Method, device and system for vnfm and vnf to establish data security connection

Abstract

The application discloses a method, device and system for establishing a data security connection between a VNFM and a VNF, and relates to the technical field of virtual resource arrangement and operation. The method comprises the following steps: when deploying the VNF, sending first encryption configuration information to the VNF, wherein the indication information in the first encryption configuration information is used for indicating whether the VNFM supports the encryption function; receiving second encryption configuration information sent by the VNF, wherein the second encryption configuration information is used for indicating whether the VNF supports the encryption function; if it is determined that the VNFM and the VNF both support the encryption function, sending the password to the VNF in the form of ciphertext; and if it is determined that at least one of the VNFM and the VNF does not support the encryption function, sending the password to the VNF in the form of plaintext. The application can realize smooth transition from not supporting the encryption function to supporting the encryption function between the VNFM and the VNF, and make the system have good compatibility.

Description

Technical Field

[0001] This invention relates to the field of virtualization resource orchestration and operation technology, and in particular to a method, device and system for establishing a secure data connection between VNFM and VNF. Background Technology

[0002] The purpose of NFV (Network Function Virtualization) architecture is to replace private, dedicated, and closed network elements in communication networks, achieving an open architecture of a unified, general-purpose hardware platform and service logic software. The NFV architecture includes NFVI (NFV infrastructure), MANO (Management and Orchestration), and multiple VNFs (Virtualized Network Functions). NFVI provides the operating environment for VNFs, including the necessary hardware and software resources; the VNFM (VNFManager) in MANO controls the lifecycle of VNFs (instantiation, configuration, shutdown, etc.).

[0003] A secure data connection needs to be established between VNFMs and VNFs, and this requires the transmission of a password. Previously, when security requirements were low, VNFMs could send the generated password to VNFs in plaintext. In recent years, with increasing security demands, VNFMs are required to send the generated password to VNFs in ciphertext. To meet this requirement, a key can be configured during the simultaneous upgrade of both the VNFM and all VNFs. The upgraded VNFM then uses this configured key to encrypt the password, sends the encrypted ciphertext to the VNFs, and the VNFs decrypt the ciphertext using the same configured key to obtain the password.

[0004] Since the key can only be obtained after VNFM and all VNFs are upgraded simultaneously, it is required that VNFM and all VNFs be upgraded at the same time. However, simultaneous upgrades will cause the system to malfunction for a short period of time, thereby affecting the normal operation of services. Furthermore, simultaneous upgrades of VNFM and all VNFs place high demands on operation and maintenance and are difficult to implement. Summary of the Invention

[0005] This invention provides a method, device, and system for establishing a secure data connection between a VNFM and a VNF (Virtual Network Function). The technical objective is to achieve a smooth transition between VNFM and VNF from not supporting encryption to supporting encryption, thereby enabling the system to have good compatibility and solving the problems of long-term key invariance and key loss.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution: A method for establishing a secure data connection between a VNFM and a VNF, used in a VNFM, the method comprising: When deploying a VNF, first encryption configuration information is sent to the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption functionality. Receive second encryption configuration information sent by the VNF, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; If it is determined that both the VNFM and the VNF support encryption, then the password is sent to the VNF in ciphertext form; If it is determined that at least one of the VNFM and the VNF does not support encryption, the password is sent to the VNF in plaintext.

[0007] Optionally, sending the ciphertext to the VNF includes: When the first encryption configuration information also includes a first key, the first key is obtained from the first encryption configuration information; or, when the VNFM configuration file includes a first key, the first key is obtained from the VNFM configuration file. The password is encrypted using the first key to obtain the first ciphertext; The first ciphertext is sent to the VNF.

[0008] Optionally, after receiving the second encrypted configuration information sent by the VNF, the method further includes: The second encrypted configuration information is stored; When a password needs to be transmitted, it is determined whether both the VNFM and the VNF support encryption functionality based on the first encryption configuration information and the stored second encryption configuration information.

[0009] Optionally, after sending the ciphertext to the VNF, the method further includes: Receive a key exchange request sent by the VNF, wherein the key exchange request carries a first key exchange number; A second key exchange number is generated according to the key exchange request, and the second key exchange number is sent to the VNF. The second key exchange number is used by the VNF to generate a second key, and the second key is used to update the first key. The second key is generated based on the first key exchange number.

[0010] Optionally, after generating the second key based on the first key exchange number, the method further includes: The first content is encrypted using the second key to obtain the second ciphertext. The first content is the password in the request content of the first lifecycle operation request, or the first content is the password and other information in the request content. The second ciphertext is sent to the VNF in the first lifecycle operation request. The VNF decrypts the second ciphertext using the second key to obtain the first content.

[0011] Optionally, after generating the second key based on the first key exchange number, the method further includes: Receive the second lifecycle operation request sent by the VNF; The second content is encrypted using the second key to obtain a third ciphertext. The second content is the password in the response content of the response message, or the second content is the password and other information in the response content. The response message is used to respond to the second lifecycle operation request. The third ciphertext is carried in the response message and sent to the VNF. The third ciphertext is decrypted by the VNF using the second key to obtain the second content.

[0012] Optionally, after generating the second key based on the first key exchange number, the method further includes: The VNF receives a third lifecycle operation request, which carries a fourth ciphertext. The fourth ciphertext is obtained by the VNF encrypting the third content using the second key. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content. The fourth ciphertext is decrypted using the second key to obtain the third content.

