Secure key protection

Abstract

The embodiment of the invention relates to equipment, a method, a device and a computer readable storage medium for security key protection in a multi-tenant cloud environment. In some embodiments, a virtualization platform may receive a request from an application side associated with a tenant, and send additional requests to a secure key store. The secure key store may generate a public-private key pair, where the private key is stored locally in the secure key store and is invisible to the application side associated with the tenant, where the public key is provided to the application side associated with the tenant through the virtualization platform. Therefore, the virtual platform can provide a trusted network bridge between the application side and the secure key storage. Therefore, key generation and key protection are realized, so that secure communication can be established among network functions in a multi-tenant cloud environment.

Description

Technical Field

[0001] The exemplary embodiments disclosed herein generally relate to the telecommunications field, and particularly to devices, methods, apparatuses, and computer-readable storage media for security key protection in multi-tenant cloud environments. Background Technology

[0002] Providing key management services is crucial in current cloud product infrastructures. Essentially, key generation and management need to be performed through software-based components because there isn't a good solution for establishing trust and secure communication between Virtual Network Functions (VNFs) and hardware devices such as Trusted Platform Modules (TPMs) or Hardware Security Modules (HSMs). In some cases, different users from different carriers can request key generation and protection, and in multi-tenant environments, key access management should be provided. Summary of the Invention

[0003] Typically, the exemplary embodiments of this disclosure provide a solution for secure key protection in a multi-tenant cloud environment.

[0004] In a first aspect, an apparatus is provided. The apparatus includes at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, cause the apparatus to at least: receive a request for a public-private key pair from an application side associated with a tenant; send a further request to a secure key store for creating a public-private key pair for the application side associated with the tenant; receive the public key of the public-private key pair from the secure key store, the private key of the public-private key pair being locally stored in the secure key store; and send the public key to the application side associated with the tenant.

[0005] In a second aspect, an apparatus is provided, including an application side associated with a tenant. The apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: send a request for a public-private key pair to a virtualization platform; and receive the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0006] In a third aspect, an apparatus is provided. The apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive from a virtualization platform a request for creating a public-private key pair for an application associated with a tenant; create a public-private key pair including a public key and a private key for the application associated with the tenant; and send the public key of the public-private key pair to the virtualization platform, the private key of the public-private key pair being locally stored in the apparatus.

[0007] In a fourth aspect, a method performed by a virtualization platform is provided. The method includes: at the virtualization platform, receiving a request for a public-private key pair from an application associated with a tenant; sending a further request to a secure key store for creating a public-private key pair for the application associated with the tenant; receiving the public key of the public-private key pair from the secure key store, the private key of which is locally stored in the secure key store; and sending the public key to the application associated with the tenant.

[0008] In a fifth aspect, a method is provided that is executed by an application-side associated with a tenant. The method includes: on the application-side associated with the tenant, sending a request for a public-private key pair to a virtualization platform; and receiving the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0009] In a sixth aspect, a method performed by a secure key store is provided. The method includes: receiving, at the secure key store, a request from a virtualization platform for creating a public-private key pair for an application associated with a tenant; creating a public-private key pair including a public key and a private key for the application associated with the tenant; and sending the public key of the public-private key pair to the virtualization platform, wherein the private key of the public-private key pair is locally stored in the device.

[0010] In a seventh aspect, an apparatus is provided. The apparatus includes: components for receiving, at a virtualization platform, a request for a public-private key pair from an application associated with a tenant; components for sending to a secure key store a further request for creating a public-private key pair for the application associated with the tenant; components for receiving the public key of the public-private key pair from the secure key store, the private key of the public-private key pair being locally stored in the secure key store; and components for sending the public key to the application associated with the tenant.

[0011] In an eighth aspect, an apparatus is provided. The apparatus includes: components for sending a request for a public-private key pair to a virtualization platform on an application side associated with a tenant; and components for receiving the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0012] In a ninth aspect, an apparatus is provided. The apparatus includes: components for receiving, at a secure key storage location, a request from a virtualization platform for creating a public-private key pair for an application associated with a tenant; components for creating a public-private key pair including a public key and a private key for the application associated with the tenant; and components for sending the public key of the public-private key pair to the virtualization platform, wherein the private key of the public-private key pair is locally stored in the apparatus.

[0013] In a tenth aspect, a non-transitory computer-readable medium is provided, including program instructions for causing the apparatus to perform at least the methods of the fourth, fifth, or sixth aspects.

[0014] In the eleventh aspect, a computer program is provided, including instructions that, when executed by a device, cause the device to perform at least the methods of the fourth, fifth, or sixth aspects.

[0015] In a twelfth aspect, a virtualization platform is provided. The virtualization platform includes: a receiving circuit system configured to receive a request for a public-private key pair from an application associated with a tenant at the virtualization platform; a sending circuit system configured to send a further request to a secure key store for creating a public-private key pair for the application associated with the tenant; a receiving circuit system configured to receive the public key of the public-private key pair from the secure key store, the private key of the public-private key pair being locally stored in the secure key store; and a sending circuit system configured to send the public key to the application associated with the tenant.

[0016] In the thirteenth aspect, an application side associated with a tenant is provided. This application side associated with the tenant includes: a sending circuitry configured to send a request for a public-private key pair to a virtualization platform on the application side associated with the tenant; and a receiving circuitry configured to receive the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0017] In a fourteenth aspect, a secure key storage is provided. The secure key storage includes: a receiving circuitry configured to receive, at the secure key storage location, a request from a virtualization platform for creating a public-private key pair for an application associated with a tenant; a creation circuitry configured to create a public-private key pair including a public key and a private key for the application associated with the tenant; and a sending circuitry configured to send the public key of the public-private key pair to the virtualization platform, the private key of the public-private key pair being locally stored in the device.

[0018] In the fifteenth aspect, a computer-readable medium is provided, including program instructions that, when executed by a device, cause the device to perform at least the methods of the fourth, fifth, or sixth aspects.

[0019] It should be understood that the summary portion of this disclosure is not intended to identify key or essential features of the embodiments thereof, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0020] Some exemplary embodiments will now be described with reference to the accompanying drawings, in which:

[0021] Figure 1 Example environments according to some example embodiments of this disclosure are shown;

[0022] Figure 2 Example procedures are shown according to some example embodiments of this disclosure;

[0023] Figure 3 An example procedure for AVC initialization according to some example embodiments of this disclosure is shown;

[0024] Figure 4 Example mappings associated with public-private key pairs are shown according to some example embodiments of this disclosure;

[0025] Figure 5 Example procedures for application key protection according to some example embodiments of this disclosure are shown;

[0026] Figure 6 Example mappings associated with application keys according to some example embodiments of this disclosure are shown;

[0027] Figure 7 Example procedures for the use of application keys are shown according to some example embodiments of this disclosure;

[0028] Figure 8 Example scenarios for key generation and management according to some example embodiments of this disclosure are shown;

[0029] Figure 9 A flowchart illustrating a method implemented on a virtualization platform such as SSRM according to some example embodiments of the present disclosure is shown;

[0030] Figure 10 A flowchart illustrating a method implemented on the application side associated with a tenant, according to some example embodiments of the present disclosure;

[0031] Figure 11 A flowchart is shown illustrating a method implemented at a secure key store according to some example embodiments of the present disclosure;

[0032] Figure 12 A simplified block diagram of a device suitable for implementing some example embodiments of this disclosure is shown; and

[0033] Figure 13 A block diagram illustrating an example of a computer-readable medium according to some exemplary embodiments of the present disclosure is shown.

