Business management method and apparatus

Abstract

The embodiment of the application provides a service management method and device, the method comprises the following steps: receiving first request information, the first request information is used for requesting measurement for a first measurement scene; determining at least one second network element according to a mapping relationship; and sending second request information to the at least one second network element, the second request information is used for requesting measurement for at least one first measurement object. Thus, specific parts in the NFV can be measured under specific triggering scenes, the complexity of measurement is reduced, the communication and calculation overheads are saved, and the remote proof practical effect is further improved.

Description

Technical Field

[0001] This application relates to the field of network function virtualization, and in particular to a service management method and apparatus in a network function virtualization (NFV) architecture. Background Technology

[0002] Network function virtualization (NFV) is a technology that uses general-purpose hardware and virtualization techniques to implement the functions of dedicated devices in traditional communication networks. It also enables the rapid deployment of new network services (NS) through resource sharing, thereby reducing network deployment costs and improving network operating efficiency.

[0003] In NFV architecture, remote attestation (RA) is typically used to ensure the security of virtual network functions (VNFs). However, since a VNF is implemented by multiple virtual instances (VIs), when measuring a VNF, regardless of the triggering scenario, the VNF is treated as a whole, and each part of the VNF is measured. This makes the entire remote attestation process lengthy and impractical.

[0004] Therefore, how to reduce the complexity of remote proof metrics and improve their efficiency has become an urgent problem to be solved in the industry. Summary of the Invention

[0005] This application provides a business management method that can measure specific parts of NFV under specific triggering scenarios, reduce the complexity of measurement, save communication and computing overhead, and further improve the practical effect of remote proof.

[0006] Firstly, a service management method is provided. This method can be executed by a first network element, or by a component of the first network element (such as a chip or circuit). There is no limitation on this. For ease of description, the following explanation will take execution by the first network element as an example.

[0007] The method may include: receiving first request information, the first request information being used to request measurement for a first measurement scenario, the first measurement scenario including multiple measurement objects; determining at least one second network element according to a mapping relationship, the mapping relationship being used to indicate the correspondence between multiple measurement objects and multiple network elements, the at least one second network element corresponding to at least one first measurement object, the first measurement object belonging to multiple measurement objects included in the first measurement scenario; and sending second request information to at least one second network element, the second request information being used to request measurement for at least one first measurement object.

[0008] Based on the above scheme, the first network element can perform measurements on specific content and objects according to different measurement scenarios, and determine whether the measurement scenario meets the requirements based on the measurement results. This avoids the waste of overhead caused by measuring every part of the business network element, thereby reducing the complexity of measurement and saving communication and computing overhead.

[0009] It should be understood that one first measurement object corresponds to one second network element, and a second network element can correspond to one or more first measurement objects. Sending a second request message to at least one second network element can be understood as the first network element requesting the second network element corresponding to the first measurement object to perform measurement on that first measurement object, depending on the different measurement objects. In other words, the second network element performs measurement on the first measurement object corresponding to it, but does not perform measurement on other first measurement objects.

[0010] For example, the first network element sends a second request message to two second network elements respectively. Each second network element corresponds to a first measurement object. The second request message sent to one of the second network elements is a request to measure the first measurement object corresponding to that second network element, and it is not necessary for that second network element to measure both first measurement objects.

[0011] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: receiving first measurement information, the first measurement information including at least one first measurement result information sent by at least one second network element, the first measurement result information being used to indicate a first measurement result for a first measurement object; and sending first feedback information for the first request information based on the first measurement information.

[0012] Based on the above scheme, the first network element can receive measurement results from multiple second network elements, and comprehensively judge whether the multiple measurement results meet the requirements of the measurement scenario, thereby reducing the complexity of measurement.

[0013] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: sending third request information to at least one measurement network element corresponding to the first network element, the third request information being used to request measurement of at least one second measurement object among multiple measurement objects included in the first measurement scenario, the second measurement object being a measurement object that the measurement network element corresponding to the first network element can measure; receiving second measurement information, the second measurement information including at least one second measurement result information sent by at least one measurement network element corresponding to the first network element, the second measurement information being used to indicate the second measurement result for the second measurement object; and sending first feedback information in response to the first request information based on the first measurement information, including: sending first feedback information in response to the first request information based on the first measurement information and the second measurement information.

[0014] Based on the above scheme, the first network element measures the measurement objects that it can measure, and combines the measurement results of the second network element to determine whether the measurement scenario meets the requirements, which increases the flexibility of the measurement scheme.

[0015] In conjunction with the first aspect, in some implementations of the first aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indexes and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0016] Based on the above scheme, the first network element can determine whether the requested measurement object itself can be measured according to the mapping relationship, thereby determining the measurement scheme.

[0017] In conjunction with the first aspect, in some implementations of the first aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more virtual storage instances of the business network element meets the requirements; and a third scenario, used to measure whether one or more software of the business network element meets the requirements.

[0018] In conjunction with the first aspect, in some implementations of the first aspect, when the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: the image file of the service network element, one or more virtualization layers corresponding to the deployment environment migration environment, and the attributes of one or more hardware corresponding to the deployment environment migration environment.

[0019] In conjunction with the first aspect, in certain implementations of the first aspect, when the measurement object of the first measurement scenario is the image file of the service network element, the first network element includes a service network element management network element, which is used to manage the service network element; the second network element includes an image verification network element, which is used to verify the correctness of the image file of the service network element; wherein, the second request information includes the identification information of the image file of the service network element; or,

[0020] When the measurement object of the first measurement scenario includes one or more virtualization layers corresponding to the deployment environment migration environment, the first network element includes the service network element management network element, and the second network element includes the virtualization infrastructure management network element. The virtualization infrastructure management network element is used to verify the security of one or more virtualization layers corresponding to the deployment environment migration environment; or...

[0021] When the measurement object of the first measurement scenario includes the attributes of one or more hardware corresponding to the deployment environment migration environment, the first network element includes a virtualization infrastructure management network element, which is used to manage the virtualization infrastructure, and the second network element includes a geolocation verification network element, which is used to verify the geolocation attributes of one or more hardware corresponding to the deployment environment.

[0022] In conjunction with the first aspect, in some implementations of the first aspect, when the service network element is successfully deployed or migrated, the method further includes: receiving deployment result information from the service network element management network element, the deployment result information being used to indicate that the service network element has been successfully deployed or migrated, the deployment result information including proof information of the service network element deployment or migration; and verifying whether the service network element has been successfully deployed or migrated based on the proof information.

[0023] Based on the above scheme, when the service network element is successfully deployed or migrated, the first network element can further verify whether the deployment was successful based on the feedback deployment results, which increases the reliability of the deployment.

[0024] In conjunction with the first aspect, in some implementations of the first aspect, when the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element. The first network element includes a business network element verification network element, which is used to verify the geographical location of one or more virtual instances responsible for storing information. The second network element includes a geographical location verification network element, which is used to verify the geographical location of the virtual instances responsible for storing information.

[0025] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: obtaining first configuration information, the first configuration information being used to indicate the correspondence between multiple identifiers and multiple virtual instance groups, wherein the storage content corresponding to any two virtual instance groups is different, and the storage content includes at least one of the following: user information, communication records, and business data; and the first request information further includes a first identifier, the second request information further includes the identifier of a virtual instance in the first virtual instance group, and the first virtual instance group is the virtual instance group corresponding to the first identifier in the first configuration information.

[0026] Based on the above scheme, the first network element can further measure the measurement object according to the identifiers corresponding to one or more virtual instance groups responsible for storing content and VI in the first configuration information.

[0027] In conjunction with the first aspect, in some implementations of the first aspect, when the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: software in the virtual instance, software of the virtualization layer deployed in the virtual instance.

[0028] In conjunction with the first aspect, in certain implementations of the first aspect, when the measurement object of the first measurement scenario includes software in a virtual instance, the first network element includes a business network element verification network element, which is used to verify whether one or more software programs of the business network element meet the requirements; the second network element includes a customer system verification network element, which is used to verify whether the software in the virtual instance meets the requirements; or,

[0029] When the measurement object of the first measurement scenario includes the software of the virtualization layer deployed by the virtual instance, the first network element includes the business network element verification network element, and the second network element includes the cloud operating system verification network element. The cloud operating system verification network element is used to verify whether the software of the virtualization layer deployed by the virtual instance meets the requirements.

[0030] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: obtaining second configuration information, the second configuration information being used to indicate the correspondence between multiple identifiers and multiple software, the multiple software including at least one of the following: software in a virtual instance, software of a virtualization layer deployed in the virtual instance; and the first request information further including a second identifier, the second request information further including an identifier of a first software, the first software being the first software corresponding to the second identifier in the second configuration information.

[0031] Based on the above scheme, the first network element can further measure the measurement object according to the identifiers corresponding to each software and VI in the second configuration information obtained by the second configuration information, thereby avoiding the waste of storage space caused by storing a large amount of software information.

[0032] In conjunction with the first aspect, in some implementations of the first aspect, when the first feedback information is used to indicate that the first measurement information does not conform to the measurement index, the method further includes: sending a first indication information to the business network element management network element, the first indication information being used to indicate that one or more measurement objects should be reconfigured.

[0033] Secondly, a service management method is provided. This method can be executed by a second network element, or by a component of the second network element (such as a chip or circuit). There is no limitation on this; for ease of description, the following explanation will use execution by a second network element as an example.

[0034] The method may include: receiving second request information, the second request information being used to request measurement of at least one first measurement object, the first measurement object belonging to multiple measurement objects included in a first measurement scenario; measuring at least one first measurement object, and determining first measurement result information.

[0035] Based on the above scheme, the second network element can perform measurements on different measurement scenarios, specific content and objects according to the measurement request of the first network element, and feed back the measurement results to the first network element. This avoids the waste of overhead caused by measuring every part of the business network element, thereby reducing the complexity of measurement and saving communication and computing overhead.

[0036] In conjunction with the second aspect, in some implementations of the second aspect, measuring at least one first measurement object and determining first measurement result information includes: sending fourth request information to at least one measurement network element corresponding to the second network element, the fourth request information being used to request measurement for at least one first measurement object; receiving third measurement information, the third measurement information including at least one third measurement result information sent by at least one measurement network element corresponding to the second network element, the third measurement information being used to indicate the second measurement result for the first measurement object; and determining the first measurement result information based on the third measurement information.

[0037] Based on the above scheme, the second network element can request its corresponding measurement network element to perform measurement for different measurement scenarios, specific content and objects according to the measurement request of the first network element, thereby saving communication and computing overhead.

[0038] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes: sending first measurement result information, the first measurement result information being used to indicate a first measurement result for at least one first measurement object.

[0039] In conjunction with the second aspect, in some implementations of the second aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more virtual storage instances of the business network element meets the requirements; and a third scenario, used to measure whether one or more software of the business network element meets the requirements.

[0040] In conjunction with the second aspect, in some implementations of the second aspect, when the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: the image file of the service network element, one or more virtualization layers corresponding to the deployment environment migration environment, and the attributes of one or more hardware corresponding to the deployment environment migration environment.

[0041] In conjunction with the second aspect, in some implementations of the second aspect, when the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element.

[0042] In conjunction with the second aspect, in some implementations of the second aspect, when the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: software in the virtual instance, software of the virtualization layer deployed in the virtual instance.

[0043] Thirdly, a service management method is provided. This method can be executed by the first network element, or by a component of the first network element (such as a chip or circuit). There is no limitation on this. For ease of description, the following explanation will take execution by the first network element as an example.

[0044] The method may include: obtaining a mapping relationship, which indicates the correspondence between multiple measurement scenarios and multiple network elements; receiving first request information, which is used to perform measurement for a first measurement scenario; determining a second network element corresponding to the first measurement scenario from multiple network elements according to the mapping relationship; and sending second request information to the second network element, which is used to request measurement for the first measurement scenario.

[0045] Based on the above scheme, the first network element can perform targeted measurements on specific content and objects in different measurement scenarios, and determine whether the measurement scenario meets the requirements based on the measurement results. This avoids the waste of overhead caused by measuring every part of the business network element, thereby reducing the complexity of measurement and saving communication and computing costs.

[0046] In conjunction with the third aspect, in some implementations of the third aspect, the first request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario; the second request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario.

[0047] Based on the above scheme, the first network element can determine the corresponding measurement scenario, measurement object, etc. in the mapping relationship according to the content of the first request information, thereby reducing the signaling overhead in information transmission.

[0048] In conjunction with the third aspect, in some implementations of the third aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0049] Based on the above scheme, the first network element can determine whether the measurement object in the measurement request can be measured, and request other network elements to measure the measurement object that cannot be measured, thereby increasing the flexibility of the measurement scheme.

[0050] In conjunction with the third aspect, in some implementations of the third aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more virtual storage instances of the business network element meets the requirements; and a third scenario, used to measure whether one or more software of the business network element meets the requirements.

[0051] In conjunction with the third aspect, in some implementations of the third aspect, the method further includes: receiving first measurement information, the first measurement information including one or more first measurement result information corresponding to one or more measurement objects; and determining second measurement result information based on whether the first measurement information conforms to the measurement index.

[0052] Based on the above scheme, the first network element can comprehensively determine whether the measurement scenario meets the requirements based on the received measurement results, thereby reducing the complexity of the measurement.

[0053] In conjunction with the third aspect, in some implementations of the third aspect, when the first network element is a service network element verification network element, the method further includes: sending the second measurement result information to the service triggering party.

[0054] In conjunction with the third aspect, in some implementations of the third aspect, when the second measurement result information is used to indicate that the first measurement information does not conform to the measurement index, the method further includes: sending a first indication information to the business network element management network element, the first indication information being used to indicate that one or more measurement objects should be reconfigured.

[0055] In conjunction with the third aspect, in some implementations of the third aspect, the method further includes: obtaining first configuration information of the business network element functional component responsible for storing information, wherein the business network element functional component responsible for storing information includes one or more virtual instances responsible for storing information, and the first configuration information includes the number of the business network element functional component responsible for storing information and one or more numbers of the one or more virtual instances responsible for storing information.

[0056] Based on the above scheme, the first network element can further measure the measurement object according to the identifiers corresponding to each virtual instance group and VI in the first configuration information, thereby avoiding the waste of storage space caused by storing a large amount of virtual instance group information.

[0057] In conjunction with the third aspect, in some implementations of the third aspect, obtaining the first configuration information of the business network element functional component responsible for storing information includes: sending a third request message to the management network element of the business network element functional component, the third request message being used to request a query of the first configuration information; and receiving the first configuration information.

[0058] Based on the above scheme, the first network element can obtain the first configuration information by requesting a query from the business network element functional component management network element, which increases the flexibility of the scheme.

