WO2022267994A1 - Communication system and method, apparatus, first device, second device, and storage medium - Google Patents

Abstract

The present application discloses a communication system, a communication method, an apparatus, a first device, a second device, and a storage medium. The system comprises: a first device, a second device, and a third device. The first device is configured to receive first information from the second device and, on the basis of the first information and a security policy, provide a security management function for an application on an edge computing platform. The first information is used to configure an application on the edge computing platform. The second device is configured to send the first information to the first device on the basis of second information from the third device. The second information is used to orchestrate an application on the edge computing platform.

Description

Communication system, method, device, first device, second device and storage medium

Cross References to Related Applications

This application is based on a Chinese patent application with application number 202110703440.3 and a filing date of June 24, 2021, and claims the priority of this Chinese patent application. The entire content of this Chinese patent application is hereby incorporated by reference into this application.

technical field

The present application relates to the communication field, and in particular to a communication system, method, device, first device, second device and storage medium.

Background technique

As a new generation of communication technology, the fifth-generation mobile communication technology (5G) has many advantages such as large bandwidth, low latency, high reliability, high connection, ubiquitous network, etc., thereby promoting the rapid development and change of vertical industries, such as smart medical, The rise of smart education and smart agriculture.

As one of the key technologies in the evolution of 5G, mobile edge computing (MEC) technology is a general information technology (IT) platform with wireless network information application programming interface (API) interaction capabilities, as well as computing, storage, and analysis functions; relying on MEC technology, It can pull traditional external applications into the mobile interior, get closer to users, and provide localized services, thereby improving user experience and giving full play to the value of edge networks.

The combination of 5G and MEC can introduce different technology combinations for different industry demand scenarios, such as quality of service (QoS), end-to-end network slicing, network capability exposure, edge cloud, etc., so as to provide customized solutions.

Among related technologies, the combination of 5G and MEC technology has security risks.

Contents of the invention

To solve related technical problems, embodiments of the present application provide a communication method, device, related equipment, and storage medium.

The technical scheme of the embodiment of the application is realized in this way:

An embodiment of the present application provides a communication system, including: a first device, a second device, and a third device; wherein,

The first device is configured to receive first information from the second device, and provide security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used for the Configure applications on the edge computing platform;

The second device is configured to send the first information to the first device based on the second information from the third device; the second information is used to arrange applications on the edge computing platform.

Preferably, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

Preferably, the first device is further configured to send third information to the second device; the third information is used to indicate whether the configuration of the first information is successful;

The second device is further configured to send fourth information to a third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

Preferably, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

The third configuration strategy; the third configuration strategy is aimed at the Domain Name System (DNS, Domain Name System) of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

Preferably, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

Preferably, the third device is further configured to receive first access authentication information from the first device, and send first authentication response information to the first device; the first authentication response information includes at least: first The identity of the device.

Preferably, the third device is further configured to receive second access authentication information from the second device, and send second authentication response information to the second device; the second authentication response information includes at least: the second device identification;

The third device is further configured to send the identity of the first device to the second device.

Preferably, the number of the first device is one or more.

An embodiment of the present application provides a communication method, which is applied to a first device, and the method includes:

receiving first information from a second device; the first information is used to configure applications on the edge computing platform;

A security management function is provided for applications on the edge computing platform based on the first information and the security policy.

Preferably, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

The second security level; the second security level characterization allows configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

Preferably, the method also includes:

Sending third information to the second device; the third information is used to indicate whether the configuration of the first information is successful.

Preferably, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

Preferably, the method also includes:

sending the first access authentication information to the third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device.

An embodiment of the present application provides a communication method, which is applied to a second device, and the method includes:

receiving second information from a third device; the second information is used to arrange applications on the edge computing platform;

Sending first information to the first device based on the second information; the first information is used to instruct the first device to configure applications on the edge computing platform based on the first device and a security policy.

Preferably, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

Preferably, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

Preferably, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

Preferably, the method also includes:

receiving third information from the first device; the third information is used to indicate whether the configuration of the first information is successful;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

Preferably, the method also includes:

Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information includes at least: the identity of the first device;

The method further includes: receiving an identity of the first device.

An embodiment of the present application provides a communication device, which is set on the first device, including:

The first communication unit is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform;

The first processing unit is configured to provide security management functions for applications on the edge computing platform based on the first information and the security policy.