[0034] Throughout the accompanying drawings, the same or similar reference numerals denote the same or similar elements. Detailed Implementation

[0035] The principles of this disclosure will now be described with reference to some exemplary embodiments. It should be understood that these embodiments are described for illustrative purposes only and to assist those skilled in the art in understanding and implementing this disclosure, and do not imply any limitation on the scope of this disclosure. This disclosure described herein can be implemented in various ways other than those described below.

[0036] In the following description and claims, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0037] In this disclosure, references to "an embodiment," "an embodiment," "an example embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes that particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Additionally, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is believed that, whether explicitly described or not, its influence on such feature, structure, or characteristic in conjunction with other embodiments is within the knowledge of those skilled in the art.

[0038] It should be understood that while the terms “first” and “second” may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used only to distinguish one element from another. For example, without departing from the scope of the exemplary embodiments, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. As used herein, the term “and / or” includes any and all combinations of one or more of the listed terms.

[0039] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments. As used herein, the singular forms “a,” “an,” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising,” “including,” “having,” “having,” “containing,” and / or “comprising” as used herein specify the presence of the stated features, elements, and / or components, but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof. As used herein, “at least one of the following: ” and “at least one of ” and similar wording, wherein the list of two or more elements is connected by “and” or “or”, indicates at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0040] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Hardware circuit implementation only (such as implementation of analog and / or digital circuit systems only), and (b) A combination of hardware circuitry and software, such as (if available): (i) A combination of analog and / or (multiple) digital hardware circuits with software / firmware, and (ii) Any part of the hardware processor(s) having software (including digital signal processor(s)), software, and memory(s), which work together to enable a device (such as a mobile phone or server) to perform various functions, and (c) (Multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or portions of (multiple) microprocessors, which require software (e.g., firmware) to operate, but may be absent when operation is not required.

[0041] This definition of circuit system applies to all uses of the term in this application, including in any claim. As another example, as used in this application, the term circuit system also covers only hardware circuitry or a processor (or multiple processors) or portions of hardware circuitry or a processor and its accompanying software and / or firmware implementation. The term circuit system also covers (e.g., and if applicable to elements of a particular claim) baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices, or other computing or network devices.

[0042] The following are some of the abbreviations used in this disclosure: APP: Application AvcKM: AVC Key Manager AVC: APP / VNF / CNF CNF: Containerized Networking Functions DSP: Digital Signal Processor EPROM: Erasable Programmable Read-Only Memory EEPROM: Electrically Erasable Programmable Read-Only Memory HTTP: Hypertext Transfer Protocol Security HSM: Hardware Security Module HW: Hardware ID: Identifier KM: Key Manager MPK: Master Private Key RAM: Random Access Memory ROM: Read-Only Memory SSAPI: Secure Storage Application Interface or Secure Storage Application Protocol Interface SSRM: Secure Storage Resource Manager SW: Software TLS: Transport Layer Security TPM: Trusted Platform Module VM: Virtual Machine VNF: Virtualized Network Function VF: Virtualization Platform

[0043] In current cloud product infrastructures, a unified key management service is lacking, which is critical in multi-tenant scenarios. Current implementations rely on key protection via Service Shield (SW). Communication is secure, but peer authentication is based on pre-installed certificates. For single-tenant solutions, the key management concept demonstrates a sufficiently good level of security, although it does not provide any components for key revocation and certificate re-registration. However, in multi-tenant scenarios, all weaknesses become very apparent: the lack of key protection through Cloud Management (HW), the lack of access management for keys and sensitive information (meaning authentication and authorization), the lack of dynamic data separation, and so on.

[0044] This disclosure provides an example embodiment of a solution for secure key protection in a multi-tenant cloud environment. A virtualization platform can receive requests from the application side associated with a tenant and send additional requests to a secure key store. The secure key store can generate public-private key pairs, where the private key is stored locally in the secure key store and is invisible to the application side associated with the tenant, while the public key is provided to the application side associated with the tenant via the virtualization platform. Therefore, the virtualization platform can provide a trusted bridge between the application side and the secure key store. Key generation and key protection are thus enabled, and secure communication can be established between network functions within the multi-tenant cloud infrastructure accordingly. The principles of this disclosure and some example embodiments will now be described in detail with reference to the accompanying drawings.

[0045] Figure 1 An example environment 100 according to some example embodiments of this disclosure is shown. For example... Figure 1 As shown, environment 100 includes an infrastructure layer 110, a platform layer 120, and a software layer 130. In some example embodiments, environment 100 may be a multi-tenant cloud infrastructure.

[0046] In some example embodiments, infrastructure layer 110 may also be referred to as the infrastructure layer, the lower layer, etc. Software layer 130 may also be referred to as the upper layer, the SW layer, etc. This disclosure does not limit this aspect.

[0047] A secure key store 112 can be provided, and the secure key store 112 can be software-based and / or hardware-based. For example... Figure 1As shown, there are SW-based secure memory 112-2 and HW-based secure memory 112-4. For example, HW-based secure memory 112-4 can be implemented as HSM, TPM, etc. Figure 1 As shown, the SW-based secure storage 112-2 can be located in the platform layer 120, while the HW-based secure storage 112-4 can be located in the infrastructure layer 110. In some example embodiments, the secure key storage 112 may also be referred to as a secure key and file storage, etc., and this disclosure does not limit this aspect.

[0048] Multiple AVCs 132-1 to 132-N (represented collectively or individually as AVC 132) may exist and be associated with multiple tenants in software layer 130. For example, a portion may be allocated to a specific tenant, and that portion may be considered an AVC associated with that specific tenant. In some examples, AVC 132 may be virtualized, containerized, or instantiated. In some examples, different AVCs may be associated with different tenants.

[0049] The virtualization platform 122 in platform layer 120 can host a Secure Storage Resource Manager (SSRM) 124. SSRM 124 can provide a Secure Storage Application Interface (SSAPI) 128, which can be used by AVC 132 to request public-private key pair generation, digital signatures, etc. Public-private key pair generation can be performed by a secure key store 112, and the public-private key pair includes a public key (or referred to as the AVC master public key) and a private key (or referred to as the AVC master private key), wherein the private key is stored in the secure key store 112 and does not leave the secure key store 112 unless encrypted, and the public key is stored in AVC 132.

[0050] In some example embodiments, the private key is created within the secure key store 112 and will never be exposed. The private key can be used to decrypt APP keys or files. For example, an APP key or file can be encrypted by an AVC with its own public key, and the encrypted APP key or file can only be decrypted by the corresponding private key.

[0051] In some example embodiments, SSAPI 128 may provide a standardized interface to / from SSRM 124 for AVC 132 to obtain services such as private / public key generation. In some example embodiments, SSAPI 128 may be a public (or unique) API for those AVCs that are running.

[0052] like Figure 1As shown, each AVC in the AVC interfaces with SSRM 124 and can use the services provided by Security Key Store 112 through SSRM 124. In some example embodiments, the services of Security Key Store 112 can be provided to AVC 132 through SSRM 124. AVC Key Manager 136 in AVC 132 can be provided to manage keys, such as key creation / retrieval / update / deletion.

[0053] In some example embodiments, SSRM 124 may provide a so-called trusted bridge between AVC 132 and security key store 112. In some example embodiments, SSRM 124 may create a unique identifier, such as AVCID, for each AVC 132. In some example embodiments, SSRM 124 may generate credentials for each AVC 132 and may create a binding between AVC identifiers and AVC credentials.

[0054] In some example embodiments, the AVC key manager 136 can import its own unique identifier and credential information for the AVC, which is created by the SSRM 124. In some example embodiments, the AVC key manager 136 can create a binding between the identifier and credential and the AVC master public key.

