Patent Description:
A network functions virtualization (NFV) technology enables some network functions to be implemented on commodity hardware in a software manner. For example, in a telecommunications network, the NFV technology may be used to implement some telecommunications network functions in a universal cloud server, switch, and storage, to deploy a network service fast and efficiently. <CIT> describes methods and an apparatuses for technologies for bootstrapping virtual network functions in a network functions virtualization, NFV network architecture include a virtual network function, VNF, bootstrap service, VBS, in secure network communication with a VBS agent of a VNF instance. The VBS agent is configured to execute a secure VNF bootstrap capture protocol in the NFV network architecture. Accordingly, the VBS agent can be configured to register with the VBS via secure communications transmitted between the VBS and the VBS agent. The secure communications include transmitting a security quote from a TEE of a platform on which the VNF instance is instantiated and a security credential request to the VBS, as well as receiving a security credential in response to validating the security quote and the security credential request.

Currently, there is an existing method for creating a virtualized network function instance (VNFI): After resources (which, for example, include a network resource, a compute resource, and a storage resource) used to create the VNFI are successfully requested, a virtual machine (Virtual Machine, VM) may be created on the requested resources, and then packages used to implement different functions are installed on the virtual machine, to create the VNFI for satisfying different service requirements. Usually, the VNFI may include one or more virtualized network function components (VNF Component, VNFC), and each VNFC may correspond to one service function. In some cases, it may be desired that some VNFCs are not visible to all. For example, to protect technical secrets of an enterprise, such as a core algorithm and a parameter, some VNFCs may be visible for use, but core algorithms and parameters internal to the VNFCs are confidential and kept unavailable for the ordinary business personnel. Therefore, a method needs to be provided to ensure security of a sensitive VNFC.

This application provides a method and an apparatus for creating a VNFI as defined by the appended claims, to improve security of a sensitive VNFC.

According to a first aspect, a method for creating a VNFI is provided, including:.

According to the foregoing technical solution, the private-public key pair is generated by the HMEE. This can ensure security of the private-public key pair, and prevent the private-public key pair from being obtained or tampered with by a third party. In addition, the security control device encrypts the security credential of the package of the first VNFC based on the public key of the private-public key pair, and the encrypted security credential can be decrypted only by using the private key generated by the HMEE, thereby ensuring security of the security credential during transmission. Further, a decryption process of the security credential is performed in a secure execution environment provided by the HMEE, so that the private key, the security credential, and the package of the first VNFC are unavailable for the outside, decryption of the security credential is invisible to the outside, and therefore an installation process of the first VNFC is invisible to the outside. In this way, security of the first VNFC can be ensured.

With reference to the first aspect, in some implementations of the first aspect, an instantiated second VNFC is deployed in the VNFI; and
the sending, by the HMEE, a public key in the private-public key pair to a security control device includes:.

To further ensure a secure execution environment of the HMEE, an interface of the HMEE may be defined as being capable of communicating only with a common VNFC (for example, the second VNFC) in the VNFI, and the common VNFC is used for forwarding information sent by the HMEE or forwarding information to the HMEE.

With reference to the first aspect, in some implementations of the first aspect, the method further includes:
receiving, by the HMEE, an instantiation complete message from the second VNFC.

After instantiation of the second VNFC, a communication connection relationship with the MANO is established, and then the second VNFC is capable of forwarding information to the HMEE.

With reference to the first aspect, in some implementations of the first aspect, the method further includes:
sending, by the HMEE, an identifier of the first VNFC to the security control device.

In some cases, the security control device may manage identifiers of a plurality of sensitive VNFCs, and therefore may encrypt, based on an identifier of a VNFC, a security credential of a package of the corresponding VNFC and then send the encrypted security credential.

Optionally, the sending, by the HMEE, an identifier of the first VNFC to the security control device includes:
sending, by the HMEE, the identifier of the first VNFC to the security control device by using the second VNFC.

With reference to the first aspect, in some implementations of the first aspect, the method further includes:
sending, by the HMEE, a hash of the public key to the security control device.

To avoid a possible security risk that is caused because the public key is tampered with by a third party during transmission, the security control device may perform integrity verification on the received public key based on the hash of the public key, and deliver the security credential when the verification succeeds, thereby ensuring secure delivery of the security credential.

Optionally, the sending, by the HMEE, a hash of the public key to the security control device includes:
sending, by the HMEE, the hash of the public key to the security control device by using the second VNFC.

With reference to the first aspect, in some implementations of the first aspect, the method further includes:
sending, by the HMEE, a host identifier and/or a hash of code to the security control device, where the host identifier is an identifier of a host on which the HMEE is installed, and the code is code executed by the HMEE.

The security control device may perform authentication on the host identifier and/or the code, to exclude a possibility that a third party (for example, a device that is not authenticated by the security control device) masquerades as the HMEE to send the public key, or that a third party controls the HMEE and uses unauthorized code attempt to obtain the security credential from the security control device. The security credential is delivered only when the host identifier and/or the code are/is successfully authenticated, to ensure secure delivery of the security credential.

