Communication method, device, related equipment and storage medium

Abstract

The present application discloses a communication method, an apparatus, a first device, a second device and a storage medium. The method includes: the first device determines a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform; according to the management request, a security policy is determined; the security policy is used to provide a security management function for the application service on the edge computing platform.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a communication method, apparatus, related equipment and storage medium. Background Art

[0002] As a new generation of communication technology, the fifth generation mobile communication technology (5G) has many advantages such as large bandwidth, low latency, high reliability, high connectivity, and ubiquitous network, thus promoting the rapid development and change of vertical industries, such as the rise of smart medical care, smart education, and smart agriculture.

[0003] Mobile edge computing (MEC) technology, as one of the key technologies for 5G evolution, is an information technology (IT) general platform with wireless network information application program interface (API) interaction capabilities, as well as computing, storage, and analysis functions. Relying on MEC technology, traditional external applications can be pulled into the mobile internal, closer to users, and localized services can be provided, thereby improving user experience and unleashing more value from edge networks.

[0004] Combining 5G and MEC can introduce different technology combinations for different industry demand scenarios, such as quality of service (QoS), end-to-end network slicing, network capability exposure, edge cloud, etc., to provide customized solutions.

[0005] Among the related technologies, the combination of 5G and MEC technologies poses security risks. Summary of the invention

[0006] To solve related technical problems, the embodiments of the present application provide a communication method, apparatus, related equipment and storage medium.

[0007] The technical solution of the embodiment of the present application is implemented as follows:

[0008] The embodiment of the present application provides a communication method, which is applied to a first device, including:

[0009] Determine a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0010] A security policy is determined based on the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0011] In the above solution, the determining the management request includes:

[0012] determining a first operation for a first device;

[0013] A first management request is determined based on the first operation; the first management request includes: a first security policy.

[0014] In the above solution, the determining the management request includes:

[0015] A second management request is received from a second device; the second management request includes: a second security policy.

[0016] In the above solution, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0017] The method further comprises:

[0018] Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

[0019] In the above solution, the determining the management request includes:

[0020] A third management request is received from the edge computing platform; the third management request includes a third security policy.

[0021] In the above solution, the third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority;

[0022] The method further comprises:

[0023] Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

[0024] In the above scheme, the method further includes:

[0025] The update result is sent to the second device; the update result at least indicates whether the security policy on the first device is updated.

[0026] In the above scheme, the method further includes:

[0027] Sending an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

[0028] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0029] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0030] Full consent, partial consent, rejection, abnormal information.

[0031] In the above solution, the security policy includes at least one of the following:

[0032] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0033] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0034] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0035] In the above solution, the configuration information includes at least one of the following:

[0036] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0037] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0038] The third configuration strategy; the third configuration strategy is for the domain name system (DNS, Domain Name System) of different application services;

[0039] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0040] The embodiment of the present application provides a communication method, which is applied to a second device, including:

[0041] A second management request is sent to the first device; the second management request is used to request configuration of a security policy for an application service on the edge computing platform; the security policy is used to provide security management functions for the application service on the edge computing platform.

[0042] In the above scheme, the method further includes:

[0043] An update result is received from a first device; the update result at least indicates whether to update the security policy on the first device.

[0044] In the above solution, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0045] The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0046] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0047] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0048] Full consent, partial consent, rejection, abnormal information.

[0049] In the above solution, the security policy includes at least one of the following:

[0050] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0051] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0052] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0053] In the above solution, the configuration information includes at least one of the following:

[0054] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0055] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0056] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0057] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0058] The embodiment of the present application provides a communication method, which is applied to an edge computing platform, including:

[0059] A third management request is sent to the first device; the third management request is used to request configuration of a security policy for an application service on the edge computing platform; the security policy is used to provide security management functions for the application service on the edge computing platform.

[0060] In the above solution, the third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority;

[0061] The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0062] In the above scheme, the method further includes:

[0063] An update result is received from the first device; the update result at least indicates whether to update the security policy on the first device.

[0064] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0065] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0066] Full consent, partial consent, rejection, abnormal information.

[0067] In the above solution, the security policy includes at least one of the following:

[0068] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0069] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0070] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0071] In the above solution, the configuration information includes at least one of the following:

[0072] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0073] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0074] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0075] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0076] The present application provides a communication device, which is provided on a first device and includes:

[0077] A first processing unit, configured to determine a management request, wherein the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0078] A security policy is determined based on the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0079] In the above solution, the first processing unit is used to determine a first operation for the first device;

[0080] A first management request is determined based on the first operation; the first management request includes: a first security policy.

[0081] In the above solution, the apparatus further includes: a first communication unit, configured to receive a second management request from a second device; the second management request includes: a second security policy.

[0082] In the above solution, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0083] The first processing unit is used to determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

[0084] In the above solution, the first communication unit is used to receive a third management request from the edge computing platform; the third management request includes a third security policy.

[0085] In the above solution, the third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority;

[0086] The first processing unit is used to determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

[0087] In the above solution, the first communication unit is further used to send the update result to the second device; the update result at least indicates whether the security policy on the first device is updated.

[0088] In the above solution, the first communication unit is also used to send an update result to the edge computing platform; the update result at least represents whether the security policy is updated.

[0089] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0090] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0091] Full consent, partial consent, rejection, abnormal information.

[0092] In the above solution, the security policy includes at least one of the following:

[0093] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0094] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0095] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0096] In the above solution, the configuration information includes at least one of the following:

[0097] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0098] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0099] The third configuration strategy; the third configuration strategy is for the domain name system DNS of different application services;

[0100] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0101] The present application provides a communication device, which is provided on a second device and includes:

[0102] The second communication unit is used to send a second management request to the first device; the second management request is used to request configuration of a security policy for an application service on an edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0103] In the above solution, the second communication unit is further used to receive an update result from the first device; the update result at least indicates whether the security policy on the first device is updated.

[0104] In the above solution, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0105] The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0106] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0107] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0108] Full consent, partial consent, rejection, abnormal information.

