送的。
本申请实施例提供了一种系统，所述系统包括VNFM和VNF；所述VNFM为如上所述的VNFM；所述VNF为如上所述的VNF。
本申请的实施例还提供了一种计算机可读存储介质，存储有计算机程序，计算机程序被处理器执行时实现上述的VNFM与VNF建立数据安全连接的方法。
附图说明
图1是本申请实施例一提供的一种VNFM与VNF建立数据安全连接的方法的流程图；
图2是本申请实施例二提供的一种VNFM与VNF之间协商密钥更新的流程图；
图3是本申请实施例三提供的VNFM将密文携带在生命周期操作请求中发送给VNF的流程图；
图4是本申请实施例三提供的VNFM将密文携带在响应消息中发送给VNF的流程图；
图5是本申请实施例三提供的VNF将密文携带在生命周期操作请求中发送给VNFM的流程图；
图6是本申请实施例四提供的VNFM的结构示意图；
图7是本申请实施例五提供的VNF的结构示意图；
图8是本申请实施例六提供的系统的结构示意图。
具体实施方式
本申请的实施例的主要目的在于提供一种VNFM与VNF建立数据安全连接的方法、设备及系统，能够实现VNFM与VNF之间从不支持加密功能到支持加密功能的平滑过渡，使系统具有较好的兼容性，还可以解决密钥长期不变和密钥丢失的问题。
下面将结合附图对本申请技术方案进行详细说明。在本申请的描述中，需要理解地是，术语“第一”、“第二”、“第三”、“第四”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量，仅用来区分不同的组成部分。
如图1所示，本申请的第一实施例提供了一种VNFM与VNF建立数据安全连接的方法，该方法可以应用于包括VNFM和VNF的系统中，该方法包括以下步骤：
步骤S101，在部署VNF时，VNFM向VNF发送第一加密配置信息，该第一加密配置信息中携带有指示信息，该指示信息用于指示VNFM是否支持加密功能。
VNFM可以先创建一个VNF，再对该VNF进行部署。在部署VNF时，VNFM可以先根据自身的配置确定自身是否支持加密功能，若VNFM自身支持加密功能，则生成用于指示VNFM支持加密功能的指示信息，并将该指示信息携带在第一加密配置信息中发送给VNF；若VNFM自身不支持加密功能，则生成用于指示VNFM不支持加密功能的指示信息，并将该指示信息携带在第一加密配置信息中发送给VNF。
本实施例中将部署VNF时首次用来加密密码的密钥称为第一密钥，且第一密钥通常是预先配置的。在第一种实现方式中，只在VNFM中配置第一密钥，那么，VNFM需要将该第一密钥添加到第一加密配置信息中发送给VNF，此时，第一加密配置信息中至少包括指示信息和第一密钥。在第二种实现方式中，可以在VNFM的配置文件和VNF的配置文件中分别配置第一密钥，那么，VNFM无需将第一密钥添加到第一加密配置信息中发送给VNF，此时，第一加密配置信息中至少包括指示信息。
步骤S102，VNF接收VNFM发送的第一加密配置信息。
VNF接收VNFM发送的第一加密配置信息，并对该第一加密配置信息进行存储。可选的，VNF可以将第一加密配置信息存储到数据库中。
步骤S103，VNF向VNFM发送第二加密配置信息，该第二加密配置信息用于指示VNF是否支持加密功能。
VNF可以先根据自身的配置确定自身是否支持加密功能，若VNF自身支持加密功能，则生成用于指示VNF支持加密功能的第二加密配置信息，并将该第二加密配置信息发送给VNFM；若VNF自身不支持加密功能，则生成用于指示VNF不支持加密功能的第二加密配置信息，将该第二加密配置信息发送给VNFM。
步骤S104，VNFM接收VNF发送的第二加密配置信息。
VNFM接收VNF发送的第二加密配置信息，并对该第二加密配置信息进行存储。可选的，VNFM可以将第二加密配置信息存储到数据库中。
VNFM可以继续部署VNF，在确定需要向VNF发送密码时，VNFM可以根据第一加密配置信息和存储的第二加密配置信息确定VNFM和VNF是否都支持加密功能；当VNFM和VNF都支持加密功能时，执行步骤S105；当VNFM不支持加密功能，VNF支持加密功能时，或者，当VNF不支持加密功能，VNFM支持加密功能时，或者，当VNFM和VNF都不支持加密功能时，执行步骤S107。
步骤S105，若确定VNFM和VNF都支持加密功能，则VNFM以密文形式向VNF发送密码，执行步骤S106。
具体的，当第一加密配置信息中还包括第一密钥时，VNFM从第一加密配置信息中获取第一密钥；或者，当VNFM的配置文件中包括第一密钥时，从VNFM的配置文件中获取第一密钥；再采用第一密钥对密码进行加密，得到第一密文；将该第一密文发送给VNF。其中，采用第一密钥对密码进行加密的加密算法有很多种，本实施例不对具体算法作限定。
步骤S106，VNF接收VNFM以密文形式发送的密码，流程结束。
