Information processing method, system and related device

Abstract

The embodiment of the present invention discloses an information processing method and system, and related devices. The method includes: a first device obtains certificate description information of a first network element to be deployed, and obtains a first public-private key pair; generates a first digital certificate based on the certificate description information and the first public-private key pair; sends a certificate application request to a second device, and the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system; when the digital certificate system verifies the first digital certificate, at least the first digital certificate is sent to the first network element.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an information processing method and system, and related devices. Background Art

[0002] In the Network Function Virtualization (NFV) architecture, each virtual network function (VNF) uses the Transport Layer Security (TLS) protocol for security protection. In order to establish a secure TLS connection between different VNFs, each VNF should be configured with a digital certificate corresponding to the VNF identity after deployment. Currently, digital certificates are mainly configured by equipment vendors for each VNF. It is only necessary to write the digital certificate into the image file to automatically configure the digital certificate when the VNF is deployed.

[0003] The 5G core network adopts a service-based architecture (SBA) network architecture. Different VNFs are required to use TLS for secure communication. Due to the huge number of VNFs and their dynamic deployment, the management of digital certificates has high security and efficiency requirements.

[0004] The above method cannot reflect the differentiated identity of VNFs, and once a VNF's digital certificate has a security problem, all VNFs using the digital certificate will face security risks. Summary of the invention

[0005] In order to solve the existing technical problems, the embodiments of the present invention provide an information processing method and system, and related devices.

[0006] To achieve the above object, the technical solution of the embodiment of the present invention is implemented as follows:

[0007] In a first aspect, an embodiment of the present invention provides an information processing method, the method comprising:

[0008] The first device obtains certificate description information of a first network element to be deployed, and obtains a first public-private key pair;

[0009] Generate a first digital certificate based on the certificate description information and the first public-private key pair;

[0010] Sending a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system;

[0011] When the digital certificate system successfully verifies the first digital certificate, at least the first digital certificate is sent to the first network element.

[0012] In the above solution, the method further includes: when the first device determines that the first digital certificate meets a preset condition, obtaining a new first public-private key pair;

[0013] Generate a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and generate a first signature based on the private key in the first public-private key pair and the new first digital certificate;

[0014] Sending a certificate update request to the second device, wherein the certificate update request includes the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system;

[0015] When the digital certificate system successfully verifies the new first digital certificate and the first signature, at least the new first digital certificate is sent to the first network element, and the new first digital certificate is used to update the first digital certificate in the first network element.

[0016] In the above solution, the first device determines that the first digital certificate meets a preset condition, including:

[0017] When the first device determines that the validity period of the first digital certificate satisfies a first preset condition, or when the first device determines that the security of the first digital certificate does not satisfy a second preset condition, it determines that the first digital certificate satisfies the preset condition.

[0018] In the above solution, the first device obtains the certificate description information of the first network element to be deployed, including:

[0019] The first device obtains certificate description information of a first network element to be deployed from a virtual network function manager (VNFM);

[0020] The obtaining of the first public-private key pair includes: the first device obtaining the first public-private key pair from a fourth device for generating a public-private key pair; the fourth device is located in a network function virtualization infrastructure (NFVI, Network Function Virtualization Infrastructure).

[0021] In the above solution, the first device is located in a network element management (EM); each network element corresponds to an EM;

[0022] The sending at least the first digital certificate to the first network element comprises:

[0023] The first digital certificate is at least sent to the first network element through a first EM; the first EM is the EM corresponding to the first network element.

[0024] In the above solution, the first device is located in the VNFM;

[0025] The sending at least the first digital certificate to the first network element comprises:

[0026] The first digital certificate is at least sent to a first EM through the VNFM, and the first digital certificate is forwarded to the first network element through the first EM; the first EM is the EM corresponding to the first network element.

[0027] In a second aspect, an embodiment of the present invention further provides an information processing method, the method comprising:

[0028] The second device obtains a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated based on the certificate description information of the first network element and the first public-private key pair;

[0029] Generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature;

[0030] Obtaining a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the verification of the first digital certificate has been successful;

[0031] A certificate request response is sent to the first device, wherein the certificate request response includes indication information indicating that the first digital certificate has been verified successfully.

[0032] In the above solution, the method further includes: the second device obtains a certificate update request sent by the first device, the certificate update request includes a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and a private key in the first public-private key;

[0033] Generate a third signature based on the specific private key and the new first digital certificate, and send a second request message including the new first digital certificate, the first signature and the third signature to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature;

[0034] Obtaining a second response message from the digital certificate system; when the digital certificate system successfully verifies the new first digital certificate, the first signature, and the third signature, the response message includes indication information indicating that the new first digital certificate has been successfully verified;

[0035] A certificate update response is sent to the first device, wherein the certificate update response includes indication information indicating that the new first digital certificate has passed verification.

[0036] In a third aspect, an embodiment of the present invention further provides an information processing method, the method further comprising:

[0037] The third device receives a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried;

[0038] Retrieving a digital certificate corresponding to the first certificate information and status information corresponding to the retrieved digital certificate from a pre-stored certificate information set;

[0039] Sending a certificate query response to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate.

[0040] In the above solution, the method further includes: the third device receives a certificate information set sent by a digital certificate system, and stores the certificate information set.

[0041] In a fourth aspect, an embodiment of the present invention further provides an information processing device, the device comprising: a first communication unit and a first processing unit; wherein,

[0042] The first communication unit is used to obtain certificate description information of a first network element to be deployed, and obtain a first public-private key pair;

[0043] The first processing unit is used to generate a first digital certificate based on the certificate description information and the first public-private key pair;

[0044] The first communication unit is used to send a certificate application request to the second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system; and is also used to send at least the first digital certificate to the first network element when the digital certificate system verifies the first digital certificate successfully.

[0045] In the above solution, the first communication unit is further used to obtain a new first public-private key pair when the first processing unit determines that the first digital certificate meets a preset condition;

[0046] The first processing unit is further configured to generate a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and to generate a first signature based on the private key in the first public-private key pair and the new first digital certificate;

[0047] The first communication unit is also used to send a certificate update request to the second device, wherein the certificate update request includes the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system; and is also used to send at least the new first digital certificate to the first network element when the digital certificate system verifies the new first digital certificate and the first signature, and the new first digital certificate is used to update the first digital certificate in the first network element.

[0048] In the above scheme, the first processing unit is used to determine that the first digital certificate meets the preset condition when the validity period of the first digital certificate meets the first preset condition, or when the security of the first digital certificate does not meet the second preset condition.