[0109] In the above solution, the security policy includes at least one of the following:

[0110] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0111] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0112] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0113] In the above solution, the configuration information includes at least one of the following:

[0114] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0115] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0116] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0117] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0118] The present application provides a communication device, which is arranged on an edge computing platform and includes:

[0119] The third communication unit is used to send a third management request to the first device; the third management request is used to request configuration of a security policy for an application service on the edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0120] In the above solution, the third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority;

[0121] The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0122] In the above solution, the third communication unit is further used to receive an update result from the first device; the update result at least indicates whether the security policy on the first device is updated.

[0123] In the above solution, the security policy includes: a security level for each application service in at least one application service;

[0124] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0125] Full consent, partial consent, rejection, abnormal information.

[0126] In the above solution, the security policy includes at least one of the following:

[0127] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0128] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0129] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0130] In the above solution, the configuration information includes at least one of the following:

[0131] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0132] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0133] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0134] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0135] The embodiment of the present application provides a first device, including: a first processor and a first communication interface; wherein,

[0136] The first processor is used to determine a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0137] A security policy is determined based on the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0138] The embodiment of the present application provides a second device, including: a second processor and a second communication interface; wherein,

[0139] The second communication interface is used to send a second management request to the first device; the second management request is used to request configuration of a security policy for an application service on an edge computing platform; and the security policy is used to provide security management functions for application services on the edge computing platform.

[0140] The embodiment of the present application provides an edge computing platform, including: a third processor and a third communication interface; wherein,

[0141] The third communication interface is used to send a third management request to the first device; the third management request is used to request configuration of a security policy for an application service on an edge computing platform; and the security policy is used to provide security management functions for application services on the edge computing platform.

[0142] The embodiment of the present application provides a network device, comprising: a processor and a memory for storing a computer program that can be run on the processor,

[0143] Wherein, when the processor is used to run the computer program, it executes the steps of any one of the methods described above on the first device side; or,

[0144] When the processor is used to run the computer program, the processor performs the steps of any one of the methods described above on the second device side; or

[0145] When the processor is used to run the computer program, it executes the steps of any one of the methods described above on the third device side.

[0146] The embodiment of the present application provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods described in the first device side are implemented; or,

[0147] When the computer program is executed by the processor, the steps of any one of the methods described above on the second device side are implemented; or,

[0148] When the computer program is executed by the processor, the steps of any one of the methods described above on the third device side are implemented.

[0149] The communication system, method, apparatus, first device, second device and storage medium provided in the embodiment of the present application, the method includes: the first device determines a management request; the management request is used to request the configuration of a security policy for an application service on an edge computing platform; the security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform. The scheme of the embodiment of the present application implements the configuration of the security policy on the first device, so that the first device can provide security management functions for application services on the edge computing platform based on the security policy; in this way, the first device can improve the security management and control capabilities of the configuration data of the edge computing platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0150] Figure 1 It is a schematic diagram of the system structure of MEC in the related technology;

[0151] Figure 2 It is a structural diagram of the host layer and system layer of MEC in the related technology;

[0152] Figure 3 This is a schematic diagram of the system structure of 5G industry cloud network integration in the embodiment of the present application;

[0153] Figure 4 This is a schematic diagram of the structure of the communication system of the application embodiment of the present application;

[0154] Figure 5 A flow chart of a communication method according to an embodiment of the present application;

[0155] Figure 6 A flow chart of another communication method according to an embodiment of the present application;

[0156] Figure 7 This is a flow chart of another communication method according to an embodiment of the present application;

[0157] Figure 8 A flow chart of a communication method according to an embodiment of the present application;

[0158] Fig. 9 A flow chart of another communication method according to an embodiment of the present application;

[0159] Fig.10 A schematic diagram of a permission authorization method in an embodiment of the present application;

[0160] Fig.11 This is a schematic diagram of the structure of a communication device according to an embodiment of the present application;

[0161] Fig.12 This is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0162] Fig.13 This is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0163] Fig.14 This is a schematic diagram of the structure of the first device in the embodiment of the present application;

[0164] Fig.15 This is a schematic diagram of the structure of the second device in the embodiment of the present application;

[0165] Fig.16 This is a schematic diagram of the structure of the third device in the embodiment of the present application. DETAILED DESCRIPTION

[0166] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0167] In the related technologies, MEC, as a multi-access edge computing platform standard led by the European Telecommunications Standards Institute (ETSI), has evolved from the initial mobile edge computing platform to a multi-access edge computing platform based on virtual network functions (VNFs). It provides more efficient business operation services by virtualizing and servitizing MEC applications, platforms, and resources to meet the differentiated processing power requirements of different businesses. The ETSI standard organization defines Figure 1 The MEC system framework is shown.

[0168] The MEC system mainly includes: MEC system-level, MEC host-level, and network-level.

[0169] The MEC system layer is responsible for the allocation, recovery and coordination of the entire MEC resource to meet the computing and transmission resource requirements of different businesses. MEC system layer management supports MEC system-level management functions and host-level management functions. MEC system-level management functions include user application lifecycle management agents, operation support systems, and MEC orchestrators. MEC host-level management functions can include MEC platform managers and virtualized infrastructure managers. MEC services provided to terminals and third-party customers (such as commercial enterprises) are managed through the MEC management layer.

[0170] The MEC host layer is used to provide necessary computing, storage, and transmission functions for MEC applications, MEC platforms, etc.

[0171] The network layer is used to provide different network options (such as 3GPP wireless networks, non-3GPP wireless networks, and wired networks) for upper-layer applications, and dynamically adjust routing strategies based on upper-layer signaling to meet the transmission requirements of different services on the network.

[0172] Among them, Figure 2 As shown, the MEC host includes: MEC platform and virtual infrastructure (computing, storage, network). The virtual infrastructure includes a data plane, which is used to execute the routing rules received from the MEC platform, and forward traffic between applications (also called MEC applications or MEP applications), services (also called MEC services or MEP services), DNS services / proxy, 3GPP networks, other access networks, local networks and external networks. Among them, MEP enables the application to provide and call the service, and MEP itself can also provide services. Specifically, the application runs on a virtual machine or container, and can provide a variety of services to the outside world (such as location, wireless network information, and traffic management). The application can also use services provided by other applications. For example, the location, traffic management and other services provided by application A can be used by application B and application C. The service can be provided by MEP or an application. When a service is provided by the application, the service can be registered in the service list of MEP.