由于VNF并不知道VNFM是以密文形式还是以明文形式发送密码，所以，VNF可以先根据存储的第一加密配置信息和第二加密配置信息确定VNFM和VNF是否都支持加密功能。在当前场景下，VNFM和VNF都支持加密功能，VNF确定接收到第一密文，需要对该第一密文进行解密，得到密码。具体的，当第一加密配置信息中还包括第一密钥时，VNF从第一加密配置信息中获取第一密钥；或者，当VNF的配置文件中包括第一密钥时，VNF从VNF的配置文件中获取第一密钥；采用第一密钥对第一密文进行解密，得到密码。其中，采用第一密钥对第一密文进行解密的解密算法与步骤S105中的加密算法相对应。
步骤S107，若确定VNFM和VNF中的至少一个不支持加密功能，则VNFM以明文形式向VNF发送密码，执行步骤S108。
VNFM可以直接将密码发送给VNF。
步骤S108，VNF接收VNFM以明文形式发送的密码。
由于VNF并不知道VNFM是以密文形式还是以明文形式发送密码，所以，VNF可以先根据存储的第一加密配置信息和第二加密配置信息确定VNFM和VNF是否都支持加密功能。在当前场景下，VNFM不支持加密功能，VNF支持加密功能，或者，VNF不支持加密功能，VNFM支持加密功能，或者，VNFM和VNF都不支持加密功能，VNF确定接收到明文形式的密码。
其中，步骤S101、步骤S104、步骤S105和步骤S107可以单独实现为VNFM侧的实施例，步骤S102、步骤S103、步骤S106和步骤S108可以单独实现为VNF侧的实施例。
本申请实施例的VNFM与VNF建立数据安全连接的方法，通过在部署VNF的过程中，VNFM向VNF发送第一加密配置信息，该第一加密配置信息中携带有用于指示VNFM是否支持加密功能的指示信息，VNF向VNFM发送第二加密配置信息，该第二加密配置信息用于指示VNF是否支持加密功能，在根据第一加密配置信息和第二加密配置信息确定VNFM和VNF都支持加密功能时，以密文形式向VNF发送密码；在根据第一加密配置信息和第二加密配置信息确定VNFM和VNF中的至少一个不支持加密功能时，以明文形式向VNF发送密码。可见，系统中既可以包括支持加密功能的设备(即升级后的设备)，也可以包括不支持加密功能的设备(即升级前的设备)，不要求系统中的所有设备都同时升级，可以实现从不支持加密功能到支持加密功能的平滑过渡，使系统具有较好的兼容性。
本申请的第二实施例提供了一种VNFM与VNF建立数据安全连接的方法，在得到第一 密钥后，VNFM和VNF还可以通过协商来生成第二密钥，并采用第二密钥来更新第一密钥，从而可以达到更新密钥的目的，可以解决密钥长期不变或密钥丢失而影响数据安全连接的问题。如图2所示，该方法可以包括：
步骤S201，VNF向VNFM发送密钥交换请求，该密钥交换请求中携带有第一密钥交换数。
其中，第一密钥交换数是VNF根据预定算法生成的。可选的，预定算法可以是Diffie-Hellman(迪菲-赫尔曼)算法。
本实施例中，VNF可以在以下三种情况下向VNFM发送密钥交换请求，下面对这三种情况进行说明。
1)在VNF部署完成后，VNF向VNFM发送密钥交换请求。
在VNF部署完成后，VNFM会向VNF发送部署完成的通知消息，VNF接收VNFM发送的部署完成的通知消息，在该通知消息的触发下向VNFM发送密钥交换请求。可选的，该通知消息可以是实例化后扩展请求。
2)在接收到VNFM发送的生命周期操作请求后，VNF向VNFM发送密钥交换请求。
其中，生命周期操作请求是用来对VNF的生命周期进行控制的操作请求，可以由VNFM向VNF发送，例如在VNF中新增虚机的生命周期操作请求、修改VNF容量的生命周期操作请求等等；也可以由VNF向VNFM发送，例如请求自愈的生命周期操作请求、系统重启的生命周期操作请求等等。
本实施例中，可以设置VNF在接收到任一生命周期操作请求后都发送密钥交换请求，也可以设置VNF在接收到部分特定的生命周期操作请求后发送密钥交换请求，还可以设置接收到任一生命周期操作请求后都不发送密钥交换请求。为了便于与下文中出现的生命周期操作请求相区别，本实施例中将触发VNF发送密钥交换请求的生命周期操作请求称为第四生命周期操作请求。
在当前场景下，VNFM向VNF发送第四生命周期操作请求，VNF接收VNFM发送的第四生命周期操作请求，在该第四生命周期操作请求的触发下向VNFM发送密钥交换请求。
3)在VNF中发生预定生命周期操作后，VNF向VNFM发送密钥交换请求。
在VNF中发生预定生命周期操作后，在该预定生命周期操作的触发下向VNFM发送密钥交换请求。其中，预定生命周期操作可以预先设置，比如，将预定生命周期操作设置为系统重启，则在系统重启后，VNF向VNFM发送密钥交换请求。
需要说明的是，在系统重启后，VNF还需要向VNFM发送系统重启的生命周期操作请求，本实施例中不限定该生命周期操作请求和密钥交换请求的先后发送顺序。
步骤S202，VNFM接收VNF发送的密钥交换请求，该密钥交换请求中携带有第一密钥交换数。
