Digital certificate updating method, device and system, electronic equipment and storage medium

Abstract

The invention discloses a digital certificate updating method, device and system, electronic equipment and a storage medium, and belongs to the technical field of communication. The method comprises the following steps that: an MANO (Management and Orchestration Domain) is used as a server and is in communication connection with an external network element, and the MANO detects whether a digital certificate of the MANO is updated or not; if the digital certificate of the MANO is updated, a historical updating success record of the external network element is deleted, a notification message is sent to the external network element, the notification message carries a new digital certificate or carries an acquisition address of the new digital certificate, and the notification message is used for notifying the external network element to update the historical digital certificate into the new digital certificate; the external network element receives a notification message sent by the MANO; acquiring a new digital certificate by adopting the certificate acquisition address, or acquiring a new digital certificate in the notification message; and updating the historical digital certificate of the external network element into the new digital certificate. Through the method and the device, the technical problem of low digital certificate updating efficiency in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, system, electronic device and storage medium for updating a digital certificate. Background Art

[0002] A digital certificate, also known as a public key certificate, refers to electronic data used to verify and certify the subject of electronic file behavior in electronic information activities, and can achieve the confidentiality and integrity of electronic files. A digital certificate is a file issued by a certificate authority (CA for short). According to the operator's technical specifications, the management and network orchestration domain MANO needs to support HTTPS two-way authentication security channels when communicating with external network elements, so digital certificates are required. Each time MANO enables a new set of digital certificates, the new digital certificate on the MANO side needs to be exchanged to the external network element for loading and use by the external network element, so that the new certificate can take effect during the HTTPS two-way authentication process.

[0003] In the related art, the new digital certificate on the MANO side needs to be provided to the external network element manually in advance, and the external network element operator manually imports and loads the certificate one by one. However, with the increasing enhancement of MANO functions, the types and numbers of external network elements connected are increasing. If the above manual method is used again, the operation is cumbersome, inefficient, and prone to errors.

[0004] With respect to the above-mentioned problems existing in the related technologies, no effective solutions have been found so far. Summary of the invention

[0005] The present application provides a method, device, system, electronic device and storage medium for updating a digital certificate to solve the technical problem of low efficiency in updating digital certificates in related technologies.

[0006] According to one aspect of an embodiment of the present application, a method for updating a digital certificate is provided, which is applied to a management and orchestration domain MANO, wherein the MANO acts as a server and is communicated with an external network element, and includes: detecting whether the digital certificate of the MANO is updated; if the digital certificate of the MANO is updated, deleting a historical update success record of the external network element, and sending a notification message to the external network element, wherein the notification message carries a new digital certificate or carries an acquisition address of the new digital certificate, and the notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate.

[0007] According to one aspect of an embodiment of the present application, another method for updating a digital certificate is provided, which is applied to an external network element, wherein the external network element is connected to a management and orchestration domain MANO as a client, and includes: receiving a notification message sent by the MANO, wherein the notification message carries a new digital certificate or carries a certificate acquisition address of the new digital certificate; using the certificate acquisition address to obtain the new digital certificate, or obtaining the new digital certificate in the notification message; and updating the historical digital certificate of the external network element to the new digital certificate.

[0008] According to another aspect of an embodiment of the present application, a digital certificate updating device is also provided, which is applied to a management and orchestration domain MANO, and the MANO is connected to an external network element as a server, including: a detection module, used to detect whether the digital certificate of the MANO is updated; a notification module, used to delete the historical update success record of the external network element if the digital certificate of the MANO is updated, and send a notification message to the external network element, the notification message carrying a new digital certificate or carrying an acquisition address of the new digital certificate, and the notification message is used to notify the external network element to update the old internal digital certificate to the new digital certificate.

[0009] Furthermore, the notification module includes an establishing unit, which is used to establish a Hypertext Transfer Protocol Security HTTPS secure channel with the MANO as the client and the external network element as the server; and use the HTTPS secure channel to send a notification message to the external network element.

[0010] Furthermore, the digital certificate updating device also includes a recording module, which is used to receive a response message returned by the external network element based on the notification message, and the response message carries the update result; record the update result as a designated external network element whose update failed; and resend the notification message to the designated external network element.