[0055] In some example embodiments, the AVC key manager 136 can create a unique APP identifier for each application. It should be understood that the unique APP ID is used to distinguish it from other applications. In some example embodiments, the AVC key manager 136 can create (or retrieve, update, delete) (multiple) application keys, and can encrypt the APP keys using the AVC master public key. Additionally, the AVC key manager 136 can create a binding between the unique APP ID and the encrypted APP key.

[0056] In some example embodiments, the AVC key manager 136 can request the decryption of the APP key when needed. In some example embodiments, the AVC key manager 136 can disable any keys and IDs bound to the current AVC session; for example, any re-instantiation of AVC will require the creation of a new AVC unique ID and a new public-private key pair. This short-lived master public-private key pair and AVC unique ID provide some replay protection.

[0057] In this disclosure, the term binding may also be referred to as association, mapping, binding, etc., and this disclosure does not limit this aspect.

[0058] Figure 2Example process 200 according to some example embodiments of this disclosure is illustrated. For the purposes of discussion, process 200 relates to an application side 201 associated with a tenant, a virtualization platform 202, and a security key store 203. In some example embodiments, references are made to... Figure 1 The application side associated with the tenant 201 can refer to the AVC 132 associated with the tenant, the virtualization platform 202 can refer to the virtualization platform 122 or SSRM 124, and the security key store 203 can refer to the security key store 112. It should be understood that, although referenced... Figure 1 Process 200 is described, but the same process flow can be applied to other communication scenarios.

[0059] In some example embodiments, communication between the tenant-associated application side 201 and the virtualization platform 202 (such as SSRM124) is via a unified SSAPI (such as...). Figure 1 The SSAPI 128 shown is used to perform this. In some example embodiments, the SSAPI is provided by the virtualization platform 202 (such as SSRM 124) and used by the application side (such as AVC 132) to use the secure storage service provided by the security key store 203 through the virtualization platform 202 (such as SSRM 124).

[0060] The application 201 associated with the tenant sends request 210, 212, to the virtualization platform 202, where request 212 is related to a public-private key pair. Virtualization platform 202 (such as SSRM 124) receives request 214, 212. In some example embodiments, request 212 may request the generation of the public-private key pair.

[0061] In some example embodiments, request 212 may include an identifier of the application-side 201 associated with the tenant, such as an AVC ID. In some example embodiments, request 212 may include credential information of the application-side 201 associated with the tenant.

[0062] Alternatively or concurrently, virtualization platform 202 (such as SSRM 124) may create an identifier and / or credential information for the application-side 201 associated with a tenant. Virtualization platform 202 (such as SSRM 124) may also obtain authorization information for the application-side 201 associated with a tenant from security key store 203. In some example embodiments, virtualization platform 202 (such as SSRM 124) may generate an association between authorization information for the application-side 201 associated with a tenant and the identifier and / or credential information for the application-side 201 associated with the tenant.

[0063] The virtualization platform 202 sends an additional request 222 to the security key store 203. The additional request 222 may request the generation of a public-private key pair. In some example embodiments, the additional request 222 includes authorization information for the application-side 201 associated with the tenant. For example, the virtualization platform 202 may obtain the identifier and / or credential information of the application-side 201 associated with the tenant from request 212, and may also determine the authorization information for the application-side 201 associated with the tenant based on the associations maintained at the virtualization platform 202.

[0064] The secure key store 203 receives an additional request 222 (224) and generates a public-private key pair (230). The public-private key pair includes a private key and a corresponding public key. Alternatively or concurrently, the secure key store 203 locally stores the private key (235). For example, unless encrypted, the private key may remain within the secure key store 203. For example, the private key may be invisible (inaccessible) to the application side (201) associated with the tenant.

[0065] In some example embodiments, the security key store 203 can obtain authorization information of the application side 201 associated with a tenant from another request 222, and the security key store 203 can also generate and maintain the association between the private key and the authorization information of the application side 201 associated with the tenant. It should be understood that if another request is received that includes authorization information of another application side (such as AVC#2) associated with another tenant, the private key will not be accessed because the private key is associated with the tenant, and therefore security can be ensured.

[0066] The security key store 203 sends public key 242 240 to the virtualization platform 202. In some example embodiments, the security key store 203 may provide the generated public key 242 to the virtualization platform 202 based on a separate request 222. For example, authorization information of the application side 201 associated with the tenant may be sent along with the public key 242 so that the security key store 203 can match it with the application side 201 associated with the tenant.

[0067] The virtualization platform 202 receives public key 244 242 from the secure key store 203, and forwards public key 250 252 to the application side 201 associated with the tenant.

[0068] The application 201 associated with the tenant (such as AVC 132) receives public key 252 254 from virtualization platform 202. Alternatively, the application 201 associated with the tenant may generate and maintain an association between public key 252 and the identification and / or credential information of the application 201 associated with the tenant.

[0069] For reference Figure 2As described, the public key can be generated by the security key store 203 and stored in the application side 201 associated with the tenant. For example, the application side 201 associated with the tenant could be as follows: Figure 1 The AVC 132 is shown, and the public key can be managed by the AVC key manager 136.

[0070] Additionally, the application side 201 associated with the tenant can receive key encryption requests from the application associated with the tenant. The application side 201 associated with the tenant can create an application key (APP key) and identifier. For example, the AVC key manager 136 can generate an APP key and an APP unique ID for the application. Furthermore, the application side 201 associated with the tenant can determine the encryption key based on the key using a public key. For example, the AVC key manager 136 can encrypt the APP key using a public key (i.e., the AVC master public key generated by the security key store 203). The application side 201 associated with the tenant can also maintain the association between the encrypted key and the application identifier. For example, the AVC key manager 136 can generate and maintain the association between the encrypted APP key and the APP unique ID.

[0071] In some example embodiments, the application side 201 associated with the tenant can generate a file and encrypt it using an application key. The encrypted file can then be sent to an external device. In some other example embodiments, the application side 201 associated with the tenant may need to decrypt the file. For example, the application side 201 associated with the tenant may receive an encrypted file from an external device and wish to decrypt it.

[0072] In this scenario, for example, the application side 201 associated with the tenant can send a key decryption request to the virtualization platform 202, where the key decryption request may include an encrypted application key (or an encrypted file). In some examples, the key decryption request may include the identification and / or credential information of the application side 201 associated with the tenant.

[0073] In response to receiving a key decryption request from the application side 201 associated with the tenant, the virtualization platform 202 may send an encrypted application key (or an encrypted file) to the security key store 203. For example, authorization information of the application side 201 associated with the tenant may be sent together with the encrypted application key (or encrypted file).

[0074] On the secure key store 203 side, the secure key store 203 can decrypt the encrypted application key (or encrypted file) using the private key; therefore, the decrypted application key (or decrypted file) can be determined. In some examples, the decrypted application key can also be referred to as the plaintext application key.

[0075] The secure key store 203 can provide the virtualization platform 202 with the decrypted application key (or decrypted file), and correspondingly, the virtualization platform 202 can forward the decrypted application key (or decrypted file) to the application side 201 associated with the tenant.

[0076] In some example embodiments, the application side 201 associated with the tenant can receive a decrypted application key from the virtualization platform 202, and the application side 201 associated with the tenant can also use the application key. For example, a file to be sent can be encrypted using the application key. In some other example embodiments, the application side 201 associated with the tenant can receive a decrypted file from the virtualization platform 202.