[0049] In the above scheme, the first communication unit is used to obtain the certificate description information of the first network element to be deployed from the VNFM; it is also used to obtain the first public-private key pair from a fourth device for generating a public-private key pair; the fourth device is located in the NFVI.

[0050] In the above solution, it is characterized in that the first device is located in the EM; each network element corresponds to one EM;

[0051] The first communication unit is used to send at least the first digital certificate to the first network element through a first EM; the first EM is an EM corresponding to the first network element.

[0052] In the above solution, the first device is located in the VNFM;

[0053] The first communication unit is used to send the first digital certificate to at least a first EM through the VNFM, and forward the first digital certificate to the first network element through the first EM; the first EM is an EM corresponding to the first network element.

[0054] In a fifth aspect, an embodiment of the present invention further provides an information processing device, the device comprising: a second communication unit and a second processing unit; wherein:

[0055] The second communication unit is used to obtain a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated based on the certificate description information of the first network element and the first public-private key pair;

[0056] The second processing unit is configured to generate a second signature based on a specific private key and the first digital certificate;

[0057] The second communication unit is also used to send a first request message including the first digital certificate and the second signature to the digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; and is also used to obtain a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; and is also used to send a certificate application response to the first device, and the certificate application response includes indication information indicating that the first digital certificate has been verified.

[0058] In the above solution, the second communication unit is further used to obtain a certificate update request sent by the first device, wherein the certificate update request includes a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and a private key in the first public-private key;

[0059] The second processing unit is further configured to generate a third signature based on the specific private key and the new first digital certificate;

[0060] The second communication unit is also used to send a second request message including the new first digital certificate, the first signature and the third signature to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature; and is also used to obtain a second response message from the digital certificate system; when the digital certificate system verifies the new first digital certificate, the first signature and the third signature, the response message includes indication information indicating that the new first digital certificate has been verified; and is also used to send a certificate update response to the first device, and the certificate update response includes indication information indicating that the new first digital certificate has been verified.

[0061] In a sixth aspect, an embodiment of the present invention further provides an information processing device, the device comprising: a third communication unit and a third processing unit; wherein,

[0062] The third communication unit is used to receive a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried;

[0063] The third processing unit is used to retrieve the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from the pre-stored certificate information set;

[0064] The third communication unit is further used to send a certificate query response to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate.

[0065] In the above solution, the device further comprises a storage unit;

[0066] The third communication unit is further used for the third device to receive a certificate information set sent by the digital certificate system;

[0067] The storage unit is used to store the certificate information set.

[0068] In a seventh aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect, the second aspect, or the third aspect of the embodiment of the present invention.

[0069] In an eighth aspect, an embodiment of the present invention further provides an information processing device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the first aspect, the second aspect, or the third aspect of the embodiment of the present invention are implemented.

[0070] In a ninth aspect, an embodiment of the present invention further provides an information processing system, the system comprising: a first device, a second device and a fourth device for generating a public-private key pair; the fourth device is located in a network function virtualization infrastructure NFVI; wherein,

[0071] The first device is used to obtain certificate description information of a first network element to be deployed, and to obtain a first public-private key pair from the fourth device; generate a first digital certificate based on the certificate description information and the first public-private key pair; send a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; and receive a certificate application response from the second device; and when the certificate application response includes indication information indicating that the first digital certificate has been verified, at least send the first digital certificate to the first network element;

[0072] The second device is used to generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; obtain a first response message from the digital certificate system; when the digital certificate system verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; and send a certificate application response to the first device, wherein the certificate application response includes indication information indicating that the first digital certificate has been verified.

[0073] In the above scheme, the system also includes a third device, which is used to receive a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried; retrieve the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from the pre-stored certificate information set; send a certificate query response to the first network element; the certificate query response includes the digital certificate and the status information corresponding to the digital certificate

[0074] The information processing method and system and related devices provided by the embodiments of the present invention, on the one hand, the first device obtains the certificate description information of the first network element to be deployed, and obtains the first public-private key pair; generates a first digital certificate based on the certificate description information and the first public-private key pair; sends a certificate application request to the second device, and the certificate application request at least includes the first digital certificate; the second device is used to verify the first digital certificate using the digital certificate system; when the digital certificate system verifies the first digital certificate successfully, at least the first digital certificate is sent to the first network element; the second device generates a second signature based on a specific private key and the first digital certificate, and sends a first request message containing the first digital certificate and the second signature to the digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; obtains a first response message from the digital certificate system; when the digital certificate system verifies the first digital certificate and the second signature successfully, the response message includes indication information indicating that the first digital certificate has been verified successfully; sends a certificate application response to the first device, and the certificate application response includes indication information indicating that the first digital certificate has been verified successfully. In this way, the first device is combined with the certificate application function of the second device to realize the application and automatic deployment of the digital certificate of each VNF before the deployment of each VNF, avoiding the problem that all VNFs will face security risks once there is a security problem with the digital certificate of any VNF when all VNFs use the same digital certificate.

[0075] On the other hand, the third device receives a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried; retrieves the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from the pre-stored certificate information set; sends a certificate query response to the first network element; the certificate query response includes the digital certificate and the status information corresponding to the digital certificate. The validity of the digital certificate is verified by using the certificate verification function of the third device. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 1 ;

[0077] Figure 2 The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 2 ;

[0078] Figure 3 The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 3 ;

[0079] Figure 4 Schematic diagram of the system architecture of the information processing method of the embodiment of the present invention Figure 1 ;

[0080] Figure 5 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 1 ;

[0081] Figure 6 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 2 ;

[0082] Figure 7 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 3 ;

[0083] Figure 8 Schematic diagram of the system architecture of the information processing method of the embodiment of the present invention Figure 2 ;

[0084] Fig. 9 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 4 ;

[0085] Fig.10 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 5 ;

[0086] Fig.11 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 1 ;

[0087] Fig.12 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 2 ;

[0088] Fig.13 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 3 ;

[0089] Fig.14 The figure is a schematic diagram of the hardware structure of the information processing device according to the embodiment of the present invention. DETAILED DESCRIPTION

[0090] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0091] Before describing in detail the information processing method according to the embodiment of the present invention, a device involved in the information processing method according to the present invention is briefly described first.

[0092] The system to which the information processing method of this embodiment is applied may include a first device, a second device and a fourth device; wherein the first device may also be called a certificate management device, the second device may also be called a certificate application device, and the fourth device may also be called a public-private key pair generation device.

[0093] The public-private key pair generating device is specifically used to generate a public-private key pair using a cryptographic algorithm.

