NETWORK FUNCTION VIRTUALIZATION-BASED CERTIFICATE CONFIGURATION METHOD, APPARATUS, AND SYSTEM

• US 20170012968A1
• Filed: 09/23/2016
• Published: 01/12/2017
• Est. Priority Date: 03/26/2014
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: FENG, Chengyan, CHEN, Jing
• Granted Patent: US 10,205,719 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

The invention discloses a network function virtualization-based certificate configuration method, apparatus, and system. A virtualized network management entity obtains initial credential information of a virtualized network function entity; and installs the initial credential information onto the virtualized network function entity during or after instantiation of the virtualized network function entity, so that the virtualized network function entity obtains, from a certificate authority by using the initial credential information, a formal certificate issued by a network operator of the virtualized network function entity. The invention not only can apply to a network function virtualization scenario, but also can resolve a problem of a security risk in network function virtualization.

Claims

1. A network function virtualization-based certificate configuration method, comprising:

obtaining, by a virtualized network management entity, initial credential information of a virtualized network function entity; and

during or after instantiation of the virtualized network function (VNF) entity by the virtualized network management entity, installing, by the virtualized network management entity, the initial credential information onto the virtualized network function entity, so that the virtualized network function entity obtains, from a certificate authority by using the initial credential information, a formal certificate issued by a network operator of the virtualized network function entity.

2. The method according to claim 1, wherein the obtaining, by a virtualized network management entity, initial credential information of a virtualized network function entity comprises:

receiving, by the virtualized network management entity, an instantiation request sent by a network operation and management entity, wherein the instantiation request comprises the initial credential information of the virtualized network function entity.

3. The method according to claim 1, wherein the obtaining, by a virtualized network management entity, initial credential information of a virtualized network function entity comprises:

obtaining, by the virtualized network management entity, the initial credential information of the virtualized network function entity from a virtualized network function package, an image file of a virtualized network function, a virtualized network function descriptor (VNFD), or instantiation data of a virtualized network function, wherein

the virtualized network function package, the image file, the VNFD, or the instantiation data is sent by the network operation and management entity to the virtualized network management entity before or during the instantiation of the virtualized network function entity by the virtualized network management entity, and the VNFD or the image file comprises the initial credential information.

4. The method according to claim 1, wherein the initial credential information comprises but is not limited to a certificate, a pre-shared key, a token or a password.

5. The method according to claim 4, wherein:

when the initial credential information comprises a certificate, the initial credential information comprises an initial certificate and a corresponding first private key; and

the initial certificate is issued by a provider or the network operator of the virtualized network function entity to the virtualized network function entity, and the first private key is a private key in a first public key-private key pair corresponding to the initial certificate.

6. The method according to claim 5, wherein:

the initial certificate is signed by using a private key corresponding to a root certificate or an intermediate certificate of the provider of the virtualized network function entity, wherein the intermediate certificate of the provider of the virtualized network function entity is a certificate issued by a lower-level sub-certificate subordinate to the root certificate of the provider of the virtualized network function entity;

or

the initial certificate is signed by using a private key corresponding to a root certificate or an intermediate certificate of the network operator of the virtualized network function entity, wherein the intermediate certificate of the network operator of the virtualized network function entity is a certificate issued by a lower-level sub-certificate subordinate to the root certificate of the network operator of the virtualized network function entity.

7. The method according to claim 1, wherein the virtualized network management entity comprises a first management entity network function virtualization orchestrator (NFVO), a second management entity virtualized network function manager (VNFM), a third management entity virtualized infrastructure manager (VIM), and a management and control unit of a fourth management entity network function virtualization infrastructure (NFVI);

the network operation and management entity comprises an operation support system (OSS) or an element management system (EMS); and

the virtualized network function entity comprises a virtualized network function unit (VNF) or a virtualized network function component (VNFC).

8. The method according to claim 7, wherein the initial credential information is configured for the virtualized network function entity by the first management entity NFVO, the second management entity VNFM, or the network operation and management entity.