[0059] In conjunction with the third aspect, in some implementations of the third aspect, obtaining the first configuration information of the service network element functional component responsible for storing information includes: sending a fourth request message to the measurement network element of the first network element, the fourth request message being used to request the second configuration information of the measurement service network element; receiving the second configuration information of the service network element, the second configuration information including the type of the service network element functional component, the number of the service network element functional component, and the number of one or more virtual instances corresponding to the service network element functional component; verifying the second configuration information to obtain the first configuration information.

[0060] Based on the above scheme, the first network element can obtain the first configuration information by requesting the measurement of the measurement network element, which increases the flexibility of the scheme.

[0061] Fourthly, a service management method is provided. This method can be executed by a second network element, or by a component of the second network element (such as a chip or circuit). There is no limitation on this; for ease of description, the following explanation will use execution by a second network element as an example.

[0062] The method may include: receiving second request information, the second request information being used to request measurement for a first measurement scenario; measuring the first measurement scenario; and sending first measurement information, the first measurement information including one or more first measurement result information corresponding to one or more measurement objects.

[0063] Based on the above scheme, the second network element can perform measurements on different measurement scenarios, specific content and objects according to the measurement request of the first network element, and feed back the measurement results to the first network element. This avoids the waste of overhead caused by measuring every part of the business network element, thereby reducing the complexity of measurement and saving communication and computing overhead.

[0064] In conjunction with the fourth aspect, in some implementations of the fourth aspect, when the second network element is a verification network element, determining the first measurement information includes: sending a second request information to one or more measurement network elements of the second network element; receiving third measurement result information, the third measurement result information including one or more results of one or more measurement parties of the second network element measuring the first measurement scenario; and determining the first measurement result information based on whether the third measurement information meets the measurement indicators.

[0065] Based on the above scheme, the second network element can request its corresponding measurement network element to perform measurement for different measurement scenarios, specific content and objects according to the measurement request of the first network element, thereby saving communication and computing overhead.

[0066] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the second request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario.

[0067] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0068] In conjunction with the fourth aspect, in some implementations of the fourth aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment of the service network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more storage devices of the service network element meets the requirements; and a third scenario, used to measure whether one or more software of the service network element meets the requirements.

[0069] Fifthly, a service management device is provided, including a unit for performing the method shown in the first aspect above. The communication device may be a first network element, or it may be a chip or circuit disposed in the first network element. This application does not limit this.

[0070] The communication device includes:

[0071] The transceiver unit is configured to receive first request information, which requests measurement for a first measurement scenario, the first measurement scenario including multiple measurement objects; the processing unit is configured to determine at least one second network element according to a mapping relationship, the mapping relationship indicating the correspondence between multiple measurement objects and multiple network elements, at least one second network element corresponding to at least one first measurement object, the first measurement object belonging to the multiple measurement objects included in the first measurement scenario; the transceiver unit is further configured to send second request information to at least one second network element, the second request information requesting measurement for at least one first measurement object.

[0072] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further configured to receive first measurement information, the first measurement information including at least one first measurement result information sent by at least one second network element, the first measurement result information being used to indicate the first measurement result for the first measurement object; the transceiver unit is further configured to send first feedback information for the first request information based on the first measurement information.

[0073] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further configured to send third request information to at least one measurement network element corresponding to the first network element. The third request information is used to request measurement of at least one second measurement object among the multiple measurement objects included in the first measurement scenario. The second measurement object belongs to the measurement objects that the measurement network element corresponding to the first network element can measure. The transceiver unit is further configured to receive second measurement information, which includes at least one second measurement result information sent by at least one measurement network element corresponding to the first network element. The second measurement information is used to indicate the second measurement result for the second measurement object. The transceiver unit is further configured to send first feedback information in response to the first request information based on the first measurement information and the second measurement information.

[0074] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0075] In conjunction with the fifth aspect, in some implementations of the fifth aspect, multiple measurement scenarios include at least one of the following measurement scenarios: the first scenario, used to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements; the second scenario, used to measure whether the geographical location of one or more virtual storage instances of the business network element meets the requirements; and the third scenario, used to measure whether one or more software of the business network element meets the requirements.

[0076] In conjunction with the fifth aspect, in some implementations of the fifth aspect, when the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: the image file of the service network element, one or more virtualization layers corresponding to the deployment environment migration environment, and the attributes of one or more hardware corresponding to the deployment environment migration environment.

[0077] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, when the measurement object of the first measurement scenario is the image file of the service network element, the first network element includes a service network element management network element, which is used to manage the service network element; the second network element includes an image verification network element, which is used to verify the correctness of the image file of the service network element; wherein, the second request information includes the identification information of the image file of the service network element; or,

[0078] When the measurement object of the first measurement scenario includes one or more virtualization layers corresponding to the deployment environment migration environment, the first network element includes the service network element management network element, and the second network element includes the virtualization infrastructure management network element. The virtualization infrastructure management network element is used to verify the security of one or more virtualization layers corresponding to the deployment environment migration environment; or...

[0079] When the measurement object of the first measurement scenario includes the attributes of one or more hardware corresponding to the deployment environment migration environment, the first network element includes a virtualization infrastructure management network element, which is used to manage the virtualization infrastructure, and the second network element includes a geolocation verification network element, which is used to verify the geolocation attributes of one or more hardware corresponding to the deployment environment.

[0080] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further configured to receive deployment result information from the service network element management network element. The deployment result information is used to indicate that the service network element has been successfully deployed or migrated. The deployment result information includes proof information of the service network element deployment or migration. The processing unit is further configured to verify whether the service network element has been successfully deployed or migrated based on the proof information.

[0081] In conjunction with the fifth aspect, in some implementations of the fifth aspect, when the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element. The first network element includes a business network element verification network element, which is used to verify the geographical location of one or more virtual instances responsible for storing information. The second network element includes a geographical location verification network element, which is used to verify the geographical location of the virtual instances responsible for storing information.

[0082] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further configured to obtain first configuration information, which indicates the correspondence between multiple identifiers and multiple virtual instance groups. The storage content corresponding to any two virtual instance groups is different, and the storage content includes at least one of the following: user information, communication records, and business data. The first request information also includes a first identifier, and the second request information also includes the identifier of the virtual instance in the first virtual instance group. The first virtual instance group is the virtual instance group corresponding to the first identifier in the first configuration information.

[0083] In conjunction with the fifth aspect, in some implementations of the fifth aspect, when the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: software in the virtual instance, software of the virtualization layer deployed in the virtual instance.

[0084] In conjunction with the fifth aspect, in some implementations of the fifth aspect, when the measurement object of the first measurement scenario includes software in a virtual instance, the first network element includes a service network element verification network element, which is used to verify whether one or more software programs of the service network element meet the requirements; the second network element includes a customer system verification network element, which is used to verify whether the software in the virtual instance meets the requirements; or,

[0085] When the measurement object of the first measurement scenario includes the software of the virtualization layer deployed by the virtual instance, the first network element includes the business network element verification network element, and the second network element includes the cloud operating system verification network element. The cloud operating system verification network element is used to verify whether the software of the virtualization layer deployed by the virtual instance meets the requirements.

[0086] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further configured to obtain second configuration information, which indicates the correspondence between multiple identifiers and multiple software, the multiple software including at least one of the following: software in a virtual instance, software of a virtualization layer deployed in the virtual instance; and the first request information further includes a second identifier, the second request information further includes an identifier of a first software, the first software being the first software corresponding to the second identifier in the second configuration information.

[0087] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is also used to send first instruction information to the service network element management network element, the first instruction information being used to instruct the reconfiguration of one or more measurement objects.

[0088] The explanation of the communication device provided in the fifth aspect and its beneficial effects can be found in the method shown in the first aspect, and will not be repeated here.

[0089] In a sixth aspect, a service management device is provided, including a unit for performing the method shown in the second aspect above. The communication device may be a second network element, or it may be a chip or circuit disposed in the second network element. This application does not limit this.

[0090] The communication device includes:

[0091] The transceiver unit is used to receive second request information, which requests measurement of at least one first measurement object, wherein the first measurement object belongs to multiple measurement objects included in the first measurement scenario; the processing unit is also used to measure at least one first measurement object and determine first measurement result information.

[0092] In conjunction with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is further configured to send a fourth request message to at least one measurement network element corresponding to the second network element, the fourth request message being used to request measurement for at least one first measurement object; the transceiver unit is further configured to receive third measurement information, the third measurement information including at least one third measurement result message sent by at least one measurement network element corresponding to the second network element, the third measurement information being used to indicate the second measurement result for the first measurement object; the processing unit is further configured to determine the first measurement result message based on the third measurement information.

[0093] In conjunction with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is also used to send first measurement result information, which is used to indicate a first measurement result for at least one first measurement object.

[0094] In conjunction with the sixth aspect, in some implementations of the sixth aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more virtual storage instances of the business network element meets the requirements; and a third scenario, used to measure whether one or more software of the business network element meets the requirements.

[0095] In conjunction with the sixth aspect, in some implementations of the sixth aspect, when the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: the image file of the service network element, one or more virtualization layers corresponding to the deployment environment migration environment, and the attributes of one or more hardware corresponding to the deployment environment migration environment.

[0096] In conjunction with the sixth aspect, in some implementations of the sixth aspect, when the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element.

[0097] In conjunction with the sixth aspect, in some implementations of the sixth aspect, when the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: software in the virtual instance, software of the virtualization layer deployed in the virtual instance.

[0098] The explanation of the communication device provided in the sixth aspect and its beneficial effects can be found in the method shown in the second aspect, and will not be repeated here.

[0099] In a seventh aspect, a service management device is provided, including a unit for performing the method shown in the third aspect above. The communication device may be a first network element, or it may be a chip or circuit disposed in the first network element. This application does not limit this.

[0100] The communication device includes:

[0101] The transceiver unit is used to obtain a mapping relationship, which indicates the correspondence between multiple measurement scenarios and multiple network elements; the transceiver unit is also used to receive first request information, which is used to perform measurement for the first measurement scenario; the processing unit is used to determine a second network element corresponding to the first measurement scenario from multiple network elements according to the mapping relationship; the transceiver unit is also used to send second request information to the second network element, which is used to request measurement for the first measurement scenario.

[0102] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the first request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario; the second request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario.

[0103] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0104] In conjunction with the seventh aspect, in some implementations of the seventh aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment of the service network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more storage devices of the service network element meets the requirements; and a third scenario, used to measure whether one or more software of the service network element meets the requirements.

[0105] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the transceiver unit is further configured to receive first measurement information, which includes one or more first measurement result information corresponding to one or more measurement objects; the processing unit is further configured to determine second measurement result information based on whether the first measurement information conforms to the measurement index.

[0106] In conjunction with the seventh aspect, in some implementations of the seventh aspect, when the first network element is a service network element verification network element, the transceiver unit is also used to send the second measurement result information to the service triggering party.

[0107] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the transceiver unit is also used to send first instruction information to the service network element management network element, the first instruction information being used to instruct the reconfiguration of one or more measurement objects.

[0108] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the transceiver unit is further configured to obtain first configuration information of the service network element functional component responsible for storing information. The service network element functional component responsible for storing information includes one or more virtual instances responsible for storing information. The first configuration information includes the number of the service network element functional component responsible for storing information and one or more numbers of the one or more virtual instances responsible for storing information.

[0109] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the transceiver unit is also used to send a third request message to the service network element functional component management network element, the third request message being used to request a query of the first configuration information; the transceiver unit is also used to receive the first configuration information.

[0110] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the transceiver unit is further configured to send a fourth request message to the measurement network element of the first network element, the fourth request message being used to request the second configuration information of the measurement service network element; the transceiver unit is further configured to receive the second configuration information of the service network element, the second configuration information including the type of the service network element functional component, the number of the service network element functional component, and the number of one or more virtual instances corresponding to the service network element functional component; the processing unit is further configured to verify the second configuration information to obtain the first configuration information.

[0111] The explanation of the communication device provided in the seventh aspect and its beneficial effects can be found in the method shown in the third aspect, and will not be repeated here.

[0112] Eighthly, a service management device is provided, including a unit for performing the method shown in the fourth aspect above. The communication device may be a second network element, or it may be a chip or circuit disposed in the second network element. This application does not limit this.

[0113] The communication device includes:

[0114] The transceiver unit is used to receive second request information, which is used to request measurement for the first measurement scenario; the processing unit is used to measure the first measurement scenario; the transceiver unit is also used to send first measurement information, which includes one or more first measurement result information corresponding to one or more measurement objects.

[0115] In conjunction with the eighth aspect, in some implementations of the eighth aspect, the transceiver unit is further configured to send a second request message to one or more measurement network elements of the second network element; the transceiver unit is further configured to receive third measurement result information, the third measurement result information including one or more results of one or more measurement parties of the second network element measuring the first measurement scenario; the processing unit is further configured to determine the first measurement result information based on whether the third measurement information conforms to the measurement index.

[0116] In conjunction with aspect eight, in some implementations of aspect eight, the second request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, and indication information of the measurement level corresponding to the first measurement scenario.

[0117] In conjunction with the eighth aspect, in some implementations of the eighth aspect, the mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups, wherein each index corresponds to at least one metric scenario, and each parameter group includes at least one of the following parameters: metric object, metric metric, metric level, and the first request information includes the index corresponding to the first metric scenario.

[0118] In conjunction with the eighth aspect, in some implementations of the eighth aspect, multiple measurement scenarios include at least one of the following measurement scenarios: a first scenario, used to measure whether the security of the deployment environment of the service network element meets the requirements; a second scenario, used to measure whether the geographical location of one or more storage devices of the service network element meets the requirements; and a third scenario, used to measure whether one or more software of the service network element meets the requirements.

[0119] The explanation of the communication device provided in the eighth aspect and its beneficial effects can be found in the method shown in the fourth aspect, and will not be repeated here.

[0120] A ninth aspect provides a business management apparatus, the apparatus comprising: a memory for storing a program; and at least one processor for executing the computer program or instructions stored in the memory to perform a method of any of the possible implementations of the first to fourth aspects described above.

[0121] In one implementation, the device is the first network element.

[0122] In another implementation, the device is a chip, chip system, or circuit used in the first network element.

[0123] In a tenth aspect, this application provides a processor for performing the methods provided in the foregoing aspects.

[0124] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0125] Eleventhly, a computer-readable storage medium is provided that stores program code for execution by a device, the program code including a method for performing any of the possible implementations of the first to fourth aspects described above.

[0126] In a twelfth aspect, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform a method of any one of the possible implementations of the first to fourth aspects described above.

[0127] In a thirteenth aspect, a chip is provided, the chip including a processor and a communication interface, wherein the processor reads instructions stored in a memory through the communication interface and executes a method of any one of the possible implementations of the first to fourth aspects described above.

[0128] Optionally, as one implementation, the chip also includes a memory storing computer programs or instructions, and a processor for executing the computer programs or instructions stored in the memory. When the computer programs or instructions are executed, the processor is used to perform the method of any of the possible implementations of the first to fourth aspects described above.