[0173] MEC platform (MEP) supports the following functions:

[0174] 1) Provide an environment in which MEC applications can discover, notify, use and provide MEC services, including MEC services provided by other platforms (optional).

[0175] 2) Receive routing rules from MEC platform management, applications or services to control data plane traffic.

[0176] 3) Manage and receive DNS records from the MEC platform and configure DNS proxy / server;

[0177] 4) Managed MEC services

[0178] 5) Provide access to permanent storage and time of day information;

[0179] MEC orchestrator (MEO), also known as MEC application orchestrator (MEAO), is the core of MEC system layer management and supports the following functions:

[0180] 1) Maintain the overall view of the MEC system (i.e., overall deployment); such as MEC host deployment, MEC available resource allocation, available MEC service calls, system topology, etc.;

[0181] 2) Manage the launch of MEC application packages, including: checking the integrity and authenticity of the application packages; confirming the application rules and requirements, and determining whether the application rules and requirements need to be adjusted. If so, adjust the application rules and requirements to comply with the operator's policies; saving the launch records of the application packages, and preparing the virtual infrastructure manager for processing the application;

[0182] 3) Selecting a suitable MEC host for application initialization based on constraints (e.g. latency, available resources, available services, etc.);

[0183] 4) Trigger the start and end of the application;

[0184] 5) Trigger on-demand migration of applications.

[0185] MEC platform manager (MEPM) supports the following functions:

[0186] 1) Manage the application life cycle, such as notifying MEAO of events related to the application;

[0187] 2) Provide MEP element management functions, including virtualized network function (VNF) element management and network service (NS) element management, where NS information elements include physical network function (PNF) information elements, virtual link information elements, and VNF forwarding graph (VNF Forwarding Graph) information elements;

[0188] 3) Manage the rules and requirements of MEC applications, such as service authorization, routing rules, domain name system (DNS) configuration, and conflict handling;

[0189] 4) Receive error reports and performance measurement data of virtual resources from the Virtualization Infrastructure Manager (VIM). The main functions of VIM include: allocating, managing, and releasing virtualized resources of the virtualized infrastructure, receiving and storing software images, and collecting and reporting performance and fault information of virtualized resources.

[0190] From the functional description of each MEC module, it can be seen that the rules of MEC applications (including routing rules, DNS configuration, business rules, etc.) are managed by MEPM, received by MEP, and finally executed on the user plane of the MEC host.

[0191] In actual applications, there are many types of terminal access technologies in vertical industries. In addition to 5G, third-party networks also include non-5G networks (such as 4G, WiFi, Bluetooth, Zigbee, NB-IoT, SPN, infrared network, dedicated line network, Wireline, etc.). The data of these terminals may be transmitted to MEP through different networks. In order to ensure the network and data security of MEP and realize ubiquitous network access and control functions, an industry gateway (iGW, industryGateWay) is introduced in a 5G industry cloud network integration system architecture. The 5G industry cloud network integration architecture is as follows: Figure 3 shown.

[0192] MEC platform management (MEPM) is generally set up on the industry gateway. The data on the MEP can be directly accessed to the external network, that is, the third-party network, through the industry gateway. The existing ETSI protocol does not provide adequate protection for data security and cannot adapt to the increasing management requirements for data security and privacy protection.

[0193] In some typical data-sensitive application scenarios such as medical care, education, and finance, some applications and available resources (hardware resources, network resources, etc.) provided by the MEP cannot be managed and configured by the remote (external) MEPM in order to protect user privacy and commercial secrets. The management configuration information (or management configuration data) sent by the MEPM to the MEP must be subject to strict security control. Based on this, in the embodiment of the present application, it is proposed to introduce a local MEPM (L-MEPM) on the existing system architecture to perform local management and configuration of the applications provided by the MEP, such as Figure 4 As shown,

[0194] The L-MEPM receives first information from the MEPM, and provides a security management function for the application on the edge computing platform based on the first information and the security policy; the first information is used to configure the application on the edge computing platform;

[0195] MEPM can receive the second information from MEAO, and send the first information to the first device according to the second information; the second information is used to orchestrate the application on the edge computing platform.

[0196] The edge computing platform may be referred to as MEP. The application orchestration on the edge computing platform may be understood as being implemented by orchestrating the application program and / or available resources of each application.

[0197] Figure 4 The system architecture shown needs to provide an effective method for managing security policies to ensure the security protection of management configuration data on the MEP side.

[0198] Based on this, in various embodiments of the present application, the first device determines a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform; based on the management request, a security policy is determined; and the security policy is used to provide security management functions for application services on the edge computing platform.

[0199] The present application embodiment provides a communication method, which is applied to a first device, such as Figure 5 As shown, the method includes:

[0200] Step 501: Determine a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0201] Step 502: Determine a security policy based on the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0202] In actual application, a first device is set on the edge computing platform side, and the first device can communicate with the second device.

[0203] In actual application, the first device can be a locally set MEPM, which can be understood as the user setting a local MEPM, and can locally manage and configure the applications provided by the MEP. The first device can be deployed locally alone or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

[0204] In actual application, the second device may be an MEPM. The embodiment of the present application does not limit the name of the second device as long as the function of the second device can be realized.

[0205] In actual application, the edge computing platform can be called MEP.

[0206] In actual application, the security policy can be directly configured by a local administrator through the human-computer interaction interface provided by the first device, ie, the local MEPM.

[0207] Based on this, in one embodiment, determining the management request includes:

[0208] determining a first operation for a first device;

[0209] A first management request is determined based on the first operation; the first management request includes: a first security policy.

[0210] Here, the local administrator performs the first operation through the human-computer interaction interface of the local MEPM, the first device determines the first operation for the first device, and determines the management request based on the first operation, that is, the first management request; based on the first management request, a corresponding security policy can be determined, recorded as the first security policy.

[0211] In actual application, the security policy can be remotely configured directly by a remote administrator through the human-computer interaction interface provided by the second device, namely, MEPM.

[0212] Based on this, in one embodiment, determining the management request includes:

[0213] A second management request is received from a second device; the second management request includes: a second security policy.

[0214] Here, the remote administrator performs a second operation through the human-computer interaction interface of MEPM, the second device determines a second operation for the second device, and determines a management request based on the second operation, namely, the second management request; the second device sends a second management request to the first device; the first device receives the second management request, and can determine a second security policy based on the second management request.