Preferably, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

Preferably, the first communication unit is further configured to send third information to the second device; the third information is used to indicate whether the configuration of the first information is successful.

Preferably, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

Preferably, the first communication unit is further configured to send the first access authentication information to the third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device.

An embodiment of the present application provides a first device, including: a first processor and a first communication interface; wherein,

The first communication interface is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform;

The first processor is configured to provide security management functions for applications on the edge computing platform based on the first information and security policies.

An embodiment of the present application provides a communication device, which is set on the second device, including:

The second communication unit is configured to receive second information from the third device; the second information is used to arrange applications on the edge computing platform;

The second processing unit is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge computing platform based on the first device and the security policy configuration for the application.

Preferably, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

Preferably, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

Preferably, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

Preferably, the second communication unit is further configured to receive third information from the first device; the third information is used to explain whether the configuration of the first information is successful;

Sending fourth information to a third device based on the third information; the fourth information is used to describe whether the configuration of the second information is successful.

Preferably, the second communication unit is further configured to send second access authentication information to a third device; receive second authentication response information from the third device; the second authentication response information includes at least: a device identity;

And, receiving the identity of the first device.

An embodiment of the present application provides a second device, including: a second processor and a second communication interface; wherein,

The second communication interface is configured to receive second information from a third device; the second information is used to arrange applications on the edge computing platform;

The second processor is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge computing based on the first device and a security policy Configure applications on the platform.

An embodiment of the present application provides a network device, including: a processor and a memory configured to store a computer program that can run on the processor,

Wherein, the processor is configured to execute the steps of any one of the methods described above on the first device side when running the computer program; or,

The processor is configured to execute the steps of any one of the methods described above on the second device side when running the computer program.

An embodiment of the present application provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the methods described above on the first device side are implemented; or,

When the computer program is executed by the processor, the steps of any one of the methods described above on the second device side are implemented.

The communication system, method, device, first device, second device, and storage medium provided in the embodiments of the present application, the system includes: the first device, the second device, and the third device; the first device is configured to receive The first information of the device, based on the first information and the security policy, provides a security management function for the application on the edge computing platform; the first information is used to configure the application on the edge computing platform; the The second device is configured to send the first information to the first device based on the second information from the third device; the second information is used to arrange applications on the edge computing platform. According to the solution of the embodiment of this application, the first device provides security management functions for applications on the edge computing platform based on the security policy, so that the first device can determine whether to perform orchestration according to the first information according to the security policy; Security management and control capabilities for configuring applications on edge computing platforms.

Description of drawings

FIG. 1 is a schematic diagram of a system structure of an MEC in the related art;

FIG. 2 is a schematic structural diagram of a host layer and a system layer of an MEC in the related art;

FIG. 3 is a schematic structural diagram of a system for 5G industry cloud-network integration according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a communication system according to an embodiment of the present application;

FIG. 5 is a schematic flowchart of a communication method according to an embodiment of the present application;

FIG. 6 is a schematic flowchart of another communication method according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a communication system of an application embodiment of the present application;

FIG. 8 is a schematic flowchart of a communication method in an application embodiment of the present application;

FIG. 9 is a schematic diagram of the registration authentication process of the application embodiment of the present application;

10 is a schematic diagram of the relationship between a MEPM and an L-MEPM according to an embodiment of the present application;

FIG. 11 is a schematic diagram of a permission authorization method according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram of a communication device according to an embodiment of the present application;

FIG. 13 is a schematic structural diagram of another communication device according to an embodiment of the present application;

Fig. 14 is a schematic structural diagram of the first device of the embodiment of the present application;

FIG. 15 is a schematic structural diagram of a second device according to an embodiment of the present application.

detailed description

The application will be further described in detail below in conjunction with the accompanying drawings and embodiments.

In related technologies, MEC is a multi-access edge computing platform standard led by the European Telecommunications Standards Institute (ETSI, European Telecommunications Standards Institute). Connect to the edge computing platform, and provide more efficient business operation services by virtualizing and serving MEC applications, platforms, and resources to meet the differentiated needs of different businesses in terms of processing capabilities. The ETSI standard organization defines the The framework of the MEC system shown.