[0129] Fourteenth aspect, a communication system is provided, including one or more of the first network element and the second network element mentioned above. Attached Figure Description

[0130] Figure 1 A schematic diagram of a network architecture applicable to embodiments of this application is shown.

[0131] Figure 2 A schematic architecture diagram of an NFV system according to an embodiment of this application is shown.

[0132] Figure 3 A schematic flowchart of a business management method 300 provided in an embodiment of this application is shown.

[0133] Figure 4A schematic flowchart of a business management method 400 provided in an embodiment of this application is shown.

[0134] Figure 5 A schematic flowchart of a business management method 500 provided in an embodiment of this application is shown.

[0135] Figure 6 A schematic flowchart of a business management method 600 provided in an embodiment of this application is shown.

[0136] Figure 7 A schematic block diagram of a communication device 700 provided in an embodiment of this application is shown.

[0137] Figure 8 A schematic block diagram of another communication device 800 provided in an embodiment of this application is shown.

[0138] Figure 9 A schematic diagram of a chip system 900 provided in an embodiment of this application is shown. Detailed Implementation

[0139] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0140] The technical solutions of this application embodiment can be applied to various communication systems, such as: Global System for Mobile Communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE Frequency Division Duplex (FDD) system, LTE Time Division Duplex (TDD) system, Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system, future 5th generation (5G) systems, or new radio (NR), etc.

[0141] Figure 1 This is a system architecture or scenario diagram of an application of this application embodiment.

[0142] like Figure 1 As shown, this network architecture is based on a 5G system (the 5G... th Taking a generation system (5GS) as an example, this network architecture can include three parts: the UE part, the data network (DN) part, and the operator network part. The operator network can include one or more of the following network elements: (Radio)access network ((R)AN) equipment, user plane function (UPF) network elements, authentication server function (AUSF) network elements, unified data repository (UDR) network elements, access and mobility management function (AMF) network elements, SMF network elements, network exposure function (NEF) network elements, network repository function (NRF) network elements, policy control function (PCF) network elements, unified data management (UDM) network elements, and application function (AF) network elements. The part of the operator network other than the (R)AN part can be referred to as the core network part. In this application, user equipment, (wireless) access network equipment, UPF network element, AUSF network element, UDR network element, AMF network element, SMF network element, NEF network element, NRF network element, PCF network element, UDM network element, and AF network element are respectively referred to as UE, (R)AN equipment, UPF, AUSF, UDR, AMF, SMF, NEF, NRF, PCF, UDM, and AF.

[0143] The following is about Figure 1 A brief description of each network element involved is provided.

[0144] 1. UE

[0145] The UE primarily accesses the 5G network and obtains services through the radio air interface. The UE interacts with the RAN through the air interface and with the AMF of the core network through non-access stratum signaling (NAS).

[0146] In the embodiments of this application, the UE can also be referred to as terminal equipment, user, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent, or user device. UE can be a cellular phone, smartwatch, wireless data card, mobile phone, tablet computer, personal digital assistant (PDA) computer, wireless modem, handheld device, laptop computer, machine type communication (MTC) terminal, computer with wireless transceiver capability, Internet of Things (IoT) terminal, virtual reality terminal device, augmented reality terminal device, wearable device, vehicle, terminal in device-to-device (D2D) communication, terminal in vehicle-to-everything (V2X) communication, terminal in machine-type communication (MTC), terminal in Internet of Things (IoT), terminal in smart office, terminal in industrial control, terminal in autonomous driving, terminal in remote surgery, terminal in smart grid, terminal in transportation safety, terminal in smart city, terminal in smart home, or terminal in satellite communication (e.g., satellite phone or satellite terminal). UE can also be customer-premises equipment (CPE), telephone, router, network switch, residential gateway (RG), set-top box, fixed-mobile converged product, home network adapter, and Internet access gateway.

[0147] The embodiments of this application do not limit the specific technology or device form used by the UE.

[0148] 2. (R)AN equipment

[0149] (R)AN devices can provide access to a communication network for authorized users in a specific area. Specifically, they can include wireless network equipment in 3GPP (3rd Generation Partnership Project) networks or access points in non-3GPP networks. For ease of description, AN devices will be used in the following text.

[0150] AN devices can employ different radio access technologies. Currently, there are two types of radio access technologies: 3GPP access technologies (e.g., those used in 3rd generation (3G), 4th generation (4G), or 5G systems) and non-3GPP access technologies. 3GPP access technologies refer to access technologies that conform to 3GPP standards and specifications. For example, access network equipment in a 5G system is called a next-generation nodebase station (gNB) or (R)AN device. Non-3GPP access technologies can include air interface technologies such as access points (APs) in Wireless Fidelity (WiFi), Worldwide Interoperability for Microwave Access (WiMAX), and Code Division Multiple Access (CDMA). AN devices allow terminal devices and the 3GPP core network to interconnect using non-3GPP technologies.

[0151] The AN device is responsible for functions such as radio resource management, quality of service (QoS) management, data compression, and encryption on the air interface side. The AN device provides access services to terminal devices, thereby completing the forwarding of control signals and user data between the terminal devices and the core network.

[0152] AN devices may include, but are not limited to: macro base stations, micro base stations (also known as small stations), radio network controllers (RNCs), node Bs (NBs), base station controllers (BSCs), base transceiver stations (BTSs), home base stations (e.g., home-evolved NodeBs, or home node Bs, HNBs), baseband units (BBUs), access points (APs) in WiFi systems, base stations (BSs) in WiMAX, wireless relay nodes, wireless backhaul nodes, transmission points (TPs), or transmission and reception points (TRPs), and may also be gNBs or transmission points (TRPs or TPs) in 5G (e.g., NR) systems, one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system, or network nodes constituting gNBs or transmission points, such as distributed units (DUs), or base stations in next-generation communication 6G systems, etc.

[0153] This application does not limit the specific technology or device form used in the AN device.

[0154] 3. UPF

[0155] UPF primarily provides user plane functions such as message forwarding, processing, connection to the DN, session anchoring, and Quality of Service (QoS) policy enforcement. For example, UPF can receive user plane data from the DN and send it to the terminal device through the AN device. UPF can also receive user plane data from the terminal device through the AN device and forward it to the DN.

[0156] 4. DN

[0157] DN is primarily used in operator networks that provide data services to UEs. Examples include the Internet, third-party service networks, and Internet Protocol Multimedia Service (IMS) networks.

[0158] 5. AUSF

[0159] AUSF is mainly used for user authentication, etc.

[0160] 6. UDR

[0161] UDR primarily provides storage capabilities for contract data, policy data, and capability-related data.

[0162] 7. AMF

[0163] AMF is mainly used for functions such as access control, mobility management, attach and detach.

[0164] 8. SMF

[0165] SMF is primarily responsible for session management (such as session establishment, modification, and release), Internet Protocol (IP) address allocation and management, and UPF selection and control.

[0166] 9. NEF

[0167] The NEF is primarily used to securely expose services and capabilities provided by 3GPP network functions to the outside world.

[0168] 10. NRF

[0169] NRF is primarily used to store information about network functional entities and the services they provide.

[0170] 11. PCF

[0171] PCF is primarily used as a unified policy framework to guide network behavior, providing policy rule information to control plane network elements (such as AMF, SMF, etc.).

[0172] 12. UDM

[0173] UDM is mainly used for UE subscription data management, including the storage and management of UE identifiers and UE access authorization.

[0174] 13. AF

[0175] AF is mainly used to provide services to 3GPP networks, such as interacting with PCF for policy control.

[0176] exist Figure 1 In the network architecture shown, network elements can communicate with each other through the interfaces shown in the diagram. Some interfaces can be implemented using service-oriented interfaces. For example... Figure 1 As shown, the UE and AMF can communicate via the N1 interface. The RAN and AMF can communicate via the N2 interface. The relationships between other interfaces and various network elements are as follows: Figure 1 As shown, for the sake of brevity, not all details are described here.

[0177] It should be understood that the network architecture shown above is merely an illustrative example, and the network architecture applicable to the embodiments of this application is not limited thereto. Any network architecture capable of realizing the functions of the above-described network elements is applicable to the embodiments of this application.

[0178] It should also be understood that Figure 1 The functions or network elements shown, such as AMF, SMF, UPF, PCF, UDM, AUSF, UDR, NEF, NRF, and AF, can be understood as network elements used to implement different functions, such as network slices that can be combined as needed. These network elements can be independent devices or integrated into the same device to implement different functions. They can be network components in hardware devices, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (e.g., a cloud platform). This application does not limit the specific form of the above network elements.

[0179] It should also be understood that the aforementioned network elements or functions can be divided into one or more services, and furthermore, services that exist independently of network functions may also exist. In this application, instances of the aforementioned functions, instances of services included in the aforementioned functions, or instances of services that exist independently of network functions can all be referred to as service instances. In addition, in actual deployment, network elements with different functions can be co-located. For example, the access and mobility management network element can be co-located with the session management network element; the session management network element can be co-located with the user plane network element. When two network elements are co-located, the interaction between the two network elements provided in the embodiments of this application becomes the internal operation of the co-located network element or can be omitted.

[0180] It should also be understood that the above naming is defined solely for the purpose of distinguishing different functions and should not constitute any limitation on this application. This application does not preclude the possibility of using other naming conventions in 6G networks and other future networks. For example, in 6G networks, some or all of the above-mentioned network elements may use the terminology from 5G, or they may use other names, etc.

[0181] It should also be understood that Figure 1 The interface names between the various network elements are merely examples; in actual implementations, the interface names may differ, and this application does not impose any specific limitations on them. Furthermore, the names of the messages (or signaling) transmitted between the aforementioned network elements are also merely examples and do not constitute any limitation on the function of the messages themselves.

[0182] Figure 2 A schematic architecture diagram of an NFV system according to an embodiment of this application is shown. Figure 2 As shown, the NFV reference architecture consists of the following main functional components:

[0183] 1. NFV infrastructure (NFVI) provides the virtualization resources required to support the execution of NFV, including commercial off-the-shelf (COTS) hardware, necessary accelerator components, and a software layer that virtualizes and abstracts the underlying hardware.

[0184] For example, NFVI may include a hardware resource layer consisting of computing hardware, storage hardware, and network hardware, a virtualization layer, and a virtual resource layer consisting of virtual computing, virtual storage, and virtual networks.

[0185] The virtualization layer is a software layer consisting of the software required to host virtual instances. It is installed on top of the hardware layer of the COTS host. The virtualization layer includes, but is not limited to, a bootloader, a cloud operating system (Cloud OS) or a host operating system (HOS), a hypervisor, a virtual machine manager (VMM), and other software required for security, transmission, and business operations that support the operation of virtual instances. This application does not impose any restrictions on these aspects.

[0186] 2. A virtual network function (VNF) is a software implementation of a network function (NF) that can run on NFVI. It may also be accompanied by an element management system (EMS) to understand and manage the individual VNF and its characteristics. A VNF is equivalent to an entity of a network node and is expected to be delivered as pure software, free from hardware dependencies.

[0187] The VNF further defines the following functional components:

[0188] (1) A Virtual Network Function Component (VNFC) is a component of a VNF and is used to implement a specific part of the VNF's functions, such as computing, storage, and communication. Generally, a VNF has multiple VNFCs, and each VNFC consists of one or more VIs. A VNFC can be understood as a virtual instance VI group.

[0189] (2) A virtual network function platform (VNFP) is a component of a VNF, providing functions such as managing VNFC, connecting to the network management system, managing virtual devices, and bus communication. Generally, a VNF has only one VNFP. The VNFP can have different forms; for example, the VNFP can be combined with the VNFC, or the VNFP can be embedded as management software into the VI that constitutes the VNF, or it can be stored as a set of configuration lists in the VNF's configuration information. This application does not impose any restrictions on this.

[0190] 3. Management and orchestration (MANO): This provides comprehensive management capabilities, including but not limited to orchestration, lifecycle management of physical and / or software resources supporting infrastructure virtualization, and VNF lifecycle management. MANO can also interact with (external to NFV) operation support systems (OSS) / business support systems (BSS) to manage NFV.

[0191] Within MANO, the following functional components are further defined:

[0192] (1) NFV orchestrator (NFVO) is mainly used for the deployment and management of network services, and coordinates the deployment and management of VNFs according to network services. NFVO can also interface with OSS / BSS to obtain service descriptions of network services. NFVO can also be used to coordinate the deployment or management of corresponding VNFs by VIM and VNFM.

[0193] (2) The VNF Manager (VNFM) is primarily responsible for deploying or managing the corresponding VNFs. It should be understood that each VNF is assumed to have an associated VNFM. A VNFM can be assigned to manage a single VNF instance or multiple VNF instances of the same or different types. The VNFM is mainly responsible for: VNF instantiation, configuring NFV resources for VNFs, updating VNF instances, scaling VNF instances, collecting NFVI performance metrics and events related to VNF instances and associating events related to VNF instances, assisting or automatically recovering VNF instances, terminating VNF instances, ensuring the integrity of VNF instances throughout their lifecycle, and acting as a global coordinator and adapter for configuration and event reporting between NFVI and EMS. For example, the VNFM can add, delete, find, or manage VNFs according to the network management requirements, such as monitoring and adjusting the status of VNFs.

[0194] (3) The Virtualized Infrastructure Manager (VIM) is primarily responsible for controlling the NFVI to provide corresponding virtual resources for VNFs. It should be understood that within an operator's infrastructure subdomain, a VIM can specialize in handling a specific type of NFV resource or manage multiple types of NFV resources. The VIM is mainly responsible for orchestrating the allocation / upgrade / deallocation / recycling of NFV resources; managing the association between virtualized resources and computing, storage, and network resources; managing the catalog of hardware resources (computing, storage, network) and software resources (e.g., hypervisors); and collecting and forwarding performance metrics and events related to virtualized resources. For example, the VIM can control the NFVI to provide corresponding virtual resources for the deployment or management of VNFs based on NFVO scheduling. The VIM can be a cloud platform, such as an open-source cloud platform like OpenStack, or a commercial cloud platform like VMware.

[0195] It should be noted that a virtual instance (VI) is a functional entity implemented through various virtualization methods, including but not limited to: traditional virtual machines implemented based on virtual machine technology, or virtual instances implemented based on container technology (e.g., Docker).

[0196] It should be understood that in the embodiments of this application, the term "network element" refers to a functional component in the NFV architecture. For example, a network element can be an NFVO, OSS, VNF, or VNFM, etc. "Network element" can also be called a "functional component", "device", or "apparatus", etc. The embodiments of this application are not limited thereto.

[0197] To facilitate understanding of the embodiments of this application, the terms or technologies involved in this application will be briefly explained.

[0198] 1. Network Functions Virtualization (NFV): This involves decoupling the network functions of many traditional network devices (such as servers, switches, and storage) from their physical devices and running them as software on commercial off-the-shelf (COTS) servers. It can also be described as using IT virtualization technology to create virtual machines (VMs), and then deploying traditional communication services on NFV.