Optionally, the sending, by the HMEE, a host identifier and/or a hash of code to the security control device includes:
sending, by the HMEE, the host identifier and/or the hash of the code to the security control device by using the second VNFC.

According to a second aspect, a method for creating a VNFI is provided, including:.

With reference to the second aspect, in some implementations of the second aspect, an instantiated second VNFC is deployed in the VNFI; and
the receiving, by a security control device, a public key from an HMEE in an NFV system includes:.

With reference to the second aspect, in some implementations of the second aspect, the method further includes:
receiving, by the security control device, an identifier of the first VNFC from the HMEE.

Optionally, the receiving, by the security control device, an identifier of the first VNFC from the HMEE includes:
receiving, by the security control device, the identifier of the first VNFC from the HMEE by using the second VNFC.

With reference to the second aspect, in some implementations of the second aspect, the method further includes:.

Optionally, the receiving, by the security control device, a hash of the public key from the HMEE includes:
receiving, by the security control device, the hash of the public key from the HMEE by using the second VNFC.

To avoid that the security credential is obtained by a third party, authentication may be performed on the HMEE, and the security credential is delivered only when the authentication succeeds, thereby ensuring secure delivery of the security credential.

With reference to the second aspect, in some implementations of the second aspect, the authenticating, by the security control device, the HMEE includes:.

The security control device may perform authentication on the host identifier and/or the code, to exclude a possibility that a third party (for example, a device that is not authenticated by the security control device) masquerades as the HMEE to send the public key, or that a third party controls the HMEE and uses unauthorized code to attempt to obtain the security credential from the security control device. The security credential is delivered only when the host identifier and/or the code are/is successfully authenticated, to ensure secure delivery of the security credential.

Optionally, the receiving, by the security control device, a host identifier and/or a hash of code from the HMEE includes:
receiving, by the security control device, the host identifier and/or the hash of the code from the HMEE by using the second VNFC.

According to a third aspect, an apparatus for creating a VNFI is provided, including units configured to perform the method in the first aspect or any possible implementation of the first aspect.

According to a fourth aspect, an apparatus for creating a VNFI is provided, including units configured to perform the method in the second aspect or any possible implementation of the second aspect.

According to a fifth aspect, an apparatus for creating a VNFI is provided, including a communications interface, a processor, and a memory, where the processor is configured to control the communications interface to receive and send a signal, the memory is configured to store a computer program, and the processor is configured to invoke the computer program from the memory and run the computer program, so that the apparatus performs the method in the first aspect or any possible implementation of the first aspect.

According to a sixth aspect, an apparatus for creating a VNFI is provided, including a communications interface, a processor, and a memory, where the processor is configured to control the communications interface to receive and send a signal, the memory is configured to store a computer program, and the processor is configured to invoke the computer program from the memory and run the computer program, so that the apparatus performs the method in the second aspect or any possible implementation of the second aspect.

According to a seventh aspect, a computer program product is provided, where the computer program product includes computer program code, and when the computer program code is run on an apparatus for creating a VNFI, the apparatus is enabled to perform the method in the first aspect or any possible implementation of the first aspect.

According to an eighth aspect, a computer program product is provided, where the computer program product includes computer program code, and when the computer program code is run on an apparatus for creating a VNFI, the apparatus is enabled to perform the method in the second aspect or any possible implementation of the second aspect.

According to a ninth aspect, a computer-readable medium is provided. The computer-readable medium stores program code, and the program code includes an instruction used to perform the method in the first aspect or any possible implementation of the first aspect.

According to a tenth aspect, a computer-readable medium is provided. The computer-readable medium stores program code, and the program code includes an instruction used to perform the method in the second aspect or any possible implementation of the second aspect.

The technical solutions of the embodiments of this application may be applied to various communications systems, such as a global system for mobile communications (GSM), a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) system, a general packet radio service (GPRS), a long term evolution (LTE) system, an LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), a universal mobile telecommunications system (UMTS), a worldwide interoperability for microwave access (WiMAX) communications system, a future 5th generation (<NUM>) system, or a new radio (NR) system.

For ease of understanding the embodiments of this application, concepts related to this application are first briefly described.

Virtual machine: A virtual machine is a complete computer system emulated by software, having complete hardware system functions and running in a completely isolated environment. In other words, the virtual machine may be a virtual device emulated on a physical device by using virtual machine software. After a user logs in to a virtual machine system, all operations can be performed in an independent virtual system. For example, the user can independently install and run software, store data, have an independent desktop of the user, and access network resources. For application programs running on virtual machines, the virtual machines operate in the same way as real physical devices.

Virtualized network function (VNF): A VNF may also be referred to as a virtualized network element, and may correspond to a physical network function in a conventional non-virtualized network. The VNF may include a plurality of lower-level components. Optionally, one VNF may be deployed on one or more VMs.