9. The method according to claim 7, wherein the initial credential information is sent by the first management entity NFVO to the third management entity VIM, or is sent by the second management entity VNFM to the third management entity VIM by using the first management entity NFVO, or is sent by the second management entity VNFM to the third management entity VIM.

10. The method according to claim 7, further comprising:

during or after instantiation of the VNF, sending, by the third management entity VIM, the initial credential information to the management and control unit of the fourth management entity NFVI, and installing, by the management and control unit of the fourth management entity NFVI, the initial credential information onto the virtualized network function entity by using a virtual machine.

11. The method according to claim 7, wherein the initial credential information is sent by the first management entity NFVO to the second management entity VNFM, or is sent by the network operation and management entity to the VNFM by using the NFVO, or is sent by the network operation and management entity to the VNFM.

12. The method according to claim 11, wherein the initial credential information is installed by the second management entity VNFM onto the virtualized network function entity during or after instantiation of the VNF.

13. A virtualized network management entity, comprising:

a receiver, configured to obtain initial credential information of a virtualized network function entity; and

a processor, configured to install the initial credential information onto the virtualized network function entity during or after instantiation of the virtualized network function entity, so that the virtualized network function entity obtains, from a certificate authority by using the initial credential information, a formal certificate issued by a network operator of the virtualized network function entity.

14. The virtualized network management entity according to claim 13, wherein the receiver is configured to receive an instantiation request sent by a network operation and management entity, and obtain the initial credential information, comprised in the instantiation request, of the virtualized network function entity.

15. The virtualized network management entity according to claim 13, wherein the receiver is further configured to obtain the initial credential information of the virtualized network function entity from a virtualized network function package, an image file of a virtualized network function, a virtualized network function descriptor (VNFD), or instantiation data of a virtualized network function, wherein

the virtualized network function package, the image file, the VNFD, or the instantiation data is sent by the network operation and management entity to the virtualized network management entity before or during the instantiation of the virtualized network function entity by the virtualized network management entity, and the virtualized network function package, the VNFD, the image file, or the instantiation data comprises the initial credential information.

16. The virtualized network management entity according to claim 13, wherein the initial credential information comprises but is not limited to a certificate, a pre-shared key, a token or a password.

17. The virtualized network management entity according to claim 16, wherein:

when the initial credential information comprises a certificate, the initial credential information comprises an initial certificate and a corresponding first private key; and

the initial certificate is issued by a provider or the network operator of the virtualized network function entity to the virtualized network function entity, and the first private key is a private key in a first public key-private key pair corresponding to the initial certificate.

18. The virtualized network management entity according to claim 17, wherein:

the initial certificate is signed by using a private key corresponding to a root certificate or an intermediate certificate of the provider of the virtualized network function entity, wherein the intermediate certificate of the provider of the virtualized network function entity is a certificate issued by a lower-level sub-certificate subordinate to the root certificate of the provider of the virtualized network function entity;

or

the initial certificate is signed by using a private key corresponding to a root certificate or an intermediate certificate of the network operator of the virtualized network function entity, wherein the intermediate certificate of the network operator of the virtualized network function entity is a certificate issued by a lower-level sub-certificate subordinate to the root certificate of the network operator of the virtualized network function entity.

19. The virtualized network management entity according to claim 13, wherein the virtualized network management entity comprises a first management entity network function virtualization orchestrator (NFVO), a second management entity virtualized network function manager (VNFM), a third management entity virtualized infrastructure manager (VIM), and a management and control unit of a fourth management entity network function virtualization infrastructure (NFVI);

the network operation and management entity comprises an operation support system (OSS) or an element management system (EMS); and

the virtualized network function entity comprises a virtualized network function unit (VNF) or a virtualized network function component (VNFC).

20. The virtualized network management entity according to claim 19, wherein the initial credential information is initial credential information configured for the virtualized network function entity by the first management entity NFVO, the second management entity VNFM, or the network operation and management entity.