[0215] In actual application, in order to improve the security of security policy configuration, the priority of security policy is proposed, and based on the priority, it is determined whether the security policy can be configured or updated based on the corresponding management request.

[0216] Based on this, in one embodiment, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0217] Accordingly, the method further includes:

[0218] Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

[0219] In actual application, the security policy can be configured through requests reported by the edge computing platform.

[0220] Based on this, in one embodiment, determining the management request includes:

[0221] A third management request is received from the edge computing platform; the third management request includes a third security policy.

[0222] In actual application, in order to improve the security of security policy configuration, the priority of security policy is proposed, and based on the priority, it is determined whether the security policy can be configured or updated based on the corresponding management request.

[0223] Based on this, in one embodiment, the third management request further includes: a priority of a third security policy; the security policy saved by the first device corresponds to an initial priority;

[0224] The method further comprises:

[0225] Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

[0226] For example, the first security policy may also have a corresponding priority. The priority of the first security policy, the priority of the second security policy, and the priority of the third security policy can be set by different operators, such as the local administrator on the first device side, the remote administrator on the second device side, and the operator on the third device side, respectively; when the first device simultaneously receives two or three of the first management request, the second management request, and the third management request, the highest priority security policy is determined by comparing the priorities, such as the first security policy mentioned above, and the security policy saved by the first device is updated according to the first security policy.

[0227] The priority of the first security policy, the priority of the second security policy, and the priority of the third security policy can also be determined based on their corresponding devices. For example, the priority of the first device is set to 1, the priority of the second device is set to 2, and the priority of the edge computing platform is set to 3. Correspondingly, the first security policy can also have a priority of 1, the priority of the second security policy is 2, and the priority of the third security policy is 3. When the first device simultaneously receives two or three of the first management request, the second management request, and the third management request, the highest priority security policy is determined by comparing the priorities, such as the first security policy mentioned above, and the security policy saved by the first device is updated according to the first security policy.

[0228] Taking into account actual applications, there may be scenarios where different operators set the same priority, such as the local administrator on the first device side, the remote administrator on the second device side, and the operator on the third device side set the same priority for the first security policy, the second security policy, and the third security policy respectively; taking this situation into consideration, the above-mentioned scheme of setting priorities by operators and determining priorities based on corresponding devices can be combined, that is, two priorities are set for each security policy, one of which is set by the operator (local administrator, remote administrator, etc.), and the other is set according to different devices (first device, second device, third device); when the first device simultaneously receives two or three of the first management request, the second management request, and the third management request, and comparison finds that the priorities set by the operators are the same, the priorities set according to different devices are further compared, and this priority shall prevail. For example: the two priorities corresponding to the first security policy are 2 (local administrator setting) and 1 (determined based on the first device), and the two priorities corresponding to the second security policy are 2 (remote administrator setting) and 2 (determined based on the second device). Comparison shows that the priorities set by the operator are both 2. Further comparison shows that the priorities determined based on the device determine that the first security policy has a higher priority. The security policy saved by the first device is updated according to the first security policy.

[0229] For the remote administrator on the second device side, there may be multiple remote administrators, and different permissions can be assigned to each remote administrator; for the local administrator on the first device side, there may be multiple local administrators, and different permissions can be assigned to each local administrator. In other words, different permissions (corresponding to different priorities) can be assigned by comprehensively considering the local administrators on the first device side, the remote administrators on the second device side, and the edge computing platform. The above is only an example based on the device configuration priority, and is not limited. In actual application, corresponding configuration should be made in combination with actual needs.

[0230] The above are just a few examples of priority settings and specific applications. In actual applications, priorities can be set based on needs without limitation.

[0231] In actual application, the first device may notify the second device of the update result of the security policy.

[0232] Based on this, in one embodiment, the method further includes:

[0233] The update result is sent to the second device; the update result at least indicates whether the security policy on the first device is updated.

[0234] In actual application, the first device can notify the edge computing platform of the update result of the security policy, especially when the security policy is updated based on a third management request.

[0235] Based on this, in one embodiment, the method further includes:

[0236] Sending an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

[0237] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0238] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0239] Full consent, partial consent, rejection, abnormal information.

[0240] In one embodiment, the security policy includes at least one of the following:

[0241] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0242] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0243] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0244] In one embodiment, the configuration information includes at least one of the following:

[0245] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0246] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0247] A third configuration strategy; the third configuration strategy is for a domain name system (DNS) of different application services;

[0248] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0249] The present application embodiment provides a communication method, which is applied to a second device, such as Figure 6 As shown, the method includes:

[0250] Step 601: Send a second management request to the first device; the second management request is used to request configuration of a security policy for an application service on an edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0251] In actual application, the first device may notify the second device of the update result of the security policy.

[0252] Based on this, in one embodiment, the method further includes:

[0253] An update result is received from a first device; the update result at least indicates whether to update the security policy on the first device.

[0254] In actual application, in order to improve the security of security policy configuration, a priority of the security policy is proposed, and the first device determines whether the security policy can be configured or updated based on the corresponding management request based on the priority.

[0255] Based on this, in one embodiment, the second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0256] The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0257] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0258] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0259] Full consent, partial consent, rejection, abnormal information.

[0260] In one embodiment, the security policy includes at least one of the following:

[0261] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0262] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0263] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0264] In one embodiment, the configuration information includes at least one of the following:

[0265] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0266] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0267] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0268] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0269] The present application embodiment provides a communication method, which is applied to an edge computing platform, such as Figure 7 As shown, the method includes:

[0270] Step 701: Send a third management request to the first device; the third management request is used to request configuration of a security policy for an application service on an edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0271] In actual application, in order to improve the security of security policy configuration, a priority of the security policy is proposed, and the first device determines whether the security policy can be configured or updated based on the corresponding management request based on the priority.

[0272] Based on this, in one embodiment, the third management request further includes: a priority of a third security policy; the security policy saved by the first device corresponds to an initial priority;

[0273] The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0274] In actual application, the first device can notify the edge computing platform of the update result of the security policy, especially when the security policy is updated based on a third management request.

[0275] Based on this, in one embodiment, the method further includes:

[0276] An update result is received from the first device; the update result at least indicates whether to update the security policy on the first device.