Virtualized network function instance (VNF Instance, VNFI): A VNFI can be created after instantiation of a VNF. The instantiation herein may include: requesting resources (which, for example, include a compute resource, a network resource, and a storage resource), installing and running the VNFI on the requested resources, and completing related configuration on the related resources, and the like, so that the VNF can perform a corresponding function of the VNF on hardware. The VNFI is a result obtained after component machines have been instantiated and connected to each other. One VNFI may include one or more virtualized network function components (Virtualized Network Function Component, VNFC), and each VNFC may be carried on one or more VMs.

Virtualized network function component (VNF Component, VNFC): A VNFC is an internal component of the VNF. An instance of each VNFC may be mapped onto one or more VMs.

Hardware-mediated execution enclave (HMEE): An HMEE is an area of process space and memory within a host (for example, VM) system environment, and can implement an instruction related to the area and protect confidentiality and integrity of data. The HMEE may be implemented in a combination of software and hardware.

With reference to <FIG>, the following describes in detail an NFV system applicable to a method and an apparatus for creating a VNFI according to an embodiment of this application.

<FIG> is a schematic architectural diagram of an NFV system <NUM> applicable to a method and an apparatus for creating a VNFI according to an embodiment of this application. The NFV system <NUM> may be run on a server. The server may include a processor, a hard disk, a memory, a system bus, and the like, and is similar to a general-purpose computer architecture. A function of the server may be implemented by one physical device, or by a cluster of physical devices. This is not limited in the embodiments of this application. In addition, the NFV system <NUM> may be implemented by using various networks, for example, a data center network, a service provider network, or a local area network (LAN, Local Area Network). As shown in <FIG>, the NFV system <NUM> may include:.

The MANO <NUM> may include an orchestrator (NFV Orchestrator, NFVO) <NUM>, one or more VNF managers (VNFM) <NUM>, and one or more virtualized infrastructure managers (VIM) <NUM>.

The NFVI <NUM> may include a hardware resource layer that includes computing hardware <NUM>, storage hardware <NUM>, and network hardware <NUM>, a virtualization layer, and a virtual resource layer that includes virtual computing <NUM> (such as a virtual machine), virtual storage <NUM>, and a virtual network <NUM>. The computing hardware <NUM> may be a dedicated processor, or a general-purpose processor configured to provide processing and computing functions. The storage hardware <NUM> is configured to provide a storage capability. The storage capability may be provided by the storage hardware <NUM> (for example, a local memory of a server), or may be provided by using a network (for example, a server is connected to a network storage device by using a network). The network hardware <NUM> may be a switch, a router, and/or another network device. The network hardware <NUM> is configured to implement communication between a plurality of devices, where the plurality of devices are connected in a wireless or wired manner. The virtualization layer in the NFVI <NUM> is used to abstract a hardware resource in the hardware resource layer, and decouple the VNF <NUM> from a physical layer to which the hardware resource belongs, to provide a virtual resource for the VNF.

As shown in <FIG>, virtual resources may include the virtual computing <NUM>, the virtual storage <NUM>, and the virtual network <NUM>. The virtual computing <NUM> and the virtual storage <NUM> may be used to provide the virtual resource for the VNF <NUM> in a form of the virtual machine or another virtual container. For example, one or more VNFs <NUM> may be deployed on one or more virtual machines. The virtualization layer abstracts the network hardware <NUM> to form the virtual network <NUM>. The virtual network <NUM>, such as a virtual switch (Vswitch) is configured to implement communication between a plurality of virtual machines, or between a plurality of other types of virtual containers that carry VNFs. Virtualization of the network hardware may be implemented by using technologies such as a virtual LAN (VLAN), a virtual private local area network service (VPLS, Virtual Private LAN Service), a virtual extensible local area network (VxLAN), or network virtualization using generic routing encapsulation (NVGRE).

The OSS/BSS <NUM> is mainly oriented to a telecommunications operator, and provides an integrated network management and business operation function, including network management (such as fault monitoring and network information collection), charging management, customer service management, and the like. The service, VNF and infrastructure description <NUM> is described in detail in the standard ETSI GS NFV <NUM> v1. Details are not described herein in this embodiment of this application.

The MANO <NUM> may be configured to monitor and manage the VNF <NUM> and the NFVI <NUM>. The NFVO <NUM> may communicate with the one or more VNFMs <NUM> to implement a resource-related request, send configuration information to the VNFM <NUM>, and collect status information of the VNF <NUM>. In addition, the NFVO <NUM> may further communicate with the VIM <NUM>, to implement resource allocation, and/or implement exchange of configuration information and status information of a virtualized hardware resource. The VNFM <NUM> may be configured to manage one or more VNFs <NUM> and execute various management functions, for example, initialization, update, query, and/or termination of the VNFs <NUM>. The VIM <NUM> may be configured to control and manage interaction between the VNFs <NUM> and the computing hardware <NUM>, the storage hardware <NUM>, the network hardware <NUM>, the virtual computing <NUM>, the virtual storage <NUM>, and the virtual network <NUM>. For example, the VIM <NUM> may be configured to allocate resources to the VNFs <NUM>. The VNFM <NUM> and the VIM <NUM> may communicate with each other to exchange the configuration information and the status information of the virtualized hardware resource.