[0013] Optionally, before receiving the key exchange request sent by the VNF, the method further includes: sending a deployment completion notification message to the VNF, wherein the VNF is configured to send the key exchange request upon triggering the notification message; or, sending a fourth lifecycle operation request to the VNF, wherein the VNF is configured to send the key exchange request upon triggering the fourth lifecycle operation request; or, the key exchange request is sent after a predetermined lifecycle operation occurs in the VNF.

[0014] A method for establishing a secure data connection between a VNFM and a VNF, used in a VNF, the method comprising: When deploying the VNF, the system receives first encryption configuration information sent by the VNFM. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption functionality. Send second encryption configuration information to the VNFM, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; Receive the password sent in encrypted form by the VNFM, wherein the password is sent in encrypted form by the VNFM when the VNFM determines that both the VNFM and the VNF support encryption; or, The VNFM receives a password sent in plaintext, which is sent by the VNFM when it determines that at least one of the VNFM and the VNF does not support encryption.

[0015] Optionally, after receiving the first encrypted configuration information sent by VNFM, the method further includes: storing the first encrypted configuration information; After receiving the password sent by the VNFM in encrypted form, the method further includes: determining whether both the VNFM and the VNF support encryption functionality based on the second encryption configuration information and the stored first encryption configuration information; If it is determined that both the VNFM and the VNF support encryption, then when the first encryption configuration information also includes a first key, the first key is obtained from the first encryption configuration information; or, when the configuration file of the VNF includes a first key, the first key is obtained from the configuration file of the VNF. The first key is used to decrypt the first ciphertext sent in ciphertext form to obtain the password.

[0016] Optionally, after receiving the ciphertext sent by the VNFM, the method further includes: Send a key exchange request to the VNFM, the key exchange request carrying a first key exchange number, the first key exchange number being used by the VNFM to generate a second key, the second key being used to update the first key; Receive the second key exchange number sent by the VNFM, the second key exchange number being generated by the VNFM based on the key exchange request; The second key is generated based on the second key exchange number.

[0017] Optionally, after generating the second key based on the second key exchange number, the method further includes: Receive a first lifecycle operation request sent by the VNFM, the first lifecycle operation request carrying a second ciphertext, the second ciphertext being obtained by the VNFM encrypting the first content using the second key, the first content being the password in the request content of the first lifecycle operation request, or the first content being the password and other information in the request content; The second key is used to decrypt the second ciphertext to obtain the first content.

[0018] Optionally, after generating the second key based on the second key exchange number, the method further includes: Send a second lifecycle operation request to the VNFM; The system receives a response message sent by the VNFM, the response message being used to respond to the second lifecycle operation request, and the response message carrying a third ciphertext, the third ciphertext being obtained by the VNFM encrypting the second content using the second key, the second content being the password in the response content of the response message, or the second content being the password and other information in the response content; The second key is used to decrypt the third ciphertext to obtain the second content.

[0019] Optionally, after generating the second key based on the second key exchange number, the method further includes: The third content is encrypted using the second key to obtain the fourth ciphertext. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content. The fourth ciphertext is sent to the VNFM in the third lifecycle operation request. The VNFM decrypts the fourth ciphertext using the generated second key to obtain the third content.

[0020] Optionally, before sending the key exchange request to the VNFM, the method further includes: Receive a deployment completion notification message from the VNFM, and, triggered by the notification message, execute the step of sending a key exchange request to the VNFM; or, Receive the fourth lifecycle operation request sent by the VNFM, and execute the step of sending a key exchange request to the VNFM upon triggering the fourth lifecycle operation request; or, After a predetermined lifecycle operation occurs in the VNF, the step of sending a key exchange request to the VNFM is executed under the trigger of the predetermined lifecycle operation.

[0021] A VNFM, the VNFM comprising: The first sending unit is used to send first encryption configuration information to the VNF when deploying the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption function. The first receiving unit is configured to receive the second encryption configuration information sent by the VNF, wherein the second encryption configuration information is used to indicate whether the VNF supports encryption functionality. The first sending unit is further configured to send a password to the VNF in ciphertext form if it is determined that both the VNFM and the VNF support encryption. The first sending unit is further configured to send the password to the VNF in plaintext if it is determined that at least one of the VNFM and the VNF does not support encryption.

[0022] A VNF, the VNF comprising: The second receiving unit is used to receive first encryption configuration information sent by the VNFM when the VNF is deployed. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption function. The second sending unit is used to send second encryption configuration information to the VNFM, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; The second receiving unit is further configured to receive a password sent in encrypted form by the VNFM, wherein the password is sent in encrypted form by the VNFM when the VNFM determines that both the VNFM and the VNF support encryption; or, The second receiving unit is further configured to receive a password sent in plaintext by the VNFM, the password being sent in plaintext by the VNFM when it determines that at least one of the VNFM and the VNF does not support encryption.

[0023] A system comprising VNFM and VNF; The VNFM is as described above; The VNF is the VNF described above.

[0024] The beneficial effects of this invention are as follows: During VNF deployment, the VNFM sends first encryption configuration information to the VNF, which carries indication information for whether the VNFM supports encryption. The VNF sends second encryption configuration information to the VNFM, which indicates whether the VNF supports encryption. When it is determined, based on the first and second encryption configuration information, that both the VNFM and VNF support encryption, a password is sent to the VNF in ciphertext. When it is determined, based on the first and second encryption configuration information, that at least one of the VNFM and VNF does not support encryption, a password is sent to the VNF in plaintext. Therefore, the system can include both devices that support encryption (i.e., upgraded devices) and devices that do not support encryption (i.e., devices before upgrade), without requiring all devices in the system to be upgraded simultaneously. This allows for a smooth transition from devices that do not support encryption to those that do, resulting in better system compatibility.