[0011] According to another aspect of an embodiment of the present application, another digital certificate updating device is provided, which is applied to an external network element, and the external network element is connected to the management and orchestration domain MANO as a client, including: a receiving module, used to receive a notification message sent by the MANO, the notification message carrying a new digital certificate or a certificate acquisition address of the new digital certificate; an acquisition module, used to use the certificate acquisition address to obtain the new digital certificate, or to obtain the new digital certificate in the notification message; an update module, used to update the old digital certificate inside the external network element to the new digital certificate.

[0012] Furthermore, the acquisition module includes a delay unit for acquiring a random delay duration; after the random delay duration after receiving the notification message, the new digital certificate is acquired using the certificate acquisition address.

[0013] According to another aspect of an embodiment of the present application, a storage medium is further provided, which includes a stored program, and the above steps are executed when the program is run.

[0014] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein: the memory is used to store computer programs; and the processor is used to execute the steps in the above method by running the program stored in the memory.

[0015] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps in the above method.

[0016] Through this application, the management and orchestration domain MANO acts as a server to communicate with external network elements. MANO detects whether the digital certificate of MANO is updated. If the digital certificate of MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate. The external network element receives the notification message sent by MANO; uses the certificate acquisition address to obtain the new digital certificate, or obtains the new digital certificate in the notification message; updates the historical digital certificate of the external network element to the new digital certificate. After the management and orchestration domain MANO updates the digital certificate, it automatically notifies the external network element to automatically update the certificate through message notification. The external network element no longer needs to import the certificate manually, which improves the update efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a hardware structure block diagram of a computer according to an embodiment of the present application;

[0019] Figure 2 is a flow chart of a method for updating a digital certificate applied to MANO according to an embodiment of the present application;

[0020] Figure 3is a flow chart of a method for updating a digital certificate applied to an external network element in an embodiment of the present application;

[0021] Figure 4 This is a schematic diagram of the relationship architecture between the MANO and external network elements in the embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of the digital certificate verification process between MANO and an external network element in an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the update process of the digital certificate in the embodiment of the present application;

[0024] Figure 7 It is a structural block diagram of a digital certificate updating device according to an embodiment of the present application;

[0025] Figure 8 It is a structural block diagram of another digital certificate updating device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only embodiments of a part of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Example 1

[0029] The method embodiment provided in the first embodiment of the present application can be executed in a mobile phone, a computer, a tablet or a similar computing device. Taking running on a computer as an example, Figure 1is a hardware structure block diagram of a computer in an embodiment of the present application. Figure 1 As shown, the computer may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the computer may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0030] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to a method for updating a digital certificate in an embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0031] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] In this embodiment, a method for updating a digital certificate is provided, which is applied to a management and orchestration domain MANO. The MANO is connected to an external network element as a server. Figure 2 is a flow chart of a method for updating a digital certificate according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0033] Step S10, detecting whether the digital certificate of the MANO is updated;

[0034] In this embodiment, the digital certificate stored on the MANO side includes a root certificate, which is a public key certificate issued by a certificate authority (CA for short). In actual network applications, for security policy considerations, a fixed validity period is usually set for the root certificate, such as 1 year, 2 years or 3 years. When the root certificate stored on the MANO side is about to expire, it is necessary to update the root certificate, that is, use a new root certificate to replace the root certificate that is about to expire. Detecting whether the digital certificate of MANO is updated may include: MANO checks the validity period of the local digital certificate, and determines whether the digital certificate of MANO needs to be updated according to the validity period (which can be determined by determining whether the time interval between the current time and the validity period is within a set threshold range). When an update is required, MANO sends a digital certificate update request to the CA server, receives a new digital certificate issued by the CA server based on the digital certificate update request, and when MANO obtains a new digital certificate from the CA server, determines that the digital certificate of MANO is updated.

[0035] Step S20: If the digital certificate of the MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate.

[0036] Optionally, in this embodiment, MANO may provide an operation interface for digital certificate update notification, so that operation and maintenance personnel can initiate digital certificate update notification operations through the interface.