The NFVI <NUM> includes hardware and software, and the hardware and the software jointly create a virtualization environment to deploy, manage, and execute the VNFs <NUM>. In other words, the hardware resource layer and the virtual resource layer are used to provide the VNFs <NUM> with virtual resources such as virtual machines and/or other forms of virtual containers.

As shown in <FIG>, the VNFM <NUM> may communicate with the VNFs <NUM> and the EMSs <NUM>, to perform VNF lifecycle management and exchange configuration/status information. The VNF <NUM> represents virtualization of at least one network function, and the network function is previously provided by a physical network device. In an implementation, the VNF <NUM> may be a virtualized mobility management entity (Mobility Management Entity, MME) node, configured to provide all network functions provided by a typical non-virtualized MME device. In another implementation, the VNF <NUM> may be configured to implement functions of some of the components provided by a non-virtualized MME device. One or more VNFs <NUM> may be deployed on one virtual machine (or one virtual container in another form). The EMS <NUM> may be configured to manage one or more VNFs.

Optionally, the VNF <NUM> may include an HMEE. The HMEE may be understood as software running on a virtual resource used to carry the VNF <NUM>, to complete a corresponding function of the VNF <NUM>. In other words, the HMEE may be understood as a VNFC in the VNF. A function of the HMEE has been described in detail. In this application, the HMEE may be configured to perform steps in a method <NUM> below.

It should be understood that the foregoing descriptions of functions of modules are intended to help a person skilled in the art better understand the embodiments of this application, but are not intended to limit the scope of the embodiments of this application. This application does not exclude a possibility that the modules listed above have other functions or a possibility of adding or deleting a module in the VNF system.

In the embodiments of this application, each VNFI may be deployed on one or more VMs, to implement different network functions. One VNFI may include one or more VNFCs, and each VNFC may be mapped onto one or more VMs. When the VNFI is deployed on a plurality of VMs, the plurality of VMs are connected to each other. A specific connection manner may be the same as that in the prior art. For example, refer to a connection manner defined in a standard. Details are not described herein in this embodiment of this application.

One VNFI may include an insensitive VNFC. The insensitive VNFC may also be referred to as a common VNFC, and has a relatively low security requirement. The insensitive VNFC may be a VNFC visible to ordinary business personnel, or may be a VNFC that can be operated by ordinary business personnel. Optionally, the VNFI may further include a sensitive VNFC, and the sensitive VNFC has a relatively high security requirement. For example, some sensitive VNFCs are invisible to the ordinary business personnel, in other words, not perceived by the ordinary business personnel, and are available only to some particular persons. Although some sensitive VNFCs can be visible and available to the ordinary business personnel, core algorithms of the VNFCs may be confidential and kept unavailable for the ordinary business personnel.

However, an installation process of a sensitive VNFC is usually implemented by using a common VNFC. In other words, an instantiation process of a VNFC is entirely controlled by the common VNFC. However, security of the common VNFC is not high. If the common VNFC is attacked, for example, is maliciously controlled, security of the sensitive VNFC is affected. Therefore, a method needs to be provided to ensure security of the sensitive VNFC.

This application provides a method and an apparatus for creating a VNFI, so that a sensitive VNFC can be installed in a secure environment, to complete VNFI instantiation and meet a security requirement of the VNFC.

With reference to the accompanying drawings, the following describes in detail the method and the apparatus for creating a VNFI in this application.

<FIG> is a schematic flowchart of a method for creating a VNFI according to an embodiment of this application from the perspective of device interaction. The method <NUM> may be performed in a system including an NFV system and a security control device. One or more VNFIs may be deployed in the VNF system, and one or more VNFCs may be deployed in each VNFI. Herein, without loss of generality, an instantiation process of a first VNFC in a first VNFI in the NFV system is used as an example to describe in detail the method <NUM> for creating a VNFI in this application. The first VNFC may be a sensitive VNFC.

It should be noted that the NFV system may be the NFV system <NUM> shown in <FIG>, and a function of the NFV system may be implemented by one physical device, or by a cluster of physical devices. An HMEE, a VNFC, and the like in the NFV system in this embodiment of this application may be understood as software running on different virtual machines. Resources (which, for example, include a network resource, a compute resource, and a storage resource) of the virtual machines may be provided by the one or more physical devices configured to run the NFV system. A processor in the physical device executes code stored in a memory, to perform corresponding functions of modules.

The following describes the method <NUM> in detail with reference to <FIG>. As shown in <FIG>, the method <NUM> includes steps <NUM> to <NUM>.

Step <NUM>: The HMEE generates a private-public key pair.

Specifically, the HMEE may be configured to provide a secure and trusted execution environment, and may be understood as a secure execution environment. The secure execution environment may be isolated from a non-secure execution environment by hardware. In other words, the secure execution environment and the non-secure execution environment may be understood as two operating environments that run on a same device. In the secure execution environment, running of an operating system, software, and the like may be considered as running on the background of the system and is invisible to a common user. Therefore, a resource in the environment can be protected from malicious software attacks and various security threats. Therefore, the secure execution environment can effectively ensure security of information and data, and an attacker cannot obtain or tamper with information or data stored in the secure execution environment. Optionally, the HMEE may be implemented by using Software Guard Extensions (SGX) technology of Intel.