[0094] The certificate management device, on the one hand, has a certificate generation function, uses the public-private key pair generated by the public-private key pair generation device and the certificate description information of the VNF from the VNFM to generate a digital certificate, and sends the digital certificate to the certificate application device through a certificate application request; sends the private key and digital certificate in the public-private key pair to the corresponding VNF; wherein the generated digital certificate can also be called a self-signed digital certificate.

[0095] The certificate application device is a trusted node in the digital certificate management system based on blockchain technology. It has independent private key and public key, where the private key is used for signing and the public key is used to identify the identity in the blockchain. It is specifically used to receive certificate application requests from the certificate management device and submit the certificate application requests to the digital certificate management system. The digital certificate management system verifies the digital certificate in the certificate application request and feeds back the certificate application response to the certificate management device.

[0096] Furthermore, the certificate management device also has a certificate update function, which is used to generate a new digital certificate when the digital certificate of the VNF is about to expire or the security is insufficient, and send the new digital certificate to the certificate application device through a certificate update request; send the private key in the public-private key pair and the new digital certificate to the corresponding VNF; wherein the generated digital certificate can also be called a self-signed digital certificate.

[0097] The certificate application device is used to receive a certificate update request from the certificate management device and submit the certificate update request to the digital certificate management system. The digital certificate management system verifies the new digital certificate in the certificate update request and feeds back a certificate update response to the certificate management device.

[0098] In some optional embodiments, the system may further include a third device, which may also be called a certificate query device, which is connected to the digital certificate management system of the blockchain technology, receives the new block generated by the digital certificate management system, and parses the information of the digital certificate in the new block to provide digital certificate query services for the VNF. Optionally, the certificate query device can be deployed at the boundary of the intranet and the Internet to provide certificate query services for intranet devices.

[0099] Based on the foregoing, an embodiment of the present invention provides an information processing method. Figure 1The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 1 ;like Figure 1 As shown, the method includes:

[0100] Step 101: A first device obtains certificate description information of a first network element to be deployed, and obtains a first public-private key pair;

[0101] Step 102: Generate a first digital certificate based on the certificate description information and the first public-private key pair;

[0102] Step 103: Sending a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system;

[0103] Step 104: When the digital certificate system successfully verifies the first digital certificate, at least the first digital certificate is sent to the first network element.

[0104] In this embodiment, the first device may be a certificate management device. Optionally, the first device may be located in a network element manager (EM) in a NFV architecture, or the first device may be located in a VNFM in the NFV architecture.

[0105] Each network element in this embodiment (for example, the first network element) may specifically be a VNF in the NFV architecture.

[0106] In this embodiment, the VNFM in the NFV architecture has a configuration file of the VNF to be deployed, and the configuration file of the VNF includes certificate description information. In some optional embodiments, the certificate description information may include a certificate identifier (ID). In other optional embodiments, the certificate description information may include information such as a certificate identifier (ID) and a certificate format. Exemplarily, the certificate format information may include fields carried in a digital certificate. Exemplarily, the certificate identifier (ID) may be at least one of the domain name, IP address, and device identifier of the VNF; if the certificate identifier (ID) includes two or more of the above information, the certificate identifier (ID) may be represented by a combination of the above two or more information.

[0107] Based on this, in some optional embodiments of the present invention, the first device obtains the certificate description information of the first network element to be deployed, including: the first device obtains the certificate description information of the first network element to be deployed from VNFM; the obtaining of the first public-private key pair includes: the first device obtains the first public-private key pair from a fourth device for generating a public-private key pair; the fourth device is located in the network function virtualization infrastructure NFVI.

[0108] In this embodiment, the first device generates a first digital certificate based on the certificate description information and the first public-private key pair. In some optional embodiments, the first device may generate a first digital certificate based on the certificate identifier and the first public-private key pair; the first digital certificate may be referred to as a first self-signed digital certificate. Exemplarily, if the certificate identifier in the certificate description information is the domain name of the VNF, the distinguished name (DN) item in the first digital certificate is the domain name of the above-mentioned VNF.

[0109] In this embodiment, the first device sends the generated first digital certificate to the second device through a certificate application request, and the second device is also the aforementioned certificate application device. Optionally, the certificate application request may include the information of the first digital certificate and the first network element to be deployed (e.g., VNF); for example, information such as the identification of the first network element.

[0110] In this embodiment, the second device is a trusted node in a digital certificate management system based on blockchain technology, and verifies the first digital certificate through the digital certificate system. If the digital certificate system verifies the first digital certificate, at least the first digital certificate is sent to the first network element.

[0111] In some optional embodiments of the present invention, the first device is located in an EM; each network element corresponds to an EM; the sending of at least the first digital certificate to the first network element includes: sending at least the first digital certificate to the first network element through the first EM; the first EM is the EM corresponding to the first network element.

[0112] In some optional embodiments of the present invention, the first device is located in the VNFM; the sending of at least the first digital certificate to the first network element includes: sending at least the first digital certificate to a first EM through the VNFM, and forwarding the first digital certificate to the first network element through the first EM; the first EM is an EM corresponding to the first network element.

[0113] Optionally, the first device may send the private key of the first public-private key pair to the first network element at the same time as sending the first digital certificate to the first network element.

[0114] In some optional embodiments of the present invention, the method also includes: when the first device determines that the first digital certificate satisfies a preset condition, obtaining a new first public-private key pair; generating a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and generating a first signature based on the private key in the first public-private key pair and the new first digital certificate; sending a certificate update request to the second device, the certificate update request including the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system; when the digital certificate system verifies the new first digital certificate and the first signature, at least the new first digital certificate is sent to the first network element, and the new first digital certificate is used to update the first digital certificate in the first network element.

[0115] In some optional embodiments of the present invention, the first device determines that the first digital certificate satisfies a preset condition, including: when the first device determines that the validity period of the first digital certificate satisfies a first preset condition, or when the first device determines that the security of the first digital certificate does not satisfy a second preset condition, determining that the first digital certificate satisfies the preset condition.

[0116] In this embodiment, when the first digital certificate is about to expire or the security of the first digital certificate is insufficient, it is necessary to initiate a process for updating the digital certificate. Then the first device obtains a new first public-private key pair through the fourth device again, and generates a new first digital certificate based on the new first public-private key pair and the original certificate description information of the first network element (such as the VNF identifier), and signs the new first digital certificate based on the private key in the original first public-private key pair to obtain a first signature; the new first digital certificate and the first signature are sent to the second device through a certificate update request. The second device verifies the new first digital certificate through the digital certificate system. Then, when the digital certificate system verifies the new first digital certificate, at least the new first digital certificate is sent to the first network element. Optionally, the first device sends the new first digital certificate and the private key in the first public-private key pair to the first network element.