[0199] 2. Remote Attestation (RA): Remote attestation is a unique security service that requests data from a metric element (called an attester) and sends it to a verifier element (called a verifier) ​​to verify or interpret a remote, untrusted internal state (including memory and storage) that may be infected with malware. Remote attestation can be extended to allow remote code updates. This can be used to securely update software running on a device, reset an infected device, or wipe a device. A common method for implementing RA in a simple verification process is the "challenge and response" protocol, which consists of the following four steps:

[0200] (1) Challenge: The verifier generates a "challenge" containing some random numbers, unique references, and request information, requesting the attester to perform the measurement.

[0201] (2) Calculate the internal state of the metric: The attester calculates the required hash value through metrics and other means.

[0202] (3) Response: The evidence included in (1) is packaged and sent to the verifier after being calculated or signed.

[0203] (4) Verification and validation of evidence: Verifier verifies that the response sent by the attester is unique to the previous challenge, and then determines whether the target response conforms to the specification by checking the hash value content.

[0204] 3. Element Management System (EMS): Primarily responsible for the functional management of Virtual Network Functions (VNFs), including but not limited to fault, configuration, billing, performance, and security management. EMS manages VNFs through dedicated interfaces. An EMS can manage one or more VNFs. EMS deployment is flexible; it may be a virtualized deployment combined with VNFs, or it may be physically deployed in a data center.

[0205] 4. Relying party: The party that takes subsequent actions based on the proof results. There are no restrictions on the specific form of the relying party. For example, it can be a regular network element (e.g., NRF), a network element located at EMS, or a network element located in MANO.

[0206] 5. Measurement Scenarios: This can be understood as performing a specified measurement process on one or more specified measurement objects in a specific scenario. For example, the measurement scenario is to measure whether the security of the deployment environment or migration environment of the business network element meets the requirements. To meet the security requirements, one or more measurement objects need to be measured and verified in sequence.

[0207] 6. Measurement object: This can be understood as the specific target when measuring a certain measurement scenario. A measurement scenario can correspond to one or more measurement objects. For example, the measurement object corresponding to the above measurement scenario can be the image file of the business network element.

[0208] 7. Measurement content: This can be understood as the specific evidence when measuring the measurement object. One measurement object can correspond to one or more measurement contents. For example, the measurement content of the above measurement object can be the generation date, hash value, modification date, etc. of the image file.

[0209] 8. Metrics: These can be understood as a baseline value, i.e., the conditions that the expected measurement results should meet. One measurement content corresponds to one metric, such as the generation date of the image file being the production date of the network element deployed for that service.

[0210] It is understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0211] The terminology used in this application has been briefly explained above, and will not be repeated in the following embodiments. The communication method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings. The embodiments provided in this application can be applied to the above... Figure 1 and Figure 2 The architecture shown is not limited.

[0212] based on Figure 2 In an NFV architecture, tenant-oriented remote proofs can be used to perform individual remote proofs for specific tenants (e.g., VNFs) within the NFV architecture. For example, remote proof-based methods can be used to ensure the security of VNFs. However, since a VNF is implemented by multiple VIs, when measuring a VNF, regardless of the triggering scenario, the attester treats the VNF as a whole and measures each part of the VNF. Furthermore, it cannot measure specific content or objects, making the entire remote proof process lengthy and impractical.

[0213] Therefore, this application provides a business management method that triggers remote proof of specific content and objects based on different measurement scenarios, measures specific parts of NFV for specific trigger scenarios, thereby reducing the complexity of measurement, saving communication and computing overhead, and further improving the practical effect of remote proof.

[0214] The business management method provided in this application will now be described in detail with reference to specific embodiments.

[0215] Figure 3 This is a schematic flowchart of a business management method 300 provided in an embodiment of this application, such as... Figure 3 As shown, the method 300 specifically includes the following steps.

[0216] S310, the first network element receives the first request information.

[0217] Specifically, the first network element receives the first request information from the service triggering party.

[0218] It should be understood that the service trigger, i.e. the functional module that requests and initiates the measurement, can be a network function in the core network, such as a session management network element or a security function network element; it can also be a management device located in NFVI, such as OSS / BSS or EMS; or it can be a periodically triggered event generator module, etc., which are not limited in this application.

[0219] The first request information is used to request measurement for the first measurement scenario, which is the measurement scenario that needs to be measured.

[0220] Specifically, the first request information includes at least one of the following: indication information of the measurement object corresponding to the first measurement scenario, indication information of the measurement index corresponding to the first measurement scenario, indication information of the measurement level corresponding to the first measurement scenario, and index corresponding to the first measurement scenario.

[0221] S320, the first network element determines at least one second network element according to the mapping relationship.

[0222] Specifically, the first network element determines at least one first measurement object and a second network element corresponding to the first measurement scenario based on the local mapping relationship.

[0223] It should be understood that the second network element can be a network element capable of measuring the first measurement object, and one second network element can correspond to multiple first measurement objects, which is not limited in this application.

[0224] It should be understood that the first network element can obtain the mapping relationship through pre-configuration or other means. For example, the mapping relationship can be configured in the first network element through local configuration, and this application does not restrict this.

[0225] Specifically, the mapping relationship is used to indicate the correspondence between multiple indices and multiple parameter groups, with each index corresponding to at least one metric scenario.

[0226] For example, measurement scenarios include, but are not limited to:

[0227] The first scenario is used to measure whether the security of the deployment or migration environment of the business network element meets the requirements.

[0228] The deployment environment can be used to deploy business network elements that have not yet been instantiated or started to a new environment.

[0229] Among them, the migration environment can be used to migrate service network elements that have been instantiated or started to a new environment.

[0230] For example, when deploying a service network element that has not yet been instantiated or started to a new environment (e.g., NFV, or virtualized network element deployment environment, or cloud platform, or telecom cloud), it is necessary to measure whether the image file, virtualization layer, hardware attributes, etc. of that environment are secure or meet the deployment requirements.

[0231] For example, when deploying a business network element that has already been instantiated or started to a new environment (e.g., NFV, virtualized network element deployment environment, cloud platform, or telecom cloud) through migration or other means, it is necessary to measure whether the image file, virtualization layer, hardware attributes, etc. of the environment are secure or meet the deployment requirements. This application does not impose any restrictions on this.

[0232] The service network element can be any network element in the communication system, such as the session management network element, mobility management network element, etc., and this application does not limit it.

[0233] The hardware of the deployment environment can be the motherboard, CPU, security chip, etc. in the host that carries the service network elements, and this application does not limit it.

[0234] The second scenario involves measuring whether the geographical location of one or more virtual storage instances of a service network element meets the requirements. For example, this application does not restrict the determination of whether the geographical location of one or more virtual instances responsible for storing information corresponding to a service network element is within a reasonable geographical range.

[0235] The third scenario involves measuring whether one or more software components of a service network element meet the requirements. For example, for software in the virtualization layer, determining whether the software version is within a reasonable range is not restricted in this application.

[0236] Each parameter group includes at least one of the following parameters: metric index, metric object, metric metric, and metric level.

[0237] The metric index is used to indicate the corresponding metric scenario, and one metric index corresponds to one metric scenario.

[0238] The measurement object is the target of a certain measurement scenario, such as the image file of a business network element, the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element, the software of the virtualization layer deployed by the virtual instance, etc., which are not limited in this application.

[0239] The measurement content refers to relevant evidence of the measurement object to be obtained, such as the software version, the hash value of the image file of the business network element, etc., which are not limited in this application.

[0240] The metric is the expected range that the measurement result obtained based on the measurement content should meet, also known as the baseline value. For example, the metric can be a threshold, such as "a reasonable software version range is v1.1-v1.5". If the measurement result is "the software version is v1.2", then the metric is met. For example, the metric can also be "specific text", such as "geographical location is China". If the measurement result is "the geographical location of the virtual instance is China", then the metric is met. For example, the metric can also be a "date", such as "June 2019 to December 2019". If the measurement result is "August 2019", then the metric is met. For example, the metric can also be a "hash value", such as "3ac295783649". If the measurement result is "3ac295783649", then the metric is met. It should be understood that this application does not limit this.

[0241] It should be understood that the metrics can be configured locally by the first network element or received from the service triggering party; this application does not impose any restrictions.

[0242] The measurement level refers to the range of measurement objects that can be measured when measuring a certain measurement scenario. It can also be called the security level. For example, when the measurement level is level 1, all measurement objects corresponding to the measurement scenario can be measured. For another example, when the measurement level is level 2, the measurement objects of the first two measurement levels in the measurement scenario can be measured. This application does not impose any restrictions.

[0243] For ease of understanding, Table 1 below provides an example of some mapping relationships, that is, the correspondence between multiple indices and multiple parameter groups.

[0244] Table 1 Mapping Relationship List

[0245]

[0246] As can be seen from Table 1 above, one metric index can correspond to one metric, and one metric scenario can correspond to one or more metric objects. It should be understood that Table 1 above is only an example and is not intended to limit the scope of this application.

[0247] To facilitate understanding, the following example illustrates how to determine the second network element.

[0248] For example, when the index corresponding to the first measurement scenario is 1, the first network element determines the measurement scenario as the first scenario according to the mapping relationship, and then determines the measurement object as the image file of the business network element, one or more virtualization layers corresponding to the deployment environment or migration environment, and one or more hardware attributes corresponding to the deployment environment or migration environment according to the measurement level of 1. Further, it determines that the second network element can be an image verification network element (e.g., IMG verifier located in MANO), a virtualization infrastructure management network element (e.g., MANO-VIM located in the virtualization layer), and a geolocation verification network element (e.g., Cloud OS verifier located in the virtualization layer).

[0249] For example, when the index corresponding to the first measurement scenario is 2, the first network element determines the measurement scenario as the second scenario according to the mapping relationship, and then determines the measurement object as the geographical location of one or more virtual instances responsible for storing information corresponding to the business network element according to the measurement level of 1, and further determines that the second network element can be a geographical location verification network element (e.g., Cloud OS verifier located in the virtualization layer).

[0250] For example, when the index corresponding to the first measurement scenario is 3, the first network element determines the measurement scenario as the third scenario according to the mapping relationship, and then determines the measurement object as the software of the virtualization layer deployed by the virtual instance according to the measurement level of 2. It further determines that the second network element can be the cloud operating system verification network element (e.g., Cloud OSverifier located in the virtualization layer).

[0251] It should be noted that the above method for determining the second network element is merely an example, and this application does not impose any restrictions on it.

[0252] It should be noted that the aforementioned IMG verifier, Cloud OS verifier, etc., are verification network element verifiers deployed in different locations and with different functions. Among them, IMG verifier and Cloud OS verifier are only examples. This application may also involve verifiers with other functions, such as Guest OS verifier, VNF verifier, etc., which are not limited in this application.

[0253] The IMG verifier can be a network element located in MANO, such as deployed on MANO-VNFM. The IMG verifier is mainly used to verify evidence related to the integrity of the image file. For example, the IMG verifier located in MANO requests relevant evidence of the image file from its corresponding IMG attester and verifies the relevant evidence. This application does not impose any restrictions on this.

[0254] The Cloud OS verifier can be a network element located in the MANO or the virtualization layer. The Cloud OS verifier is mainly used to verify whether the specified virtualization layer and hardware layer are secure and to obtain relevant evidence of the configuration. For example, the Cloud OS verifier located in the virtualization layer requests relevant evidence located in the hardware layer, virtualization layer, or virtual example from its corresponding Cloud OS attester and verifies the relevant evidence. This application does not impose any restrictions on this.

[0255] The Guest OS verifier can be a network element located in the virtual instance. The Guest OS verifier is mainly used to verify whether the software in the virtual instance is secure and the relevant configuration evidence. For example, the Guest OS verifier located in the virtual instance requests the relevant evidence of the software in the virtual instance from its corresponding Guest OS attester and verifies the relevant evidence. This application does not restrict this.

[0256] The VNF verifier, or service network element verification network element, can be a functional module on the EMS or a verification functional module located on other service network elements. The VNF verifier is mainly used to verify the security and configuration-related evidence of the service network element. For example, the VNF verifier located on the EMS requests relevant evidence of the VNFP from its corresponding VNF attester and verifies the relevant evidence. This application does not impose any restrictions on this.

[0257] In one possible implementation, when the first network element determines that there is a measurement object that the corresponding measurement network element of the first network element cannot measure among at least one measurement object in the first request information, the second network element identifies the measurement object as the first measurement object, determines the second network element that can measure the first measurement object according to the mapping relationship, and sends the second request information to the second network element to request the measurement of the first measurement object.

[0258] When the first network element determines whether there is a measurement object that its corresponding measurement network element cannot measure among at least one measurement object in the first request information, it can do so in the following ways:

[0259] In one possible implementation, after the first network element obtains the measurement object that needs to be measured, it determines the network element corresponding to the measurement object to be measured according to the mapping relationship. If the network element is another network element, the measurement object is determined to be a measurement object that the measurement network element corresponding to the first network element cannot measure.

[0260] For example, if the first network element is MANO-VNFM and the measurement object is the image file of the service network element, and the first network element determines through the mapping relationship that the measurement object for the image file is IMG verifier, not MANO-VNFM, then the first network element determines that the image file of the service network element is a measurement object that cannot be measured.

[0261] In one possible implementation, if the first network element determines that the pre-configured measurement indicators do not include any measurement indicators that can verify the measurement object, then the first network element determines that the measurement object is a measurement object that the measurement network element corresponding to the first network element cannot measure.

[0262] For example, if the measurement object is a virtual instance of software and the corresponding measurement metric is "the software version range is v1.1-v1.5", and the first network element's pre-configured measurement metric does not include "the software version range is v1.1-v1.5", then the first network element determines that the image file of the service network element is a measurement object that cannot be measured.

[0263] In one possible implementation, if the first network element determines that the pre-configured measurable objects do not include the measurable object that needs to be measured, then the first network element determines that the measurable object is a measurable object that the corresponding measurable network element cannot measure.

[0264] For example, if the object to be measured is a mirror file of a service network element, and the mirror file of a service network element is not included in the pre-configured measurable objects of the first network element, then the first network element determines that the object to be measured is a measurable object that the corresponding measurable network element cannot measure.

[0265] It should be noted that the above method of determining whether there is a measurement object that the measurement network element corresponding to the first network element cannot measure among at least one measurement object in the first request information is only an example, and this application does not limit it.

[0266] S330, the first network element sends a second request message to at least one second network element.

[0267] It should be understood that after the first network element determines at least one first measurement object, it determines the second network element corresponding to the first measurement object according to the mapping relationship, and sends a second request message to the second network element to request the measurement of the first measurement object.

[0268] The second request information is used to request a measurement for the first measurement scenario.

[0269] One possible approach is to include measurement content and metrics in the second request information.

[0270] In one possible scenario, the second request information does not include measurement content and metrics, and the second network element obtains the measurement content and metrics for the first measurement scenario through local pre-configuration.