[0077] In some cases, AVC 132 can be disabled. In some examples, if the application side 201 associated with the tenant is disabled, the encrypted application key stored in the application side 201 associated with the tenant (such as in the AVC key manager) can disappear. Therefore, key leakage can be avoided.

[0078] According to the reference Figure 2 In this embodiment, the AVC master public-private key pair can be generated by a secure key store. The public key is stored in the AVC associated with the tenant. The private key is stored in the secure key store and will not leave the secure key store unless encrypted. For example, the private key can be encrypted so that it can only be read by the secure key store. Therefore, security can be ensured.

[0079] Figure 3 An example process 300 for AVC initialization according to some example embodiments of the present disclosure is illustrated. Process 300 involves an AVC 132 associated with a tenant, an SSRM 124, and a security key store 112. The AVC 132 associated with the tenant may be... Figure 1 Any of the AVCs shown, for example, AVC 132-1 (i.e., AVC#1).

[0080] SSRM 124 creates 312 identification and credential information for AVC 132. In some example embodiments, when multiple AVCs exist (such as...), Figure 1 In the case of AVCs 132-1 to 132-N shown, SSRM 124 can create identification and credential information for each AVC among AVCs 132-1 to 132-N. In some example embodiments, the identification and credential information is unique for AVC 132. For example, different AVCs may have different identifications and different credential information. In some examples, the identification and credential information can be used to distinguish and authenticate AVCs in SSRM 124. For ease of description, it is assumed that the identification of AVC 132 is the AVC ID.

[0081] SSRM 124 sends a request 314 for authorization information regarding AVC 132 to the security key store 112. In some example embodiments, when multiple AVCs (such as...) exist... Figure 1 In the case of AVCs 132-1 to 132-N shown, SSRM 124 can send a request for authorization information for each of AVCs 132-1 to 132-N.

[0082] The security key store 112 sends authorization information for AVC 132 (316) to the SSRM 124. In some example embodiments, the security key store 112 may return authorization information based on a request sent at 314. For example, authorization information for multiple AVCs 132-1 to 132-N may be returned.

[0083] SSRM 124 maintains the association between the identifier, credential information, and authorization information for AVC 132 (section 318). For example, SSRM 124 maintains the mapping between AVC ID, credential information, and authorization information. An example association maintained in SSRM 124 could be as follows: Figure 4 The mapping shown is 420.

[0084] AVC 132 imports 320 identification and credential information for authentication with SSRM 124. For example, identification and credential information can be imported into AVC 132 during the AVC initialization process.

[0085] AVC 132 sends a request (330) to SSRM 124 to trigger key pair creation. Specifically, AVC 132 can authenticate with SSRM 124 using its identity and credentials, and trigger key pair creation. The key pair can be a public-private key pair, or referred to as the AVC master public-private key pair. It should be understood that the request or authentication at step 330 is performed via the aforementioned SSAPI.

[0086] SSRM 124 sends another request (340) to the security key store 112 for the creation of a public-private key pair. Specifically, SSRM 124 can determine the associated authorization information using the association maintained at (318), the identification and credential information based on AVC 132. Additionally, the request to the security key store 112 may include authorization information from AVC 132.

[0087] The secure key store 112 generates 350 public-private key pairs. In some example embodiments, the secure key store 112 can generate public-private key pairs for AVC 132 based on a request from SSRM 124, including a private key (or referred to in some examples as the AVC master private key) and a public key (or referred to in some examples as the master public key). The secure key store 112 can store the private key locally; in other words, the private key cannot be accessed by AVC 132. The private key is stored within the secure key store 112 and can remain within the secure key store 112 unless encrypted.

[0088] The secure key store 112 sends the 360 ​​public key to the SSRM 124. In some examples, the secure key store 110 may provide the AVC master public key of the key pair based on a request from the SSRM 124.

[0089] SSRM 124 forwards public key 370 to AVC 132. Therefore, the AVC master public key can be sent to AVC 132.

[0090] AVC 132 stores the 380 public key. Specifically, AVC 132 can store the AVC master public key, which can be mapped to identity and credential information. An example mapping at AVC 132-1 could refer to the following: Figure 4 The mapping shown is 412.

[0091] Figure 4 An example mapping 400 associated with a public-private key pair is shown according to some example embodiments of this disclosure. For example... Figure 4 As shown, the AVC#1 key manager can maintain the mapping between the AVC#1 master public key and the AVC#1 ID + AVC#1 credential information 412, the AVC#2 key manager can maintain the mapping between the AVC#2 master public key and the AVC#2 ID + AVC#2 credential information 414, ..., and the AVC#N key manager can maintain the mapping between the AVC#N master public key and the AVC#N ID + AVC#N credential information 418. As shown at 420, the SSRM can maintain the mapping between the AVC#1 ID + AVC#1 credential information and the AVC#1 authorization information, the mapping between the AVC#2 ID + AVC#2 credential information and the AVC#2 authorization information, ..., and the mapping between the AVC#N ID + AVC#N credential information and the AVC#N authorization information. As shown at 430, the secure key store can maintain the mapping between AVC#1 authorization information and AVC#1 master private key, the mapping between AVC#2 authorization information and AVC#2 master private key, ..., and the mapping between AVC#N authorization information and AVC#N master private key.

[0092] Figure 5An example process 500 for application key protection according to some example embodiments of this disclosure is illustrated. Process 500 involves an AVC application 501 and an AVC key manager 502. It should be understood that the AVC application 501 and the AVC key manager 502 are associated with the same tenant, such as, AVC application 501 and AVC key manager 502 in... Figure 1 As shown in AVC 132-1 (i.e., AVC#1).

[0093] AVC application 501 sends a request 510 to AVC key manager 502 for the creation of an APP key. AVC key manager 502 generates an APP key 520 based on the request from AVC application 501. AVC key manager 502 can also generate an APP identifier for AVC application 501; for example, the APP identifier could be a unique APP ID.

[0094] The AVC key manager 502 uses the public key to encrypt the 530 APP key. The public key can be the aforementioned AVC master public key, for example, which was received at 370, such as... Figure 3 As shown.

[0095] The AVC key manager 502 locally stores the encrypted application key (540). In some examples, the AVC key manager 502 can store a mapping between the encrypted application key and application identifiers (such as the application's unique ID). An example mapping could refer to... Figure 6 620 in the middle.

[0096] AVC key manager 502 sends APP identifier 550 to AVC application 501. AVC application 501 stores APP identifier 560 (such as APP unique ID).

[0097] Figure 6An example mapping 600 associated with an application key according to some example embodiments of this disclosure is shown. For a particular AVC 132 (such as AVC 132-1, i.e., AVC#1), it is assumed that multiple applications, such as APP#1 to APP#M, are installed. Each application may store its identifier. For example, AVC APP#1 stores a unique ID for APP#1 as shown at 612, AVC APP#2 stores a unique ID for APP#2 as shown at 614, AVC APP#3 stores a unique ID for APP#3 as shown at 616, ..., AVC APP#M stores a unique ID for APP#M as shown at 618. For each application, the AVC key manager stores a mapping between encrypted APP keys and APP identifiers. For example, the AVC key manager stores the mapping between the unique ID of APP#1 for AVC APP#1 and the encrypted APP#1 APP key, the mapping between the unique ID of APP#2 for AVC APP#2 and the encrypted APP#2 APP key, the mapping between the unique ID of APP#3 for AVC APP#3 and the encrypted APP#3 APP key, ..., and the mapping between the unique ID of APP#M for AVC APP#M and the encrypted APP#M APP key, as shown at 620.