步骤S203，VNFM根据密钥交换请求生成第二密钥交换数，并将该第二密钥交换数发送给VNF。
VNFM可以在接收到密钥交换请求后，根据预定算法生成第二密钥交换数。可选的，预定算法可以是Diffie-Hellman(迪菲-赫尔曼)算法。
步骤S204，VNFM根据第一密钥交换数生成第二密钥。
VNFM可以将第一密钥交换数输入预定算法中，得到第二密钥。可选的，预定算法可以是Diffie-Hellman(迪菲-赫尔曼)算法。
VNFM将生成的第二密钥加密存储在数据库中。
步骤S205，VNF接收VNFM发送的第二密钥交换数。
其中，本实施例不限定步骤S204和步骤S205的先后执行顺序。
步骤S206，VNF根据第二密钥交换数生成第二密钥。
VNF可以将第二密钥交换数输入预定算法中，得到第二密钥。可选的，预定算法可以是Diffie-Hellman(迪菲-赫尔曼)算法。
VNF将生成的第二密钥加密存储在数据库中。
需要说明的是，预定算法可以根据不同的输入(第一密钥交换数和第二密钥交换数)生成相同的输出(第二密钥)。
其中，步骤S202、步骤S203和步骤S204可以单独实现为VNFM侧的实施例，步骤S201、步骤S205和步骤S206可以单独实现为VNF侧的实施例。
本申请的第三实施例提供了一种VNFM与VNF建立数据安全连接的方法，在生成第二密钥后，VNFM和VNF可以利用第二密钥来进行密文传输，下面对三种传输场景进行说明。
1)如图3所示，VNFM将密文携带在生命周期操作请求中发送给VNF。
步骤S301，VNFM采用第二密钥对第一内容进行加密，得到第二密文，第一内容为第一生命周期操作请求中的请求内容中的密码，或者，第一内容为该请求内容中的密码和其他信息。
VNFM在确定需要向VNF发送第一生命周期操作请求时，从数据库中读取第二密钥，再 获取第一生命周期请求中的请求内容中的第一内容，采用第二密钥对第一内容进行加密，得到第二密文。
其中，当请求内容中包括密码和其他信息时，VNFM可以只将密码确定为第一内容，此时，VNFM只对请求内容中的密码进行加密，而不对请求内容中的其他信息进行加密；或者，VNFM可以将密码和其他信息都确定为第一内容，此时，VNFM对请求内容中的密码和其他信息都进行加密。当请求内容中只包括密码，而不包括其他信息时，VNFM可以将密码确定为第一内容，此时，VNFM对请求内容中的密码进行加密。
步骤S302，VNFM将第二密文携带在第一生命周期操作请求中发送给VNF。
步骤S303，VNF接收VNFM发送的第一生命周期操作请求，该第一生命周期操作请求中携带有第二密文。
步骤S304，VNF采用第二密钥对第二密文进行解密，得到第一内容。
VNF可以从第一生命周期操作请求中读取第二密文，再从数据库中读取第二密钥，采用第二密钥对第二密文进行解密，得到第一内容。其中，采用第二密钥对第二密文进行解密的解密算法与步骤S301中的加密算法相对应。
其中，步骤S301和步骤S302可以单独实现为VNFM侧的实施例，步骤S303和步骤S304可以单独实现为VNF侧的实施例。
2)如图4所示，VNFM将密文携带在响应消息中发送给VNF，该响应消息用于响应VNF发送的生命周期操作请求。
步骤S401，VNF向VNFM发送第二生命周期操作请求。
步骤S402，VNFM接收VNF发送的第二生命周期操作请求。
步骤S403，VNFM采用第二密钥对第二内容进行加密，得到第三密文，第二内容为响应消息中的响应内容中的密码，或者，第二内容为该响应内容中的密码和其他信息，响应消息用于响应第二生命周期操作请求。
VNFM在接收到第二生命周期操作请求后，需要向VNF发送响应消息，此时，VNFM从数据库中读取第二密钥，再获取响应消息中的响应内容中的第二内容，采用第二密钥对第二内容进行加密，得到第三密文。
其中，当响应内容中包括密码和其他信息时，VNFM可以只将密码确定为第二内容，此时，VNFM只对响应内容中的密码进行加密，而不对响应内容中的其他信息进行加密；或者，VNFM可以将密码和其他信息都确定为第二内容，此时，VNFM对响应内容中的密码和其他 信息都进行加密。当响应内容中只包括密码，而不包括其他信息时，VNFM可以将密码确定为第二内容，此时，VNFM对响应内容中的密码进行加密。
步骤S404，VNFM将第三密文携带在响应消息中发送给VNF。
步骤S405，VNF接收VNFM发送的响应消息，该响应消息中携带有第三密文。
步骤S406，VNF采用第二密钥对第三密文进行解密，得到第二内容。
VNF可以从响应消息中读取第三密文，再从数据库中读取第二密钥，采用第二密钥对第三密文进行解密，得到第二内容。其中，采用第二密钥对第三密文进行解密的解密算法与步骤S403中的加密算法相对应。
其中，步骤S402、步骤S403和步骤S404可以单独实现为VNFM侧的实施例，步骤S401、步骤S405和步骤S406可以单独实现为VNF侧的实施例。