[0277] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0278] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0279] Full consent, partial consent, rejection, abnormal information.

[0280] In one embodiment, the security policy includes at least one of the following:

[0281] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0282] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0283] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0284] In one embodiment, the configuration information includes at least one of the following:

[0285] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0286] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0287] A third configuration strategy; the third configuration strategy is for a domain name system (DNS) of different application services;

[0288] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0289] The present application is further described in detail below in conjunction with application examples.

[0290] In this application embodiment, the first device is called a local MEPM (L-MEPM); the second device is a MEPM; and the edge computing platform is called a MEP.

[0291] Three ways to manage security policies on L-MEPM are proposed:

[0292] 1) The local administrator directly performs operation configuration on the L-MEPM, corresponding to the configuration performed through the first management request described above;

[0293] 2) The remote administrator performs configuration via the MEPM remote management request; corresponding to the configuration via the second management request described above;

[0294] 3) Configuration is performed through a local request reported by the MEP; corresponding to the configuration performed through the third management request described above.

[0295] Considering that L-MEPM has default security policies for each application on MEP, if several methods are operated at the same time, there may be conflicts or security issues. It is proposed to configure according to the priority of security policies.

[0296] Method 2) Take an example to illustrate that the security policies on L-MEPM are stored as follows:

[0297] Authorized remote operators: Each remote operator can be stored in an array or other manner.

[0298] The examples are as follows:

[0299]

[0300] An example is provided for setting (or updating) a security policy.

[0301] Use JSON strings to store the security policies of all applications, for example:

[0302]

[0303] Here, in order to facilitate uniformly performing the same operation on multiple applications, application grouping is proposed, and the application grouping is used to manage multiple application lists of the same security level.

[0304] In this application embodiment, a communication method is provided, which is configured through a remote management request (equivalent to the above-mentioned second management request) sent by MEPM, such as Figure 8 As shown, the method includes:

[0305] Step 801, MEPM sends a remote management request to L-MEPM;

[0306] Specifically, the remote administrator initiates a configuration request for the security policy on the operation and maintenance management device, and initiates a remote management request to the L-MEPM through the MEPM, wherein the remote management request is used to request configuration or update of the security policy.

[0307] An example is given for the content of the request information, which includes but is not limited to the content in Table 1.

[0308]

[0309] Table 1

[0310] Here, an example of the task request type is given, as shown in Table 2.

[0311]

[0312] Table 2

[0313] Here, an example of a unique ID in the system is given, as shown in Table 3.

[0314]

[0315] Table 3

[0316] Here, an example of security policy priority is provided. Specifically,

[0317] Method 1: Use numbers (Int or Long) to indicate the security policy priority. The smaller the number, the higher the priority. The highest priority is set to 0, and the priority from high to low is 0 / 1 / 2 / 3 / 4.

[0318] Method 1: Use a JSON string to indicate the priority of the security policy applied to the MEP

[0319]

[0320] Method 2: Use a hash table, where the key is the application name and the value is the priority of the security policy.

[0321] 1) When the security policy priority parameter in the request is less than or equal to the priority stored in L-MEPM, the security policy is updated; for example: if the priority of the remote management request is 1 and the existing priority parameter is 3, the security policy is updated.

[0322] 2) When the security policy priority parameter in the request is greater than the priority stored in L-MEPM, the security policy is not updated; for example: if the priority of the remote management request is 1 and the existing priority parameter is 0, the security policy is not updated.

[0323] Here, an example is given for the security policy information, and the security policy information shown in Table 4 may be included for each application on the MEP.

[0324]

[0325] Table 4

[0326] Here, an example is given for the configuration information, as shown in the following Table 5:

[0327]

[0328]

[0329] Table 5

[0330] Specifically, when the security level applied on the MEP is set or updated to "strict", the management configuration data operations of all applications on the MEP are prohibited from configuring the MEP, and the L-MEPM will actively cut off the management configuration operations of the MEPM.

[0331] When the security level of applications on a MEP is set or updated to "Normal", only permitted applications can be managed and configured by the MEPM, using applications for differentiation.

[0332] When the security level of an application on a MEP is set or updated to "relaxed", all management configuration data of the application is allowed to operate.

[0333] Step 802: L-MEPM responds to the remote management request.

[0334] Specifically, after receiving a remote management request for a security policy, L-MEPM makes a security policy judgment based on the "security policy priority" in the remote management request;

[0335] If the security policy applied on the MEP on the L-MEPM can be updated / cannot be updated, the L-MEPM sends a message reply to the MEPM.

[0336] An example is given for the reply message, where the request information includes but is not limited to the content in Table 6.

[0337]

[0338] Table 6

[0339] Here, an example is given for the reply type and reply description sent by L-MEPM to MEPM, as shown in Table 7.

[0340]

[0341] Table 7

[0342] If the security policy applied on the MEP changes, the MEP can also actively report the updated security policy to the L-MEPM. The priority of the security policy can be higher than the existing security policy of the L-MEPM.

[0343] In this application embodiment, a communication method is also provided, which is configured through a local request (equivalent to the third management request) reported by a MEP, such as Fig. 9 As shown, the method includes:

[0344] Step 901: MEP sends a local request to L-MEPM;

[0345] Specifically, when the security policy of an application on the MEP changes, the changed security policy information is sent to the L-MEPM; the content may be as shown in Table 8 below:

[0346]

[0347] Table 8

[0348] Step 902: L-MEPM responds to the local request.

[0349] Specifically, after receiving the security policy management request, L-MEPM makes a security policy judgment. When L-MEPM detects that the "security policy priority" parameter in the request message is less than or equal to the existing "security policy priority" parameter, it updates the security policy. L-MEPM replies to MEP, and the reply information may include the information shown in Table 9 below:

[0350]

[0351] Table 9

[0352] An example of the reply message and reply description sent by L-MEPM to MEP is provided, as shown in Table 10.

[0353]

[0354] Table 10

[0355] The method may further comprise:

[0356] Step 903: Report the suspension of security management authority to MEPM;

[0357] After the security policy is updated, the security level of some applications may change, such as from "general" to "strict". In this case, the update result can be sent to MEPM, as shown in Table 11, to inform the MEPM that the security management authority of the application is terminated, that is, to inform the MEPM that it does not need to send configuration information to L-MEPM, and MEPM will not be able to manage and configure this application on the MEP.