[0098] Figure 7 An example process 700 for application key usage according to some example embodiments of this disclosure is illustrated. Process 700 relates to an AVC application 701, an AVC key manager 702, an SSRM 703, and a security key store 704. In some example embodiments, references are made to... Figure 1 AVC application 701 and AVC key manager 702 can be in the same AVC 132, such as AVC132-1 (i.e., AVC#1), and AVC key manager 702 can be as follows: Figure 1 The AVC#1 key manager 136 is shown. (As shown...) Figure 1 As shown, SSRM 703 can refer to SSRM 124, and security key storage 704 can refer to security key storage 112. It should be understood that, although referenced... Figure 1 Process 200 is described; however, this process flow can be applied in the same way to other communication scenarios.

[0099] AVC application 701 sends a 710 request to AVC key manager 702, whereby the request may request the use of the APP key. In some examples, the request may include an identifier of AVC application 701, such as the APP unique ID.

[0100] In response to a request received from AVC application 701, AVC key manager 702 can search for the APP key encrypted by 702. In some example embodiments, AVC key manager 702 can determine the encrypted APP key based on the APP unique ID in the request from AVC application 701. For example, refer to... Figure 6 Map 620 can be used by AVC key manager 702 to search for encrypted APP keys.

[0101] AVC Key Manager 702 sends a 730 request to SSRM 703 to decrypt the APP key. In some examples, the request to SSRM 703 may include the encrypted APP key. In some examples, the request to SSRM 703 may also include the AVC#1 identifier and / or credential information. For example, AVC Key Manager 702 may invoke SSAPI with the AVC#1 identifier and / or credential information to decrypt the APP key.

[0102] In response to a request received from the AVC key manager 702, the SSRM 703 can send a 740 request to the security key store 704 to decrypt the APP key. In some examples, the SSRM 703 can determine that the authorization information for AVC#1 can be included in the request to the security key store 704. For example, it can use... Figure 4 The mapping at 420 is shown. In some examples, a request to the security key store 704 may include an encrypted app key.

[0103] The secure key store 704 uses the private key to decrypt the 750 APP key. Specifically, the secure key store 704 can determine the private key based on the authorization information of AVC#1 in the request from SSRM 703, for example, by using... Figure 4 The mapping at position 430 is shown. The secure key store 704 can also decrypt the encrypted app key using the private key to obtain the decrypted app key, i.e., the plaintext app key.

[0104] The secure key store 704 sends the decrypted APP key to the SSRM 703 (760), and the SSRM 703 forwards the decrypted APP key to the AVC key manager 702 (770). Additionally, the decrypted APP key can be returned or provided (780) to the AVC application 701 for further use. For example, the AVC application 701 can use the APP key for signing purposes. For instance, a digital signature can be determined by the AVC application 701.

[0105] Figure 8 An example scenario 800 for key generation and management is shown according to some example embodiments of the present disclosure. Figure 8AVC 132-1 is shown as an example, and AVC 132-2 to AVC 132-N are not shown therein. As mentioned above, the secure key store 112 can be a SW-based secure memory 112-2 or a HW-based secure memory 112-4. For ease of description, it is assumed that... Figure 8 In this context, the secure key storage 112 is a secure memory 112-2 based on SW.

[0106] AVC 132-1 can request the generation of private and public keys via SSAPI 128 at (1); and SSRM 124 can forward the request to SW-based secure storage 112-2 at (2). SW-based secure storage 112-2 generates private and public keys, with the private key stored locally, and provides the public key to AVC 132-1 via SSRM 124 at (3). For example, SSRM 124 can obtain the public key from SW-based secure storage 112-2 and forward it to AVC 132-1.

[0107] Additionally, AVC 132-1 can use a public key for a specific application (such as APP#1) to generate an encrypted APP key and store the encrypted APP key in the AVC key manager 134.

[0108] In cases where the AVC 132-1 requires the use of the APP key, the decryption key request can be sent to the SW-based secure storage 112-2 at (4). For example, a detailed description may refer to... Figure 7 Steps 710 to 740 in the process. At (5), the SW-based secure storage 112-2 can decrypt the APP key using the private key and provide plaintext (or plaintext) to the AVC 132-1. For example, a detailed description may refer to Figure 7 Steps 750 to 780 in the process.

[0109] Figure 9 A flowchart of method 900 implemented on a virtualization platform such as SSRM according to some example embodiments of this disclosure is shown. At block 910, the virtualization platform receives a request for a public-private key pair from the application side associated with the tenant. At block 920, the virtualization platform sends an additional request to a secure key store for creating a public-private key pair for the application side associated with the tenant. At block 930, the virtualization platform receives the public key of the public-private key pair from the secure key store, the private key of which is locally stored in the secure key store. At block 940, the virtualization platform sends the public key to the application side associated with the tenant.

[0110] In some example embodiments, the request includes at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0111] In some example embodiments, an additional request includes: application-side authorization information associated with the tenant. In some example embodiments, the virtualization platform maintains an association between the application-side authorization information associated with the tenant and at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0112] In some example embodiments, for the application side associated with a tenant, the virtualization platform creates at least one of the following: an identifier of the application side associated with the tenant, or credential information of the application side associated with the tenant. In some example embodiments, the virtualization platform obtains authorization information of the application side associated with the tenant from a security key store. In some example embodiments, the virtualization platform generates an association between the authorization information of the application side associated with the tenant and at least one of the following: an identifier of the application side associated with the tenant, or credential information of the application side associated with the tenant.

[0113] In some example embodiments, the virtualization platform receives a key decryption request from the application side associated with the tenant, the key decryption request including an encrypted application key; sends the encrypted application key to a secure key store; receives a decrypted application key corresponding to the encrypted application key from the secure key store, the decrypted application key being determined by the secure key store based on a private key; and sends the decrypted application key to the application side associated with the tenant.

[0114] In some example embodiments, the key decryption request includes at least one of the following: an application-side identifier associated with the tenant, or application-side credential information associated with the tenant. In some example embodiments, application-side authorization information associated with the tenant and the encrypted application key are sent together to the secure key store.

[0115] In some example implementations, the application associated with the tenant maintains an association between a public key and at least one of the following: the identifier of the application associated with the tenant; or the credential information of the application associated with the tenant.

[0116] In some example implementations, the security key store maintains the association between the private key and the application-side authorization information associated with the tenant.

[0117] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0118] In some example embodiments, communication between the virtualization platform and the application side associated with the tenant is via a unified SSAPI. In some example embodiments, the unified SSAPI is provided by the virtualization platform and used by the application side associated with the tenant to use secure storage services.

[0119] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0120] Figure 10 A flowchart illustrating a method 1000 implemented on the application side associated with a tenant (such as AVC) according to some example embodiments of this disclosure is shown. At block 1010, the application side associated with the tenant sends a request for a public-private key pair to the virtualization platform. At block 1020, the application side associated with the tenant receives the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0121] In some example embodiments, the request includes at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0122] In some example implementations, the application-side identifier associated with the tenant and the application-side credentials associated with the tenant are created by the virtualization platform.

[0123] In some example embodiments, the application associated with the tenant receives a key encryption request from the application associated with the tenant. In some example embodiments, for the application associated with the tenant, the application associated with the tenant creates an identifier and key for the application associated with the tenant. In some example embodiments, the application associated with the tenant determines the encryption key based on the key using a public key. In some example embodiments, the application associated with the tenant maintains an association between the encryption key and the identifier of the application associated with the tenant.

[0124] In some example implementations, the encryption key is stored locally on the application side associated with the tenant, and the encryption key cannot be accessed by different application sides associated with different tenants.