3)如图5所示，VNF将密文携带在生命周期操作请求中发送给VNFM。
步骤S501，VNF采用第二密钥对第三内容进行加密，得到第四密文，第三内容为第三生命周期操作请求中的请求内容中的密码，或者，第三内容为该请求内容中的密码和其他信息。
VNF在确定需要向VNFM发送第三生命周期操作请求时，从数据库中读取第二密钥，再获取第三生命周期请求中的请求内容中的第三内容，采用第二密钥对第三内容进行加密，得到第四密文。
其中，当请求内容中包括密码和其他信息时，VNF可以只将密码确定为第三内容，此时，VNF只对请求内容中的密码进行加密，而不对请求内容中的其他信息进行加密；或者，VNF可以将密码和其他信息都确定为第三内容，此时，VNF对请求内容中的密码和其他信息都进行加密。当请求内容中只包括密码，而不包括其他信息时，VNF可以将密码确定为第三内容，此时，VNF对请求内容中的密码进行加密。
步骤S502，VNF将第四密文携带在第三生命周期操作请求中发送给VNFM。
步骤S503，VNFM接收VNF发送的第三生命周期操作请求，该第三生命周期操作请求中携带有第四密文。
步骤S504，VNFM采用第二密钥对第四密文进行解密，得到第三内容。
VNFM可以从第三生命周期操作请求中读取第四密文，再从数据库中读取第二密钥，采用第二密钥对第四密文进行解密，得到第三内容。其中，采用第二密钥对第四密文进行解密的解密算法与步骤S501中的加密算法相对应。
其中，步骤S503和步骤S504可以单独实现为VNFM侧的实施例，步骤S501和步骤S502 可以单独实现为VNF侧的实施例。
如图6所示，本申请的第四实施例提供了一种VNFM，该VNFM可以包括：
第一发送单元601，用于在部署VNF时，向VNF发送第一加密配置信息，该第一加密配置信息中携带有指示信息，该指示信息用于指示VNFM是否支持加密功能。
第一接收单元602，用于接收VNF发送的第二加密配置信息，该第二加密配置信息用于指示VNF是否支持加密功能。
第一发送单元601，还用于若确定VNFM和VNF都支持加密功能，则以密文形式向VNF发送密码。
第一发送单元601，还用于若确定VNFM和VNF中的至少一个不支持加密功能，则以明文形式向VNF发送密码。
可选的，VNFM还可以包括：第一处理单元603，用于当第一加密配置信息中还包括第一密钥时，从第一加密配置信息中获取第一密钥；或者，当VNFM的配置文件中包括第一密钥时，从VNFM的配置文件中获取第一密钥。
第一处理单元603，还用于采用第一密钥对密码进行加密，得到第一密文。
第一发送单元601，用于将第一密文发送给VNF。
可选的，第一处理单元603，还用于：在第一接收单元602接收VNF发送的第二加密配置信息之后，对第二加密配置信息进行存储。当需要传输密码时，根据第一加密配置信息和存储的第二加密配置信息确定VNFM和VNF是否都支持加密功能。
可选的，第一接收单元602，还用于在第一发送单元601以密文形式向VNF发送密码之后，接收VNF发送的密钥交换请求，该密钥交换请求中携带有第一密钥交换数。
第一处理单元603，还用于根据密钥交换请求生成第二密钥交换数。
第一发送单元601，还用于将第二密钥交换数发送给VNF，该第二密钥交换数用于供VNF生成第二密钥，该第二密钥用于更新第一密钥。
第一处理单元603，还用于根据第一密钥交换数生成第二密钥。
可选的，第一处理单元603，还用于在根据第一密钥交换数生成第二密钥之后，采用第二密钥对第一内容进行加密，得到第二密文，第一内容为第一生命周期操作请求中的请求内容中的密码，或者，第一内容为请求内容中的密码和其他信息。
第一发送单元601，还用于将第二密文携带在第一生命周期操作请求中发送给VNF，该第二密文由VNF采用第二密钥进行解密后得到第一内容。
可选的，第一接收单元602，还用于在第一处理单元603根据第一密钥交换数生成第二密钥之后，接收VNF发送的第二生命周期操作请求；
第一处理单元603，还用于采用第二密钥对第二内容进行加密，得到第三密文，第二内容为响应消息中的响应内容中的密码，或者，第二内容为响应内容中的密码和其他信息，响应消息用于响应第二生命周期操作请求；
第一发送单元601，还用于将第三密文携带在响应消息中发送给VNF，该第三密文由VNF采用第二密钥进行解密后得到第二内容。
可选的，第一接收单元602，还用于在第一处理单元603根据第一密钥交换数生成第二密钥之后，接收VNF发送的第三生命周期操作请求，该第三生命周期操作请求中携带有第四密文，该第四密文是VNF采用第二密钥对第三内容进行加密得到的，第三内容为第三生命周期操作请求中的请求内容中的密码，或者，第三内容为请求内容中的密码和其他信息；
第一处理单元603，还用于采用第二密钥对第四密文进行解密，得到第三内容。