The MEC system mainly includes: MEC system-level (MEC system-level), MEC host level (MEC host level), and network layer (Networks).

Among them, the MEC system layer is responsible for the allocation, recovery and coordination of the entire MEC resources to meet the needs of different services for computing and transmission resources. MEC system-level management supports MEC system-level management functions and host-level management functions. MEC system-level management functions include user application lifecycle management agents, operation support systems, and MEC orchestrators, and MEC host-level management functions can include MEC platform managers and virtualized infrastructure managers. MEC services provided to terminals and third-party customers (such as commercial enterprises) are managed through the MEC management layer.

The MEC host layer is used to provide necessary computing, storage and transmission functions for MEC applications and MEC platforms.

The network layer is used to provide different network options (such as 3GPP wireless network, non-3GPP wireless network, and wired network) for upper-layer applications, and dynamically adjust routing strategies according to upper-layer signaling to meet the transmission requirements of different services on the network.

Among them, as shown in Figure 2, the MEC host (MEC host) includes: MEC platform and virtual infrastructure (computing, storage, network). The virtual facility includes the data plane, which is used to execute the routing rules received from the MEC platform, in the application (also called MEC app, MEC application or MEP application), service (also called MEC service or MEP service), DNS service/proxy, 3GPP Forward traffic between the network, other access networks, local networks, and external networks. Wherein, the MEP enables the application to provide and invoke the service, and the MEP itself can also provide the service. Specifically, the application runs on a virtual machine or a container, and can provide a variety of services (such as: location, wireless network information, traffic management), and the application can also use services provided by other applications, for example: Application A The provided services such as location and traffic management can be used by application B and application C. The service may be provided by the MEP or a certain application. When a certain service is provided by the application, the service may be registered in the service list of the MEP.

MEC platform (MEP, MEC platform), supported functions include:

1) Provide an environment where MEC applications can discover, notify, use and provide MEC services, including MEC services provided by other platforms (optional).

2) Receive routing rules from MEC platform management, applications or services to control data plane traffic.

3) Manage and receive DNS records from the MEC platform, and configure DNS proxy/server;

4) Managed MEC services;

5) Provide access to permanent storage and time of day information;

MEC orchestrator (MEO, MEC orchestrator), also known as MEC application orchestrator (MEAO, MEC application orchestrator), is the core of MEC system layer management. The supported functions include:

1) Maintain the overall view of the MEC system (that is, the overall deployment); such as MEC host deployment, MEC available resource allocation, available MEC service calls, system topology, etc.;

2) Manage the launch of the MEC application package, including: checking the integrity and authenticity of the application package; confirming the application rules and requirements, and judging whether the application rules and requirements need to be adjusted; conform to the vendor's policy; keep a record of the application package's rollout, and prepare the virtual infrastructure manager for handling the application;

3) Select an appropriate MEC host for application initialization based on constraints (such as delay, available resources, available services, etc.);

4) Trigger the start and end of the application;

5) Trigger on-demand migration of applications.

MEC platform management (MEPM, MEC platform manager), supported functions include:

1), MEC application life cycle management (LCM, Life Cycle Management), such as: notify MEAO of related application events;

2) Provide the element management (Element mgmt) function of the MEC platform (MEP, MEC Platform), including virtual network function (VNF, Virtualized Network Function) element management and network service (NS, Network Service) element management, where the NS information element Including physical network function (PNF, Physical Network Function) information element, virtual link information element, VNF forwarding graph (VNF Forwarding Graph) information element;

3), MEC application rules and requirements management (MEC app rules&reqts mgmt), such as: service authorization, routing rules, Domain Name System (DNS) configuration and conflict handling;

4) Receive error reports and performance measurement data of virtual resources from a virtual infrastructure manager (VIM, Virtualisation Infrastructure Manager). The main functions of VIM include: allocating, managing, and releasing virtualized resources of virtualized infrastructure, receiving and storing software images, collecting and reporting performance and fault information of virtualized resources.

From the functional description of each module of MEC, it can be seen that the rules applied by MEC (including routing rules, DNS configuration, business rules, etc.) are managed by MEPM, received by MEP, and finally executed on the user plane of the MEC host.