[0125] In some example implementations, when the application side associated with the tenant is disabled, the encrypted key stored on the application side associated with the tenant disappears.

[0126] In some example embodiments, the application associated with the tenant sends a key decryption request to the virtualization platform, wherein the key decryption request includes an encrypted application key; and receives a decrypted application key from the virtualization platform, wherein the decrypted application key is determined by a secure key store based on a private key.

[0127] In some example embodiments, the key decryption request includes at least one of the following: an application-side identifier associated with the tenant, or application-side credential information associated with the tenant.

[0128] In some example embodiments, the application associated with the tenant maintains an association between a public key and at least one of the following: the identifier of the application associated with the tenant; or the credential information of the application associated with the tenant.

[0129] In some example embodiments, the virtualization platform maintains authorization information for the application side associated with the tenant and an association with at least one of the following: the identifier of the application side associated with the tenant; or the credential information of the application side associated with the tenant.

[0130] In some example implementations, the security key store maintains the association between the private key and the application-side authorization information associated with the tenant.

[0131] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0132] In some example embodiments, communication between the virtualization platform and the application side associated with the tenant is via a unified SSAPI. In some example embodiments, the unified SSAPI is provided by the virtualization platform and used by the application side associated with the tenant to use secure storage services.

[0133] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0134] Figure 11 A flowchart illustrating a method 1100 implemented at a secure key store according to some example embodiments of the present disclosure is shown. At block 1110, the secure key store receives a request from the virtualization platform for creating a public-private key pair for the application side associated with a tenant. At block 1120, for the application side associated with the tenant, the secure key store creates a public-private key pair including a public key and a private key. At block 1130, the secure key store sends the public key of the public-private key pair to the virtualization platform, the private key of which is locally stored in the secure key store.

[0135] In some example implementations, the request includes: application-side authorization information associated with the tenant.

[0136] In some example implementations, the security key store maintains the association between the private key and the application-side authorization information associated with the tenant.

[0137] In some example embodiments, the security key store receives encrypted application keys from the virtualization platform for the application side associated with the tenant. In some example embodiments, for the application side associated with the tenant, the security key store determines the decryption application key for the encrypted application key using a private key. In some example embodiments, the security key store sends the decrypted application key to the virtualization platform.

[0138] In some example implementations, the application-side authorization information associated with the tenant and the encrypted application key are received together.

[0139] In some example embodiments, the application associated with the tenant maintains an association between a public key and at least one of the following: the identifier of the application associated with the tenant; or the credential information of the application associated with the tenant.

[0140] In some example embodiments, the virtualization platform maintains authorization information for the application side associated with the tenant and an association with at least one of the following: the identifier of the application side associated with the tenant; or the credential information of the application side associated with the tenant.

[0141] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0142] In some example implementations, the unified SSAPI is provided by the virtualization platform and used on the application side associated with the tenant to use secure storage services.

[0143] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0144] In some example embodiments, the apparatus capable of performing method 900 (e.g., SSRM) may include components for performing the corresponding steps of method 900. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0145] In some example embodiments, the apparatus includes: components for receiving a request for a public-private key pair from an application side associated with a tenant; components for sending a further request to a secure key store for creating a public-private key pair for the application side associated with the tenant; components for receiving the public key of the public-private key pair from the secure key store, the private key of the public-private key pair being locally stored in the secure key store; and components for sending the public key to the application side associated with the tenant.

[0146] In some example embodiments, the request includes at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0147] In some example embodiments, additional requests include: application-side authorization information associated with the tenant, wherein the apparatus further includes components for maintaining the application-side authorization information associated with the tenant and at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0148] In some example embodiments, the apparatus further includes: components for creating at least one of the following for an application side associated with a tenant: an identifier of the application side associated with the tenant, or credential information of the application side associated with the tenant; components for obtaining authorization information of the application side associated with the tenant from a security key store; and components for generating an association between the authorization information of the application side associated with the tenant and at least one of the following: an identifier of the application side associated with the tenant, or credential information of the application side associated with the tenant.

[0149] In some example embodiments, the apparatus further includes: components for receiving a key decryption request from an application side associated with a tenant, the key decryption request including an encrypted application key; components for sending the encrypted application key to a secure key store; components for receiving a decrypted application key corresponding to the encrypted application key from the secure key store, the decrypted application key being determined by the secure key store based on a private key; and components for sending the decrypted application key to the application side associated with the tenant.

[0150] In some example embodiments, the key decryption request includes at least one of the following: an application-side identifier associated with the tenant, or application-side credential information associated with the tenant; and wherein the application-side authorization information associated with the tenant and the encrypted application key are sent together to the secure key store.

[0151] In some example embodiments, the application associated with the tenant maintains an association between a public key and at least one of the following: the identifier of the application associated with the tenant; or the credential information of the application associated with the tenant.

[0152] In some example implementations, the security key store maintains the association between the private key and the application-side authorization information associated with the tenant.

[0153] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0154] In some example embodiments, communication between the device and the application side associated with the tenant is via a unified SSAPI. In some example embodiments, the unified SSAPI is provided by the device and used by the application side associated with the tenant to use secure storage services.

[0155] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0156] In some example embodiments, the apparatus capable of performing method 1000 (e.g., AVC) may include components for performing the corresponding steps of method 1000. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0157] In some example embodiments, the apparatus includes: a component for sending a request for a public-private key pair to a virtualization platform; and a component for receiving the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

[0158] In some example embodiments, the request includes at least one of the following: an application-side identifier associated with the tenant; or application-side credential information associated with the tenant.

[0159] In some example implementations, the application-side identifier associated with the tenant and the application-side credentials associated with the tenant are created by the virtualization platform.

[0160] In some example embodiments, the apparatus further includes: components for receiving a key encryption request from an application associated with a tenant; components for creating an identifier and key for the application associated with the tenant; components for determining an encryption key based on the key using a public key; and components for maintaining an association between the encryption key and the identifier of the application associated with the tenant.

[0161] In some example embodiments, the encryption key is stored locally in the device and cannot be accessed by different application sides associated with different tenants.

[0162] In some example implementations, the encrypted key stored on the device disappears when the application side associated with the tenant is disabled.

[0163] In some example embodiments, the apparatus further includes: a component for sending a key decryption request to a virtualization platform, wherein the key decryption request includes an encrypted application key; and a component for receiving a decrypted application key from the virtualization platform, wherein the decrypted application key is determined by a secure key storage based on a private key.

[0164] In some example embodiments, the key decryption request includes at least one of the following: an application-side identifier associated with the tenant, or application-side credential information associated with the tenant.

[0165] In some example embodiments, the apparatus further includes: a component for maintaining an association between a public key and at least one of the following: an application-side identifier associated with a tenant; or application-side credential information associated with a tenant.

[0166] In some example embodiments, the virtualization platform maintains authorization information for the application side associated with the tenant and an association with at least one of the following: the identifier of the application side associated with the tenant; or the credential information of the application side associated with the tenant.

[0167] In some example implementations, the security key store maintains the association between the private key and the application-side authorization information associated with the tenant.

[0168] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0169] In some example implementations, communication between the virtualization platform and the application side associated with the tenant is via the Unified Secure Storage Application Interface (SSAPI).

[0170] In some example implementations, the unified SSAPI is provided by the virtualization platform and used on the application side associated with the tenant to use secure storage services.

[0171] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0172] In some example embodiments, the apparatus capable of performing method 1100 (e.g., a secure key storage) may include components for performing the corresponding steps of method 1100. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0173] In some example embodiments, the apparatus includes: components for receiving from a virtualization platform a request to create a public-private key pair for an application side associated with a tenant; components for creating a public-private key pair including a public key and a private key for the application side associated with the tenant; and components for sending the public key of the public-private key pair to the virtualization platform, wherein the private key of the public-private key pair is stored locally in the apparatus.