[0117] Based on the above embodiments, an embodiment of the present invention further provides an information processing method. Figure 2 The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 2 ;like Figure 2 As shown, the method includes:

[0118] Step 201: The second device obtains a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated based on the certificate description information of the first network element and a first public-private key pair;

[0119] Step 202: Generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature;

[0120] Step 203: Obtain a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the verification of the first digital certificate has been successful;

[0121] Step 204: Send a certificate request response to the first device, wherein the certificate request response includes indication information indicating that the first digital certificate has been verified successfully.

[0122] In this embodiment, after receiving the certificate application request, the second device generates a second signature based on its own independent private key (i.e., a specific private key) and the first digital certificate, and sends a first request message containing the first digital certificate and the second signature to the digital certificate system; the digital certificate system verifies the first digital certificate and the second signature; after the verification is passed, the digital certificate system records the first digital certificate and its status information in the blockchain. Once the first digital certificate is recorded in the blockchain, it is recognized by all nodes in the blockchain. The second device sends a certificate application response to the first device.

[0123] In some optional embodiments of the present invention, the method also includes: the second device obtains a certificate update request sent by the first device, the certificate update request including a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and the private key in the first public-private key; a third signature is generated based on the specific private key and the new first digital certificate, and a second request message including the new first digital certificate, the first signature and the third signature is sent to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature; a second response message of the digital certificate system is obtained; when the digital certificate system verifies the new first digital certificate, the first signature and the third signature, the response message includes indication information indicating that the new first digital certificate has been verified; a certificate update response is sent to the first device, and the certificate update response includes indication information indicating that the new first digital certificate has been verified.

[0124] In this embodiment, when the first digital certificate is about to expire or the security of the first digital certificate is insufficient, it is necessary to initiate a process for updating the digital certificate. Then the second device receives a certificate update request containing a new first digital certificate and a first signature. The second device generates a third signature based on its own private key (i.e., a specific private key) and the new first digital certificate, and sends a second request message containing the new first digital certificate, the first signature, and the third signature to the digital certificate system, and the digital certificate system verifies the new first digital certificate, the first signature, and the third signature; after the verification is passed, the digital certificate system records the new first digital certificate and its status information in the blockchain. Once the new first digital certificate is recorded in the blockchain, it is recognized by all nodes in the blockchain. The second device sends a certificate update response to the first device.

[0125] By adopting the technical solution of the embodiment of the present invention, the first device is combined with the certificate application function of the second device to realize the application and automatic deployment of the digital certificate of each VNF before the deployment of each VNF, so as to avoid the problem that all VNFs will face security risks once the digital certificate of any VNF has security problems when all VNFs use the same digital certificate.

[0126] The embodiment of the present invention also provides an information processing method. Figure 3 The flowchart of the information processing method of the embodiment of the present invention is as follows Figure 3 ;like Figure 3 As shown, the method includes:

[0127] Step 301: The third device receives a certificate query request from a first network element; the certificate query request includes first certificate information to be queried;

[0128] Step 302: Retrieve a digital certificate corresponding to the first certificate information and status information corresponding to the retrieved digital certificate from a pre-stored certificate information set;

[0129] Step 303: Send a certificate query response to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate.

[0130] In some optional embodiments of the present invention, the method further includes: the third device receiving a certificate information set sent by a digital certificate system, and storing the certificate information set.

[0131] The technical solution of this embodiment realizes the verification of the validity of the digital certificate by utilizing the certificate verification function of the third device. The third device of this embodiment can be deployed at the boundary of the intranet and the Internet to solve the problem that the intranet VNF ​​cannot use the traditional OCSP / CRL method to query the validity of the certificate.

[0132] The information processing method of the embodiment of the present invention is described below with reference to specific examples. In the following examples, the first device in the above embodiment is a certificate management device, the second device is a certificate application device, the third device is a certificate query device, the fourth device is a public-private key pair generation device, and the network element is a VNF.

[0133] Scene 1

[0134] In this scenario, Figure 4 Schematic diagram of the system architecture of the information processing method of the embodiment of the present invention Figure 1 ;like Figure 4 As shown, the certificate management device is located in each EM, and each EM corresponds to a VNF; the public-private key pair generation device is located in the NFVI. The following is an example of the certificate deployment process, certificate query process, and certificate update process of the VNF.

[0135] Example 1

[0136] Figure 5 The interactive process diagram of the information processing method of the embodiment of the present invention is as follows Figure 1 ;like Figure 5 As shown, including:

[0137] Step 401 to step 402: The certificate management device obtains the configuration file (VNFD) of the VNF from the VNFM through the EM, and obtains the VNF certificate description information from the VNFD.

[0138] Before VNF deployment, VNFM indicates the description of the digital certificate in the VNF configuration file (VNFD), including information such as certificate format and certificate ID. Exemplarily, the certificate format can be a field carried in the certificate, and the certificate ID can be at least one of the domain name, IP address, and device identification of the VNF.

[0139] Step 403: When the VNF is deployed, the certificate management device located in the EM applies for a public-private key pair from the public-private key pair generating device. The public-private key pair generating device generates a public-private key pair and sends the public-private key pair to the certificate management device based on the application of the certificate management device.

[0140] Step 404: The certificate management device generates a self-signed digital certificate (i.e., the aforementioned first digital certificate) based on the certificate description information and the public-private key pair. If the certificate ID in the certificate description information is the domain name of the VNF, then in the self-signed digital certificate, the DN item of the certificate is the domain name of the VNF.

[0141] Step 405: The certificate management device sends a certificate application request to the certificate application device, where the certificate application request includes a self-signed digital certificate and information about the VNF to be deployed.

[0142] Step 406 to step 407: After receiving the certificate application request, the certificate application device sends a certificate issuance request to the digital certificate system, and the digital certificate system sends a certificate issuance response to the certificate application device.

[0143] Among them, the certificate application device signs the self-signed digital certificate based on its own private key, and sends the self-signed digital certificate and the signature to the digital certificate system based on blockchain through a certificate issuance request. The digital certificate system based on blockchain will verify the self-signed digital certificate and the signature; after verification and consensus, the self-signed digital certificate and its status will be recorded in the blockchain. Once the digital certificate is recorded in the blockchain, it will be recognized by all nodes in the blockchain.

[0144] Steps 408 to 410: The certificate application device sends a certificate application response to the certificate management device; the certificate management device sends the private key and self-signed digital certificate in the public-private key pair to the corresponding VNF through EM.

[0145] Example 2

[0146] Figure 6 The interactive process diagram of the information processing method according to the embodiment of the present invention is as follows Figure 2 ;like Figure 6 As shown, including:

[0147] Step 501: During the certificate information maintenance phase, the certificate query device receives new blocks from the digital certificate system and locally updates and maintains the digital certificate and its status information.