[0025] The first key can be configured in the first encryption configuration information or in the configuration file, thus expanding the ways to obtain the first key.

[0026] After the VNF initiates a key exchange request, the VNF and VNFM can negotiate and generate the same second key, and then use the second key to update the first key, thereby achieving the purpose of updating the key and solving the problem of data security connection being affected by keys that have not changed for a long time or keys that have been lost. Attached Figure Description

[0027] Figure 1 This is a flowchart of a method for establishing a secure data connection between a VNFM and a VNF, provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of a key update negotiation between a VNFM and a VNF provided in Embodiment 2 of the present invention; Figure 3 This is a flowchart of how VNFM sends ciphertext in a lifecycle operation request to VNF, provided in Embodiment 3 of the present invention; Figure 4 This is a flowchart of how VNFM sends ciphertext in a response message to VNF, provided in Embodiment 3 of the present invention; Figure 5 This is a flowchart of how the VNF sends ciphertext in a lifecycle operation request to the VNFM, as provided in Embodiment 3 of the present invention; Figure 6 This is a schematic diagram of the VNFM structure provided in Embodiment 4 of the present invention; Figure 7 This is a schematic diagram of the VNF structure provided in Embodiment 5 of the present invention; Figure 8 This is a schematic diagram of the system provided in Embodiment Six of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings. In the description of this application, it should be understood that the terms "first," "second," "third," and "fourth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features; they are merely used to distinguish different components.

[0029] Example 1 like Figure 1 As shown, this embodiment provides a method for establishing a secure data connection between a VNFM and a VNF. This method can be applied to systems including VNFMs and VNFs, and includes the following steps: In step S101, when deploying the VNF, the VNFM sends the first encryption configuration information to the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption functionality.

[0030] A VNFM can first create a VNF and then deploy it. During deployment, the VNFM can first determine whether it supports encryption based on its own configuration. If the VNFM supports encryption, it generates an indication message indicating that it supports encryption and sends this message along with the first encryption configuration information to the VNF. If the VNFM does not support encryption, it generates an indication message indicating that it does not support encryption and sends this message along with the first encryption configuration information to the VNF.

[0031] In this embodiment, the key used for encrypting the password for the first time when deploying the VNF is referred to as the first key, and the first key is usually pre-configured. In the first implementation, the first key is configured only in the VNFM. In this case, the VNFM needs to add the first key to the first encryption configuration information and send it to the VNF. At this time, the first encryption configuration information includes at least indication information and the first key. In the second implementation, the first key can be configured in both the VNFM configuration file and the VNF configuration file. In this case, the VNFM does not need to add the first key to the first encryption configuration information and send it to the VNF. At this time, the first encryption configuration information includes at least indication information.

[0032] In step S102, the VNF receives the first encrypted configuration information sent by the VNFM.

[0033] The VNF receives the first encrypted configuration information sent by the VNFM and stores it. Optionally, the VNF may store the first encrypted configuration information in a database.

[0034] In step S103, the VNF sends a second encryption configuration information to the VNFM, which is used to indicate whether the VNF supports encryption functionality.

[0035] A VNF can first determine whether it supports encryption based on its own configuration. If the VNF supports encryption, it generates a second encryption configuration information to indicate that the VNF supports encryption and sends the second encryption configuration information to the VNFM. If the VNF does not support encryption, it generates a second encryption configuration information to indicate that the VNF does not support encryption and sends the second encryption configuration information to the VNFM.

[0036] In step S104, the VNFM receives the second encrypted configuration information sent by the VNF.

[0037] The VNFM receives the second encrypted configuration information sent by the VNF and stores it. Optionally, the VNFM can store the second encrypted configuration information in a database.

[0038] VNFM can continue to deploy VNF. When it is determined that a password needs to be sent to VNF, VNFM can determine whether both VNFM and VNF support encryption based on the first encryption configuration information and the stored second encryption configuration information. When both VNFM and VNF support encryption, step S105 is executed. When VNFM does not support encryption but VNF ​​does, or when VNF does not support encryption but VNFM does, or when neither VNFM nor VNF supports encryption, step S107 is executed.

[0039] Step S105: If it is determined that both VNFM and VNF support encryption, then VNFM sends the password to VNF in ciphertext form, and proceeds to step S106.

[0040] Specifically, when the first encryption configuration information also includes a first key, the VNFM obtains the first key from the first encryption configuration information; or, when the VNFM's configuration file includes a first key, the VNFM obtains the first key from the VNFM's configuration file; then, the first key is used to encrypt the password to obtain the first ciphertext; and the first ciphertext is sent to the VNFM. There are many encryption algorithms that can be used to encrypt the password using the first key, and this embodiment does not limit the specific algorithm.

[0041] Step S106: The VNF receives the password sent by the VNFM in encrypted form, and the process ends.

[0042] Since the VNF does not know whether the VNFM sends the password in ciphertext or plaintext, the VNF can first determine whether both the VNFM and VNF support encryption based on the stored first and second encryption configuration information. In the current scenario, both the VNFM and VNF support encryption. The VNF determines that it has received the first ciphertext and needs to decrypt it to obtain the password. Specifically, when the first encryption configuration information also includes a first key, the VNF obtains the first key from the first encryption configuration information; or, when the VNF's configuration file includes a first key, the VNF obtains the first key from the VNF's configuration file. The first key is then used to decrypt the first ciphertext to obtain the password. The decryption algorithm used to decrypt the first ciphertext with the first key corresponds to the encryption algorithm in step S105.