[0174] In some example implementations, the request includes: application-side authorization information associated with the tenant.

[0175] In some example embodiments, the apparatus further includes an associated component for maintaining a private key and application-side authorization information associated with the tenant.

[0176] In some example embodiments, the apparatus further includes: components for receiving an encrypted application key from the virtualization platform for an application associated with a tenant; components for determining a decryption application key for the encrypted application key using a private key for the application associated with the tenant; and components for sending the decrypted application key to the virtualization platform.

[0177] In some example implementations, the application-side authorization information associated with the tenant and the encrypted application key are received together.

[0178] In some example embodiments, the application associated with the tenant maintains an association between a public key and at least one of the following: the identifier of the application associated with the tenant; or the credential information of the application associated with the tenant.

[0179] In some example embodiments, the virtualization platform maintains authorization information for the application side associated with the tenant and an association with at least one of the following: the identifier of the application side associated with the tenant; or the credential information of the application side associated with the tenant.

[0180] In some example embodiments, the application side associated with a tenant includes: application / virtualized network function (VNF) / containerized network function (CNF) (AVC) associated with the tenant.

[0181] In some example implementations, the unified SSAPI is provided by the virtualization platform and used on the application side associated with the tenant to use secure storage services.

[0182] In some example implementations, the private key of the public-private key pair is not visible to the application side associated with the tenant.

[0183] Figure 12 A simplified block diagram of a device 1200 suitable for implementing some example embodiments of the present disclosure is shown. The device 1200 can be provided to implement a communication device, such as an AVC, virtualization platform, or secure key store as described above. As shown, the device 1200 includes one or more processors 1210, one or more memories 1220 coupled to the processors 1210, and one or more communication modules 1240 coupled to the processors 1210.

[0184] The communication module 1240 is used for bidirectional communication. The communication module 1240 has at least one antenna to facilitate communication. The communication interface can represent any interface required for communication with other network elements.

[0185] Processor 1210 can be of any type suitable for a local technology network, and by way of non-limiting example, can include one or more of the following: general-purpose computer, special-purpose computer, microprocessor, digital signal processor (DSP), and processor based on a multi-core processor architecture. Device 1200 can have multiple processors, such as application-specific integrated circuit chips that are time-dependent on a clock synchronized with the main processor.

[0186] Memory 1220 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 1224, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, hard disk, optical disc (CD), digital video disc (DVD), and other magnetic and / or optical memories. Examples of volatile memories include, but are not limited to, random access memory (RAM) 1222 and other volatile memories that will not persist during power-off periods.

[0187] Computer program 1230 includes computer-executable instructions that are executed by the associated processor 1210. Program 1230 may be stored in ROM 1224. Processor 1210 may perform any appropriate actions and processes by loading program 1230 into RAM 1222.

[0188] Embodiments of this disclosure can be implemented by means of program 1230, enabling device 1200 to execute reference... Figures 2 to 11 Any process discussed in this disclosure. Embodiments of this disclosure may also be implemented by hardware or by a combination of software and hardware.

[0189] In some example embodiments, program 1230 may be tangibly contained in a computer-readable medium, which may be included in device 1200 (such as memory 1220) or other storage devices accessible by device 1200. Device 1200 may load program 1230 from the computer-readable medium into RAM 1222 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc.

[0190] Figure 13 A block diagram of an example of a computer-readable medium 1300 according to some exemplary embodiments of the present disclosure is shown. The computer-readable medium 1300 has a program 1230 stored thereon. It should be noted that although the computer-readable medium 1300... Figure 13The program is depicted in the form of a CD or DVD, but the computer-readable medium 1300 may be any other form suitable for carrying or storing the program 1230.

[0191] Generally, the various embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software, which can be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of this disclosure are shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, as non-limiting examples, the blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0192] This disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions (such as those included in program modules) that are executed in a device on a target real or virtual processor to perform the above-mentioned references. Figures 9 to 11 Any of the methods described herein. Typically, a program module includes routines, programs, libraries, objects, classes, components, data structures, etc., that perform a specific task or implement a specific abstract data type. In various embodiments, the functionality of a program module can be combined or split among program modules as desired in various embodiments. The machine-executable instructions of a program module can execute on a local or distributed device. In a distributed device, a program module can reside on both local and remote storage media.

[0193] Program code used to perform the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that, when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine (as a standalone software package), partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0194] In the context of this disclosure, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, etc.

[0195] Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable media can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specific examples of computer-readable storage media will include electrical connections having one or more wires, portable computer floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable optical disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. As used herein, the term "non-transient" is a limitation on the medium itself (i.e., tangible, not signaling), not a limitation on the persistence of data storage (e.g., RAM and ROM).

[0196] Furthermore, although operations are described in a specific order, this should not be construed as requiring the execution of such operations in the specific order or sequence shown, or the execution of all shown operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure, but rather as descriptions of features that may be specific to particular embodiments. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0197] Although this disclosure has been described in language specific to structural features and / or methodological actions, it should be understood that the disclosure as defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features or actions described above are disclosed as exemplary forms of implementing the claims.

Claims

1. An apparatus comprising: At least one processor; as well as At least one memory storing instructions, which, when executed by the at least one processor, cause the means to at least: Receive requests for public / private key pairs from the application side associated with the tenant; Send an additional request to the security key store for creating the public-private key pair for the application side associated with the tenant; The public key of the public-private key pair is received from the secure key storage, and the private key of the public-private key pair is stored locally in the secure key storage; as well as Send the public key to the application side associated with the tenant.

2. The apparatus of claim 1, wherein the request comprises at least one of the following: The application-side identifier associated with the tenant; or The application-side credentials associated with the tenant.

3. The apparatus of claim 2, wherein the additional request includes application-side authorization information associated with the tenant, wherein the apparatus maintains an association between the application-side authorization information associated with the tenant and at least one of the following: The identifier associated with the tenant on the application side; or The credential information associated with the tenant on the application side.

4. The apparatus of claim 3, wherein the apparatus is further configured to: For the application side associated with the tenant, create at least one of the following: the identifier of the application side associated with the tenant, or the credential information of the application side associated with the tenant; Obtain the authorization information associated with the tenant from the application side of the security key storage; as well as Generate the authorization information associated with the tenant on the application side and the association of at least one of the following: the identifier of the application side associated with the tenant, or the credential information of the application side associated with the tenant.

5. The apparatus according to any one of claims 1 to 4, wherein the apparatus is further configured to: Receive a key decryption request from the application side associated with the tenant, the key decryption request including an encrypted application key; Send the encrypted application key to the security key store; The security key store receives a decrypted application key corresponding to the encrypted application key, the decrypted application key being determined by the security key store based on the private key; as well as The decrypted application key is sent to the application side associated with the tenant.

6. The apparatus according to any one of claims 1 to 5, wherein the key decryption request includes at least one of: an application-side identifier associated with the tenant, or application-side credential information associated with the tenant; and The authorization information of the application side associated with the tenant and the encrypted application key are sent together to the security key storage.

7. The apparatus according to any one of claims 1 to 6, wherein the application side associated with the tenant maintains an association between the public key and at least one of the following: The application-side identifier associated with the tenant; or The application-side credentials associated with the tenant.

8. The apparatus according to any one of claims 1 to 7, wherein the security key storage maintains the association between the private key and the application-side authorization information associated with the tenant.