可选的，第一发送单元601，还用于在第一接收单元602接收VNF发送的密钥交换请求之前，向VNF发送部署完成的通知消息，该VNF用于在通知消息的触发下发送密钥交换请求；或者，向VNF发送第四生命周期操作请求，该VNF用于在第四生命周期操作请求的触发下发送密钥交换请求；或者，
密钥交换请求是VNF中发生预定生命周期操作后发送的。
如图7所示，本申请的第五实施例提供了一种VNF，该VNF可以包括：
第二接收单元701，用于在部署VNF时，接收VNFM发送的第一加密配置信息，该第一加密配置信息中携带有指示信息，该指示信息用于指示VNFM是否支持加密功能。
第二发送单元702，用于向VNFM发送第二加密配置信息，该第二加密配置信息用于指示VNF是否支持加密功能。
第二接收单元701，还用于接收VNFM以密文形式发送的密码，该密码是VNFM确定VNFM和VNF都支持加密功能时，以密文形式发送的；或者，第二接收单元701，还用于接收VNFM以明文形式发送的密码，该密码是VNFM确定VNFM和VNF中的至少一个不支持加密功能时，以明文形式发送的。
可选的，VNF还可以包括：第二处理单元703，用于在第二接收单元701接收VNFM发送的第一加密配置信息之后，对第一加密配置信息进行存储。
第二处理单元703，还用于在第二接收单元701接收VNFM以密文形式发送的密码之后， 根据第二加密配置信息和存储的第一加密配置信息确定VNFM和VNF是否都支持加密功能；若确定VNFM和VNF都支持加密功能，则当第一加密配置信息中还包括第一密钥时，从第一加密配置信息中获取第一密钥；或者，当VNF的配置文件中包括第一密钥时，从VNF的配置文件中获取第一密钥；采用第一密钥对以密文形式发送的第一密文进行解密，得到密码。
可选的，第二发送单元702，还用于在第二接收单元701接收VNFM以密文形式发送的密码之后，向VNFM发送密钥交换请求，该密钥交换请求中携带有第一密钥交换数，该第一密钥交换数用于供VNFM生成第二密钥，该第二密钥用于更新第一密钥。
第二接收单元701，还用于接收VNFM发送的第二密钥交换数，该第二密钥交换数是VNFM根据密钥交换请求生成的。
第二处理单元703，还用于根据第二密钥交换数生成第二密钥。
可选的，第二接收单元701，还用于在第二处理单元703根据第二密钥交换数生成第二密钥之后，接收VNFM发送的第一生命周期操作请求，该第一生命周期操作请求中携带有第二密文，该第二密文是VNFM采用第二密钥对第一内容进行加密得到的，第一内容为第一生命周期操作请求中的请求内容中的密码，或者，第一内容为请求内容中的密码和其他信息。
第二处理单元703，还用于采用第二密钥对第二密文进行解密，得到第一内容。
可选的，第二发送单元702，还用于在第二处理单元703根据第二密钥交换数生成第二密钥之后，向VNFM发送第二生命周期操作请求。
第二接收单元701，还用于接收VNFM发送的响应消息，该响应消息用于响应第二生命周期操作请求，且响应消息中携带有第三密文，该第三密文是VNFM采用第二密钥对第二内容进行加密得到的，第二内容为响应消息中的响应内容中的密码，或者，第二内容为响应内容中的密码和其他信息。
第二处理单元703，还用于采用第二密钥对第三密文进行解密，得到第二内容。
可选的，第二处理单元703，还用于在根据第二密钥交换数生成第二密钥之后，采用第二密钥对第三内容进行加密，得到第四密文，第三内容为第三生命周期操作请求中的请求内容中的密码，或者，第三内容为请求内容中的密码和其他信息。
第二发送单元702，还用于将第四密文携带在第三生命周期操作请求中发送给VNFM，该第四密文由VNFM采用生成的第二密钥进行解密后得到第三内容。
可选的，在向VNFM发送密钥交换请求之前，第二接收单元701还用于接收VNFM发送的部署完成的通知消息，第二发送单元702还用于在通知消息的触发下执行向VNFM发送 密钥交换请求的步骤；或者，第二接收单元701还用于接收VNFM发送的第四生命周期操作请求，第二发送单元702还用于在第四生命周期操作请求的触发下执行向VNFM发送密钥交换请求的步骤；或者，第二发送单元702还用于在VNF中发生预定生命周期操作后，在预定生命周期操作的触发下执行向VNFM发送密钥交换请求的步骤。
如图8所示，本申请第六实施例提供了一种系统，该系统中包括VNFM801和VNF802，且VNFM801可以是如图6所示的VNFM，VNF802可以是如图7所示的VNF。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、设备中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。
在本申请的硬件实施例中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。以上参照附图说明了本申请的优选实施例，并非因此局限本申请的权利范围。本领域技术人员不脱离本申请的范围和实质内所作的任何修改、等同替换和改进，均应在本申请的权利范围之内。