Mx1 , Mx2 , Mp1 , Mp2 , Mp3 , Mm1 , Mm2 . . . Mm9 in FIG. 2 indicate that various devices or modules can call interfaces and/or use corresponding communication protocols for communication.

In practical applications, there are many types of terminal access technologies in vertical industries. In addition to 5G, third-party networks also have non-5G networks (such as 4G, WiFi, Bluetooth, Zigbee, NB-IoT, SPN, infrared network, dedicated line network, Wireline, etc.) ), the data of these terminals may be transmitted to the MEP through different networks. In order to ensure the network and data security of MEP and realize ubiquitous network access and control functions, an industry gateway (iGW, industry GateWay) is introduced into a 5G industry cloud-network integration system architecture. The 5G industry cloud-network integration architecture is as follows: Figure 3 shows.

MEC platform management (MEPM) is generally set on the industry gateway. The data on the MEP can be directly connected to the external network, that is, the third-party network through the industry gateway. The existing ETSI protocol does not protect data security in place and cannot adapt to the increasingly There are more and more management requirements for data security and privacy protection.

In some typical application scenarios with sensitive data such as medical care, education, and finance, some applications and available resources (hardware resources, network resources, etc.) External) MEPM for management and configuration, the management configuration information (or management configuration data) sent by MEPM to MEP must be subject to strict security control. In related technologies, the MEPM lacks necessary security protection and authorization management mechanism for the management configuration information on the MEP, and the security management control mechanism of the MEPM for the MEP is not clearly defined.

Based on this, in various embodiments of the present application, the first device is configured to receive the first information from the second device, and provide security management functions for applications on the edge computing platform based on the first information and security policies; The first information is used to configure applications on the edge computing platform; the second device is used to send the first information to the first device based on the second information from the third device; the The second information is used to orchestrate applications on the edge computing platform. In this way, the ability to manage and control the configuration of the application for the edge computing platform in the first device can be improved.

An embodiment of the present application provides a communication system. As shown in FIG. 4 , the system includes: a first device, a second device, and a third device; wherein,

The first device is configured to receive first information from the second device, and provide security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used for the Configure applications on the edge computing platform;

The second device is configured to send the first information to the first device based on the second information from the third device; the second information is used to arrange applications on the edge computing platform.

Wherein, in actual application, the second device is arranged between the first device and the third device.

In actual application, the first device may be a locally set MEPM, which can be understood as the user sets up a local MEPM, and can perform local management and configuration on applications provided by the MEP. The first device can be deployed locally or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In practical applications, the second device may be an MEPM, and the embodiment of the present application does not limit the name of the second device, as long as the functions of the second device can be realized.

In practical application, the third device may be MEO or MEAO, and the embodiment of the present application does not limit the name of the third device, as long as the function of the third device can be realized.

In practical application, the edge computing platform may be called MEP.

The orchestration of applications on the edge computing platform can be understood as: implementing by orchestrating the application programs and/or available resources of each application.

In one embodiment, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

The first device saves a security policy, and the security policy is used to set a security level, and manage whether the first device allows configuration of some applications on the edge computing platform through different security levels.

In actual application, the second device may be notified whether the configuration is successful, that is, whether the arrangement is completed.

Based on this, in an embodiment, the first device is further configured to send third information to the second device; the third information is used to indicate whether the configuration of the first information is successful;

The second device is further configured to send fourth information to a third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

In an embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

The third configuration strategy; the third configuration strategy is aimed at Domain Name System (DNS) of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

In an embodiment, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

Here, the application management information may include: management of application packages, such as: loading application packages, enabling application packages, disabling application packages, and the like.

The life cycle management information of the application may include: instantiating the application package, operating (using) the application instance, and terminating the application instance.

The lifecycle change notification of the application may include: the application is not instantiated, the application has started and is running, and the application stops running.

In actual application, the third device can perform identity authentication on the first device, and can communicate after passing the authentication.

Based on this, in an embodiment, the third device is further configured to receive first access authentication information from the first device, and send first authentication response information to the first device; the first authentication response The information includes at least: the identity of the first device.

In actual application, the third device can authenticate the identity of the second device, and can communicate after passing the authentication.

Based on this, in an embodiment, the third device is further configured to receive second access authentication information from the second device, and send second authentication response information to the second device; the second authentication response The information at least includes: the identity of the second device;

The third device is further configured to send the identity of the first device to the second device.