[0148] Exemplarily, the new block contains the digital certificates and their status information that have been newly verified in the digital certificate system within a period of time. The status information may indicate whether the digital certificate is valid, for example, the status information may indicate whether the corresponding digital certificate is in a valid state or a revoked state, etc.

[0149] Step 502 to step 504: When the VNF receives a digital certificate from another VNF, the VNF sends a certificate query request to the certificate query device; the certificate query device retrieves the digital certificate corresponding to the certificate information and its status information, and sends the result as a certificate query response to the VNF.

[0150] In this embodiment, the certificate query request may include the certificate information to be queried, such as a certificate ID or a certificate hash value.

[0151] Furthermore, the VNF receives a certificate query response from the certificate query device and verifies the validity of the digital certificate.

[0152] Example 3

[0153] This example is a certificate renewal process. When the VNF's digital certificate is about to expire, or the digital certificate is no longer secure, the certificate management device initiates the certificate renewal process. Figure 7 The interactive process diagram of the information processing method of the embodiment of the present invention is as follows Figure 3 ;like Figure 7 As shown, including:

[0154] Steps 601 to 604: The certificate management device located in the EM of the corresponding VNF obtains a new public-private key pair from a public-private key pair generating device, and the certificate management device generates a new self-signed digital certificate (such as the aforementioned new first digital certificate).

[0155] In this embodiment, the certificate management device can generate a new self-signed digital certificate based on the description information of the original digital certificate of the VNF (such as the certificate ID) and the new public and private key pair.

[0156] Step 605: The certificate management device sends a certificate update request to the certificate application device. The certificate update request includes a new self-signed digital certificate and a signature of the new self-signed digital certificate by the certificate management device based on the original private key.

[0157] Step 606 to step 607: After receiving the digital certificate update request, the certificate application device sends a certificate issuance request to the digital certificate system; the digital certificate system sends a certificate issuance response to the certificate application device.

[0158] Among them, the certificate application device signs the new self-signed digital certificate based on its own private key, and sends the new self-signed digital certificate and signature (including the signature of the certificate management device based on the original private key and the signature of the certificate application device based on its own private key) to the digital certificate system based on blockchain through a certificate issuance request. The digital certificate system based on blockchain will verify the self-signed digital certificate and the signature; after verification and consensus, the self-signed digital certificate and its status will be recorded in the blockchain. Once the digital certificate is recorded in the blockchain, it will be recognized by all nodes in the blockchain.

[0159] Steps 608 to 610: The certificate application device sends a certificate application response to the certificate management device; the certificate management device sends the private key in the new public-private key pair and the new self-signed digital certificate to the corresponding VNF through EM.

[0160] It should be noted that the VNF certificate update process can be done by redeploying the VNF, shutting down the original VNF, deploying a new VNF, and using a new digital certificate during the deployment process.

[0161] Scene 2

[0162] In this scenario, Figure 8 Schematic diagram of the system architecture of the information processing method of the embodiment of the present invention Figure 2 ;like Figure 8 As shown, the certificate management device is located in the VNFM; the public-private key pair generation device is located in the NFVI. The following is an example of the certificate deployment process, certificate query process and certificate update process of the VNF.

[0163] Example 4

[0164] Fig. 9 The interactive process diagram of the information processing method of the embodiment of the present invention is as follows Figure 4 ;like Fig. 9 As shown, including:

[0165] Step 701: The certificate management device obtains the certificate description information of the VNF from the VNFM through the EM.

[0166] Before VNF deployment, VNFM specifies the description of the digital certificate in the VNF configuration file VNFD, including information such as the certificate format and certificate ID. For example, the certificate format can be a field carried in the certificate, and the certificate ID can be required to be the domain name, IP address, device ID, and a combination of the above information of the VNF.

[0167] Steps 702 to 704: The certificate management apparatus applies for a public-private key pair from a public-private key pair generating apparatus, the public-private key pair generating apparatus generates a public-private key pair, and sends the public-private key pair to the certificate management apparatus based on the application of the certificate management apparatus.

[0168] Step 705: The certificate management device generates a self-signed digital certificate (i.e., the aforementioned first digital certificate) based on the certificate description information and the public-private key pair. If the certificate ID in the certificate description information is the domain name of the VNF, then in the self-signed digital certificate, the DN item of the certificate is the domain name of the VNF.

[0169] Step 706: The certificate management device sends a certificate application request to the certificate application device, where the certificate application request includes a self-signed digital certificate and information about the VNF to be deployed.

[0170] Steps 707 to 708: After receiving the certificate application request, the certificate application device sends a certificate issuance request to the digital certificate system, and the digital certificate system sends a certificate issuance response to the certificate application device.

[0171] Among them, the certificate application device signs the self-signed digital certificate based on its own private key, and sends the self-signed digital certificate and the signature to the digital certificate system based on blockchain through a certificate issuance request. The digital certificate system based on blockchain will verify the self-signed digital certificate and the signature; after verification and consensus, the self-signed digital certificate and its status will be recorded in the blockchain. Once the digital certificate is recorded in the blockchain, it will be recognized by all nodes in the blockchain.

[0172] Steps 709 to 711: the certificate application device sends a certificate application response to the certificate management device; the certificate management device sends the private key and self-signed digital certificate in the public-private key pair to the VNFM, and the VNFM sends the VNFD, private key and self-signed digital certificate to the corresponding EM.

[0173] Optionally, since both the private key and the self-signed digital certificate can be a string of hexadecimal codes, the private key and the self-signed digital certificate can be sent to the EM as a part of the VNFD for deploying and configuring the VNF.

[0174] Example 5

[0175] This example contains the certificate query process. For details, please refer to the processing flow of the aforementioned example 2, which will not be repeated here.

[0176] Example 6

[0177] This example is a certificate renewal process. When the VNF's digital certificate is about to expire, or the digital certificate is no longer secure, the certificate management device initiates the certificate renewal process. Fig.10 The interactive process diagram of the information processing method of the embodiment of the present invention is as follows Figure 5 ;like Fig.10 As shown, including:

[0178] Step 801 to step 804: The certificate management device obtains a new public-private key pair from a public-private key pair generating device, and the certificate management device generates a new self-signed digital certificate (eg, the aforementioned new first digital certificate).

[0179] In this embodiment, the certificate management device can generate a new self-signed digital certificate based on the description information of the original digital certificate of the VNF (such as the certificate ID) and the new public and private key pair.

[0180] Step 805: The certificate management device sends a certificate update request to the certificate application device. The certificate update request includes a new self-signed digital certificate and a signature of the new self-signed digital certificate by the certificate management device based on the original private key.