[0043] Step S107: If it is determined that at least one of VNFM and VNF does not support encryption, then VNFM sends the password to VNF in plaintext, and proceeds to step S108.

[0044] VNFM can directly send the password to VNF.

[0045] Step S108: The VNF receives the password sent by the VNFM in plaintext.

[0046] Since the VNF does not know whether the VNFM sends the password in ciphertext or plaintext, the VNF can first determine whether both the VNFM and the VNF support encryption based on the stored first and second encryption configuration information. In the current scenario, the VNFM does not support encryption, but the VNF does; or the VNF does not support encryption, but the VNFM does; or neither the VNFM nor the VNF supports encryption, in which case the VNF will determine that it has received the password in plaintext.

[0047] Among them, steps S101, S104, S105 and S107 can be implemented individually as VNFM-side embodiments, and steps S102, S103, S106 and S108 can be implemented individually as VNF-side embodiments.

[0048] In summary, the method for establishing a secure data connection between a VNFM and a VNF proposed in this embodiment of the invention involves the VNFM sending first encrypted configuration information to the VNF during VNF deployment. This first encrypted configuration information carries indications of whether the VNFM supports encryption functionality. The VNF then sends second encrypted configuration information to the VNFM, indicating whether the VNF supports encryption functionality. When it is determined, based on the first and second encrypted configuration information, that both the VNFM and VNF support encryption functionality, a password is sent to the VNF in ciphertext. When it is determined, based on the first and second encrypted configuration information, that at least one of the VNFM and VNF does not support encryption functionality, a password is sent to the VNF in plaintext. Therefore, the system can include both devices that support encryption functionality (i.e., upgraded devices) and devices that do not support encryption functionality (i.e., devices before upgrades), without requiring all devices in the system to be upgraded simultaneously. This allows for a smooth transition from devices that do not support encryption functionality to those that do, resulting in better system compatibility.

[0049] Example 2 After obtaining the first key, VNFM and VNF can negotiate to generate a second key and use the second key to update the first key, thus achieving the purpose of updating the key and solving the problem of data security being affected by keys remaining unchanged for a long time or keys being lost. Figure 2 As shown, the method may include: In step S201, the VNF sends a key exchange request to the VNFM, which carries the first key exchange number.

[0050] The first key exchange number is generated by the VNF according to a predetermined algorithm. Optionally, the predetermined algorithm can be the Diffie-Hellman algorithm.

[0051] In this embodiment, the VNF can send a key exchange request to the VNFM in the following three situations, which are described below.

[0052] 1) After the VNF is deployed, the VNF sends a key exchange request to the VNFM.

[0053] After the VNF deployment is complete, the VNFM sends a deployment completion notification message to the VNF. Upon receiving this notification message, the VNF sends a key exchange request to the VNFM. Optionally, this notification message can be an instantiation extension request.

[0054] 2) Upon receiving the lifecycle operation request from VNFM, VNF sends a key exchange request to VNFM.

[0055] Lifecycle operation requests are operation requests used to control the lifecycle of a VNF. They can be sent from the VNFM to the VNF, such as lifecycle operation requests to add a virtual machine in the VNF or modify the VNF capacity; or they can be sent from the VNF to the VNFM, such as lifecycle operation requests to request self-healing or system restart.

[0056] In this embodiment, the VNF can be configured to send a key exchange request after receiving any lifecycle operation request, or it can be configured to send a key exchange request after receiving a subset of specific lifecycle operation requests, or it can be configured not to send a key exchange request after receiving any lifecycle operation request. To distinguish it from the lifecycle operation requests mentioned below, the lifecycle operation request that triggers the VNF to send a key exchange request is referred to as the fourth lifecycle operation request in this embodiment.

[0057] In the current scenario, the VNFM sends a fourth lifecycle operation request to the VNF, and the VNF receives the fourth lifecycle operation request from the VNFM and sends a key exchange request to the VNFM when triggered by the fourth lifecycle operation request.

[0058] 3) After a predetermined lifecycle operation occurs in the VNF, the VNF sends a key exchange request to the VNFM.

[0059] After a predetermined lifecycle operation occurs in the VNF, a key exchange request is sent to the VNFM triggered by that predetermined lifecycle operation. The predetermined lifecycle operation can be pre-set; for example, if the predetermined lifecycle operation is set to a system restart, then the VNF will send a key exchange request to the VNFM after the system restarts.

[0060] It should be noted that after the system restarts, the VNF also needs to send a system restart lifecycle operation request to the VNFM. In this embodiment, the order in which the lifecycle operation request and the key exchange request are sent is not limited.

[0061] In step S202, the VNFM receives a key exchange request sent by the VNF, which carries the first key exchange number.

[0062] In step S203, the VNFM generates a second key exchange number based on the key exchange request and sends the second key exchange number to the VNF.

[0063] VNFM can generate a second key exchange number according to a predetermined algorithm after receiving a key exchange request. Optionally, the predetermined algorithm can be the Diffie-Hellman algorithm.

[0064] Step S204: VNFM generates a second key based on the first key exchange number.

[0065] VNFM can input the first key exchange number into a predetermined algorithm to obtain the second key. Optionally, the predetermined algorithm can be the Diffie-Hellman algorithm.

[0066] VNFM encrypts and stores the generated second key in the database.

[0067] Step S205: The VNF receives the second key exchange number sent by the VNFM.

[0068] In this embodiment, the execution order of steps S204 and S205 is not limited.

[0069] Step S206: VNF generates a second key based on the second key exchange number.