In an embodiment, the number of the first device is one or more.

Correspondingly, the embodiment of the present application also provides a communication method, which is applied to the first device, as shown in FIG. 5 , the method includes:

Step 501, receiving first information from a second device; the first information is used to configure applications on the edge computing platform;

Step 502: Provide security management functions for applications on the edge computing platform based on the first information and the security policy.

In actual application, the first device may be a locally set MEPM, which can be understood as the user sets up a local MEPM, and can perform local management and configuration on applications provided by the MEP. The first device can be deployed locally or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In practical applications, the second device may be an MEPM, and the embodiment of the present application does not limit the name of the second device, as long as the functions of the second device can be realized.

In practical application, the edge computing platform may be called MEP.

In one embodiment, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

The first device saves a security policy, and the security policy is used to set a security level, and whether the configuration for some applications on the edge computing platform is allowed in the first device is managed through different security levels.

In an embodiment, the first device may request the second device to authenticate itself, and communication may be performed after the authentication is passed.

Based on this, in an embodiment, the method further includes:

Sending third information to the second device; the third information is used to indicate whether the configuration of the first information is successful.

In an embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

In actual application, the first device may request the third device to authenticate itself, and communication may be performed after the authentication is passed.

Based on this, in an embodiment, the method further includes:

sending the first access authentication information to the third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device.

Correspondingly, the embodiment of the present application provides another communication method, which is applied to the second device, as shown in FIG. 6 , the method includes:

Step 601. Receive second information from a third device; the second information is used to arrange applications on the edge computing platform;

Step 602: Send first information to the first device based on the second information; the first information is used to instruct the first device to configure applications on the edge computing platform based on the first device and security policies .

In actual application, the first device may be a locally set MEPM, which can be understood as the user sets up a local MEPM, and can perform local management and configuration on applications provided by the MEP. The first device can be deployed locally or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In practical applications, the second device may be an MEPM, and the embodiment of the present application does not limit the name of the second device, as long as the functions of the second device can be realized.

In practical application, the third device may be MEO or MEAO, and the embodiment of the present application does not limit the name of the third device, as long as the function of the third device can be realized.

In practical application, the edge computing platform may be called MEP.

In actual application, the orchestration of applications on the edge computing platform can be understood as: implementing the orchestration of the application programs and/or available resources of each application.

In an embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

In an embodiment, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

In one embodiment, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

The first device saves a security policy, and the security policy is used to set a security level, and manage whether the first device allows configuration of some applications on the edge computing platform through different security levels.

In actual application, the second device can perform identity authentication on the first device, and can communicate after passing the authentication.

Based on this, in an embodiment, the method further includes:

receiving third information from the first device; the third information is used to indicate whether the configuration of the first information is successful;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

In actual application, the second device can request the third device to authenticate itself, and communication can be performed after the authentication is passed.

Based on this, in an embodiment, the method further includes:

Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information includes at least: the identity of the first device;

The method further includes: receiving an identity of the first device.

The present application will be further described in detail below in conjunction with application examples.

In this application embodiment, the first device is called local MEPM (L-MEPM, Local MEPM); the second device is called MEPM; the third device is called MEAO or MEO; the edge computing platform is called for MEPs.

In this application embodiment, an L-MEPM deployed on the MEP side is introduced, which is mainly responsible for signaling interaction with the MEPM and/or MEAO, and responsible for the security supervision of the MEP local management configuration data, as shown in Figure 7 .

Among them, L-MEPM, support functions include:

1), manage the management configuration request of MEPM, according to the corresponding management configuration request such as the security policy for the application on the MEP;

2) The security policy is saved, and the management configuration data from the MEPM (that is, the above-mentioned first information from the second device) is managed based on the security policy. The security policy can include three levels: strict, general, and loose. For example, at the strict level, the management configuration data from MEPM cannot configure the application on the MEP; at the general level, L-MEPM determines the Whether the management configuration data can configure the application on the MEP, at the loose level, the L-MEPM is only responsible for forwarding the management configuration data of the MEPM (the management configuration data is determined based on the management configuration request from the MEPM) to the MEP for configuration of different applications.

Of course, in actual application, the grade division can be further subdivided, which is not limited here.