[0181] Step 806 to step 807: After receiving the digital certificate update request, the certificate application device sends a certificate issuance request to the digital certificate system; the digital certificate system sends a certificate issuance response to the certificate application device.

[0182] Among them, the certificate application device signs the new self-signed digital certificate based on its own private key, and sends the new self-signed digital certificate and signature (including the signature of the certificate management device based on the original private key and the signature of the certificate application device based on its own private key) to the digital certificate system based on blockchain through a certificate issuance request. The digital certificate system based on blockchain will verify the self-signed digital certificate and the signature; after verification and consensus, the self-signed digital certificate and its status will be recorded in the blockchain. Once the digital certificate is recorded in the blockchain, it will be recognized by all nodes in the blockchain.

[0183] Steps 808 to 810: The certificate application device sends a certificate application response to the certificate management device; the certificate management device sends the private key in the new public-private key pair and the new self-signed digital certificate to the corresponding EM through the VNFM, and the EM sends them to the corresponding VNF.

[0184] The embodiment of the present invention also provides an information processing device. Fig.11 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 1 ;like Fig.11 As shown, the device includes: a first communication unit 11 and a first processing unit 12; wherein,

[0185] The first communication unit 11 is used to obtain certificate description information of a first network element to be deployed, and obtain a first public-private key pair;

[0186] The first processing unit 12 is used to generate a first digital certificate based on the certificate description information and the first public-private key pair;

[0187] The first communication unit 11 is used to send a certificate application request to the second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system; and is also used to send at least the first digital certificate to the first network element when the digital certificate system verifies the first digital certificate successfully.

[0188] In some optional embodiments of the present invention, the first communication unit 11 is further configured to obtain a new first public-private key pair when the first processing unit 12 determines that the first digital certificate meets a preset condition;

[0189] The first processing unit 12 is further configured to generate a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and to generate a first signature based on the private key in the first public-private key pair and the new first digital certificate;

[0190] The first communication unit 11 is also used to send a certificate update request to the second device, wherein the certificate update request includes the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system; and is also used to send at least the new first digital certificate to the first network element when the digital certificate system verifies the new first digital certificate and the first signature, and the new first digital certificate is used to update the first digital certificate in the first network element.

[0191] In some optional embodiments of the present invention, the first processing unit 12 is used to determine that the first digital certificate satisfies a preset condition when the validity period of the first digital certificate satisfies a first preset condition, or when the security of the first digital certificate does not satisfy a second preset condition.

[0192] In some optional embodiments of the present invention, the first communication unit 11 is used to obtain certificate description information of the first network element to be deployed from the VNFM; and is also used to obtain the first public-private key pair from a fourth device for generating a public-private key pair; the fourth device is located in the NFVI.

[0193] In some optional embodiments of the present invention, the first device is located in an EM; each network element corresponds to an EM;

[0194] The first communication unit 11 is used to send the first digital certificate to at least the first network element through a first EM; the first EM is an EM corresponding to the first network element.

[0195] In some optional embodiments of the present invention, the first device is located in the VNFM; the first communication unit 11 is used to send the first digital certificate to at least the first EM through the VNFM, and forward the first digital certificate to the first network element through the first EM; the first EM is the EM corresponding to the first network element.

[0196] In an embodiment of the present invention, the first processing unit 12 in the device can be implemented by a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA) in actual applications; the first communication unit 11 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0197] It should be noted that: when the information processing device provided in the above embodiment performs information processing, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information processing device provided in the above embodiment and the information processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0198] The embodiment of the present invention also provides an information processing device. Fig.12 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 2 ;like Fig.12 As shown, the device includes: a second communication unit 21 and a second processing unit 22; wherein,

[0199] The second communication unit 21 is used to obtain a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated based on the certificate description information of the first network element and the first public-private key pair;

[0200] The second processing unit 22 is used to generate a second signature based on a specific private key and the first digital certificate;

[0201] The second communication unit 21 is also used to send a first request message including the first digital certificate and the second signature to the digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; it is also used to obtain a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; it is also used to send a certificate application response to the first device, and the certificate application response includes indication information indicating that the first digital certificate has been verified.

[0202] In some optional embodiments of the present invention, the second communication unit 21 is further used to obtain a certificate update request sent by the first device, wherein the certificate update request includes a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and a private key in the first public-private key;

[0203] The second processing unit 22 is further configured to generate a third signature based on the specific private key and the new first digital certificate;

[0204] The second communication unit 21 is also used to send a second request message including the new first digital certificate, the first signature and the third signature to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature; it is also used to obtain a second response message from the digital certificate system; when the digital certificate system verifies the new first digital certificate, the first signature and the third signature, the response message includes indication information indicating that the new first digital certificate has been verified; it is also used to send a certificate update response to the first device, and the certificate update response includes indication information indicating that the new first digital certificate has been verified.

[0205] In an embodiment of the present invention, the second processing unit 22 in the device can be implemented by a CPU, a DSP, an MCU or an FPGA in actual applications; the second communication unit 21 in the device can be implemented by a communication module (including: a basic communication kit, an operating system, a communication module, a standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0206] It should be noted that: when the information processing device provided in the above embodiment performs information processing, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information processing device provided in the above embodiment and the information processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0207] The embodiment of the present invention also provides an information processing device. Fig.13 The structure diagram of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 3 ;like Fig.13 As shown, the device includes: a third communication unit 31 and a third processing unit 32; wherein,

[0208] The third communication unit 31 is used to receive a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried;

[0209] The third processing unit 32 is used to retrieve the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from the pre-stored certificate information set;

[0210] The third communication unit 31 is further used to send a certificate query response to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate.

[0211] In some optional embodiments of the present invention, the device further comprises a storage unit;

[0212] The third communication unit 31 is also used for the third device to receive a certificate information set sent by the digital certificate system;

[0213] The storage unit is used to store the certificate information set.

[0214] In an embodiment of the present invention, the third processing unit 32 in the device can be implemented by a CPU, a DSP, an MCU or an FPGA in actual applications; the storage unit in the device can be implemented by a memory in actual applications; the third communication unit 31 in the device can be implemented by a communication module (including: a basic communication kit, an operating system, a communication module, a standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0215] It should be noted that: when the information processing device provided in the above embodiment performs information processing, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information processing device provided in the above embodiment and the information processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0216] The embodiment of the present invention further provides an information processing device, Fig.14 FIG. 1 is a schematic diagram of the hardware structure of the information processing device according to an embodiment of the present invention. Fig.14 As shown, the information processing device includes a memory 42, a processor 41, and a computer program stored in the memory 42 and executable on the processor 41. When the processor 41 executes the program, the steps of the information processing method applied to the first device, the second device, or the third device are implemented.