[0070] VNF can input the second key exchange number into a predetermined algorithm to obtain the second key. Optionally, the predetermined algorithm can be the Diffie-Hellman algorithm.

[0071] VNF encrypts and stores the generated second key in the database.

[0072] It should be noted that the predetermined algorithm can generate the same output (second key) based on different inputs (first key exchange number and second key exchange number).

[0073] Steps S202, S203, and S204 can be implemented individually as VNFM-side embodiments, and steps S201, S205, and S206 can be implemented individually as VNF-side embodiments.

[0074] Example 3 After generating the second key, VNFM and VNF can use the second key to transmit encrypted data. The following describes three transmission scenarios.

[0075] 1) such as Figure 3 As shown, VNFM sends the ciphertext along with the lifecycle operation request to VNF.

[0076] In step S301, VNFM uses the second key to encrypt the first content to obtain the second ciphertext. The first content is the password in the request content of the first lifecycle operation request, or the first content is the password and other information in the request content.

[0077] When VNFM determines that it needs to send a first lifecycle operation request to VNF, it reads the second key from the database, then obtains the first content from the request content in the first lifecycle request, and encrypts the first content with the second key to obtain the second ciphertext.

[0078] Specifically, when the request content includes a password and other information, VNFM can either specify only the password as the primary content, encrypting only the password and not the other information; or, specify both the password and other information as the primary content, encrypting both. When the request content only includes the password and no other information, VNFM can specify the password as the primary content and encrypt it.

[0079] In step S302, VNFM sends the second ciphertext along with the first lifecycle operation request to VNF.

[0080] In step S303, the VNF receives a first lifecycle operation request sent by the VNFM, which carries a second ciphertext.

[0081] In step S304, the VNF uses the second key to decrypt the second ciphertext to obtain the first content.

[0082] The VNF can read the second ciphertext from the first lifecycle operation request, then read the second key from the database, and use the second key to decrypt the second ciphertext to obtain the first content. The decryption algorithm used to decrypt the second ciphertext with the second key corresponds to the encryption algorithm in step S301.

[0083] Steps S301 and S302 can be implemented separately as VNFM-side embodiments, and steps S303 and S304 can be implemented separately as VNF-side embodiments.

[0084] 2) such as Figure 4 As shown, VNFM sends the ciphertext in a response message to VNF, which is used to respond to the lifecycle operation request sent by VNF.

[0085] Step S401: VNF sends a second lifecycle operation request to VNFM.

[0086] Step S402: VNFM receives the second lifecycle operation request sent by VNF.

[0087] In step S403, VNFM uses the second key to encrypt the second content to obtain the third ciphertext. The second content is the password in the response content of the response message, or the second content is the password and other information in the response content. The response message is used to respond to the second lifecycle operation request.

[0088] After receiving the second lifecycle operation request, VNFM needs to send a response message to VNF. At this time, VNFM reads the second key from the database, then obtains the second content from the response content in the response message, and encrypts the second content using the second key to obtain the third ciphertext.

[0089] In this scenario, when the response content includes a password and other information, VNFM can either define only the password as the second piece of content, encrypting only the password and not the other information; or, VNFM can define both the password and other information as the second piece of content, encrypting both. Conversely, when the response content includes only the password and no other information, VNFM can define the password as the second piece of content and encrypt it.

[0090] In step S404, VNFM sends the third ciphertext in the response message to VNF.

[0091] In step S405, the VNF receives a response message sent by the VNFM, which carries a third ciphertext.

[0092] In step S406, the VNF uses the second key to decrypt the third ciphertext to obtain the second content.

[0093] The VNF can read the third ciphertext from the response message, then read the second key from the database, and use the second key to decrypt the third ciphertext to obtain the second content. The decryption algorithm used to decrypt the third ciphertext with the second key corresponds to the encryption algorithm in step S403.

[0094] Steps S402, S403, and S404 can be implemented individually as VNFM-side embodiments, and steps S401, S405, and S406 can be implemented individually as VNF-side embodiments.

[0095] 3) such as Figure 5 As shown, VNF sends the ciphertext along with the lifecycle operation request to VNFM.

[0096] In step S501, the VNF uses the second key to encrypt the third content to obtain the fourth ciphertext. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content.

[0097] When VNF determines that it needs to send a third lifecycle operation request to VNFM, it reads the second key from the database, then obtains the third content from the request content of the third lifecycle request, and encrypts the third content using the second key to obtain the fourth ciphertext.

[0098] In this scenario, when the request content includes a password and other information, the VNF can either define only the password as third-party content, encrypting only the password and not the other information, or define both the password and other information as third-party content, encrypting both. Conversely, when the request content only includes the password and no other information, the VNF can define the password as third-party content and encrypt it.

[0099] In step S502, the VNF sends the fourth ciphertext to the VNFM along with the third lifecycle operation request.

[0100] In step S503, the VNFM receives a third lifecycle operation request sent by the VNF, which carries a fourth ciphertext.

[0101] In step S504, VNFM uses the second key to decrypt the fourth ciphertext to obtain the third content.

[0102] VNFM can read the fourth ciphertext from the third lifecycle operation request, then read the second key from the database, and use the second key to decrypt the fourth ciphertext to obtain the third content. The decryption algorithm used to decrypt the fourth ciphertext with the second key corresponds to the encryption algorithm in step S501.

[0103] Specifically, steps S503 and S504 can be implemented separately as VNFM-side embodiments, and steps S501 and S502 can be implemented separately as VNF-side embodiments.