[0271] In one possible implementation, when the first network element determines that among at least one measurement object in the first request information, there is a measurement object that the first network element's corresponding measurement network element can measure, the first network element identifies the measurement object as the second measurement object, and the first network element sends a third request information to at least one measurement network element corresponding to the first network element to request that the second measurement object be measured.

[0272] Optionally, when the measurement scenario is the second scenario, the method 300 further includes:

[0273] S331, the first network element obtains the first configuration information.

[0274] The first configuration information is used to indicate the correspondence between multiple identifiers and multiple virtual instance groups.

[0275] It should be understood that each virtual instance group includes multiple virtual instances, and the storage content corresponding to any two virtual instance groups is different. For example, virtual instance group number 01 is used to store data information, and virtual instance group number 02 is used for calculation, etc. This application does not impose any restrictions.

[0276] For example, the virtual instance group can be a virtual network function component (VNFC), and this application is not limited thereto.

[0277] It should be understood that in an NFV system, each VNF includes multiple VNFCs with different functions. This can be understood as an NFV system including multiple VNFs, where each VNF consists of multiple VIs, and one or more VIs are assigned to different VNFCs according to their different functions.

[0278] The stored content includes at least one of the following: user information, communication records, and business data.

[0279] For example, user information may include information about the terminal device in the network, communication records may include record information between multiple network elements, and service data may include subscription database information of the terminal device, etc., which are not limited in this application.

[0280] In one possible implementation, the first network element obtains the first configuration information by requesting a query from the VNFP.

[0281] One possible implementation is that the first network element obtains the first configuration information by verifying the network element metric through the service network element.

[0282] It should be understood that after the first network element obtains the first configuration information, it can determine the virtual instance group that needs to be verified through the measurement object in the first request information, carry the identifier of the virtual instance in the virtual instance group in the request information, and request the second network element to measure the virtual instance group.

[0283] Optionally, when the measurement scenario is a third scenario, the method 300 further includes:

[0284] S332, the first network element obtains the second configuration information.

[0285] The second configuration information is used to indicate the correspondence between multiple identifiers and multiple software, wherein the multiple software includes at least one of the following: software in a virtual instance, software of the virtualization layer deployed in the virtual instance, for example, VI-1 corresponding to number 0001 includes software such as Cloud OS-1 and hypervisor-1, etc., which are not limited in this application.

[0286] In one possible implementation, the first network element obtains the second configuration information by requesting a query from the VNFP.

[0287] One possible implementation is that the first network element obtains the second configuration information by verifying the network element metric through the service network element.

[0288] For example, the service network element verification network element can be a VNF verifier, which is not limited in this application.

[0289] It should be understood that after the first network element obtains the second configuration information, it can determine the software corresponding to the VI that needs to be verified through the measurement object in the first request information, carry the identifier of the software in the request information, and request the second network element to measure the software.

[0290] S340, the second network element measures at least one first measurement object and determines the first measurement result information.

[0291] It should be understood that after receiving the second request information from the first network element, the second network element measures the first measurement scenario according to the measurement scenario, measurement object, measurement content and measurement index, and determines the first measurement result information.

[0292] The first measurement result information is used to indicate the first measurement result for the at least one first measurement object. One possible implementation, when the measurement scenario is the first scenario:

[0293] For example, when the measurement object is a mirror file of a service network element, the second network element (e.g., IMG verifier) ​​verifies the correctness of the mirror file of the service network element and obtains the first measurement result.

[0294] Verifying the correctness of the image file of the service network element may include verifying whether the image file is complete, such as whether the hash value, file name, and modification time of the image file conform to the baseline value, which is not limited in this application.

[0295] For example, when the measurement object is one or more virtualization layers corresponding to the deployment environment or migration environment, the second network element (e.g., MANO-VIM) verifies the security of one or more virtualization layers corresponding to the deployment environment or migration environment and obtains the first measurement result.

[0296] For example, when the metric is an attribute of one or more hardware devices corresponding to a deployment environment or a migration environment, the second network element (e.g., Cloud OS verifier located in the virtualization layer) verifies the attribute of one or more hardware devices corresponding to the deployment environment or the migration environment to obtain the first metric result.

[0297] Verifying the attributes of one or more hardware devices corresponding to the deployment or migration environment may include verifying whether the hardware includes secure hardware (e.g., a security chip, a global positioning system (GPS) module, etc.) or whether the geographical location of the cloud server where the hardware is located is secure, etc., which are not limited in this application.

[0298] One possible implementation, when the measurement scenario is the second scenario:

[0299] For example, when the measurement object is the geographical location of one or more virtual instances responsible for storing information corresponding to a business network element, the second network element (e.g., Cloud OS verifier) ​​verifies the geographical location of the virtual instance to obtain the first measurement result.

[0300] Verifying the geographical location of a virtual instance may include verifying whether the geographical location of the virtual instance responsible for storing information is within the expected geographical location, such as whether the geographical location of VI-1 is within the expected "China-Beijing". This application does not impose any restrictions on this.

[0301] One possible implementation, when the measurement scenario is a third scenario:

[0302] For example, when the measurement object is software in a virtual instance, the second network element (e.g., the Guest OS verifier located in the virtual instance) verifies the software in the virtual instance and obtains the first measurement result.

[0303] Verifying the software in the virtual instance may include verifying whether the software version is within a reasonable range, etc., which is not limited in this application.

[0304] For example, when the measurement object is the software of the virtualization layer deployed in the virtual instance, the second network element (e.g., Cloud OS verifier located in the virtualization layer) verifies the software of the virtualization layer deployed in the virtual instance and obtains the first measurement result.

[0305] Verifying the software of the virtualization layer deployed in the virtual instance may include verifying whether the software version is within a reasonable range, etc., which is not limited in this application.

[0306] S350, the first network element receives the first measurement information.

[0307] The first measurement information includes at least one first measurement result information sent by the at least one second network element.

[0308] In one possible implementation, when the first network element determines that among at least one measurement object in the first request information, there is a measurement object that the measurement network element corresponding to the first network element can measure, namely the second measurement object, the first network element requests at least one measurement network element corresponding to the first network element to measure the second measurement object and receives the second measurement information.

[0309] The second measurement information includes at least one second measurement result information sent by at least one measurement network element corresponding to the first network element, and the second measurement information is used to indicate the second measurement result for the second measurement object.

[0310] S360, the first network element sends first feedback information in response to the first request information based on the first measurement information.

[0311] It should be understood that the first network element determines the first feedback information based on whether the first measurement information meets the measurement indicators, and then feeds it back to the service triggering party.

[0312] The first feedback information is used to indicate whether the first measurement scenario meets the requirements.

[0313] In one possible implementation, when the first network element receives the second measurement information, the first network element determines the first feedback information based on the first measurement information and the second measurement information, and then feeds it back to the service triggering party.

[0314] Optionally, when the first feedback information is used to indicate that the first measurement scenario does not meet the requirements, the method further includes:

[0315] S370, the first network element sends the first instruction information to the service network element management network element.

[0316] The first indication information is used to instruct one or more metric objects to be reconfigured.

[0317] For example, reconfiguring the measurement object includes, but is not limited to: restarting virtual instances that do not meet the requirements, re-instantiating the service network element using the image file, and re-providing the image file, etc., and this application does not limit this.

[0318] Based on the above scheme, the first network element can perform targeted measurements on specific parts of NFV according to different measurement scenarios triggered by the service triggering party, reducing the complexity of measurement, saving communication and computing overhead, and further improving the practical effect of remote proof.

[0319] Based on the service management method provided by Method 300, the network elements and measurement processes differ in different measurement scenarios. The following section will combine... Figures 4-6 This section provides a detailed explanation of the specific measurement processes for different measurement scenarios.

[0320] When the measurement scenario involves assessing whether the security of the deployment environment of a service network element meets the requirements, methods such as... can be used. Figure 4 The method shown is used for measurement, and the following is combined with... Figure 4 A detailed introduction will be provided.

[0321] Figure 4 This is a schematic diagram of a communication method 400 provided in an embodiment of this application. Figure 4 For reference Figure 3 As described above, the method 400 may include the following steps.

[0322] S401, receive trigger request information.

[0323] It should be understood that when deploying a business network element that has not yet been instantiated or started to a new environment, or when migrating a business network element that has already been instantiated or started to a new environment, it is necessary to measure whether the security of the new environment meets the requirements. At this time, the network management EMS is triggered to measure the security of the deployment environment of the business network element.

[0324] One possible implementation involves the service triggering party sending a trigger request message to the EMS to trigger a measurement of the security of the deployment environment of the service network element.

[0325] One possible implementation is that when the service triggering party and EMS are deployed together, the internal triggering EMS measures the security of the deployment environment of the service network elements.

[0326] The trigger request information includes at least one of the following: network element type and measurement level.

[0327] Specifically, in one possible implementation, the trigger request information includes the network element type and measurement level.

[0328] Among them, the network element type is used by the network management EMS to determine the security environment used when deploying service network elements, so as to request measurement whether the new environment meets the security requirements.

[0329] The metric level is used to indicate the metric objects that need to be measured when measuring the security of the deployment environment. The metric level can also be called a security level or a security requirement description. This application does not limit the name.

[0330] For example, when the metric level is 1, there are three metric objects: the image file of the business network element, the security of one or more virtualization layers corresponding to the deployment environment, and the security of one or more hardware devices corresponding to the deployment environment.

[0331] For example, when the metric level is 2, there are two metric objects: the image file of the business network element and one or more virtualization layers corresponding to the deployment environment.

[0332] It should be understood that each metric level includes one or more virtualization layers corresponding to the deployment environment in the metric object.

[0333] It should be understood that the measurement object can also refer to other objects, and is not limited to the three types mentioned above. This application embodiment does not impose any restrictions on this.

[0334] Alternatively, in one possible implementation, the trigger request information may not include the metric level; that is, the trigger request information may only include the network element type. In this case, the EMS determines the metric level to be used when deploying the metric based on the pre-configuration.

[0335] S402, EMS sends the first request message to MANO-VNFM (MANO-VNF manager).

[0336] Accordingly, MANO-VNFM receives the first request information from EMS.

[0337] It should be understood that the MANO-VNFM in S402 above can be understood as the first network element in S330.

[0338] It should be noted that MANO-VNFM is a network element located in MANO that is responsible for managing virtual network functions, including but not limited to instantiating, monitoring, repairing, expanding, updating and backing up virtual network functions.

[0339] The first request information is used to request whether the security of the deployment environment of the measurement service network element meets the requirements.

[0340] Specifically, the first request information includes a measurement strategy.

[0341] The measurement strategy refers to the feedback of measurement results for the measurement objects corresponding to the measurement level. For example, the measurement results for the image files of business network elements, the measurement results for one or more virtualization layers corresponding to the deployment environment, and the measurement results for the attributes of one or more hardware devices corresponding to the deployment environment. This application does not limit this.

[0342] Alternatively, in one possible implementation, the first request information may also include NFVI deployment location requirements.

[0343] The NFVI deployment location requirement refers to the geographical location where the service network element is expected to be deployed. This geographical location can be a specific location or a range of locations. For example, the NFVI deployment location requirement may refer to requiring the hardware COTS to have a trusted execution environment; or the NFVI deployment location requirement may refer to the virtual instance using a container; or the NFVI deployment location requirement may refer to the traditional virtual machine method; or the NFVI deployment location requirement may refer to the virtual machine group identifier from which the VNF is composed (e.g., the virtual data center (vDC) number); or the NFVI deployment location requirement may refer to the hardware geographical location identifier (e.g., the availability zone (Az) number) where the Cloud OS is located. This application embodiment does not limit this.

[0344] S403, MANO-VNFM defines the measurement object.

[0345] Specifically, MANO-VNFM analyzes the measurement strategy in the first request information to determine the measurement object.

[0346] It should be understood that a metric object corresponds to one or more metric indicators, which represent the expected range that the metric object's measurement results should meet. It should also be understood that these metric indicators can be obtained from EMS or from MANO-VNFM based on local configuration; this application does not impose any restrictions.

[0347] It should be understood that the measurement method varies depending on the object being measured. The following section introduces the corresponding measurement methods for different objects being measured.

[0348] In one possible implementation, when the measurement object includes a mirror file of a service network element, the method may further include S404-S406.

[0349] S404, MANO-VNFM sends a second request message to IMG verifier.

[0350] Accordingly, the IMG verifier receives a second request from MANO-VNFM.

[0351] It should be understood that MANO-VNFM in S404 can be understood as the first network element in S330, and IMG verifier can be understood as the second network element in S330.

[0352] It should be understood that the IMG verifier is a network element used in the MANO system to verify image files. It should be noted that other network elements can also be used for image file verification; this application uses the IMG verifier as an example only and does not impose any limitations.

[0353] The second request information is used to request IMGverifier to verify the correctness of the image file of the service network element.

[0354] The second request information includes identification information for the image file of the service network element. This identification information is used to indicate the image file corresponding to the service network element, and may include the file name, the file hash value, the file directory, etc., which are not limited in this application.

[0355] It should be understood that verifying the correctness of the image file of a service network element can be understood as verifying whether the image file is complete or has been tampered with. For example, whether the hash value, file name, and modification time of the image file meet the metrics or baseline values.

[0356] S405, IMGverifier requests IMG attester to measure the image files of the service network elements.

[0357] It should be understood that after receiving the second request information, IMGverifier requests evidence from IMG attester. After receiving the corresponding evidence, it verifies one or more pieces of evidence according to the measurement indicators to obtain the first measurement result information.

[0358] The first measurement result information is used to indicate whether the image file of the service network element meets the measurement indicators.

[0359] S406, IMGverifier returns the first measurement result information corresponding to the image file of the service network element to MANO-VNFM.

[0360] To facilitate understanding, the measurement process, i.e., S404-S406, is illustrated with examples when the measurement object is the image file of a service network element.

[0361] For example, when the second request information sent by MANO-VNFM to IMG verifier includes the identifier information of the image file of the service network element as "udm123.img file", IMG verifier requests its corresponding IMGattester to find the corresponding udm123.img file in the storage device. The IMGattester measures the file and obtains evidence such as the file's generation date, hash value, and modification date, and replies this evidence to IMG verifier. IMG verifier verifies the evidence against the measurement indicators sent by MANO-VNFM or the locally configured measurement indicators, determines whether the above evidence meets the measurement indicators, determines the first measurement result information of the udm123.img file, such as "udm123.img remote verification result is qualified", and returns the first measurement result information to MANO-VNFM.

[0362] In one possible implementation, when the measurement object is one or more virtualization layers corresponding to the deployment environment, the method 400 may further include S407-S408.

[0363] S407, MANO-VNFM sends a third request message to MANO-VIM.

[0364] Accordingly, MANO-VIM receives a third request message from MANO-VNFM.

[0365] It should be understood that MANO-VNFM in S407 can be understood as the first network element in S330, and MANO-VIM can be understood as the second network element in S330.