Claims (19)

  1. 一种VNFM与VNF建立数据安全连接的方法，用于VNFM中，所述方法包括：
    在部署VNF时，向所述VNF发送第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；
    接收所述VNF发送的第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；
    若确定所述VNFM和所述VNF都支持加密功能，则以密文形式向所述VNF发送密码；
    若确定所述VNFM和所述VNF中的至少一个不支持加密功能，则以明文形式向所述VNF发送密码。
  2. 根据权利要求1所述的方法，其中，所述以密文形式向所述VNF发送密码，包括：
    当所述第一加密配置信息中还包括第一密钥时，从所述第一加密配置信息中获取所述第一密钥；或者，当所述VNFM的配置文件中包括第一密钥时，从所述VNFM的配置文件中获取所述第一密钥；
    采用所述第一密钥对密码进行加密，得到第一密文；
    将所述第一密文发送给所述VNF。
  3. 根据权利要求1所述的方法，其中，在所述接收所述VNF发送的第二加密配置信息之后，所述方法还包括：
    对所述第二加密配置信息进行存储；
    当需要传输密码时，根据所述第一加密配置信息和存储的所述第二加密配置信息确定所述VNFM和所述VNF是否都支持加密功能。
  4. 根据权利要求1至权利要求3中任一项所述的方法，其中，在所述以密文形式向所述VNF发送密码之后，所述方法还包括：
    接收所述VNF发送的密钥交换请求，所述密钥交换请求中携带有第一密钥交换数；
    根据所述密钥交换请求生成第二密钥交换数，并将所述第二密钥交换数发送给所述VNF，所述第二密钥交换数用于供所述VNF生成第二密钥，所述第二密钥用于更新所述第一密钥；
    根据所述第一密钥交换数生成所述第二密钥。
  5. 根据权利要求4所述的方法，其中，在所述根据所述第一密钥交换数生成所述第二密钥之后，所述方法还包括：
    采用所述第二密钥对第一内容进行加密，得到第二密文，所述第一内容为第一生命周期 操作请求中的请求内容中的密码，或者，所述第一内容为所述请求内容中的密码和其他信息；
    将所述第二密文携带在所述第一生命周期操作请求中发送给所述VNF，所述第二密文由所述VNF采用所述第二密钥进行解密后得到所述第一内容。
  6. 根据权利要求4所述的方法，其中，在所述根据所述第一密钥交换数生成所述第二密钥之后，所述方法还包括：
    接收所述VNF发送的第二生命周期操作请求；
    采用所述第二密钥对第二内容进行加密，得到第三密文，所述第二内容为响应消息中的响应内容中的密码，或者，所述第二内容为所述响应内容中的密码和其他信息，所述响应消息用于响应所述第二生命周期操作请求；
    将所述第三密文携带在所述响应消息中发送给所述VNF，所述第三密文由所述VNF采用所述第二密钥进行解密后得到所述第二内容。
  7. 根据权利要求4所述的方法，其中，在所述根据所述第一密钥交换数生成所述第二密钥之后，所述方法还包括：
    接收所述VNF发送的第三生命周期操作请求，所述第三生命周期操作请求中携带有第四密文，所述第四密文是所述VNF采用所述第二密钥对第三内容进行加密得到的，所述第三内容为所述第三生命周期操作请求中的请求内容中的密码，或者，所述第三内容为所述请求内容中的密码和其他信息；
    采用所述第二密钥对所述第四密文进行解密，得到所述第三内容。
  8. 根据权利要求4所述的方法，其中，在所述接收所述VNF发送的密钥交换请求之前，所述方法还包括：
    向所述VNF发送部署完成的通知消息，所述VNF用于在所述通知消息的触发下发送所述密钥交换请求；或者，向所述VNF发送第四生命周期操作请求，所述VNF用于在所述第四生命周期操作请求的触发下发送所述密钥交换请求；或者，
    所述密钥交换请求是所述VNF中发生预定生命周期操作后发送的。
  9. 一种VNFM与VNF建立数据安全连接的方法，用于VNF中，所述方法包括：
    在部署所述VNF时，接收VNFM发送的第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；
    向所述VNFM发送第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；
    接收所述VNFM以密文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF都支持加密功能时，以密文形式发送的；或者，
    接收所述VNFM以明文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF中的至少一个不支持加密功能时，以明文形式发送的。
  10. 根据权利要求9所述的方法，其中，在所述接收VNFM发送的第一加密配置信息之后，所述方法还包括：对所述第一加密配置信息进行存储；
    在所述接收所述VNFM以密文形式发送的密码之后，所述方法还包括：
    根据所述第二加密配置信息和存储的所述第一加密配置信息确定所述VNFM和所述VNF是否都支持加密功能；
    若确定所述VNFM和所述VNF都支持加密功能，则当所述第一加密配置信息中还包括第一密钥时，从所述第一加密配置信息中获取所述第一密钥；或者，当所述VNF的配置文件中包括第一密钥时，从所述VNF的配置文件中获取所述第一密钥；