[0217] Optionally, the information processing device may further include a network interface 43. It is understood that the various components in the information processing device are coupled together via a bus system 44. It is understood that the bus system 44 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 44 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.14 Various buses are labeled as bus system 44 .

[0218] It can be understood that the memory 42 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 42 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0219] The method disclosed in the above embodiment of the present invention can be applied to the processor 41, or implemented by the processor 41. The processor 41 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 41 or the instruction in the form of software. The above processor 41 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 41 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 42. The processor 41 reads the information in the memory 42 and completes the steps of the above method in combination with its hardware.

[0220] In an exemplary embodiment, the information processing device may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general-purpose processor, controller, MCU, microprocessor, or other electronic components to execute the aforementioned method.

[0221] In an exemplary embodiment, the present invention also provides a computer-readable storage medium, such as a memory 42 including a computer program, and the computer program can be executed by a processor 41 of an information processing device to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or it can be various devices including one or any combination of the above memories.

[0222] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the information processing method applied to the first device, the second device or the third device are implemented.

[0223] The embodiment of the present invention also provides an information processing system, which can use the above-mentioned Figure 4 or Figure 8 The system comprises: a first device, a second device and a fourth device for generating a public-private key pair; the fourth device is located in a network function virtualization infrastructure NFVI; wherein,

[0224] The first device is used to obtain certificate description information of a first network element to be deployed, and to obtain a first public-private key pair from the fourth device; generate a first digital certificate based on the certificate description information and the first public-private key pair; send a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; and receive a certificate application response from the second device; and when the certificate application response includes indication information indicating that the first digital certificate has been verified, at least send the first digital certificate to the first network element;

[0225] The second device is used to generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; obtain a first response message from the digital certificate system; when the digital certificate system verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; and send a certificate application response to the first device, wherein the certificate application response includes indication information indicating that the first digital certificate has been verified.

[0226] In some optional embodiments of the present invention, the system also includes a third device, which is used to receive a certificate query request from a first network element; the certificate query request includes first certificate information to be queried; the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate are retrieved from a pre-stored certificate information set; a certificate query response is sent to the first network element; the certificate query response includes the digital certificate and the status information corresponding to the digital certificate.

[0227] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0228] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0229] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0230] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0231] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0232] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0233] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0234] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0235] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An information processing method, characterized in that: The method comprises: The first device obtains certificate description information of a first network element to be deployed, and obtains a first public-private key pair from a fourth device for generating a public-private key pair; the first device is located in a network element manager EM, or the first device is located in a virtual network function manager VNFM; the fourth device is located in a network function virtualization infrastructure NFVI; Generate a first digital certificate based on the certificate description information and the first public-private key pair; Sending a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system; When the digital certificate system successfully verifies the first digital certificate, at least the first digital certificate is sent to the first network element.

2. The method according to claim 1, characterized in that: The method further comprises: When the first device determines that the first digital certificate meets a preset condition, obtaining a new first public-private key pair; Generate a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and generate a first signature based on the private key in the first public-private key pair and the new first digital certificate; Sending a certificate update request to the second device, wherein the certificate update request includes the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system; When the digital certificate system successfully verifies the new first digital certificate and the first signature, at least the new first digital certificate is sent to the first network element, and the new first digital certificate is used to update the first digital certificate in the first network element.

3. The method according to claim 2, characterized in that The first device determines that the first digital certificate meets a preset condition, including: When the first device determines that the validity period of the first digital certificate satisfies a first preset condition, or when the first device determines that the security of the first digital certificate does not satisfy a second preset condition, it determines that the first digital certificate satisfies the preset condition.

4. The method according to claim 1, characterized in that The first device obtains certificate description information of a first network element to be deployed, including: The first device obtains certificate description information of the first network element to be deployed from the virtual network function manager VNFM; the fourth device is located in the network function virtualization infrastructure NFVI.

5. The method according to any one of claims 1 to 4, characterized in that: The first device is located in the network element management EM; each network element corresponds to an EM; The sending at least the first digital certificate to the first network element comprises: Sending at least the first digital certificate to the first network element through the first EM; The first EM is the EM corresponding to the first network element.

6. The method according to any one of claims 1 to 4, characterized in that: The first device is located in the VNFM; The sending at least the first digital certificate to the first network element comprises: Sending the first digital certificate to at least a first EM through the VNFM, and forwarding the first digital certificate to the first network element through the first EM; The first EM is the EM corresponding to the first network element.

7. An information processing method, characterized in that: The method comprises: The second device obtains a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated by the first device based on the obtained certificate description information of the first network element and the first public-private key pair obtained from a fourth device for generating a public-private key pair; the first device is located in a network element management EM, or the first device is located in a virtual network function manager VNFM; the fourth device is located in a network function virtualization infrastructure NFVI; Generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; Obtaining a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the verification of the first digital certificate has been successful; A certificate request response is sent to the first device, wherein the certificate request response includes indication information indicating that the first digital certificate has been verified successfully.

8. The method according to claim 7, characterized in that The method further comprises: The second device obtains a certificate update request sent by the first device, wherein the certificate update request includes a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and a private key in the first public-private key; Generate a third signature based on the specific private key and the new first digital certificate, and send a second request message including the new first digital certificate, the first signature and the third signature to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature; Obtaining a second response message from the digital certificate system; when the digital certificate system successfully verifies the new first digital certificate, the first signature, and the third signature, the response message includes indication information indicating that the new first digital certificate has been successfully verified; A certificate update response is sent to the first device, wherein the certificate update response includes indication information indicating that the new first digital certificate has passed verification.

9. An information processing method, characterized in that: The method further comprises: The third device receives a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried; Retrieving a digital certificate corresponding to the first certificate information and status information corresponding to the retrieved digital certificate from a pre-stored certificate information set; A certificate query response is sent to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate; the digital certificate is generated by the first device based on the certificate description information of the first network element and the public-private key pair obtained from the fourth device for generating the public-private key pair, and is verified by the digital certificate system; the first device is located in the network element management EM, or the first device is located in the virtual network function manager VNFM; the fourth device is located in the network function virtualization infrastructure NFVI.

10. The method according to claim 9, characterized in that The method further comprises: The third device receives the certificate information set sent by the digital certificate system and stores the certificate information set.