[0358]

[0359] Table 11

[0360] Step 904, L-MEPM responds to MEPM regarding the termination.

[0361] That is, L-MEPM informs MEPM that it has received and learned that it will not be able to manage and configure this application on MEP.

[0362] Here, an example of a response reply is given, as shown in Table 12.

[0363]

[0364] Table 12

[0365] In order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the first device, such as Fig.11 As shown, the device comprises:

[0366] A first processing unit 1102 is used to determine a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0367] A security policy is determined based on the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0368] In one embodiment, the first processing unit 1102 is configured to determine a first operation for a first device;

[0369] A first management request is determined based on the first operation; the first management request includes: a first security policy.

[0370] In one embodiment, the apparatus further includes: a first communication unit 1101, configured to receive a second management request from a second device; the second management request includes: a second security policy.

[0371] The second management request further includes: a priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

[0372] The first processing unit 1102 is configured to determine whether to update the security policy stored in the first device according to the priority of the second security policy and the initial priority corresponding to the security policy stored in the first device.

[0373] In one embodiment, the first communication unit 1101 is used to receive a third management request from the edge computing platform; the third management request includes a third security policy.

[0374] The third management request further includes: a priority of a third security policy; the security policy saved by the first device corresponds to an initial priority;

[0375] The first processing unit 1102 is configured to determine whether to update the security policy stored in the first device according to the priority of the third security policy and the initial priority corresponding to the security policy stored in the first device.

[0376] In one embodiment, the first communication unit 1101 is further configured to send the update result to the second device; the update result at least indicates whether the security policy on the first device is updated.

[0377] In one embodiment, the first communication unit 1101 is further used to send an update result to the edge computing platform; the update result at least represents whether the security policy is updated.

[0378] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0379] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0380] Full consent, partial consent, rejection, abnormal information.

[0381] In one embodiment, the security policy includes at least one of the following:

[0382] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0383] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0384] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0385] In one embodiment, the configuration information includes at least one of the following:

[0386] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0387] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0388] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0389] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0390] In actual application, the first communication unit 1101 and the first processing unit 1102 can be implemented by a processor in a communication device in combination with a communication interface.

[0391] In order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the second device, such as Fig.12 As shown, the device comprises:

[0392] The second communication unit 1201 is used to send a second management request to the first device; the second management request is used to request configuration of a security policy for an application service on an edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0393] In one embodiment, the second communication unit 1201 is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

[0394] The second management request further includes: a priority of the second security policy; the security policy stored in the first device corresponds to an initial priority;

[0395] The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0396] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0397] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0398] Full consent, partial consent, rejection, abnormal information.

[0399] In one embodiment, the security policy includes at least one of the following:

[0400] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0401] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0402] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0403] In one embodiment, the configuration information includes at least one of the following:

[0404] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0405] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0406] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0407] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0408] In actual application, the second communication unit 1201 can be implemented by a communication interface in a communication device.

[0409] It should be noted that: when the communication device provided in the above embodiment performs communication, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0410] In order to implement the method on the third device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the third device, such as Fig.13 As shown, the device comprises:

[0411] The third communication unit 1301 is used to send a third management request to the first device; the third management request is used to request configuration of a security policy for an application service on an edge computing platform; the security policy is used to provide security management functions for application services on the edge computing platform.

[0412] In one embodiment, the third management request further includes: a priority of a third security policy; the security policy saved by the first device corresponds to an initial priority;

[0413] The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

[0414] In one embodiment, the third communication unit 1301 is further configured to receive an update result from the first device; the update result at least indicates whether the security policy on the first device is updated.

[0415] In one embodiment, the security policy includes: a security level for each application service in at least one application service;

[0416] The update result includes a configuration response for the security policy of each application service; the types of the configuration response include:

[0417] Full consent, partial consent, rejection, abnormal information.

[0418] In one embodiment, the security policy includes at least one of the following:

[0419] First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform;

[0420] The second security level represents the configuration information allowed for some application services on the edge computing platform;

[0421] Third security level: The first security level represents configuration information allowed for all application services on the edge computing platform.

[0422] In one embodiment, the configuration information includes at least one of the following:

[0423] A first configuration policy; the first configuration policy is for operation permissions of different application services;

[0424] The second configuration strategy; the second configuration strategy is for routing rules of different application services;

[0425] A third configuration strategy; the third configuration strategy is for domain name systems of different application services;

[0426] Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

[0427] In actual application, the third communication unit 1301 can be implemented by a communication interface in a communication device.

[0428] It should be noted that: when the communication device provided in the above embodiment performs communication, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0429] Based on the hardware implementation of the above program module, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a first device, such as Fig.14 As shown, the first device 1400 includes:

[0430] The first communication interface 1401 is capable of exchanging information with the second device;

[0431] The first processor 1402 is connected to the first communication interface 1401 to implement information exchange with the second device, and is used to execute the method provided by one or more technical solutions on the first device side when running a computer program. The computer program is stored in the first memory 1403.

[0432] Specifically, the first communication interface 1401 is used to determine a management request; the management request is used to request configuration of a security policy for an application service on an edge computing platform;

[0433] The first processor 1402 is used to determine a security policy according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

[0434] In one embodiment, the first communication interface 1401 is used to: determine a first operation for a first device;

[0435] A first management request is determined based on the first operation; the first management request includes: a first security policy.

[0436] In one embodiment, the first communication interface 1401 is used to:

[0437] A second management request is received from a second device; the second management request includes: a second security policy.

[0438] In one embodiment, the first processor 1402 is used to determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

[0439] In one embodiment, the first communication interface 1401 is used to: receive a third management request from the edge computing platform; the third management request includes a third security policy.

[0440] In one embodiment, the first processor 1402 is used to determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

[0441] In one embodiment, the first communication interface 1401 is further used to: send the update result to the second device; the update result at least indicates whether the security policy on the first device is updated.

[0442] In one embodiment, the first communication interface 1401 is further used to: send an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

[0443] It should be noted that the specific processing process of the first processor 1402 and the first communication interface 1401 can be understood by referring to the above method.

[0444] Of course, in actual application, the various components in the first device 1400 are coupled together through the bus system 1404. It can be understood that the bus system 1404 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1404 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.14 Various buses are labeled as bus system 1404.