[0037] In this embodiment, the management and orchestration domain MANO (Management and Network) includes the network function virtualization orchestrator NFVO (Network Functions Virtualisation Orchestrator) and the virtual network function manager VNFM (Virtual Network Function Manager). The main external network elements it connects to include: Figure 4The operations support system OSS (Operations Support System), 4A, virtual infrastructure manager VIM (VirtualisedInfrastructure Manager) / container infrastructure manager CIM (Container Infrastructure Manager), element management system EMS (Element Management System) and virtual network function VNF (VirtualNetwork Function) are shown. Among them, NFVO cooperates with VNFM and VIM systems to provide virtual resource orchestration of VNF network elements. During the orchestration process, VNFM can exchange messages with VNF and EMS; NFVO connects to OSS to report the configuration, performance and alarm data of VNF virtual machine resource sources; EMS has the network management capability of VNF network elements and connects to VNFM to report the configuration, performance and alarm model and data of VNF network elements; VIM provides the management capability of virtualized resources; CIM provides the management capability of containerized resources based on the virtual machines or bare metal devices provided by VIM.

[0038] In the related art, both the MANO-side root certificate and the MANO-side client certificate need to be provided to the external network element manually in advance, and the external network element operator manually imports and loads the certificates one by one. As the MANO function becomes increasingly powerful, the types and number of external network elements connected are increasing. Currently, one VNFM can support the management of 400 VNFs, and one NFVO supports the management of at least 128 VIMs. If the above manual method is used for update, the operation is cumbersome, inefficient, and prone to errors.

[0039] In this embodiment, through the above steps, the management and orchestration domain MANO acts as a server to communicate with the external network element, and MANO detects whether the digital certificate of MANO is updated; if the digital certificate of MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate; the external network element receives the notification message sent by MANO; uses the certificate acquisition address to obtain the new digital certificate, or obtains the new digital certificate in the notification message; updates the historical digital certificate of the external network element to the new digital certificate. After the management and orchestration domain MANO updates the digital certificate, the new certificate is automatically exchanged with the external network element connected to it. The external network element no longer needs to import the certificate manually, which improves the update efficiency.

[0040] In this embodiment, sending a notification message to the external network element includes:

[0041] S21, using the MANO as a client and the external network element as a server to establish a Hypertext Transfer Protocol (HTTPS) secure channel;

[0042] S22, using the HTTPS secure channel to send a notification message to the external network element.

[0043] In this embodiment, after the root certificate stored in MANO is updated, MANO issues a server certificate mano-server.cert and a client certificate mano-client.cert based on the root certificate mano-ca.cert. The updated root certificate and client certificate are used as new digital certificates in this embodiment. With MANO as the client and the external network element as the server, a Hypertext Transfer Protocol HTTPS secure channel is established. The HTTPS secure channel is used to send a notification message to the external network element to batch notify all external network elements to obtain and load the new digital certificate to achieve certificate update. In this embodiment, the MANO-side root certificate and the MANO-side client certificate stored in MANO are automatically exchanged to the external network element when they expire and are updated, and manual intervention is no longer required, which greatly improves ease of use.

[0044] In this embodiment, the external network element is used as the server and MANO is used as the client. The HTTPS secure channel two-way authentication is enabled. The digital certificate verification process involved is as follows: Figure 5 As shown, it includes: MANO initiates an HTTPS request to the external network element. After the external network element receives the HTTPS request, it sends the server certificate on the external network element side to MANO. MANO uses the historical root certificate on the MANO side to verify the legitimacy of the server certificate; MANO sends the client certificate on the MANO side to the external network element. The external network element verifies the client certificate according to the current root certificate on the external network element side. When the above-mentioned server certificate and client certificate are verified to be legal, the HTTPS secure channel two-way authentication can succeed.

[0045] In this embodiment, after the MANO-side root certificate and the MANO-side client certificate stored in the MANO are updated, the MANO automatically sends a message to notify all external network elements of the certificate update by using the existing HTTPS secure channel.

[0046] In one implementation of this embodiment, after sending the notification message to the external network element, the method also includes: receiving a response message returned by the external network element based on the notification message, the response message carrying the update result; recording the update result as the designated external network element whose update failed; and resending the notification message to the designated external network element.