    采用所述第一密钥对以密文形式发送的第一密文进行解密，得到所述密码。
  11. 根据权利要求9或权利要求10所述的方法，其中，在所述接收所述VNFM以密文形式发送的密码之后，所述方法还包括：
    向所述VNFM发送密钥交换请求，所述密钥交换请求中携带有第一密钥交换数，所述第一密钥交换数用于供所述VNFM生成第二密钥，所述第二密钥用于更新所述第一密钥；
    接收所述VNFM发送的第二密钥交换数，所述第二密钥交换数是所述VNFM根据所述密钥交换请求生成的；
    根据所述第二密钥交换数生成所述第二密钥。
  12. 根据权利要求11所述的方法，其中，在所述根据所述第二密钥交换数生成所述第二密钥之后，所述方法还包括：
    接收所述VNFM发送的第一生命周期操作请求，所述第一生命周期操作请求中携带有第二密文，所述第二密文是所述VNFM采用所述第二密钥对第一内容进行加密得到的，所述第一内容为所述第一生命周期操作请求中的请求内容中的密码，或者，所述第一内容为所述请求内容中的密码和其他信息；
    采用所述第二密钥对所述第二密文进行解密，得到所述第一内容。
  13. 根据权利要求11所述的方法，其中，在所述根据所述第二密钥交换数生成所述第二密钥之后，所述方法还包括：
    向所述VNFM发送第二生命周期操作请求；
    接收所述VNFM发送的响应消息，所述响应消息用于响应所述第二生命周期操作请求，且所述响应消息中携带有第三密文，所述第三密文是所述VNFM采用所述第二密钥对第二内容进行加密得到的，所述第二内容为所述响应消息中的响应内容中的密码，或者，所述第二内容为所述响应内容中的密码和其他信息；
    采用所述第二密钥对所述第三密文进行解密，得到所述第二内容。
  14. 根据权利要求11所述的方法，其中，在所述根据所述第二密钥交换数生成所述第二密钥之后，所述方法还包括：
    采用所述第二密钥对第三内容进行加密，得到第四密文，所述第三内容为第三生命周期操作请求中的请求内容中的密码，或者，所述第三内容为所述请求内容中的密码和其他信息；
    将所述第四密文携带在所述第三生命周期操作请求中发送给所述VNFM，所述第四密文由所述VNFM采用生成的所述第二密钥进行解密后得到所述第三内容。
  15. 根据权利要求11所述的方法，其中，在所述向所述VNFM发送密钥交换请求之前，所述方法还包括：
    接收所述VNFM发送的部署完成的通知消息，在所述通知消息的触发下执行所述向所述VNFM发送密钥交换请求的步骤；或者，
    接收所述VNFM发送的第四生命周期操作请求，在所述第四生命周期操作请求的触发下执行所述向所述VNFM发送密钥交换请求的步骤；或者，
    在所述VNF中发生预定生命周期操作后，在所述预定生命周期操作的触发下执行所述向所述VNFM发送密钥交换请求的步骤。
  16. 一种VNFM，所述VNFM包括：
    第一发送单元，用于在部署VNF时，向所述VNF发送第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；
    第一接收单元，用于接收所述VNF发送的第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；
    所述第一发送单元，还用于若确定所述VNFM和所述VNF都支持加密功能，则以密文形式向所述VNF发送密码；
    所述第一发送单元，还用于若确定所述VNFM和所述VNF中的至少一个不支持加密功能，则以明文形式向所述VNF发送密码。
  17. 一种VNF，所述VNF包括：
    第二接收单元，用于在部署所述VNF时，接收VNFM发送的第一加密配置信息，所述第一加密配置信息中携带有指示信息，所述指示信息用于指示所述VNFM是否支持加密功能；
    第二发送单元，用于向所述VNFM发送第二加密配置信息，所述第二加密配置信息用于指示所述VNF是否支持加密功能；
    所述第二接收单元，还用于接收所述VNFM以密文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF都支持加密功能时，以密文形式发送的；或者，
    所述第二接收单元，还用于接收所述VNFM以明文形式发送的密码，所述密码是所述VNFM确定所述VNFM和所述VNF中的至少一个不支持加密功能时，以明文形式发送的。
  18. 一种系统，所述系统包括VNFM和VNF；
    所述VNFM为如权利要求16所述的VNFM；
    所述VNF为如权利要求17所述的VNF。
  19. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至8中任一所述的VNFM与VNF建立数据安全连接的方法，或者能够实现如9至15中任一所述的VNFM与VNF建立数据安全连接的方法。
PCT/CN2021/121787 2020-12-28 2021-09-29 Vnfm与vnf建立数据安全连接的方法、设备及系统 WO2022142555A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011576431.4A CN114760048A (zh) 2020-12-28 2020-12-28 Vnfm与vnf建立数据安全连接的方法、设备及系统
CN202011576431.4 2020-12-28