[0445] The first memory 1403 in the embodiment of the present application is used to store various types of data to support the operation of the first device 1400. Examples of such data include: any computer program used to operate on the first device 1400.

[0446] The method disclosed in the above embodiment of the present application can be applied to the first processor 1402, or implemented by the first processor 1402. The first processor 1402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 1402. The above-mentioned first processor 1402 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1402 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1403, and the first processor 1402 reads the information in the first memory 1403 and completes the steps of the above method in combination with its hardware.

[0447] In an exemplary embodiment, the first device 1400 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0448] Based on the hardware implementation of the above program module, and in order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a second device, such as Fig.15 As shown, the second device 1500 includes:

[0449] The second communication interface 1501 is capable of exchanging information with the first device and the third device;

[0450] The second processor 1502 is connected to the second communication interface 1501 to implement information exchange with the first device and the third device, and is used to execute the method provided by one or more technical solutions on the second device side when running the computer program. The computer program is stored in the second memory 1503.

[0451] Specifically, the second communication interface 1501 is used to send a second management request to the first device; the second management request is used to request configuration of a security policy for an application service on an edge computing platform; and the security policy is used to provide security management functions for application services on the edge computing platform.

[0452] In one embodiment, the second communication interface 1501 is further used for:

[0453] An update result is received from a first device; the update result at least indicates whether to update the security policy on the first device.

[0454] It should be noted that the specific processing process of the second communication interface 1501 and the second processor 1502 can be understood by referring to the above method.

[0455] Of course, in actual application, the various components in the second device 1500 are coupled together through the bus system 1504. It can be understood that the bus system 1504 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1504 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.15 Various buses are labeled as bus system 1504.

[0456] The second memory 1503 in the embodiment of the present application is used to store various types of data to support the operation of the second device 1500. Examples of such data include: any computer program used to operate on the second device 1500.

[0457] The method disclosed in the above embodiment of the present application can be applied to the second processor 1502, or implemented by the second processor 1502. The second processor 1502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 1502. The above-mentioned second processor 1502 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1502 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1503. The second processor 1502 reads the information in the second memory 1503 and completes the steps of the above method in combination with its hardware.

[0458] In an exemplary embodiment, the second device 1500 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0459] Based on the hardware implementation of the above program modules, and in order to implement the method on the third device side of the embodiment of the present application, the embodiment of the present application also provides a third device, such as Fig.16 As shown, the third device 1600 includes:

[0460] The third communication interface 1601 is capable of exchanging information with the first device and the third device;

[0461] The third processor 1602 is connected to the third communication interface 1601 to implement information exchange with the first device and the third device, and is used to execute the method provided by one or more technical solutions on the third device side when running the computer program. The computer program is stored in the third memory 1603.

[0462] Specifically, the third communication interface 1601 is used to send a third management request to the first device; the third management request is used to request configuration of a security policy for an application service on an edge computing platform; and the security policy is used to provide security management functions for application services on the edge computing platform.

[0463] In one embodiment, the third communication interface 1601 is further used for:

[0464] An update result is received from the first device; the update result at least indicates whether to update the security policy on the first device.

[0465] It should be noted that the specific processing process of the third communication interface 1601 and the third processor 1602 can be understood by referring to the above method.

[0466] Of course, in actual application, the various components in the third device 1600 are coupled together through the bus system 1604. It can be understood that the bus system 1604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.16 Various buses are labeled as bus system 1604.

[0467] The third memory 1603 in the embodiment of the present application is used to store various types of data to support the operation of the third device 1600. Examples of such data include: any computer program used to operate on the third device 1600.

[0468] The method disclosed in the above embodiment of the present application can be applied to the third processor 1602, or implemented by the third processor 1602. The third processor 1602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the third processor 1602 or an instruction in the form of software. The above-mentioned third processor 1602 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The third processor 1602 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the third memory 1603, and the third processor 1602 reads the information in the third memory 1603 and completes the steps of the above method in combination with its hardware.

[0469] In an exemplary embodiment, the third device 1600 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0470] It can be understood that the memory (first memory 1403, second memory 1503, third memory 1603) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache.By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0471] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0472] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0473] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A communication method, characterized in that: Applied to a first device, the first device is a local mobile edge computing platform management L-MEPM, the method includes: Determine a management request; the management request includes a security policy, which is used to request configuration of a security policy for an application service on an edge computing platform; Determining a security policy according to the management request; the security policy includes a security level for each application service in at least one application service; Receiving first information from a second device; the first information is used to configure an application service on the edge computing platform; the second device is a mobile edge computing platform management MEPM; Based on the first information and the security policy, a security management function is provided for the application service on the edge computing platform.

2. The method according to claim 1, characterized in that: The determining of the management request comprises: determining a first operation for a first device; A first management request is determined based on the first operation; the first management request includes: a first security policy.

3. The method according to claim 1, characterized in that The determining of the management request comprises: A second management request is received from a second device; the second management request includes: a second security policy.

4. The method according to claim 3, characterized in that The second management request further includes: a priority of the second security policy; the security policy stored in the first device corresponds to an initial priority; The method further comprises: Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

5. The method according to claim 1, characterized in that The determining of the management request comprises: A third management request is received from the edge computing platform; the third management request includes a third security policy.

6. The method according to claim 5, characterized in that The third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority; The method further comprises: Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: An update result is sent to the second device; the update result at least indicates whether the security policy on the first device is updated.

8. The method according to claim 4, characterized in that The method further comprises: Sending an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

9. The method according to any one of claims 7 to 8, characterized in that: The update result includes a configuration response for the security policy of each application service; the types of the configuration response include: Full consent, partial consent, rejection, abnormal information.

10. The method according to claim 9, characterized in that The security policy includes at least one of the following: First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform; The second security level represents the configuration information allowed for some application services on the edge computing platform; Third security level; The third security level represents configuration information allowed for all application services on the edge computing platform.