[0104] Example 4 like Figure 6 As shown, this embodiment provides a VNFM, which may include: The first sending unit 601 is used to send first encryption configuration information to the VNF when deploying the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption function. The first receiving unit 602 is used to receive the second encryption configuration information sent by the VNF, which is used to indicate whether the VNF supports encryption function. The first sending unit 601 is also used to send the password to the VNF in ciphertext form if it is determined that both the VNFM and the VNF support encryption. The first sending unit 601 is further configured to send the password to the VNF in plaintext if it is determined that at least one of the VNFM and VNF does not support encryption.

[0105] Optionally, VNFM may also include: The first processing unit 603 is configured to obtain the first key from the first encryption configuration information when the first encryption configuration information also includes the first key; or, to obtain the first key from the VNFM configuration file when the VNFM configuration file includes the first key. The first processing unit 603 is also used to encrypt the password using the first key to obtain the first ciphertext; The first sending unit 601 is used to send the first ciphertext to the VNF.

[0106] Optionally, the first processing unit 603 is also used for: After the first receiving unit 602 receives the second encrypted configuration information sent by the VNF, it stores the second encrypted configuration information. When a password needs to be transmitted, it is determined whether both VNFM and VNF support encryption based on the first encryption configuration information and the stored second encryption configuration information.

[0107] Optionally, the first receiving unit 602 is further configured to receive a key exchange request sent by the VNF after the first sending unit 601 sends the password to the VNF in ciphertext form, the key exchange request carrying the first key exchange number. The first processing unit 603 is also configured to generate a second key exchange number based on the key exchange request. The first sending unit 601 is further configured to send a second key exchange number to the VNF, the second key exchange number being used by the VNF to generate a second key, the second key being used to update the first key; The first processing unit 603 is also used to generate a second key based on the first key exchange number.

[0108] Optionally, the first processing unit 603 is further configured to, after generating the second key according to the first key exchange number, encrypt the first content with the second key to obtain the second ciphertext, wherein the first content is the password in the request content of the first lifecycle operation request, or the first content is the password and other information in the request content; The first sending unit 601 is also used to send the second ciphertext to the VNF in the first lifecycle operation request. The second ciphertext is decrypted by the VNF using the second key to obtain the first content.

[0109] Optionally, the first receiving unit 602 is further configured to receive a second lifecycle operation request sent by the VNF after the first processing unit 603 generates the second key according to the first key exchange number. The first processing unit 603 is further configured to encrypt the second content using the second key to obtain the third ciphertext, wherein the second content is the password in the response content of the response message, or the second content is the password and other information in the response content, and the response message is used to respond to the second lifecycle operation request. The first sending unit 601 is also used to send the third ciphertext in the response message to the VNF, and the third ciphertext is decrypted by the VNF using the second key to obtain the second content.

[0110] Optionally, the first receiving unit 602 is further configured to receive a third lifecycle operation request sent by the VNF after the first processing unit 603 generates a second key according to the first key exchange number. The third lifecycle operation request carries a fourth ciphertext, which is obtained by the VNF encrypting the third content using the second key. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content. The first processing unit 603 is also used to decrypt the fourth ciphertext using the second key to obtain the third content.

[0111] Optionally, the first sending unit 601 is further configured to send a deployment completion notification message to the VNF before the first receiving unit 602 receives the key exchange request sent by the VNF, wherein the VNF is configured to send the key exchange request upon triggering the notification message; or, send a fourth lifecycle operation request to the VNF, wherein the VNF is configured to send the key exchange request upon triggering the fourth lifecycle operation request; or, The key exchange request is sent after a predetermined lifecycle operation occurs in the VNF.

[0112] Example 5 like Figure 7 As shown, this embodiment provides a VNF, which may include: The second receiving unit 701 is used to receive first encryption configuration information sent by VNFM when deploying VNF. The first encryption configuration information carries indication information, which is used to indicate whether VNFM supports encryption function. The second sending unit 702 is used to send second encryption configuration information to the VNFM, which is used to indicate whether the VNF supports encryption function. The second receiving unit 701 is also used to receive a ciphertext sent by the VNFM in encrypted form, which is sent in encrypted form by the VNFM when it determines that both the VNFM and the VNF support encryption; or, The second receiving unit 701 is also used to receive a password sent in plaintext by the VNFM, which is sent in plaintext by the VNFM when it determines that at least one of the VNFM and VNF does not support encryption.

[0113] Optionally, the VNF may also include: The second processing unit 703 is used to store the first encrypted configuration information after the second receiving unit 701 receives the first encrypted configuration information sent by VNFM. The second processing unit 703 is further configured to, after the second receiving unit 701 receives the password sent by the VNFM in ciphertext form, determine whether both the VNFM and the VNF support encryption functions based on the second encryption configuration information and the stored first encryption configuration information; if it is determined that both the VNFM and the VNF support encryption functions, then if the first encryption configuration information also includes a first key, obtain the first key from the first encryption configuration information; or, if the configuration file of the VNF includes a first key, obtain the first key from the configuration file of the VNF; and use the first key to decrypt the first ciphertext sent in ciphertext form to obtain the password.

[0114] Optionally, the second sending unit 702 is further configured to send a key exchange request to the VNFM after the second receiving unit 701 receives the password sent by the VNFM in encrypted form. The key exchange request carries a first key exchange number, which is used by the VNFM to generate a second key, and the second key is used to update the first key. The second receiving unit 701 is also used to receive a second key exchange number sent by VNFM, which is generated by VNFM according to the key exchange request. The second processing unit 703 is also used to generate a second key based on the second key exchange number.