[0366] The third request information is used to request MANO-VIM to verify the security of one or more virtualization layers in the specified NFVI portion of the deployment environment.

[0367] In one possible implementation, when the NFVI deployment location requirement is included in the first request information, MANO-VNFM requests MANO-VIM to remotely authenticate one or more virtualization layers within the specified NFVI region.

[0368] In one possible implementation, when the NFVI deployment location requirement is not included in the first request information, MANO-VNFM requests MANO-VIM to remotely verify one or more virtualization layers within the specified NFVI region according to the pre-configured NFVI region.

[0369] S408, MANO-VIM requests to measure one or more virtualization layers corresponding to the deployment environment.

[0370] Specifically, MANO-VIM parses the NFVI deployment location requirement in the received third request information and requests relevant evidence from the MANO-VIM-corresponding attester to obtain evidence related to one or more virtualization layers corresponding to the deployment environment. After receiving the relevant evidence, MANO-VIM verifies the evidence according to the metrics to obtain the first metric result information.

[0371] S409, MANO-VIM returns the first metric result information corresponding to one or more virtualization layers of the deployment environment to MANO-VNFM.

[0372] The first metric result information is used to indicate whether one or more virtualization layers corresponding to the deployment environment meet the metric.

[0373] To facilitate understanding, the following example illustrates the measurement process when the measurement object is one or more virtualization layers corresponding to the deployment environment, namely S407-S409.

[0374] For example, when the NFVI deployment location requirement indicates deployment on the COTS host with Az number 0010, after MANO-VNFM receives a request for remote authentication of the COTS host with Az number 0010, it sends a second request message to MANO-VIM to request verification of whether the COTS host with Az number 0010 has performed a trusted boot. After receiving the request, MANO-VIM uses the corresponding attester to obtain relevant evidence, such as the authentication documents after trusted boot, the time after trusted boot execution, and the hash value sequence generated during trusted boot. Then, MANO-VIM verifies the above evidence according to the metrics and obtains the first metric result information, such as "the remote authentication result of the COTS host with Az number 0010 is qualified" and returns the first metric result information to MANO-VNFM.

[0375] In one possible implementation, when the object of measurement is the security of one or more hardware devices corresponding to the deployment environment, the method 400 may further include S410-S414.

[0376] S410, MANO-VNFM sends the fourth request message to MANO-VIM.

[0377] The second request information is used to request MANO-VIM to remotely verify the security of one or more hardware components in the specified NFVI portion of the deployment environment.

[0378] The security of one or more hardware components can be understood as whether there is secure hardware (e.g., whether there is a secure platform chip, secure execution environment, etc.) or whether the one or more hardware components are deployed within a predetermined geographical area (e.g., whether the data center number, rack number, etc. are located within a predetermined geographical area). It should be understood that the embodiments of this application are not limited to the above two situations.

[0379] S411, MANO-VIM sends this fourth request message to Cloud OSverifier.

[0380] It should be understood that after receiving the fourth request information, MANO-VIM determines that it does not have the ability to measure the security of one or more hardware devices, and therefore forwards the fourth request information to the geolocation verification network element.

[0381] It should be understood that MANO-VIM sends the fourth request information to the geolocation verification network element, which can be located in Cloud OS, such as Cloud OS verifier. The following explanation uses Cloud OS verifier as an example.

[0382] In one possible implementation, when the NFVI deployment location requirement is included in the first request information, MANO-VIM requests the Cloud OS verifier to remotely verify the security of one or more hardware devices within the specified NFVI area.

[0383] In one possible implementation, when the NFVI deployment location requirement is not included in the first request information, MANO-VIM requests Cloud OS verifier to remotely verify the security of one or more hardware devices within the specified NFVI region, based on the pre-configured NFVI region.

[0384] S412, Cloud OS verifier requests Cloud OS attester to measure the security of one or more hardware devices within a specified NFVI zone.

[0385] Specifically, the Cloud OS verifier requests evidence of the security of one or more hardware components corresponding to the deployment environment from the Cloud OS attester. After receiving the evidence, the Cloud OS verifier verifies it based on metrics to obtain the first metric result information.

[0386] S413, Cloud OS verifier returns the first metric result information for the security of one or more hardware devices corresponding to the deployment environment to MANO-VIM.

[0387] The first measurement result information is used to indicate whether the security of one or more hardware devices corresponding to the deployment environment meets the measurement criteria.

[0388] S414, MANO-VIM returns to MANO-VNFM the first metric result information corresponding to the security of one or more hardware devices in the deployment environment.

[0389] To facilitate understanding, the measurement process, namely S410-S414, is illustrated with examples when the measurement object is the security of one or more hardware devices corresponding to the deployment environment.

[0390] For example, when the NFVI deployment location requirement indicates deployment in hardware tier 0010, after MANO-VNFM receives a request for remote authentication of hardware tier 0010, it sends a second request message to MANO-VIM. MANO-VIM forwards this second request message to the Cloud OS verifier, requesting the Cloud OS verifier to remotely authenticate the security of hardware tier 0010. The Cloud OS verifier requests the Cloud OS attester to measure, for example, whether the host with the number 0010 has secure hardware (trusted execution environment, trusted root), whether the host with the number 0010 is located in a specified geographical location (e.g., country, data center), and the BIOS firmware version of the host with the number 0010. The Cloud OS verifier obtains relevant evidence, such as proof documents after trusted boot, the time after trusted boot execution, and the hash value sequence generated during trusted boot, etc., and then the Cloud OS... After the verifier verifies the above evidence according to the measurement indicators, it obtains the first measurement result information, such as "the remote verification result of the host with number 0010 is qualified", and returns the first measurement result information to MANO-VNFM through MANO-VIM.

[0391] S415, MANO-VNFM returns the first measurement information to EMS.

[0392] The first measurement information includes one or more first measurement result information corresponding to one or more measurement objects. Specifically, MANO-VNFM summarizes one or more first measurement result information received from MANO-VIM, IMGverifier, etc., and returns one or more first measurement result information to EMS in the first measurement information. For example, the expedition verification result of the image file of the service network element is qualified, the expedition verification result of one or more virtualization layers corresponding to the deployment environment is unqualified, and the security of one or more hardware devices corresponding to the deployment environment is qualified, etc., this application does not limit this.

[0393] In one possible implementation, when the measurement object includes the security of one or more virtualization layers corresponding to the deployment environment and the security of one or more hardware devices corresponding to the deployment environment, after MANO-VIM returns the first measurement result information of the security of one or more hardware devices corresponding to the deployment environment to MANO-VNFM, MANO-VNFM returns the first measurement result information of the one or more virtualization layers corresponding to the deployment environment and the first measurement result information of the security of one or more hardware devices corresponding to the deployment environment to EMS together. In other words, when the measurement object includes the security of one or more virtualization layers corresponding to the deployment environment and the security of one or more hardware devices corresponding to the deployment environment, when obtaining the first measurement result information of the security of one or more hardware devices corresponding to the deployment environment, MANO-VNFM will wait until it obtains the first measurement result information of the one or more virtualization layers corresponding to the deployment environment before returning both first measurement result information to EMS together.

[0394] S416, EMS, based on the first measurement information received in S415, comprehensively determines whether the deployment environment of the specified NFVI area meets the conditions for deploying / migrating service network elements.

[0395] For example, when the metric level in S401 is 1, if the first metric result information corresponding to the security of the image file of the service network element, one or more virtualization layers corresponding to the deployment environment, and one or more hardware corresponding to the deployment environment are all qualified, then EMS determines that the deployment environment of the specified NFVI area has the conditions for deploying / migrating VNFs.

[0396] For example, when the metric level in S401 is 1, if any of the first metric results for the security of the image file of the service network element, one or more virtualization layers corresponding to the deployment environment, or one or more hardware corresponding to the deployment environment is unqualified, then EMS determines that the deployment environment of the specified NFVI area does not meet the conditions for deploying / migrating VNFs.

[0397] In one possible implementation, if the EMS determines that the deployment environment of the specified NFVI area meets the conditions for deploying / migrating VNFs, the method may further include: S417, the EMS determines a deployment location in the specified NFVI area and instructs MANO-VNFM and MANO-VIM to deploy service network elements at that deployment location. It should be noted that the deployment of service network elements can refer to the specific procedures of existing technologies, which will not be elaborated upon here.

[0398] S418, MANO-VNFM deploys service network elements and remotely verifies whether the service network elements have been successfully deployed.

[0399] For example, MANO-VNFM instructs MANO-VIM to initialize a service network element at a verified location numbered 0010 using the UDM123.img file. The software in MANO-VNFM initializes the service network element through the UDM123.img file, and the software causes the service network element to perform trusted startup, generating a series of hash values, which are stored in MANO-VNFM. MANO-VIM reports the geographic location number of the service network element after startup and provides remote verification results to MANO-VNFM.

[0400] In one possible implementation, after the service network element is successfully deployed, the method 400 further includes: S419, MANO-VNFM returns deployment result information to EMS.

[0401] The deployment result information is used to indicate that the service network element has been successfully deployed.

[0402] Specifically, the deployment result information includes proof information of the deployment of business network elements.

[0403] The proof information for the deployment of the service network element may include: the signature of the VNFM, the hash value generated by the successful deployment of the service network element, the number of the successfully deployed virtual instance, the deployment vDC number, the Az number of the hardware corresponding to the service network element, etc. This application embodiment does not limit this.

[0404] S420, EMS verifies the proof information of the service network element deployment in S419, and determines whether MANO-VNFM can reliably execute the deployment of the service network element.

[0405] For example, EMS determines whether MANO-VNFM can reliably execute the deployment of service network elements by verifying the signature of VNFM and the hash value generated by the successful deployment of service network elements. This application does not limit this.

[0406] S421, EMS returns deployment result response information to the business triggering party.

[0407] In one possible implementation, if either step S416 or S419 determines that the corresponding conditions are not met, the EMS will reply to the service triggering party with a deployment result response message indicating that the service network element cannot be deployed securely.

[0408] In one possible implementation, if both steps S416 and S419 determine that the corresponding conditions are met, the EMS will reply to the service triggering party with a deployment result response message indicating that the service network element has been successfully deployed on demand.

[0409] Based on the above scheme, the method provided in this embodiment can determine whether the deployment environment is secure by measuring a specific part of the NFVI when deploying a new network element, thereby determining whether deployment can be carried out at the deployment location. This achieves accurate measurement triggered by the scenario, saves measurement overhead, and increases practicality.

[0410] When the measurement scenario involves determining whether the geographical location of one or more storage devices of a measurement service network element meets the requirements, the following methods can be used: Figure 5 The method shown is used for measurement, and the following is combined with... Figure 5 A detailed introduction will be provided.

[0411] Figure 5 This is a schematic diagram of a communication method 500 provided in an embodiment of this application. Figure 5 For reference Figure 3 As described above, the method 500 may include the following steps.

[0412] S501, EMS receives the first request information.

[0413] It should be understood that when it is necessary to verify whether the geographical location of the storage meets the usage requirements, a first request message is sent to the EMS to trigger the EMS to measure the geographical location of one or more virtual storage instances of the service network element.

[0414] Specifically, the geographical location of one or more virtual storage instances of a business network element can be an actual location such as a country or city, for example, the geographical location of the country, city, or specific region where the virtual storage instance is located. It can also be a number of hardware, facilities, racks, etc., such as the data center number (e.g., Az number, datacenter (DC) number), virtual data center number (e.g., vDC), virtual private cloud number (e.g., virtual private cloud (vPC) number), virtual network function number (e.g., VNF number), etc., which are not limited in this application.

[0415] One possible implementation involves a network device, such as a service network element, OSS / BSS, or NFVI management network element, sending a first request message to the EMS to trigger a measurement of the geographical location of one or more storage devices of the service network element.

[0416] One possible implementation is that when the service triggering party is deployed in conjunction with EMS, the program module inside EMS periodically sends a first request message to EMS to trigger the measurement of the geographical location of one or more virtual storage instances of the service network element.

[0417] One possible implementation involves the OSS / BSS sending a first request message to the EMS to trigger the EMS to measure the geographical location of one or more virtual storage instances of the service network element.

[0418] The first request information includes: the identifiers of one or more virtual instances responsible for storing information corresponding to the service network element.

[0419] The virtual instance responsible for storing information is used to store data information during the communication process, information of user equipment during the communication process, etc., and this application does not restrict it.

[0420] S502, EMS obtains the first configuration information.

[0421] The first configuration information is used to indicate the correspondence between multiple identifiers and multiple virtual instance groups.

[0422] It should be understood that multiple VIs are divided into multiple virtual instance groups according to different functions. The storage content corresponding to any two virtual instance groups is different. The storage content includes, but is not limited to, user information, communication records, business data, etc.

[0423] For example, in an NFV system, there are multiple VNFs, each of which consists of multiple VIs. These VIs are assigned to different VNFCs based on their functions. That is, each VNF includes multiple VNFCs with different functions, such as a VNFC responsible for storing information, a VNFC responsible for computation, etc. Each VNFC includes multiple VIs, and these multiple VNFCs are managed by a single VNFP.

[0424] It should be noted that, for ease of description, the business network element functional components will be replaced by VNFC and the virtual instance will be replaced by VI in the following text.

[0425] For example, the first configuration information can be in the form of Table 2:

[0426] Table 2 First Configuration Information List

[0427]

[0428] As shown in Table 2 above, the first configuration list includes multiple VNFC numbers, VI numbers, and the geographical location of each VI. For example, VNFC-1 includes three VIs, VI-1 to VI-3, and the geographical locations of the three VIs are Az-0001, Az-0002, and Az-0001, respectively. It should be noted that Table 2 above is only an example, and this application does not impose any limitations on it.

[0429] Specifically, EMS obtains the first configuration information in the following two ways.

[0430] One possible implementation is that the EMS obtains the first configuration information, namely S503-S504, by querying the VNFP:

[0431] S503, EMS sends a third request message to VNFP to obtain the VNFC configuration list.

[0432] Specifically, when the VNFP can accept the EMS's query request, the EMS sends a third request message to the VNFP. This third request message is used to request the VNFC configuration list, and the EMS receives the VNFC configuration list from the VNFP.

[0433] The VNFC configuration list includes the identifiers of multiple VNFCs.

[0434] Optionally, the VNFC configuration list may also include the type of VNF, etc., which is not limited in this application.

[0435] S504, EMS requests the VNF verifier to remotely verify the VNFC configuration list and obtain the first configuration information.

[0436] Specifically, the EMS requests the VNF verifier to remotely verify the identifier of the VNFC responsible for storing information. The VNF verifier initiates a measurement to the VNF attester, and the measurement content includes, but is not limited to, the identifier of the VI contained in the VNFC, the geographical location of each VI (e.g., vDC number), etc. The VNF verifier obtains the identifier of one or more VIs corresponding to the VNFC responsible for storing information, i.e., the first configuration information, and returns it to the EMS.

