A method for creating a virtualized network function instance, VNFI, comprising: generating, by a hardware-mediated execution enclave, HMEE, in a network functions virtualization, NFV, system, a private-public key pair, wherein a to-be-instantiated VNFI is deployed in the NFV system, and the HMEE and a to-be-instantiated first virtualized network function component, VNFC, are deployed in the VNFI; sending, by the HMEE, a public key in the private-public key pair to a security control device; receiving, by the HMEE, an encrypted security credential from the security control device, wherein the encrypted security credential is obtained by encrypting a security credential of a package of the first VNFC based on the public key, and the security credential is used to decrypt the package of the first VNFC; and decrypting, by the HMEE, the encrypted security credential based on a private key in the private-public key pair, to obtain the security credential, wherein an instantiated second VNFC is deployed in the VNFI; and the sending, by the HMEE, a public key in the private-public key pair to a security control device comprises: sending, by the HMEE, the public key in the private-public key pair to the security control device by using the second VNFC; and the receiving, by the HMEE, an encrypted security credential from the security control device comprises: receiving, by the HMEE, the encrypted security credential from the security control device by using the second VNFC. generating, by a hardware-mediated execution enclave, HMEE, in a network functions virtualization, NFV, system, a private-public key pair, wherein a to-be-instantiated VNFI is deployed in the NFV system, and the HMEE and a to-be-instantiated first virtualized network function component, VNFC, are deployed in the VNFI; sending, by the HMEE, a public key in the private-public key pair to a security control device; receiving, by the HMEE, an encrypted security credential from the security control device, wherein the encrypted security credential is obtained by encrypting a security credential of a package of the first VNFC based on the public key, and the security credential is used to decrypt the package of the first VNFC; and decrypting, by the HMEE, the encrypted security credential based on a private key in the private-public key pair, to obtain the security credential, wherein an instantiated second VNFC is deployed in the VNFI; and the sending, by the HMEE, a public key in the private-public key pair to a security control device comprises: sending, by the HMEE, the public key in the private-public key pair to the security control device by using the second VNFC; and the receiving, by the HMEE, an encrypted security credential from the security control device comprises: receiving, by the HMEE, the encrypted security credential from the security control device by using the second VNFC. sending, by the HMEE, the public key in the private-public key pair to the security control device by using the second VNFC; and the receiving, by the HMEE, an encrypted security credential from the security control device comprises: receiving, by the HMEE, the encrypted security credential from the security control device by using the second VNFC.