[0115] Optionally, the second receiving unit 701 is further configured to receive a first lifecycle operation request sent by VNFM after the second processing unit 703 generates a second key according to the second key exchange number. The first lifecycle operation request carries a second ciphertext, which is obtained by VNFM encrypting the first content using the second key. The first content is the password in the request content of the first lifecycle operation request, or the first content is the password and other information in the request content. The second processing unit 703 is also used to decrypt the second ciphertext using the second key to obtain the first content.

[0116] Optionally, the second sending unit 702 is further configured to send a second lifecycle operation request to the VNFM after the second processing unit 703 generates the second key according to the second key exchange number; The second receiving unit 701 is also used to receive a response message sent by VNFM. The response message is used to respond to the second lifecycle operation request, and the response message carries a third ciphertext. The third ciphertext is obtained by VNFM encrypting the second content with the second key. The second content is the password in the response content of the response message, or the second content is the password and other information in the response content. The second processing unit 703 is also used to decrypt the third ciphertext using the second key to obtain the second content.

[0117] Optionally, the second processing unit 703 is further configured to, after generating the second key according to the second key exchange number, encrypt the third content using the second key to obtain the fourth ciphertext, wherein the third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content; The second sending unit 702 is also used to send the fourth ciphertext in the third lifecycle operation request to the VNFM, and the fourth ciphertext is decrypted by the VNFM using the generated second key to obtain the third content.

[0118] Optionally, before sending a key exchange request to the VNFM, the second receiving unit 701 is further configured to receive a deployment completion notification message sent by the VNFM, and the second sending unit 702 is further configured to execute the step of sending a key exchange request to the VNFM triggered by the notification message; or, the second receiving unit 701 is further configured to receive a fourth lifecycle operation request sent by the VNFM, and the second sending unit 702 is further configured to execute the step of sending a key exchange request to the VNFM triggered by the fourth lifecycle operation request; or, the second sending unit 702 is further configured to execute the step of sending a key exchange request to the VNFM triggered by a predetermined lifecycle operation after a predetermined lifecycle operation occurs in the VNF.

[0119] Example 6 like Figure 8 As shown, this embodiment provides a system including VNFM801 and VNF802, and VNFM801 can be as follows: Figure 6 The VNFM shown, VNF802 can be as follows: Figure 7 The VNF shown.

[0120] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0121] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0122] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the present invention.

Claims

1. A method for establishing a secure data connection between a VNFM and a VNF, characterized in that, For use in VNFM, the method includes: When deploying a VNF, first encryption configuration information is sent to the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption functionality. Receive second encryption configuration information sent by the VNF, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; If it is determined that both the VNFM and the VNF support encryption, then the password is sent to the VNF in ciphertext form, wherein the password is encrypted according to the first key; If it is determined that at least one of the VNFM and the VNF does not support encryption, then the password is sent to the VNF in plaintext. After sending the ciphertext to the VNF, a key exchange request is received from the VNF. The key exchange request carries a first key exchange number. A second key exchange number is generated based on the key exchange request and sent to the VNF. The second key exchange number is used by the VNF to generate a second key. The second key is used to update the first key. The second key is generated based on the first key exchange number.

2. The method according to claim 1, characterized in that, Sending the password to the VNF in encrypted form includes: When the first encryption configuration information also includes a first key, the first key is obtained from the first encryption configuration information; or, when the VNFM configuration file includes a first key, the first key is obtained from the VNFM configuration file. The password is encrypted using the first key to obtain the first ciphertext; The first ciphertext is sent to the VNF.

3. The method according to claim 1, characterized in that, After receiving the second encrypted configuration information sent by the VNF, the method further includes: The second encrypted configuration information is stored; When a password needs to be transmitted, it is determined whether both the VNFM and the VNF support encryption functionality based on the first encryption configuration information and the stored second encryption configuration information.

4. The method according to claim 1, characterized in that, After generating the second key based on the first key exchange number, the method further includes: The first content is encrypted using the second key to obtain the second ciphertext. The first content is the password in the request content of the first lifecycle operation request, or the first content is the password and other information in the request content. The second ciphertext is sent to the VNF in the first lifecycle operation request, and the VNF decrypts the second ciphertext using the second key to obtain the first content.

5. The method according to claim 1, characterized in that, After generating the second key based on the first key exchange number, the method further includes: Receive the second lifecycle operation request sent by the VNF; The second content is encrypted using the second key to obtain a third ciphertext. The second content is the password in the response content of the response message, or the second content is the password and other information in the response content. The response message is used to respond to the second lifecycle operation request. The third ciphertext is carried in the response message and sent to the VNF. The third ciphertext is decrypted by the VNF using the second key to obtain the second content.

6. The method according to claim 1, characterized in that, After generating the second key based on the first key exchange number, the method further includes: The VNF receives a third lifecycle operation request, which carries a fourth ciphertext. The fourth ciphertext is obtained by the VNF encrypting the third content using the second key. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content. The fourth ciphertext is decrypted using the second key to obtain the third content.

7. The method according to claim 1, characterized in that, Before receiving the key exchange request sent by the VNF, the method further includes: sending a deployment completion notification message to the VNF, wherein the VNF is configured to send the key exchange request upon triggering the notification message; or, sending a fourth lifecycle operation request to the VNF, wherein the VNF is configured to send the key exchange request upon triggering the fourth lifecycle operation request; or, The key exchange request is sent after a predetermined lifecycle operation occurs in the VNF.