[0437] One possible implementation is that the EMS obtains the first configuration information, namely S505-S507, by requesting metrics from the VNF verifier:

[0438] S505, EMS requests the VNF verifier to remotely verify the VNFP in order to obtain the VNFC configuration list.

[0439] It should be understood that VNFP may not have the ability to respond to information. If EMS cannot obtain the VNFC configuration list by requesting VNFP, then EMS needs to request VNF ​​verifier to obtain the VNFC configuration list by measuring VNFP.

[0440] Specifically, the VNF verifier initiates a measurement of the VNFP to the VNF attester, such as measuring the VNF's identity, the VNFP's configuration address, and the identifier of the VNFC responsible for storing information, to obtain a VNFC configuration list including the identifier of the VNFC responsible for storing information.

[0441] S506, EMS requests the VNF verifier to remotely verify the VNFC configuration list and obtain the first configuration information.

[0442] It should be noted that the process of S506 is similar to that of S504. To avoid redundancy, its detailed description is omitted here.

[0443] Furthermore, after obtaining the first configuration information, the EMS determines the expected geographical location number corresponding to the VI based on the identifier of one or more VIs responsible for storing information corresponding to the service network element requesting measurement in S501.

[0444] S507, EMS determines the expected geographic location number corresponding to the VI responsible for storing information.

[0445] It should be understood that EMS can determine the expected geographical location number of the VI responsible for storing information by means of pre-configured country and Az number correspondence or by querying external databases.

[0446] It should be understood that the expected geographical location can be a specific location or a range of locations, and this application does not limit it.

[0447] For example, the expected geographical location of VI with Az number 0001 is China-Beijing, and the expected geographical location of VI with Az number 0002 is China-Shanghai, etc., but this application does not limit it.

[0448] One possible implementation is that the EMS can be configured with a corresponding list for different geographic location levels. When the EMS receives geographic locations at different levels, it can determine other locations at different levels corresponding to that geographic location based on the corresponding list.

[0449] For example, the corresponding list for different geographic location levels can be in the form of Table 3:

[0450] Table 3. Corresponding list for different geographical location levels

[0451] Az-0001 China Jiangsu Az-0002 USA Georgia … … …

[0452] S508, EMS sends a second request message to Cloud OS verifier.

[0453] It should be understood that EMS sends the second request information to the geolocation verification network element, which can be either MANO-VIM or Cloud OS verifier. This application does not impose any restrictions, and the following explanation uses Cloud OS verifier as an example.

[0454] The second request information is used to request Cloud OS verifier to verify whether the identifier of one or more VIs responsible for storing information corresponding to the service network element is located within the expected geographical location.

[0455] The second request information includes the identifiers of one or more VIs responsible for storing information corresponding to the service network element and the expected geographical locations corresponding to the one or more VIs.

[0456] S509, Cloud OS verifier requests Cloud OS attester to perform measurements and obtain relevant evidence, namely the actual geographical location of one or more VIs responsible for storing information corresponding to the service network element.

[0457] It should be noted that the measurement process between Cloud OS verifier and Cloud OS attester can refer to existing technologies, and will not be elaborated here.

[0458] S510, Cloud OS verifier verifies the relevant evidence and obtains the first measurement result information.

[0459] It should be understood that after receiving relevant evidence from the Cloud OS attester, the Cloud OS verifier verifies the relevant evidence based on the metric, i.e., the expected geographical location corresponding to VI, and obtains the first metric result information.

[0460] The first measurement result information is used to indicate whether one or more VIs responsible for storing information corresponding to the service network element meet the measurement indicators.

[0461] For example, the first measurement result information may be "the geographical location of VI-1 matches the expected geographical location", or it may be "the geographical location of VI-2 does not match the expected geographical location", etc., which are not limited in this application.

[0462] S511, Cloud OS verifier sends the first measurement information to EMS.

[0463] The first measurement information includes one or more first measurement result information.

[0464] S512, EMS determines whether the first measurement result meets the requirements based on the first measurement information.

[0465] One possible implementation is that when the EMS verifies all VIs according to the expected geographical location corresponding to the VI, if the geographical location of one VI does not meet the expected geographical location, it is determined that one or more VIs responsible for storing information corresponding to that service network element do not meet the requirements.

[0466] One possible implementation is that when the EMS verifies all VIs according to the expected geographical location corresponding to the VI, if the geographical location of 90% of the VIs matches the expected geographical location, then it is determined that one or more VIs responsible for storing information corresponding to the service network element meet the requirements.

[0467] Furthermore, when EMS determines that the geographic location of VI does not match the expected geographic location, the method 500 may further include:

[0468] S513, EMS requests VNFM to re-instantiate VIs that do not conform to the expected geographical location.

[0469] It should be noted that the process of EMS requesting VNFM to re-instantiate the VI can be understood as deleting the VI and reinstalling the VI in the corresponding VNFC, that is, the process of redeploying the VI. For details, please refer to S402-S420, which will not be repeated here.

[0470] Optionally, when the EMS determines that one or more VIs responsible for storing information corresponding to a service network element do not meet the requirements, the method 500 may further include:

[0471] S514, EMS sends error alerts to the relevant dependent parties.

[0472] The dependent party is able to take subsequent actions based on the remote proof results. It should be understood that the specific form of the dependent party is not limited. For example, the dependent party can be a general network element (e.g., NRF), a function located in the network management office, or a function located in MANO, etc. This application does not impose any restrictions.

[0473] For example, when the EMS determines that one or more VIs responsible for storing information corresponding to a service network element do not meet the requirements, the EMS sends an error alarm to the OSS / BSS.

[0474] Based on the above scheme, the method provided in this embodiment can accurately measure the geographical location of a specific component, VNFC, within an already running VNF. Furthermore, when the geographical location of a VNFC does not conform to the expected range, the specific VNFC can be redeployed, increasing its practicality.

[0475] When the measurement scenario involves determining whether one or more software components of a service network element meet the requirements, the following methods can be used: Figure 6 The method shown is used for measurement, and the following is combined with... Figure 6 A detailed introduction will be provided.

[0476] Figure 6 This is a schematic diagram of a communication method 600 provided in an embodiment of this application. Figure 6 For reference Figure 3 As described above, the method 600 may include the following steps.

[0477] S601, EMS receives the first request information.

[0478] It should be understood that when it is necessary to verify whether the software meets the requirements, a first request message is sent to the EMS to trigger the EMS to measure one or more software of the service network element and verify whether the software meets the requirements of the measurement scenario.

[0479] For example, whether software meets the requirements of the measurement scenario can be understood as whether the software version is within a reasonable range, whether the software has been patched with a specified version of vulnerability patches, whether the number of abnormal operations managed by the software is within a reasonable range, or whether security software is installed for measurement, etc., which are not limited in this application. Among them, one or more software components of the business network element include software in the virtual instance and software of the virtualization layer deployed on the virtual instance.

[0480] The software in the virtual instance can be understood as an operating system installed in the VI, such as Guest OS, etc., and this application does not limit this. The following uses Guest OS as an example.

[0481] The software in the virtualization layer deployed in the virtual instance can be understood as modules installed in the virtualization layer, such as the hypervisor and the VMM. This application does not limit this. The following uses the hypervisor as an example.

[0482] Specifically, the first request information includes at least one of the following: the measurement object, the measurement metric, and the measurement level.

[0483] The measurement objects include, but are not limited to, Guest OS and hypervisor.

[0484] S602, EMS obtains the second configuration information.

[0485] The second configuration information is used to indicate the correspondence between multiple identifiers and multiple software programs. The second configuration information includes the identifier of the VNFC and the identifier of the VI corresponding to the VNFC. This identifier can be an identity identifier or a number; this application does not impose any restrictions.

[0486] For example, the second configuration information can be in the form of Table 4:

[0487] Table 4 Second Configuration Information List

[0488]

[0489] As shown in Table 4 above, the second configuration list includes multiple VNFC numbers, VI numbers, and the identifier of the hypervisor deployed for each VI. For example, VNFC-1 includes three VIs, VI-1 to VI-3, and the geographical locations of the hypervisor identifiers deployed for the three VIs are hypervisor-1, hypervisor-2, and hypervisor-2, respectively. It should be noted that Table 4 above is only an example, and this application does not impose any limitations on it.

[0490] It should be noted that the process described in S602 is similar to that in S502-S507. The EMS obtains the VNFC configuration list by requesting a query from the VNFP or by requesting a metric from the VNF verifier. It then requests the VNF verifier to remotely verify the VNFC configuration list to obtain the second configuration information. To avoid redundancy, a detailed explanation is omitted here.

[0491] Optionally, when the metric is a Guest OS, the method 600 may also include the following S603-S605.

[0492] S603, EMS sends a second request message to the Guest OS verifier.

[0493] Accordingly, the Guest OS verifier receives a second request from the EMS.

[0494] It should be understood that the EMS in S603 can be understood as the first network element in S330, and the Guest OS verifier can be understood as the second network element in S330.

[0495] The second request information is used to request remote verification of the trusted boot of the Guest OS.

[0496] The second request information includes the identifier of the VI, which requests verification of whether the GUEST OS performs trusted boot.

[0497] Optionally, the second request information may also include a trusted baseline value of the Guest OS. Specifically, the trusted baseline value of the Guest OS may include any one or more of the following: the baseline value of the system version, the baseline value of the security version of the main application, the digital signature baseline value of the critical process executable file (e.g., a binary executable file), etc. This application does not limit this.

[0498] S604, Guest OS verifier requests Guest OS attester to measure the trusted boot of Guest OS.

[0499] It should be understood that the Guest OS verifier requests the Guest OS attester to obtain relevant evidence based on the description of whether the Guest OS performs trusted boot.

[0500] S605, the Guest OS verifier verifies the GUEST OS containing VI based on the credible baseline value of the Guest OS and relevant evidence, and obtains the first measurement result information.

[0501] The first metric result information includes the identifier of the VI and the trusted boot result of the Guest OS where the VI is located.

[0502] Optionally, when the metric object is a hypervisor, the method 600 may also include the following S606-S608.

[0503] S606, EMS sends a third request message to Cloud OS verifier.

[0504] Accordingly, Cloud OS verifier receives third-party request information from EMS.

[0505] It should be understood that the EMS in S606 can be understood as the first network element in S330, and the Cloud OS verifier can be understood as the second network element in S330.

[0506] The third request information is used to request remote verification of the hypervisor's trusted startup.

[0507] The third request information includes the hypervisor's identifier and a description requesting verification of whether the hypervisor performs trusted boot.

[0508] Optionally, the second request information may also include a trusted baseline value of the hypervisor. Specifically, the trusted baseline value of the hypervisor may include any one or more of the following: virtual machine management software version, number of abnormal management operations, etc., which are not limited in this application.

[0509] S607, Cloud OS verifier requests Cloud OS attester to measure the trusted boot of the hypervisor.

[0510] It should be understood that the CloudOS verifier requests the CloudOS attester to obtain evidence of trusted boot (e.g., a sequence of hash values, etc.) based on a description of whether the hypervisor has performed trusted boot.

[0511] S608, Cloud OS verifier verifies the GUEST OS where the VI resides based on the hypervisor's trusted baseline values ​​and relevant evidence, and obtains the first metric result information.

[0512] The first metric result information includes the hypervisor's identifier and the hypervisor's trusted startup result.

[0513] For example, the first metric result could be "VI-1's virtual machine management software version is v2.1", which is not limited in this application.

[0514] Furthermore, after obtaining the first measurement result information, it is returned to EMS. This method 600 also includes:

[0515] S609, EMS receives the first measurement information.

[0516] The first measurement information includes one or more first measurement result information.

[0517] It should be understood that after obtaining the first measurement result information, the Guest OS verifier and / or Cloud OS verifier send one or more first measurement result information to the EMS.

[0518] For example, the first measurement result information may include "VI-1's virtual machine management software version is v2.1" or "VI-1's Guest OS version is v1.0", etc., which are not limited in this application.

[0519] S610, EMS determines whether one or more software programs of the service network element meet the requirements based on the first measurement information.

[0520] It should be understood that this application does not restrict the method for determining whether one or more software components of a service network element meet the requirements.

[0521] For example, the requirement for one or more software programs of a service network element is determined by verifying whether the software version is within a reasonable software version range. Specifically, when EMS verifies the versions of one or more software programs of a service network element according to a reasonable software version range, if the versions of three software programs are not within a reasonable software version range, it is determined that none of the one or more software programs corresponding to that service network element meet the requirements.

[0522] Furthermore, when the EMS determines that one or more software programs corresponding to a service network element do not meet the requirements, the method 600 may further include:

[0523] Optionally, S611, EMS notifies VNFM to update relevant image files.

[0524] It should be understood that when EMS determines that the software of the virtual instance, such as the Guest OS software, does not meet the requirements, it will notify VNFM to update the image file of the VI corresponding to the Guest OS.

[0525] Optionally, in S612, EMS requests VNFM to re-instantiate the service network element.

[0526] It should be understood that when EMS determines that the software of the virtualization layer deployed in the virtual instance, such as the version of the hypervisor, does not meet the requirements, it requests VNFM to destroy the service network element or the VNFC corresponding to the hypervisor, and re-instantiate the service network element or the corresponding VNFC in the appropriate virtualization layer according to the requirements.

[0527] Based on the above scheme, the method provided in this embodiment can specifically measure the information of a specified software, saving measurement overhead and enabling a more efficient measurement and remote verification process.

[0528] It is understood that in the embodiments of this application... Figures 3 to 6 The examples provided are merely to facilitate understanding of the embodiments of this application by those skilled in the art, and are not intended to limit the embodiments of this application to the specific scenarios illustrated. Figures 3 to 6 The examples are obviously subject to various equivalent modifications or changes, and such modifications or changes also fall within the scope of the embodiments of this application.

[0529] It is also understood that some optional features in the various embodiments of this application may not depend on other features in some scenarios, or may be combined with other features in some scenarios, without limitation.

[0530] It is also understood that the solutions in the various embodiments of this application can be used in reasonable combinations, and the explanations or descriptions of the various terms appearing in the embodiments can be referenced or explained to each other in the various embodiments, without limitation.

[0531] It should also be understood that the various numerical sequences in the embodiments of this application do not imply the order of execution, but are merely a distinction for the convenience of description, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0532] It is also understood that some message names are involved in the various embodiments of this application, such as business discovery function entity selection information or policy information, etc. It should be understood that their naming does not limit the protection scope of the embodiments of this application.

[0533] It is also understood that, in the above method embodiments, the methods and operations implemented by the terminal device can also be implemented by components of the terminal device (e.g., chips or circuits); furthermore, the methods and operations implemented by the network device can also be implemented by components of the network device (e.g., chips or circuits), without limitation. Corresponding to the methods given in the above method embodiments, this application also provides corresponding apparatuses, which include modules for executing the corresponding methods in the above method embodiments. These modules can be software, hardware, or a combination of software and hardware. It is understood that the technical features described in the above method embodiments are also applicable to the following apparatus embodiments.