[0047] MANO receives the response message returned by the external network element based on the notification message, and records the certificate update result returned by each external network element, records which external network element certificates are successfully updated and which external network element certificates fail to be updated, so as to resend the notification message to all designated external network elements whose certificates have failed to be updated manually or automatically in a timing manner. MANO will not resend the certificate update notification message to the external network element whose certificate has been successfully updated. Therefore, in this embodiment, when the root certificate on the MANO side is updated again, the historical update success record of the external network element is deleted, that is, the historical record of the external network element whose certificate has been successfully updated on MANO is cleared, and all external network elements are notified of the certificate update again.

[0048] In this embodiment, another method for updating a digital certificate is provided, which is applied to an external network element. The external network element is connected to the management and orchestration domain MANO as a client. Figure 3 As shown, the process includes the following steps:

[0049] Step S30, receiving a notification message sent by the MANO, wherein the notification message carries a new digital certificate or a certificate acquisition address of the new digital certificate;

[0050] Step S40, using the certificate acquisition address to acquire the new digital certificate, or acquiring the new digital certificate in the notification message;

[0051] Step S50: updating the historical digital certificate of the external network element to the new digital certificate.

[0052] After receiving the notification message sent by MANO, the external network element uses the secure channel provided by the certificate acquisition address to obtain a new digital certificate and loads the certificate for use, or directly obtains the new digital certificate in the notification message for loading and use, and returns a response message of successful certificate update to MANO. If the external network element fails to obtain the certificate, it returns a response message of failed certificate update to MANO.

[0053] In this embodiment, after the digital certificate on the MANO side expires and is updated, the new digital certificate is automatically exchanged with the external network element, and the external network element automatically obtains and loads the new digital certificate, and no manual intervention is required, thereby improving the update efficiency.

[0054] In this embodiment, using the certificate acquisition address to acquire the new digital certificate includes:

[0055] S41, obtaining a random delay duration;

[0056] S42: After the random delay period after receiving the notification message, use the certificate acquisition address to acquire the new digital certificate.

[0057] After receiving the notification message of certificate update, in order to avoid message storm, the external network element can randomly delay for a certain period of time within a fixed time period, and then use the secure channel provided by the certificate acquisition address to obtain the certificate and load the certificate for use. In this embodiment, multiple external network elements randomly delay for different periods of time to stagger the certificate acquisition time, thereby avoiding message storm.

[0058] refer to Figure 6 , Figure 6 This is an implementation flow chart of this embodiment, including:

[0059] After the MANO-side root certificate and MANO-side client certificate stored in MANO are updated, MANO sends a certificate update notification message, using the existing HTTPS secure channel to batch notify all external network elements to update the certificates. The message carries the certificate acquisition address or a new certificate.

[0060] After receiving the certificate update notification message, in order to avoid message storms, the external network element randomly delays a certain time within a fixed time period, obtains the certificate through the secure channel provided by the certificate acquisition address, loads and uses the certificate, and returns a certificate update notification success response to MANO; if the external network element fails to obtain the certificate, it returns a certificate update notification failure response to MANO;

[0061] MANO records the certificate update notification response returned by each external network element, and records which external network element certificates are successfully updated;

[0062] Subsequent MANO supports manual or automatic timing to resend certificate update notification messages to all external network elements whose certificates have not been successfully updated; MANO will not resend certificate update notification messages to external network elements whose certificates have been successfully updated;

[0063] If MANO subsequently updates the MANO-side root certificate and MANO-side client certificate again, the records of which external network element certificates on MANO are successfully updated will be cleared, and all external network elements need to be notified of the certificate update.

[0064] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0065] Example 2

[0066] In this embodiment, a digital certificate updating device is also provided to implement the above-mentioned embodiments and preferred implementation modes, which have been described and will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0067] Figure 7 is a structural block diagram of a digital certificate updating device applied to MANO according to an embodiment of the present application, such as Figure 7 As shown, the device comprises:

[0068] A detection module 71, used to detect whether the digital certificate of the MANO is updated;

[0069] The notification module 72 is used to delete the historical update success record of the external network element if the digital certificate of the MANO is updated, and send a notification message to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the old internal digital certificate to the new digital certificate.