11. An information processing device, characterized in that: The device comprises: a first communication unit and a first processing unit; wherein, The first communication unit is used to obtain certificate description information of a first network element to be deployed, and to obtain a first public-private key pair from a fourth device for generating a public-private key pair; the first device is located in a network element manager EM, or the first device is located in a virtual network function manager VNFM; the fourth device is located in a network function virtualization infrastructure NFVI; The first processing unit is used to generate a first digital certificate based on the certificate description information and the first public-private key pair; The first communication unit is used to send a certificate application request to the second device, wherein the certificate application request includes at least the first digital certificate; the second device is used to verify the first digital certificate using a digital certificate system; and is also used to send at least the first digital certificate to the first network element when the digital certificate system verifies the first digital certificate successfully.

12. The device according to claim 11, characterized in that The first communication unit is further configured to obtain a new first public-private key pair when the first processing unit determines that the first digital certificate satisfies a preset condition; The first processing unit is further configured to generate a new first digital certificate based on the new first public-private key pair and the certificate description information of the first network element, and to generate a first signature based on the private key in the first public-private key pair and the new first digital certificate; The first communication unit is also used to send a certificate update request to the second device, wherein the certificate update request includes the new first digital certificate and the first signature; the second device is used to verify the new first digital certificate and the first signature using the digital certificate system; and is also used to send at least the new first digital certificate to the first network element when the digital certificate system verifies the new first digital certificate and the first signature, and the new first digital certificate is used to update the first digital certificate in the first network element.

13. The device according to claim 12, characterized in that The first processing unit is configured to determine that the first digital certificate satisfies a preset condition when it is determined that the validity period of the first digital certificate satisfies a first preset condition, or when it is determined that the security of the first digital certificate does not satisfy a second preset condition.

14. The device according to claim 11, characterized in that The first communication unit is used to obtain certificate description information of the first network element to be deployed from the virtual network function manager VNFM; the fourth device is located in the network function virtualization infrastructure NFVI.

15. The device according to any one of claims 11 to 14, characterized in that The first device is located in the network element management EM; each network element corresponds to an EM; The first communication unit is used to send at least the first digital certificate to the first network element through a first EM; the first EM is an EM corresponding to the first network element.

16. The device according to any one of claims 11 to 14, characterized in that The first device is located in the VNFM; The first communication unit is used to send the first digital certificate to at least a first EM through the VNFM, and forward the first digital certificate to the first network element through the first EM; the first EM is an EM corresponding to the first network element.

17. An information processing device, characterized in that: The device comprises: a second communication unit and a second processing unit; wherein, The second communication unit is used to obtain a certificate application request sent by the first device, wherein the certificate application request includes at least a first digital certificate; the first digital certificate is generated by the first device based on the obtained certificate description information of the first network element and the first public-private key pair obtained from the fourth device for generating a public-private key pair; the first device is located in the network element management EM, or the first device is located in the virtual network function manager VNFM; the fourth device is located in the network function virtualization infrastructure NFVI; The second processing unit is configured to generate a second signature based on a specific private key and the first digital certificate; The second communication unit is also used to send a first request message including the first digital certificate and the second signature to the digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; and is also used to obtain a first response message from the digital certificate system; when the digital certificate system successfully verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; and is also used to send a certificate application response to the first device, and the certificate application response includes indication information indicating that the first digital certificate has been verified.

18. The device according to claim 17, characterized in that The second communication unit is further configured to obtain a certificate update request sent by the first device, wherein the certificate update request includes a new first digital certificate and a first signature; the first signature is generated based on the new first digital certificate and a private key in the first public-private key; The second processing unit is further configured to generate a third signature based on the specific private key and the new first digital certificate; The second communication unit is also used to send a second request message including the new first digital certificate, the first signature and the third signature to the digital certificate system; the digital certificate system is used to verify the new first digital certificate, the first signature and the third signature; and is also used to obtain a second response message from the digital certificate system; when the digital certificate system verifies the new first digital certificate, the first signature and the third signature, the response message includes indication information indicating that the new first digital certificate has been verified; and is also used to send a certificate update response to the first device, and the certificate update response includes indication information indicating that the new first digital certificate has been verified.

19. An information processing device, characterized in that: The device comprises: a third communication unit and a third processing unit; wherein, The third communication unit is used to receive a certificate query request from the first network element; the certificate query request includes the first certificate information to be queried; The third processing unit is used to retrieve the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from the pre-stored certificate information set; The third communication unit is also used to send a certificate query response to the first network element; the certificate query response includes the digital certificate and status information corresponding to the digital certificate; the digital certificate is generated by the first device based on the certificate description information of the first network element and the public-private key pair obtained from the fourth device for generating a public-private key pair, and is verified by the digital certificate system; the first device is located in the network element management EM, or the first device is located in the virtual network function manager VNFM; the fourth device is located in the network function virtualization infrastructure NFVI.

20. The device according to claim 19, characterized in that The device also includes a storage unit; The third communication unit is also used for the third device to receive the certificate information set sent by the digital certificate system; The storage unit is used to store the certificate information set.

21. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented; or When the program is executed by a processor, the steps of the method according to claim 7 or 8 are implemented; or, When the program is executed by a processor, the steps of the method according to claim 9 or 10 are implemented.

22. An information processing device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented; or, When the processor executes the program, the steps of the method according to claim 7 or 8 are implemented; or, When the processor executes the program, the steps of the method according to claim 9 or 10 are implemented.

23. An information processing system, characterized in that: The system comprises: a first device, a second device and a fourth device for generating a public-private key pair; the fourth device is located in a network function virtualization infrastructure NFVI; wherein, The first device is used to obtain certificate description information of a first network element to be deployed, and to obtain a first public-private key pair from the fourth device; generate a first digital certificate based on the certificate description information and the first public-private key pair; send a certificate application request to a second device, wherein the certificate application request includes at least the first digital certificate; and receive a certificate application response from the second device; and when the certificate application response includes indication information indicating that the first digital certificate has been verified, at least send the first digital certificate to the first network element; The second device is used to generate a second signature based on a specific private key and the first digital certificate, and send a first request message including the first digital certificate and the second signature to a digital certificate system; the digital certificate system is used to verify the first digital certificate and the second signature; obtain a first response message from the digital certificate system; when the digital certificate system verifies the first digital certificate and the second signature, the response message includes indication information indicating that the first digital certificate has been verified; and send a certificate application response to the first device, wherein the certificate application response includes indication information indicating that the first digital certificate has been verified.

24. The system according to claim 23, characterized in that The system also includes a third device, which is used to receive a certificate query request from a first network element; the certificate query request includes first certificate information to be queried; retrieve the digital certificate corresponding to the first certificate information and the status information corresponding to the retrieved digital certificate from a pre-stored certificate information set; send a certificate query response to the first network element; the certificate query response includes the digital certificate and the status information corresponding to the digital certificate.

Images