9. The apparatus of any one of claims 1 to 8, wherein the application side associated with the tenant comprises: The application / virtualized network function (VNF) / containerized network function (CNF) associated with the tenant (AVC).

10. The apparatus according to any one of claims 1 to 9, wherein communication between the apparatus and the application side associated with the tenant is via a unified secure storage application interface (SSAPI).

11. The apparatus of claim 10, wherein the unified SSAPI is provided by the apparatus and used on the application side associated with the tenant to use secure storage services.

12. The apparatus according to any one of claims 1 to 11, wherein the private key of the public-private key pair is not visible to the application side associated with the tenant.

13. An apparatus comprising an application side associated with a tenant, the apparatus comprising: At least one processor; as well as At least one memory storing instructions, which, when executed by the at least one processor, cause the means to at least: Send a request for the public / private key pair to the virtualization platform; as well as The public key of the public-private key pair is received from the virtualization platform. The public-private key pair is generated by a secure key store, and the private key of the public-private key pair is stored locally in the secure key store.

14. The apparatus of claim 13, wherein the request comprises at least one of the following: The application-side identifier associated with the tenant; or The application-side credentials associated with the tenant.

15. The apparatus of claim 14, wherein the identifier of the application side associated with the tenant and the credential information of the application side associated with the tenant are created by the virtualization platform.

16. The apparatus according to any one of claims 13 to 15, wherein the apparatus is further configured to: Receive a key encryption request from the application associated with the tenant; For the application associated with the tenant, create an identifier and key for the application associated with the tenant; The encryption key is determined based on the public key using the public key; as well as Maintain the association between the encryption key and the identifier of the application associated with the tenant.

17. The apparatus of claim 16, wherein the encryption key is stored locally at the apparatus and the encryption key cannot be accessed by different application sides associated with different tenants.

18. The apparatus of claim 16 or 17, wherein the encrypted key stored in the apparatus is lost when the application side associated with the tenant is disabled.

19. The apparatus according to any one of claims 13 to 18, wherein the apparatus is further configured to: Sending a key decryption request to the virtualization platform, wherein the key decryption request includes an encrypted application key; and The application key is received from the virtualization platform as a decrypted application key of the encrypted application key, wherein the decrypted application key is determined by the security key storage based on the private key.

20. The apparatus of claim 19, wherein the key decryption request includes at least one of the following: an identifier of the application side associated with the tenant, or credential information of the application side associated with the tenant.

21. The apparatus according to any one of claims 13 to 20, wherein the apparatus maintains an association between the public key and at least one of the following: The application-side identifier associated with the tenant; or The application-side credentials associated with the tenant.

22. The apparatus of claim 21, wherein the virtualization platform maintains the application-side authorization information associated with the tenant and an association with at least one of the following: The identifier associated with the tenant on the application side; or The credential information associated with the tenant on the application side.

23. The apparatus of claim 22, wherein the security key storage maintains the association between the private key and the authorization information on the application side associated with the tenant.

24. The apparatus of any one of claims 13 to 23, wherein the application side associated with the tenant comprises: The application / virtualized network function (VNF) / containerized network function (CNF) associated with the tenant (AVC).

25. The apparatus of any one of claims 13 to 24, wherein communication between the virtualization platform and the application side associated with the tenant is via a unified secure storage application interface (SSAPI).

26. The apparatus of claim 24, wherein the unified SSAPI is provided by the virtualization platform and is used by the application side associated with the tenant to use secure storage services.

27. The apparatus of any one of claims 13 to 26, wherein the private key of the public-private key pair is not visible to the application side associated with the tenant.

28. An apparatus comprising: At least one processor; as well as At least one memory storing instructions, which, when executed by the at least one processor, cause the means to at least: Receive a request from the virtualization platform to create a public-private key pair for the application side associated with the tenant; For the application side associated with the tenant, create the public-private key pair, which includes a public key and a private key; as well as The public key of the public-private key pair is sent to the virtualization platform, and the private key of the public-private key pair is stored locally in the device.

29. The apparatus of claim 28, wherein the request comprises: The application-side authorization information associated with the tenant.

30. The apparatus of claim 29, wherein the apparatus is further configured to: Maintain the association between the private key and the authorization information on the application side associated with the tenant.

31. The apparatus according to any one of claims 28 to 30, wherein the apparatus is further configured to: Receive from the virtualization platform the encrypted application key associated with the application side of the tenant; For the application side associated with the tenant, the application key for decrypting the encrypted application key is determined using the private key; and Send the decrypted application key to the virtualization platform.

32. The apparatus of claim 31, wherein the application-side authorization information associated with the tenant and the encrypted application key are received together.

33. The apparatus of any one of claims 28 to 32, wherein the application side associated with the tenant maintains an association between the public key and at least one of the following: The application-side identifier associated with the tenant; or The application-side credentials associated with the tenant.

34. The apparatus of claim 33, wherein the virtualization platform maintains the application-side authorization information associated with the tenant and an association with at least one of the following: The identifier associated with the tenant on the application side; or The credential information associated with the tenant on the application side.

35. The apparatus of any one of claims 28 to 34, wherein the application side associated with the tenant comprises: The application / virtualized network function (VNF) / containerized network function (CNF) associated with the tenant (AVC).

36. The apparatus of any one of claims 28 to 35, wherein the unified secure storage application interface (SSAPI) is provided by the virtualization platform and is used by the application side associated with the tenant to use the secure storage service.

37. The apparatus of any one of claims 28 to 36, wherein the private key of the public-private key pair is not visible to the application side associated with the tenant.

38. A method comprising: At the virtualization platform, requests for public-private key pairs are received from the application side associated with the tenant; Send a further request to the security key store for creating the public-private key pair for the application side associated with the tenant; The public key of the public-private key pair is received from the secure key storage, and the private key of the public-private key pair is stored locally in the secure key storage; as well as Send the public key to the application side associated with the tenant.

39. A method comprising: On the application side associated with the tenant, a request for the public-private key pair is sent to the virtualization platform; as well as The public key of the public-private key pair is received from the virtualization platform. The public-private key pair is generated by a secure key store, and the private key of the public-private key pair is stored locally in the secure key store.

40. A method comprising: At the secure key store, a request is received from the virtualization platform to create a public-private key pair for the application side associated with the tenant; For the application side associated with the tenant, create the public-private key pair, which includes a public key and a private key; as well as The public key of the public-private key pair is sent to the virtualization platform, and the private key of the public-private key pair is stored locally in the device.

41. An apparatus comprising: A component used at the virtualization platform to receive requests for public-private key pairs from the application side associated with the tenant; A component for sending a request to the security key store for creating the public-private key pair for the application side associated with the tenant; A component for receiving the public key of the public-private key pair from the secure key storage, wherein the private key of the public-private key pair is stored locally in the secure key storage; as well as A component used to send the public key to the application side associated with the tenant.

42. An apparatus comprising: A component used to send requests for public-private key pairs to the virtualization platform on the application side associated with the tenant; as well as A component for receiving the public key of the public-private key pair from the virtualization platform, the public-private key pair being generated by a secure key store, and the private key of the public-private key pair being locally stored in the secure key store.

43. An apparatus comprising: A component used to receive requests from the virtualization platform at a secure key store for creating public-private key pairs for application-side use associated with tenants; A component for creating a public-private key pair, including a public key and a private key, for the application side associated with the tenant; as well as A component for sending the public key of the public-private key pair to the virtualization platform, wherein the private key of the public-private key pair is stored locally in the device.

44. A computer-readable medium comprising program instructions for causing a device to perform at least the method according to any one of claims 38 to 40.

Images