It should be noted that the HMEE may load software onto a physical device (for example, a server) to implement a corresponding function of the HMEE. In addition to implementing the corresponding function of the HMEE, the device may also be configured to construct a plurality of VNFIs by using a virtualization technology, to implement a plurality of service functions.

It should be understood that the HMEE may be understood as an example of the secure execution environment, and shall not constitute any limitation on this application. The secure execution environment may alternatively be, for example, a trusted environment (Trusted Environment, TE).

Step <NUM>: The HMEE sends, to a security control device, a public key in the private-public key pair generated in step <NUM>.

In this embodiment of this application, the private-public key pair generated by the HMEE may include a public key and a private key that correspond to each other. The HMEE may send the public key to the security control device to request instantiation of the first VNFC, and store the private key in the HMEE. Because the HMEE can generate the private-public key pair in the secure execution environment and store the private key, the private key has relatively high security and cannot be easily attacked or tampered with by an attacker.

Correspondingly, in step <NUM>, the security control device receives the public key from the HMEE.

In some cases, the HMEE may not be capable of external communication for security reasons. For example, an HMEE manufacturer may define an application programming interface (Application Programming Interface, API) interface as being capable of communicating only with a common VNFC in the NFV system but incapable of directly communicating with the security control device. In this case, the HMEE may forward the public key to the security control device by using a network element in the NFV system. Optionally, the first VNFI further includes a second VNFC, and the second VNFC may be an instantiated VNFC.

Optionally, step <NUM> specifically includes:
sending, by the HMEE, the public key to the security control device by using the second VNFC.

Correspondingly, the security control device receives the public key from the HMEE by using the second VNFC.

Further, after the second VNFC is created, the second VNFC will be initialized to establish a communication connection with the outside (specifically, a VNFM in a MANO), thereby completing instantiation of the second VNFC. Optionally, the method <NUM> further includes the following step:
Step <NUM>: The second VNFC sends an instantiation complete message to the HMEE.

Correspondingly, in step <NUM>, the HMEE receives the instantiation complete message sent by the second VNFC.

Then, in step <NUM>, the HMEE may send the public key to the security control device by using the second VNFC. More specifically, the HMEE may send the public key to the second VNFC, the second VNFC may send the public key to the MANO (specifically, the VNFM in the MANO), and the MANO may forward the public key to the security control device.

It should be noted that the security control device herein may be understood as a third-party security control device, for example, may be a security controller (SC) or network security manager (NSM) defined in the European Telecommunications Standards Institute (ETSI) NFV SEC <NUM>, or a credential manager (CM) of an operator.

It should be understood that specific forms, listed above, of the security control device are merely example descriptions, and shall not constitute any limitation on this application. Regardless of a specific form, in this embodiment of this application, the security control device may be configured to manage a security credential of a to-be-instantiated first VNFC. The security control device determines whether to deliver the security credential to the HMEE. In other words, the security control device determines whether to instantiate the first VNFC.

Step <NUM>: The security control device encrypts a security credential of a package of the first VNFC based on the public key, to obtain an encrypted security credential.

The security credential may be used to encrypt the package of the first VNFC, for example, encrypt a part or all of code in the package of the first VNFC. The package of the first VNFC can be used to install the first VNFC only after being decrypted by using the security credential.

Step <NUM>: The security control device sends the encrypted security credential to the HMEE.

Correspondingly, in step <NUM>, the HMEE receives the encrypted security credential from the security control device.

Optionally, the security control device may forward the encrypted security credential to the HMEE by using the MANO and the second VNFC. Correspondingly, the HMEE receives the encrypted security credential from the security control device by using the MANO and the second VNFC.

In some cases, a same security control device may manage security credentials of a plurality of sensitive VNFCs, and each security credential corresponds to one VNFC. In addition, a same security control device may receive public keys from a plurality of HMEEs, or even a public key sent by a third party that masquerades as an HMEE. The security control device may perform authentication on a sender (that is, the HMEE) of the received information, to ensure secure delivery of the security credential. In addition, the public key may be tampered with due to attacks from the third party during transmission. The security control device may verify the public key before encrypting the security credential, to ensure secure delivery of the security credential.

Optionally, the method further includes: sending, by the HMEE, an identifier of the first VNFC to the security control device.

Correspondingly, the security control device receives the identifier of the first VNFC from the HMEE. The security control device may search for a corresponding security credential based on the identifier of the first VNFC, encrypt the security credential, and then send the encrypted security credential.

Optionally, the method further includes: sending, by the HMEE, a hash of the public key to the security control device.