11. The method according to claim 10, characterized in that The configuration information includes at least one of the following: A first configuration policy; the first configuration policy is for operation permissions of different application services; The second configuration strategy; the second configuration strategy is for routing rules of different application services; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different application services; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

12. A communication method, characterized in that: Applied to a second device, the second device being a MEPM, the method comprises: A second management request and first information are sent to a first device; the second management request includes a second security policy, which is used to request configuration of a security policy for an application service on an edge computing platform; the security policy includes a security level for each application service in at least one application service; the first device is an L-MEPM; the first information is used to configure the application service on the edge computing platform; the first information and the security policy are used by the first device to provide security management functions for the application service on the edge computing platform.

13. The method according to claim 12, characterized in that The method further comprises: An update result is received from a first device; the update result at least indicates whether to update the security policy on the first device.

14. The method according to claim 12, characterized in that The second management request further includes: a priority of the second security policy; the security policy stored in the first device corresponds to an initial priority; The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

15. The method according to any one of claims 13 to 14, characterized in that: Update results, including configuration responses for each application service's security policy; The types of configuration responses include: Full consent, partial consent, rejection, abnormal information.

16. The method according to claim 12, characterized in that The security policy includes at least one of the following: First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform; The second security level represents the configuration information allowed for some application services on the edge computing platform; Third security level; The third security level represents configuration information allowed for all application services on the edge computing platform.

17. The method according to claim 16, characterized in that The configuration information includes at least one of the following: A first configuration policy; the first configuration policy is for operation permissions of different application services; The second configuration strategy; the second configuration strategy is for routing rules of different application services; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different application services; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

18. A communication method, characterized in that: Applied to edge computing platforms, including: A third management request is sent to the first device; the third management request includes a third security policy, which is used to request configuration of a security policy for application services on the edge computing platform; the security policy includes a security level for each application service in at least one application service, and is used for the first device to provide security management functions for the application services on the edge computing platform based on the security policy and first information received from the second device; the first information is used to configure the application services on the edge computing platform; the first device is L-MEPM; the second device is MEPM.

19. The method according to claim 18, characterized in that The third management request further includes: a priority of a third security policy; the security policy stored in the first device corresponds to an initial priority; The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

20. The method according to claim 19, characterized in that The method further comprises: An update result is received from the first device; the update result at least indicates whether to update the security policy on the first device.

21. The method according to claim 20, characterized in that The update result includes a configuration response for the security policy of each application service; the types of the configuration response include: Full consent, partial consent, rejection, abnormal information.

22. The method according to any one of claims 18 to 21, characterized in that The security policy includes at least one of the following: First security level: The first security level represents the rejection of configuration information for all application services on the edge computing platform; The second security level represents the configuration information allowed for some application services on the edge computing platform; Third security level; The third security level represents configuration information allowed for all application services on the edge computing platform.

23. The method according to claim 22, characterized in that The configuration information includes at least one of the following: A first configuration policy; the first configuration policy is for operation permissions of different application services; The second configuration strategy; the second configuration strategy is for routing rules of different application services; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different application services; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different application services.

24. A communication device, characterized in that: Set on a first device, the first device is L-MEPM, and the device includes: A first processing unit, configured to determine a management request; the management request includes a security policy, configured to request configuration of a security policy for an application service on an edge computing platform; Determining a security policy according to the management request; the security policy includes a security level for each application service in at least one application service; A first communication unit, configured to receive first information from a second device; the first information is used to configure an application service on the edge computing platform; the second device is a MEPM; The first processing unit is further used to provide security management functions for application services on the edge computing platform based on the first information and the security policy.

25. A communication device, characterized in that: Set on a second device, the second device is a MEPM, and the device includes: A second communication unit is used to send a second management request and a first information to a first device; the second management request includes a second security policy, which is used to request configuration of a security policy for an application service on an edge computing platform; the security policy includes a security level for each application service in at least one application service; the first device is L-MEPM; the first information is used to configure the application service on the edge computing platform; the first information and the security policy are used by the first device to provide security management functions for the application service on the edge computing platform.

26. A communication device, characterized in that: Set up on the edge computing platform, including: A third communication unit is used to send a third management request to the first device; the third management request includes a third security policy, which is used to request configuration of a security policy for application services on the edge computing platform; the security policy includes a security level for each application service in at least one application service, and is used for the first device to provide a security management function for the application service on the edge computing platform based on the security policy and the first information received from the second device; the first information is used to configure the application service on the edge computing platform; the first device is L-MEPM; the second device is MEPM.

27. A first device, characterized in that: The first device is an L-MEPM, comprising: a first processor and a first communication interface; wherein, The first processor is used to determine a management request; the management request includes a security policy, which is used to request configuration of a security policy for an application service on an edge computing platform; Determining a security policy according to the management request; the security policy includes a security level for each application service in at least one application service; The first communication interface is used to receive first information from a second device; the first information is used to configure an application service on the edge computing platform; the second device is a MEPM; The first processor is further used to provide security management functions for application services on the edge computing platform based on the first information and the security policy.

28. A second device, characterized in that: The second device is a MEPM, comprising: a second processor and a second communication interface; wherein, The second communication interface is used to send a second management request and first information to the first device; the second management request includes a second security policy, which is used to request configuration of a security policy for an application service on an edge computing platform; the security policy includes a security level for each application service in at least one application service; the first device is L-MEPM; the first information is used to configure the application service on the edge computing platform; the first information and the security policy are used by the first device to provide security management functions for the application service on the edge computing platform.

29. An edge computing platform, characterized in that: include: A third processor and a third communication interface; wherein, The third communication interface is used to send a third management request to the first device; The third management request includes a third security policy, which is used to request configuration of a security policy for application services on the edge computing platform; the security policy includes a security level for each application service in at least one application service, and is used by the first device to provide security management functions for the application services on the edge computing platform based on the security policy and the first information received from the second device; the first information is used to configure the application services on the edge computing platform; the first device is L-MEPM; the second device is MEPM.

30. A network device, characterized in that: include: a processor and a memory for storing a computer program capable of running on the processor, Wherein, when the processor is used to run the computer program, the steps of the method according to any one of claims 1 to 11 are performed; or, When the processor is used to run the computer program, the processor performs the steps of the method according to any one of claims 12 to 17; or When the processor is used to run the computer program, the steps of the method according to any one of claims 18 to 23 are performed.

31. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented; or When the computer program is executed by a processor, the steps of the method according to any one of claims 12 to 17 are implemented; or When the computer program is executed by a processor, the steps of the method according to any one of claims 18 to 23 are implemented.

Images