8. A method for establishing a secure data connection between a VNFM and a VNF, characterized in that, For use in VNF, the method includes: When deploying the VNF, the system receives first encryption configuration information sent by the VNFM. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption functionality. Send second encryption configuration information to the VNFM, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; Receive the password sent by the VNFM in encrypted form, wherein the password is sent in encrypted form by the VNFM when the VNFM determines that both the VNFM and the VNF support encryption, wherein the password is encrypted according to a first key; or, Receive the password sent in plaintext by the VNFM, the password being sent in plaintext by the VNFM when it determines that at least one of the VNFM and the VNF does not support encryption. After receiving the password sent by the VNFM in encrypted form, a key exchange request is sent to the VNFM. The key exchange request carries a first key exchange number. The first key exchange number is used by the VNFM to generate a second key. The second key is used to update the first key. The second key exchange number sent by the VNFM is received. The second key exchange number is generated by the VNFM according to the key exchange request. The second key is generated according to the second key exchange number.

9. The method according to claim 8, characterized in that, After receiving the first encrypted configuration information sent by VNFM, the method further includes: storing the first encrypted configuration information; After receiving the password sent by the VNFM in encrypted form, the method further includes: determining whether both the VNFM and the VNF support encryption functionality based on the second encryption configuration information and the stored first encryption configuration information; If it is determined that both the VNFM and the VNF support encryption, then when the first encryption configuration information also includes a first key, the first key is obtained from the first encryption configuration information; or, when the configuration file of the VNF includes a first key, the first key is obtained from the configuration file of the VNF. The first key is used to decrypt the first ciphertext sent in ciphertext form to obtain the password.

10. The method according to claim 8, characterized in that, After generating the second key based on the second key exchange number, the method further includes: Receive a first lifecycle operation request sent by the VNFM, the first lifecycle operation request carrying a second ciphertext, the second ciphertext being obtained by the VNFM encrypting the first content using the second key, the first content being the password in the request content of the first lifecycle operation request, or the first content being the password and other information in the request content; The second key is used to decrypt the second ciphertext to obtain the first content.

11. The method according to claim 8, characterized in that, After generating the second key based on the second key exchange number, the method further includes: Send a second lifecycle operation request to the VNFM; The system receives a response message sent by the VNFM, the response message being used to respond to the second lifecycle operation request, and the response message carrying a third ciphertext, the third ciphertext being obtained by the VNFM encrypting the second content using the second key, the second content being the password in the response content of the response message, or the second content being the password and other information in the response content; The second key is used to decrypt the third ciphertext to obtain the second content.

12. The method according to claim 8, characterized in that, After generating the second key based on the second key exchange number, the method further includes: The third content is encrypted using the second key to obtain the fourth ciphertext. The third content is the password in the request content of the third lifecycle operation request, or the third content is the password and other information in the request content. The fourth ciphertext is sent to the VNFM in the third lifecycle operation request. The VNFM decrypts the fourth ciphertext using the generated second key to obtain the third content.

13. The method according to claim 8, characterized in that, Before sending the key exchange request to the VNFM, the method further includes: Receive a deployment completion notification message from the VNFM, and, triggered by the notification message, execute the step of sending a key exchange request to the VNFM; or, Receive the fourth lifecycle operation request sent by the VNFM, and execute the step of sending a key exchange request to the VNFM upon triggering the fourth lifecycle operation request; or, After a predetermined lifecycle operation occurs in the VNF, the step of sending a key exchange request to the VNFM is executed under the trigger of the predetermined lifecycle operation.

14. A VNFM, characterized in that, The VNFM includes: The first sending unit is used to send first encryption configuration information to the VNF when deploying the VNF. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption function. The first receiving unit is configured to receive the second encryption configuration information sent by the VNF, wherein the second encryption configuration information is used to indicate whether the VNF supports encryption functionality. The first sending unit is further configured to send a password to the VNF in ciphertext form if it is determined that both the VNFM and the VNF support encryption, wherein the password is encrypted according to a first key; The first sending unit is further configured to send a password to the VNF in plaintext if it is determined that at least one of the VNFM and the VNF does not support encryption. The first sending unit is further configured to: after sending the ciphertext to the VNF, receive a key exchange request sent by the VNF, the key exchange request carrying a first key exchange number, generate a second key exchange number according to the key exchange request, and send the second key exchange number to the VNF, the second key exchange number being used by the VNF to generate a second key, the second key being used to update the first key, and the second key being generated according to the first key exchange number.

15. A VNF, characterized in that, The VNF includes: The second receiving unit is used to receive first encryption configuration information sent by the VNFM when the VNF is deployed. The first encryption configuration information carries indication information, which is used to indicate whether the VNFM supports encryption function. The second sending unit is used to send second encryption configuration information to the VNFM, the second encryption configuration information being used to indicate whether the VNF supports encryption functionality; The second receiving unit is further configured to receive a password sent by the VNFM in encrypted form, wherein the password is sent in encrypted form by the VNFM when the VNFM determines that both the VNFM and the VNF support encryption, wherein the password is encrypted according to a first key; or, The second receiving unit is further configured to receive a password sent in plaintext by the VNFM, the password being sent in plaintext by the VNFM when it determines that at least one of the VNFM and the VNF does not support encryption. The second receiving unit is further configured to, after receiving the password sent by the VNFM in encrypted form, send a key exchange request to the VNFM, the key exchange request carrying a first key exchange number, the first key exchange number being used by the VNFM to generate a second key, the second key being used to update the first key, receive a second key exchange number sent by the VNFM, the second key exchange number being generated by the VNFM according to the key exchange request, and generate the second key according to the second key exchange number.

16. A system, characterized in that, The system includes VNFM and VNF; The VNFM is the VNFM as described in claim 14; The VNF is the VNF as described in claim 15.

Images