Correspondingly, the security control device receives the hash of the public key from the HMEE. The hash of the public key may be used to perform integrity verification on the public key received in step <NUM>. Therefore, step <NUM> may specifically include: encrypting, by the security control device, the security credential based on the public key when the verification succeeds. When the verification fails, the security control device may not deliver the security credential, for example, returns an empty message, a failure message, or a random message, to notify the HMEE that the security credential is not delivered. In this way, a possible security risk that is caused because the public key is being tampered with during transmission can be avoided. This ensures secure delivery of the security credential.

Optionally, the method further includes: sending, by the HMEE, a host identifier and/or a hash of code to the security control device. The host identifier is an identifier of a host on which the HMEE is installed, and the code is code executed by the HMEE.

Correspondingly, the security control device receives the host identifier and/or the hash of the code from the HMEE. The security control device performs, based on the host identifier and a prestored authenticated host identifier, authentication on the host on which the HMEE is installed. Therefore, step <NUM> may specifically include: delivering, by the security control device, the encrypted security credential to the HMEE when the host is successfully authenticated. When the host fails to be authenticated, the security control device may not deliver the security credential, for example, returns an empty message, a failure message, or a random message, to notify the HMEE that the security credential is not delivered. In this way, a possibility that another device masquerades as an HMEE to obtain the security credential from the security control device can be excluded. This ensures secure delivery of the security credential.

Alternatively, the security control device may perform, based on the hash of the code and prestored code that is allowed to be executed, authentication on the code executed by the HMEE. Therefore, step <NUM> may specifically include: delivering, by the security control device, the encrypted security credential to the HMEE when the code is successfully authenticated. When the code fails to be authenticated, the security control device may not deliver the security credential, for example, returns an empty message, a failure message, or a random message, to notify the HMEE that the security credential is not delivered. In this way, a possibility that the third party controls the host and uses unauthorized code to obtain the security credential from the security control device can be excluded. This ensures secure delivery of the security credential.

The security control device may perform authentication on both the host and the code. Therefore, step <NUM> may specifically include: delivering, by the security control device, the encrypted security credential to the HMEE when the host and the code are successfully authenticated; or not delivering, by the security control device, the encrypted security credential to the HMEE when at least one of the host and the code fails to be authenticated. Therefore, authentication can be performed from perspectives of hardware and software, to further improve security.

In a possible design, the public key, the identifier of the first VNFC, the hash of the public key, the host identifier, and the hash of the code may be carried in a same message (which, for example, is denoted as a first message). For example, the HMEE sends the first message to the security control device, so that the security control device completes integrity verification for the public key and authentication for the HMEE based on the received message, and then encrypts the security credential of the package of the first VNFC based on the public key.

It should be understood that specific information carried in the first message listed herein is merely an example description. In addition to the public key, the first message may further carry at least one of the following: the hash of the public key, the identifier of the first VNFC, the host identifier, and the hash of the code.

It should be further understood that a method for carrying the foregoing information by using the first message is merely a possible implementation. The information listed above may be sent to the security control device by using one or more messages. This is not limited in this application.

In a possible implementation, the hash of the public key, the identifier of the first VNFC, the host identifier, and the hash of the code may all be forwarded to the security control device by using the second VNFC.

After receiving the encrypted security credential from the security control device in step <NUM>, the HMEE may perform step <NUM>. To be specific, the HMEE decrypts the encrypted security credential based on a private key, to obtain the security credential.

Specifically, the HMEE may generate the private-public key pair by using an encryption algorithm, where the public key and the private key in the private-public key pair correspond to each other, and information encrypted by using the public key can be decrypted only by using the private key. Therefore, after the security control device encrypts the security credential based on the public key sent by the HMEE, the encrypted security credential can be decrypted only by using the private key in the HMEE. After generating the private-public key pair, the HMEE can store the private key in the HMEE. Because the HMEE is a secure environment, the private key cannot be obtained or tampered with by the third party. After receiving the encrypted security credential, the HMEE may decrypt the encrypted security credential based on the private key stored in the HMEE, to obtain the security credential.

Then, the HMEE may decrypt the package of the first VNFC based on the security credential, so that instantiation of the first VNFC is completed on a preconfigured virtual resource (for example, a VM). Optionally, the HMEE may delete the package of the first VNFC after the instantiation of the first VNFC. It should be understood that the instantiation process of the first VNFC may be the same as an instantiation process of a sensitive VNFC in the prior art. For brevity, detailed description of the process is omitted herein. After the instantiation of the first VNFC, the first VNFC may have a same function as the second VNFC, for example, may directly communicate with the outside. A function of the first VNFC is not limited in this application.

According to the foregoing technical solution, the security control device may encrypt the security credential of the package of the first VNFC based on the public key generated by the HMEE, where the encrypted security credential can be decrypted only by using the private key generated by the HMEE, thereby ensuring the security of the security credential during transmission. In addition, both the private-public key pair is generated and a decryption process is performed in the secure execution environment provided by the HMEE, so that the code of the first VNFC, the private key, and the security credential are unavailable for the outside, decryption of the security credential is invisible to the outside, and therefore an installation process of the first VNFC is invisible to the outside. In this way, security of the first VNFC can be ensured.