[0070] Figure 8 is a structural block diagram of a digital certificate updating device applied to an external network element according to an embodiment of the present application, such as Figure 8 As shown, the device comprises:

[0071] A receiving module 81, configured to receive a notification message sent by the MANO, wherein the notification message carries a new digital certificate or a certificate acquisition address of the new digital certificate;

[0072] An acquisition module 82, configured to acquire the new digital certificate using the certificate acquisition address, or acquire the new digital certificate in the notification message;

[0073] The updating module 83 is used to update the old digital certificate in the external network element to the new digital certificate.

[0074] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0075] Example 3

[0076] An embodiment of the present application further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0077] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0078] S1, detecting whether the digital certificate of the MANO is updated;

[0079] S2. If the digital certificate of the MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate.

[0080] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0081] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0082] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0083] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0084] S1, detecting whether the digital certificate of the MANO is updated;

[0085] S2. If the digital certificate of the MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate.

[0086] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0087] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0088] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0089] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0090] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0091] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0092] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly or all or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0093] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for updating a digital certificate, characterized in that: Applied to a management and orchestration domain MANO, the MANO is connected to an external network element as a server, and the method includes: Detecting whether the digital certificate of the MANO is updated; If the digital certificate of the MANO is updated, the historical update success record of the external network element is deleted, and a notification message is sent to the external network element. The notification message carries the new digital certificate or carries the acquisition address of the new digital certificate. The notification message is used to notify the external network element to update the historical digital certificate to the new digital certificate.

2. The method according to claim 1, characterized in that Sending a notification message to the external network element includes: Using the MANO as a client and the external network element as a server to establish a Hypertext Transfer Protocol Security (HTTPS) secure channel; The HTTPS secure channel is used to send a notification message to the external network element.

3. The method according to claim 1, characterized in that After sending the notification message to the external network element, the method further includes: Receiving a response message returned by the external network element based on the notification message, wherein the response message carries an update result; Recording the update result as the designated external network element whose update failed; Resend the notification message to the designated external network element.

4. A method for updating a digital certificate, characterized in that: Applied to an external network element, the external network element is connected to the management and orchestration domain MANO as a client, and the method includes: Receiving a notification message sent by the MANO, where the notification message carries a new digital certificate or a certificate acquisition address of the new digital certificate; Acquire the new digital certificate using the certificate acquisition address, or acquire the new digital certificate in the notification message; The historical digital certificate of the external network element is updated to the new digital certificate.

5. The method according to claim 4, characterized in that Using the certificate acquisition address to obtain the new digital certificate includes: Get the random delay duration; After the random delay period after receiving the notification message, the new digital certificate is acquired using the certificate acquisition address.

6. A digital certificate updating device, characterized in that: Applied to the management and orchestration domain MANO, the MANO acts as a server to communicate with external network elements, including: A detection module, used to detect whether the digital certificate of the MANO is updated; A notification module is used to delete the historical update success record of the external network element if the digital certificate of the MANO is updated, and send a notification message to the external network element, wherein the notification message carries the new digital certificate or carries the acquisition address of the new digital certificate, and the notification message is used to notify the external network element to update the old internal digital certificate to the new digital certificate.

7. A digital certificate updating device, characterized in that: Applied to an external network element, the external network element is connected to the management and orchestration domain MANO as a client, including: A receiving module, configured to receive a notification message sent by the MANO, wherein the notification message carries a new digital certificate or a certificate acquisition address of the new digital certificate; An acquisition module, used to acquire the new digital certificate using the certificate acquisition address, or acquire the new digital certificate in the notification message; The updating module is used to update the old digital certificate in the external network element to the new digital certificate.

8. A digital certificate updating system, characterized in that: It includes a management and orchestration domain MANO and external network elements, wherein the MANO includes a network function virtualization orchestrator NFVO and a virtual network function manager VNFM, wherein: The MANO is communicatively connected with the external network element, including the apparatus according to claim 6; The external network element comprises the device as claimed in claim 7.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; wherein: Memory, used to store computer programs; A processor, configured to execute the method steps of any one of claims 1 to 5 by running a program stored in a memory.

10. A storage medium, characterized in that: The storage medium comprises a stored program, wherein the program executes the method steps of any one of claims 1 to 5 when executed.

Images