[0534] It should be understood that the first network element and the second network element can perform some or all of the steps in the above embodiments. These steps or operations are merely examples, and the embodiments of this application can also perform other operations or variations of various operations. Furthermore, the steps can be performed in different orders as presented in the above embodiments, and it is not necessary to perform all the operations in the above embodiments.

[0535] The above combination Figures 3-6 The communication method provided in the embodiments of this application is described in detail below. Figures 7-9 This application provides a detailed description of the communication device provided in its embodiments. It should be understood that the descriptions of the device embodiments correspond to the descriptions of the method embodiments; therefore, any content not described in detail can be found in the above method embodiments. For brevity, some content is omitted hereafter.

[0536] Figure 7 This is a schematic block diagram of a communication device provided in an embodiment of this application. The device 700 includes a transceiver unit 710, which can be used to implement corresponding communication functions. The transceiver unit 710 can also be referred to as a communication interface or a communication unit.

[0537] Optionally, the device 700 may further include a processing unit 720, which can be used for data processing.

[0538] Optionally, the device 700 further includes a storage unit, which can be used to store instructions and / or data. The processing unit 720 can read the instructions and / or data in the storage unit so that the device can implement the actions of different terminal devices in the foregoing method embodiments, such as the actions of the first network element or the second network element.

[0539] The device 700 can be used to perform the actions performed by the first network element or the second network element in the above method embodiments. In this case, the device 700 can be the first network element or the second network element, or a component of the first network element or the second network element. The transceiver unit 710 is used to perform the transceiver-related operations of the first network element or the second network element in the above method embodiments, and the processing unit 720 is used to perform the processing-related operations of the first network element or the second network element in the above method embodiments.

[0540] It should also be understood that the device 700 here is embodied in the form of a functional unit. The term "unit" here can refer to an application-specific integrated circuit (ASIC), electronic circuitry, a processor (e.g., a shared processor, a proprietary processor, or a group processor, etc.) and memory for executing one or more software or firmware programs, combined logic circuitry, and / or other suitable components supporting the described functions. In an alternative example, those skilled in the art will understand that the device 700 may specifically be the first network element or the second network element in the above embodiments, and may be used to execute the various processes and / or steps corresponding to the first network element or the second network element in the above method embodiments; or, the device 700 may specifically be the first network element or the second network element in the above embodiments, and may be used to execute the various processes and / or steps corresponding to the first network element or the second network element in the above method embodiments. To avoid repetition, further details are omitted here.

[0541] The apparatus 700 of each of the above-described schemes has the function of implementing the corresponding steps performed by the first network element or the second network element in the above-described method; or, the apparatus 700 of each of the above-described schemes has the function of implementing the corresponding steps performed by the first network element or the second network element in the above-described method. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver unit can be replaced by a transceiver (e.g., the transmitting unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as processing units, can be replaced by processors, respectively executing the transceiver operations and related processing operations in each method embodiment.

[0542] In addition, the transceiver unit 710 described above can also be a transceiver circuit (for example, it may include a receiving circuit and a transmitting circuit), and the processing unit can be a processing circuit.

[0543] It should be pointed out that, Figure 7 The device mentioned can be the network element or equipment in the foregoing embodiments, or it can be a chip or chip system, such as a system on chip (SoC). The transceiver unit can be an input / output circuit or a communication interface; the processing unit is a processor, microprocessor, or integrated circuit integrated on the chip. No limitations are imposed here.

[0544] like Figure 8 As shown, this application provides another communication device 800. The device 800 includes a processor 810 coupled to a memory 820. The memory 820 is used to store computer programs or instructions and / or data. The processor 810 is used to execute the computer programs or instructions stored in the memory 820, or to read the data stored in the memory 820, to perform the methods in the above method embodiments.

[0545] Optionally, there may be one or more processors 810.

[0546] Optionally, the memory 820 may be one or more.

[0547] Alternatively, the memory 820 can be integrated with the processor 810, or it can be set separately.

[0548] Optionally, such as Figure 8 As shown, the device 800 also includes a transceiver 830 for receiving and / or transmitting signals. For example, a processor 810 is used to control the transceiver 830 to receive and / or transmit signals.

[0549] As one approach, the device 800 is used to implement the operations performed by the first network element or the second network element in the various method embodiments described above.

[0550] For example, processor 810 is used to execute computer programs or instructions stored in memory 820 to implement the relevant operations of the first SMF in the various method embodiments described above. For example, Figures 3 to 6 The first network element in any of the embodiments shown, or Figures 3 to 6 The method of the first network element in any of the embodiments shown.

[0551] It should be understood that the processor mentioned in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0552] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0553] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0554] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0555] like Figure 9 This application provides a chip system 900. The chip system 900 (or processing system) includes logic circuitry 910 and an input / output interface 920.

[0556] The logic circuit 910 can be a processing circuit in the chip system 900. The logic circuit 910 can be coupled to a memory unit, calling instructions from the memory unit, enabling the chip system 900 to implement the methods and functions of the embodiments of this application. The input / output interface 920 can be an input / output circuit in the chip system 900, outputting information processed by the chip system 700, or inputting data or signaling information to be processed into the chip system 19000 for processing.

[0557] As one approach, the chip system 1000 is used to implement the operations performed by the first network element or the second network element in the various method embodiments described above.

[0558] For example, logic circuit 910 is used to implement operations related to the processing of the first network element in the above method embodiment, such as... Figures 3 to 6 The processing-related operations of the first network element in any of the illustrated embodiments; the input / output interface 920 is used to implement the sending and / or receiving-related operations of the first network element in the above method embodiments, such as... Figures 3 to 6 The first network element in any of the illustrated embodiments performs transmission and / or reception-related operations.

[0559] This application also provides a computer-readable storage medium storing computer instructions for implementing the methods executed by the first network element or the second network element in the above-described method embodiments.

[0560] For example, when the computer program is executed by the computer, it enables the computer to implement the methods executed by the first network element or the second network element in the various embodiments of the above methods.

[0561] This application also provides a computer program product comprising instructions that, when executed by a computer, implement the methods performed by the first network element or the second network element in the above-described method embodiments.

[0562] The explanations and beneficial effects of the relevant contents in any of the devices provided above can be found in the corresponding method embodiments provided above, and will not be repeated here.

[0563] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of apparatus or units may be electrical, mechanical, or other forms.

[0564] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs). For example, the aforementioned available media include, but are not limited to, USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, and other media capable of storing program code.

[0565] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A business management method, characterized in that, The method is executed by the first network element and includes: Receive first request information, the first request information is used to request a metric for a first metric scenario, the first metric scenario includes multiple metric objects; Based on the mapping relationship, at least one second network element is determined. The mapping relationship is used to indicate the correspondence between the plurality of measurement objects and the plurality of network elements. The at least one second network element corresponds to at least one first measurement object, and the first measurement object belongs to the plurality of measurement objects included in the first measurement scenario. A second request message is sent to the at least one second network element, the second request message being used to request measurement of the at least one first measurement object. The first metric scenario includes at least one of the following metric scenarios: The first scenario is used to measure whether the security of the deployment or migration environment of the business network element meets the requirements; The second scenario is used to measure whether the geographical location of one or more virtual storage instances of a business network element meets the requirements; The third scenario involves measuring whether one or more software components of a service network element meet the requirements. When the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: The image file of the service network element, one or more virtualization layers corresponding to the deployment environment or the migration environment, and the attributes of one or more hardware devices corresponding to the deployment environment or the migration environment.

2. The method according to claim 1, characterized in that, The method further includes: Receive first measurement information, the first measurement information including at least one first measurement result information sent by the at least one second network element, the first measurement result information being used to indicate a first measurement result for the first measurement object; Based on the first measurement information, send first feedback information in response to the first request information.

3. The method according to claim 2, characterized in that, The method further includes: Send a third request message to at least one measurement network element corresponding to the first network element. The third request message is used to request measurement of at least one second measurement object among the multiple measurement objects included in the first measurement scenario. The second measurement object belongs to the measurement objects that the measurement network element corresponding to the first network element can measure. Receive second measurement information, the second measurement information including at least one second measurement result information sent by at least one measurement network element corresponding to the first network element, the second measurement information being used to indicate the second measurement result for the second measurement object; and The step of sending first feedback information in response to the first request information based on the first measurement information includes: Based on the first measurement information and the second measurement information, send first feedback information in response to the first request information.

4. The method according to claim 2, characterized in that, The mapping relationship is specifically used to indicate the correspondence between multiple indices and multiple parameter groups. Each index corresponds to at least one metric scenario. Each parameter group includes at least one of the following parameters: metric object, metric, and metric level. In addition, the first request information includes the index corresponding to the first measurement scenario.

5. The method according to claim 1 or 2, characterized in that, When the measurement object of the first measurement scenario includes the image file of the service network element, the first network element includes a service network element management network element, which is used to manage the service network element; the second network element includes an image verification network element, which is used to verify the correctness of the image file of the service network element; wherein, the second request information includes the identification information of the image file of the service network element; or, When the measurement object of the first measurement scenario includes one or more virtualization layers corresponding to the deployment environment or the migration environment, the first network element includes the service network element management network element, and the second network element includes the virtualization infrastructure management network element. The virtualization infrastructure management network element is used to verify the security of one or more virtualization layers corresponding to the deployment environment or the migration environment; or... When the measurement object of the first measurement scenario includes the attributes of one or more hardware devices corresponding to the deployment environment or the migration environment, the first network element includes a virtualization infrastructure management network element, which is used to manage virtualization infrastructure, and the second network element includes a geolocation verification network element, which is used to verify the attributes of one or more hardware devices corresponding to the deployment environment or the migration environment.

6. The method according to claim 1 or 2, characterized in that, When the service network element is successfully deployed or migrated, the method further includes: Receive deployment result information from the business network element management network element. The deployment result information is used to indicate that the business network element has been successfully deployed or migrated. The deployment result information includes proof information of the deployment or migration of the business network element. Based on the proof information, verify whether the service network element has been successfully deployed or migrated.

7. The method according to claim 1 or 2, characterized in that, When the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the service network element. The first network element includes a service network element verification network element, which is used to verify the geographical location of one or more virtual instances responsible for storing information. The second network element includes a geographical location verification network element, which is used to verify the geographical location of the virtual instances responsible for storing information.

8. The method according to claim 7, characterized in that, The method further includes: Obtain first configuration information, which indicates the correspondence between multiple identifiers and multiple virtual instance groups, wherein the storage content corresponding to any two virtual instance groups is different, and the storage content includes at least one of the following: user information, communication records, and business data; and The first request information also includes a first identifier. The second request information also includes the identifier of the virtual instance in the first virtual instance group, where the first virtual instance group is the virtual instance group corresponding to the first identifier in the first configuration information.

9. The method according to claim 1 or 2, characterized in that, When the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: Software in a virtual instance, and software in the virtualization layer deployed on a virtual instance.

10. The method according to claim 9, characterized in that, When the measurement object of the first measurement scenario includes the software in the virtual instance, the first network element includes a service network element verification network element, which is used to verify whether one or more software programs of the service network element meet the requirements; the second network element includes a customer system verification network element, which is used to verify whether the software in the virtual instance meets the requirements; or... When the measurement object of the first measurement scenario includes the software of the virtualization layer deployed by the virtual instance, the first network element includes the service network element verification network element, and the second network element includes the cloud operating system verification network element. The cloud operating system verification network element is used to verify whether the software of the virtualization layer deployed by the virtual instance meets the requirements.

11. The method according to claim 10, characterized in that, The method further includes: Obtain second configuration information, which indicates the correspondence between multiple identifiers and multiple software programs, wherein the multiple software programs include at least one of the following: software in the virtual instance, software of the virtualization layer deployed on the virtual instance; and The first request information also includes a second identifier. The second request information also includes the identifier of the first software, which is the first software corresponding to the second identifier in the second configuration information.

12. The method according to claim 4, characterized in that, When the first feedback information is used to indicate that the first metric information does not conform to the metric indicator, the method further includes: Send a first instruction message to the service network element management network element. The first instruction message is used to instruct one or more metric objects to be reconfigured.

13. A business management method, characterized in that, The method is executed by the second network element and includes: Receive a second request message, the second request message being used to request to perform measurement on at least one first measurement object, the first measurement object belonging to multiple measurement objects included in the first measurement scenario in multiple measurement scenarios; The at least one first measurement object is measured to determine the first measurement result information; The multiple measurement scenarios include at least one of the following: The first scenario is used to measure whether the security of the deployment or migration environment of the business network element meets the requirements; The second scenario is used to measure whether the geographical location of one or more virtual storage instances of a business network element meets the requirements; The third scenario is used to measure whether one or more software components of a service network element meet the requirements; When the first measurement scenario includes the first scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: The image file of the service network element, one or more virtualization layers corresponding to the deployment environment or the migration environment, and the attributes of one or more hardware devices corresponding to the deployment environment or the migration environment.

14. The method according to claim 13, characterized in that, The step of measuring the at least one first measurement object and determining the first measurement result information includes: Send a fourth request message to at least one measurement network element corresponding to the second network element, the fourth request message being used to request measurement for the at least one first measurement object; Receive third measurement information, the third measurement information including at least one third measurement result information sent by at least one measurement network element corresponding to the second network element, the third measurement information being used to indicate the second measurement result for the first measurement object; The first measurement result information is determined based on the third measurement information.

15. The method according to claim 13 or 14, characterized in that, Send first measurement result information, which is used to indicate the first measurement result for the at least one first measurement object.

16. The method according to claim 13 or 14, characterized in that, When the first measurement scenario includes the second scenario, the measurement object corresponding to the first measurement scenario includes the geographical location of one or more virtual instances responsible for storing information corresponding to the service network element.

17. The method according to claim 16, characterized in that, When the first measurement scenario includes the third scenario, the measurement object corresponding to the first measurement scenario includes at least one of the following: Software in a virtual instance, and software in the virtualization layer deployed on a virtual instance.

18. A communication device, characterized in that, include: A processor for executing a computer program stored in a memory to cause the communication device to perform the method of any one of claims 1 to 17.

19. A computer-readable storage medium, characterized in that, It stores a computer program or instructions thereon, characterized in that, when the computer program or instructions are executed by a processor, the method as described in any one of claims 1 to 17 is performed.

20. A computer program product comprising instructions that, when run on a computer, cause the method as described in any one of claims 1 to 17 to be performed.

21. A chip system, characterized in that, Includes: a processor for retrieving and running computer programs or instructions from memory, causing a communication device on which the chip system is mounted to implement the method as described in any one of claims 1 to 17.

22. A communication system, characterized in that, It includes a first network element and a second network element, wherein the first network element is used to perform the method as described in any one of claims 1 to 12, and the second network element is used to perform the method as described in any one of claims 13 to 17.

Images