Certificate management method and apparatus in network functions virtualization architecture

Patent metadata

Field	Value
Publication number	US-11070541-B2
Application number	US-201815958465-A
Country	US
Kind code	B2
Filing date	Apr 20, 2018
Priority date	Oct 21, 2015
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

Embodiments of the present application provide a certificate management method and apparatus in an NFV architecture. The certificate management method includes: determining, by an MANO, a storage network element, where the storage network element is configured to store a certificate of a VNFC, and the storage network element is different from the VNFC; creating, by the MANO, storage space in the storage network element, where the storage space is used to store the certificate of the VNFC; and sending, by the MANO, an address of the storage space to the VNFC, so that the VNFC accesses the address of the storage space, obtains the certificate of the VNFC, and directly communicates with another network element by using the certificate stored in the storage network element. The VNFC does not locally store the certificate.

First claim

What is claimed is:

1. A method implemented by a network functions virtualization (NFV) management and network orchestration (MANO) system and comprising:
obtaining first indication information of a virtualized network function component (VNFC), wherein the first indication information is in an instantiation request message or a virtualized network function component descriptor (VNFCD) of the VNFC, and wherein the first indication information indicates a decision network element for determining a storage network element;
determining, according to a determining result of the decision network element, the storage network element for storing all of a certificate of the VNFC without dividing the certificate, wherein the storage network element is different from the VNFC;
creating a storage space in the storage network element for storing the certificate; and
sending an address of the storage space to the VNFC.

2. The method of claim 1 , further comprising further determining the storage network element before or during a process in which the VNFC applies for the certificate.

3. The method of claim 1 , further comprising further sending the address in storage and management information of the certificate.

4. The method of claim 1 , wherein the first indication information is in the instantiation request message.

5. The method of claim 1 , wherein the first indication information is in the VNFCD.

6. The method of claim 1 , further comprising further determining the storage network element according to a management policy.

7. The method of claim 1 , wherein the certificate is from a certificate authority (CA) after the VNFC is registered with and certified by the CA.

8. A method implemented by a virtualized network function component (VNFC) and comprising:
receiving, from a network functions virtualization (NFV) management and orchestration (MANO) system, an address of a storage space, wherein the storage space is for storing all of a certificate of the VNFC without dividing the certificate, wherein the storage space is located in a storage network element, and wherein the storage network element is different from the VNFC;
accessing the storage space according to the address to obtain the certificate;
receiving a certificate invalidity indication message from a management network element; and
deleting the address of the storage space or setting the address of the storage space to be invalid according to the certificate invalidity indication message.

9. The method of claim 8 , further comprising:
registering with a certificate authority (CA); and
attempting to be certified by the CA to obtain the certificate.

10. The method of claim 9 , further comprising sending the certificate to the storage network element for storing the certificate in the storage space.

11. A network functions virtualization (NFV) management and network orchestration (MANO) system comprising:
a memory configured to store instructions;
a processor coupled to the memory and configured to execute the instructions to:
obtain first indication information of a virtualized network function component (VNFC), wherein the first indication information is in an instantiation request message or a virtualized network function component descriptor (VNFCD) of the VNFC, and wherein the first indication information indicates a decision network element for determining a storage network element;
determine, according to a determining result of the decision network element, the storage network element for storing all of a certificate of the VNFC without dividing the certificate, wherein the storage network element is different from the VNFC, and
create a storage space in the storage network element for storing the certificate; and

a transceiver coupled to the processor and configured to send an address of the storage space to the VNFC.

12. The NFV MANO system of claim 11 , wherein the processor is further configured to further determine the storage network element before or during a process in which the VNFC applies for the certificate.

13. The NFV MANO system of claim 11 , wherein the transceiver is further configured to further send the address in storage and management information of the certificate.

14. The NFV MANO system of claim 11 , wherein the first indication information is in the instantiation request message.

15. The NFV MANO system of claim 11 , wherein the first indication information is in the VNFCD.

16. The NFV MANO system of claim 11 , wherein the processor is further configured to further determine the storage network element according to a management policy.

17. The NFV MANO system of claim 11 , wherein the certificate is from a certificate authority (CA) after the VNFC is registered with and certified by the CA.

18. A virtualized network function component (VNFC) comprising:
a transceiver configured to:
receive, from a network functions virtualization (NFV) management and orchestration (MANO) system, an address of a storage space, wherein the storage space is for storing all of a certificate of the VNFC without dividing the certificate, wherein the storage space is located in a storage network element, and wherein the storage network element is different from the VNFC; and
receive a certificate invalidity indication message from a management network element;

a memory configured to store instructions; and
a processor coupled to the transceiver and the memory and configured to:
execute the instructions to access the storage space according to the address to obtain the certificate; and
delete the address of the storage space or setting the address of the storage space to be invalid according to the certificate invalidity indication message.

19. The VNFC of claim 18 , wherein the processor is further configured to:
register with a certificate authority (CA); and
attempt to be certified by the CA to obtain the certificate.

20. The VNFC of claim 19 , wherein the transceiver is further configured to send the certificate to the storage network element for storing the certificate in the storage space.

Assignees

• Huawei Tech Co Ltd

Inventors

• Liu Wenji
• Wang Jiangsheng

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/28 Primary

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title