Publications (1)

Publication Number Publication Date
WO2022142555A1 true WO2022142555A1 (zh) 2022-07-07

Family

ID=82259047

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/121787 WO2022142555A1 (zh) 2020-12-28 2021-09-29 Vnfm与vnf建立数据安全连接的方法、设备及系统

Country Status (2)

Country Link
CN (1) CN114760048A (zh)
WO (1) WO2022142555A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170257276A1 (en) * 2014-09-25 2017-09-07 Intel IP Corporation Network functions virtualization
CN107534678A (zh) * 2015-05-12 2018-01-02 华为技术有限公司 建立vnfm与vim之间的连接的方法、装置及系统
CN110115012A (zh) * 2016-12-30 2019-08-09 华为技术有限公司 一种秘密信息的分发方法和设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170257276A1 (en) * 2014-09-25 2017-09-07 Intel IP Corporation Network functions virtualization
CN107534678A (zh) * 2015-05-12 2018-01-02 华为技术有限公司 建立vnfm与vim之间的连接的方法、装置及系统
CN110115012A (zh) * 2016-12-30 2019-08-09 华为技术有限公司 一种秘密信息的分发方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NOKIA, NOKIA SHANGHAI BELL: "SCAS VNP: Security requirements on the interface between VNF and VNFM", 3GPP DRAFT; S3-203167, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20201109 - 20201120, 30 October 2020 (2020-10-30), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051949743 *

Also Published As

Publication number Publication date
CN114760048A (zh) 2022-07-15

Similar Documents

Publication Publication Date Title
US20210328773A1 (en) Trusted startup methods and apparatuses of blockchain integrated station
JP4993733B2 (ja) 暗号クライアント装置、暗号パッケージ配信システム、暗号コンテナ配信システム及び暗号管理サーバ装置
US11604633B2 (en) Trusted startup methods and apparatuses of blockchain integrated station
US11616636B2 (en) Hash updating methods and apparatuses of blockchain integrated station
TWI598814B (zh) 用於管理及診斷配備有統一可延伸韌體介面（ｕｅｆｉ）相容韌體的計算裝置之系統與方法
WO2019105290A1 (zh) 数据处理方法、可信用户界面资源数据的应用方法及装置
US10255089B2 (en) Self-deleting virtual machines
EP3207488B1 (en) Identifying security boundaries on computing devices
US20210067326A1 (en) Cryptographic operation method, method for creating working key, cryptographic service platform, and cryptographic service device
JP2011211461A (ja) 情報処理システム、情報処理方法、複製元情報処理装置、複製先情報処理装置、及び、プログラム
US10045212B2 (en) Method and apparatus for providing provably secure user input/output
US10229272B2 (en) Identifying security boundaries on computing devices
US20230222230A1 (en) Key distribution system in a secure enclave
US11637704B2 (en) Method and apparatus for determining trust status of TPM, and storage medium
US11727126B2 (en) Method and service to encrypt data stored on volumes used by containers
WO2022142555A1 (zh) Vnfm与vnf建立数据安全连接的方法、设备及系统
US9270649B1 (en) Secure software authenticator data transfer between processing devices
CN114691034A (zh) 一种数据存储方法及数据处理设备
US20240022554A1 (en) Secure exchange of certificate authority certificate inline as part of file transfer protocol
CN114339630B (zh) 一种用于短信保护的方法和装置
US11784978B2 (en) Method for establishing remote work environment to ensure security of remote work user terminal and apparatus using the same
US20240356909A1 (en) Signing messages using public key cryptography and certificate verification
EP4283926A1 (en) Method and apparatus for providing secure messaging service
JP2012151807A (ja) ポリシ管理サーバ装置、サーバ装置、クライアント装置、及びこれらを有する暗号アルゴリズム切換システム
KR20230165084A (ko) 보안 메시징 서비스 제공 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913300

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21913300

Country of ref document: EP

Kind code of ref document: A1