It should be noted that, in a process of transmitting the information shown in <FIG>, the information is forwarded by the second VNFC and the MANO. However, it should be understood that forwarding by the second VNFC and the MANO may be only transparent transmission, and the information is not processed.

It should be understood that <FIG> shows only network elements in the embodiments of this application for ease of understanding. However, network elements in the NFV system are not limited to the network elements shown in <FIG>. Therefore, the network elements shown in <FIG> shall not constitute any limitation on this application. For example, the MANO may include a VIM, the VNFM, and an NFVO. For another example, the NFV system may further include a third VNFC, and the like.

It should be understood that sequence numbers of the foregoing processes do not mean execution sequences in the embodiments of this application. The execution sequences of the processes should be determined based on functions and internal logic of the processes, and shall not constitute any limitation on an implementation processes of the embodiments of this application.

The foregoing describes in detail the method for creating the VNFI in the embodiments of this application with reference to <FIG>. The following describes in detail an apparatus for creating a VNFI in the embodiments of this application with reference to <FIG>.

<FIG> is a schematic block diagram of an apparatus <NUM> for creating a VNFI according to an embodiment of this application. It should be understood that the apparatus <NUM> for creating the VNFI shown in <FIG> is merely an example. An apparatus for creating a VNFI in the embodiments of this application may further include another unit or module, or include units with functions similar to those of units in <FIG>, or unnecessarily include all units in <FIG>.

Specifically, the apparatus <NUM> is configured in a network functions virtualization NFV system, where a to-be-instantiated VNFI is deployed in the NFV system, and a device <NUM> and a to-be-instantiated first virtualized network function component VNFC are deployed in the VNFI. As shown in <FIG>, the apparatus <NUM> may include a generation unit <NUM>, a communications unit <NUM>, and a decryption unit <NUM>.

The generation unit <NUM> is configured to generate a private-public key pair.

The communications unit <NUM> is configured to send a public key in the private-public key pair to a security control device.

The decryption unit <NUM> is configured to decrypt an encrypted security credential based on a private key in the private-public key pair, to obtain a security credential.

It should be understood that the apparatus <NUM> for creating the VNFI in <FIG> may correspond to (for example, may be configured on or may be) the HMEE in the method for creating the VNFI in the foregoing embodiment. In addition, the foregoing and other operations and/or functions of the units of the apparatus <NUM> for creating the VNFI are intended to implement corresponding procedures of the method for creating the VNFI in <FIG>. For brevity, details are not described herein again.

<FIG> is a schematic block diagram of an apparatus <NUM> for creating a VNFI according to another embodiment of this application. It should be understood that the apparatus <NUM> for creating the VNFI in <FIG> is merely an example. An apparatus for creating a VNFI in the embodiments of this application may further include another unit or module, or include units with functions similar to those of units in <FIG>, or unnecessarily include all units in <FIG>.

Specifically, as shown in <FIG>, the apparatus <NUM> may include a communications unit <NUM> and an encryption unit <NUM>.

The communications unit <NUM> is configured to receive a public key from a hardware-mediated execution enclave HMEE in a network functions virtualization NFV system, where a to-be-instantiated VNFI is deployed in the NFV system, and the HMEE and a to-be-instantiated first virtualized network function component VNFC are deployed in the VNFI.

The encryption unit <NUM> is configured to encrypt a security credential of a package of the first VNFC based on the public key, to obtain an encrypted security credential, where the security credential is used to decrypt the package of the first VNFC.

The communications unit <NUM> is further configured to send the encrypted security credential to the HMEE.

It should be understood that the apparatus <NUM> for creating the VNFI in <FIG> may correspond to (for example, may be configured on or may be) the security control device in the method for creating the VNFI in the foregoing embodiment. In addition, the foregoing and other operations and/or functions of the units of the apparatus <NUM> for creating the VNFI are intended to implement corresponding procedures of the method for creating the VNFI in <FIG>. For brevity, details are not described herein again.

<FIG> is a schematic structural diagram of a device <NUM> for creating a VNFI according to an embodiment of this application. As shown in <FIG>, the device <NUM> includes a memory <NUM>, a processor <NUM>, and a communications interface <NUM>. The memory <NUM> may be integrated into the processor <NUM>, or may be independent of the processor <NUM>. The memory <NUM> may be configured to store an instruction, and the processor <NUM> may be configured to execute the instruction stored in the memory <NUM>, to control the communications interface <NUM> to receive and send information or a signal. The memory <NUM>, the processor <NUM>, and the communications interface <NUM> may communicate with each other by using an internal connection path, to transfer a control signal and/or a data signal.

Specifically, the device <NUM> is configured in a network functions virtualization NFV system, where a to-be-instantiated VNFI is deployed in the NFV system, and the device <NUM> and a to-be-instantiated first virtualized network function component VNFC are deployed in the VNFI. The processor <NUM> of the device <NUM> may invoke program code stored in the memory <NUM> to perform the following operations:.

It should be understood that the device <NUM> for creating the VNFI in <FIG> may correspond to (for example, may be configured on or may be) the HMEE in the method for creating the VNFI in the foregoing embodiment. In addition, the foregoing and other operations and/or functions of the units of the device <NUM> for creating the VNFI are intended to implement corresponding procedures of the method for creating the VNFI in <FIG>. For brevity, details are not described herein again. In addition, the generation unit <NUM> and the encryption unit <NUM> of the apparatus <NUM> in <FIG> may correspond to the processor <NUM>, and the communications unit <NUM> of the apparatus <NUM> in <FIG> may correspond to the communications interface <NUM>.

<FIG> is a schematic structural diagram of a device <NUM> for creating a VNFI according to another embodiment of this application. As shown in <FIG>, the device <NUM> includes a memory <NUM>, a processor <NUM>, and a communications interface <NUM>. The memory <NUM> may be integrated into the processor <NUM>, or may be independent of the processor <NUM>. The memory <NUM> may be configured to store an instruction, and the processor <NUM> may be configured to execute the instruction stored in the memory <NUM>, to control the communications interface <NUM> to receive and send information or a signal. The memory <NUM>, the processor <NUM>, and the communications interface <NUM> may communicate with each other by using an internal connection path, to transfer a control signal and/or a data signal.

Optionally, the processor <NUM> may invoke program code stored in the memory <NUM> to perform the following operations:.

It should be understood that the device <NUM> for creating the VNFI in <FIG> may correspond to (for example, may be configured on or may be) the security control device in the method for creating the VNFI in the foregoing embodiment. In addition, the foregoing and other operations and/or functions of the units of the device <NUM> for creating the VNFI are intended to implement corresponding procedures of the method for creating the VNFI in <FIG>. For brevity, details are not described herein again. In addition, the communications unit <NUM> of the apparatus <NUM> in <FIG> may correspond to the communications interface <NUM>, and the encryption unit <NUM> of the apparatus <NUM> in <FIG> may correspond to the processor <NUM>.

The processor in the embodiments of this application may be an integrated circuit chip, and is capable of signal processing. In an implementation process, steps in the foregoing method embodiment can be implemented by using a hardware integrated logical circuit in the processor, or by using instructions in a form of software. The processor may be a CPU, or may be another general purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component.

The processor may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of this application. The general purpose processor may be a microprocessor, or may be any conventional processor or the like. Steps of the method disclosed with reference to the embodiments of this application may be directly executed and accomplished by using a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in a decoding processor. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register. The storage medium is located in the memory, and a processor reads information in the memory and completes the steps in the foregoing methods in combination with hardware of the processor.

The memory in the embodiments of this application may be a volatile memory or a nonvolatile memory, or may include a volatile memory and a nonvolatile memory. The nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an electrically erasable programmable read-only memory (electrically EPROM, EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM) and is used as an external cache. Through example but not limitative description, many forms of RAMs may be used, for example, a static random access memory (static RAM, SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (synchronous DRAM, SDRAM), a double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), an enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), a synchronous link dynamic random access memory (synch link DRAM, SLDRAM), and a direct rambus random access memory (direct ram bus RAM, DR RAM).

A person of ordinary skill in the art may be aware that units and algorithm steps in the examples described with reference to the embodiments disclosed in this specification can be implemented by electronic hardware or a combination of computer software and electronic hardware.

It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiment, and details are not described herein again.

When the functions are implemented in a form of a software functional unit and sold or used as an independent product, the functions may be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of this application essentially, or the part contributing to the prior art, or some of the technical solutions may be implemented in a form of a software product. The software product is stored in a storage medium, and includes several instructions for instructing a computer device (which may be a personal computer, a server, or a network device) to perform all or some of the steps of the method described in the embodiments of this application. The foregoing storage medium includes: various mediums that can store program code, such as a USB flash drive, a removable hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disc.

Claim 1:
A method for creating a virtualized network function instance, VNFI, comprising:
generating (<NUM>), by a hardware-mediated execution enclave, HMEE, in a network functions virtualization, NFV, system, a private-public key pair, wherein a to-be-instantiated VNFI is deployed in the NFV system, and the HMEE and a to-be-instantiated first virtualized network function component, VNFC, are deployed in the VNFI;
sending (<NUM>), by the HMEE, a public key in the private-public key pair to a security control device;
receiving (<NUM>), by the HMEE, an encrypted security credential from the security control device, wherein the encrypted security credential is obtained by encrypting a security credential of a package of the first VNFC based on the public key, and the security credential is used to decrypt the package of the first VNFC; and
decrypting (<NUM>), by the HMEE, the encrypted security credential based on a private key in the private-public key pair, to obtain the security credential,
wherein an instantiated second VNFC is deployed in the VNFI; and
the sending, by the HMEE, a public key in the private-public key pair to a security control device comprises:
sending, by the HMEE, the public key in the private-public key pair to the security control device by using the second VNFC; and
the receiving, by the HMEE, an encrypted security credential from the security control device comprises:
receiving, by the HMEE, the encrypted security credential from the security control device by using the second VNFC.