In this application embodiment, as shown in Figure 8, MEAO performs orchestration management through MEPM, and L-MEPM is locally configured with a security policy to perform data security management and control for the control plane (specifically referring to the management configuration data of the application provided by MEP), In order to prevent the data of the control plane from arbitrarily configuring the application of the MEP. The communication methods include:

Step 801, MEAO (an example of a third device) sends second information to MEPM (an example of a second device);

The second information includes: MEPM identity and arrangement information;

The second information is used to orchestrate applications on the edge computing platform.

An example is given for the second information, which includes but is not limited to the contents of Table 1:

Table 1

Step 802. After receiving the second information, the MEPM sends the first information to the L-MEPM (an example of a third device);

The first information includes: L-MEPM identity and management configuration information;

The first information is used to configure applications on the edge computing platform.

An example is given for the first information, as shown in Table 2;

parameter name Types of illustrate L-MEPM ID As shown in Table 5 Unique ID of L-MEPM Manage configuration information As shown in Table 8 Manage configuration information

Table 2

Step 803, after receiving the first message, the L-MEPM checks the local security policy; performs corresponding operations based on the first message and the security policy and replies to the third message;

The local security policy of the L-MEPM includes:

At the "strict" level (equivalent to the above-mentioned first security level), L-MEPM rejects all management configuration information for MEP;

At the "general" level (equivalent to the above-mentioned second security level), L-MEPM allows some management configuration information for MEP;

At "loose" level (corresponding to the third security level mentioned above), L-MEPM allows all management configuration information for MEP.

Each application in L-MEPM has a unique identifier, and each application's identifier is marked in the security policy, and whether the corresponding mark meets the requirements.

Check the local security policy, and configure the application on the MEP corresponding to the situation that meets the security policy, and reply to the MEPM with a successful configuration message after the configuration is completed;

Corresponding to the situation in which part of the security policy is met, the application information on the MEP is partially configured, and after the configuration is completed, the configuration success information is returned to the MEPM;

If it does not comply with the local security policy, it will directly reply the configuration failure information to MEPM.

That is to say, the third information includes: MEPM identity and management configuration result information; as shown in Table 3.

parameter name Types of illustrate MEPM ID As shown in Table 5 Unique ID of MEPM Manage configuration result information As shown in Table 9 success or failure

table 3

Step 804, after the MEPM receives the third message from the L-MEPM, it returns the fourth message to the MEAO;

The fourth information is used to explain the result of editing based on the second information.

The fourth information may include: MEAO identity and management configuration result information; as shown in Table 4.

parameter name Types of illustrate MEAO identity As shown in Table 5 Unique ID of MEAO Manage configuration result information As shown in Table 10 success or failure

Table 4

The unique ID can be used in each embodiment of the application to identify the identity, such as the embodiment in Table 5;

table 5

In each embodiment of the present application, the MEPM type can be distinguished by a number or a character string identification, such as the embodiment of Table 6;

type of data illustrate number 1 means common MEPM; 2 means L-MEPM string "1" means normal MEPM; "2" means L-MEPM

Table 6

The layout information issued by MEAO in each embodiment of this application, as shown in Table 7, is designed according to the provisions of the ETSI MEC 010-2 standard protocol, and for each application package:

Table 7

The management configuration information issued by MEPM to L-MEPM provides an application example, as shown in Table 8;

Table 8

The reply information of L-MEPM to MEPM, that is, the third information, gives an application example, as shown in Table 9;

Table 9

The reply message from MEPM to MEAO, that is, the fourth message, gives an application example, as shown in Table 10;

Table 10

During actual application, in order to obtain MEPM identity mark, L-MEPM identity mark, described method also includes: identity registration; As shown in Figure 9, includes:

Step 901, MEPM (an example of a second device) and L-MEPM (an example of a first device) respectively register a request with MEAO (an example of a third device);

The registration request is the identity authentication information, which is used to request the MEAO to register an identity; the MEAO stores the corresponding identity marks of MEPM and L-MEPM after receiving the registration request and performing a registration operation. The registered identity information can include the following content as shown in Table 11:

Table 11

After step 902, MEAO receives the registration request, registers and reply information; Include content as shown in table 12 below:

Table 12

After MEAO receives the MEPM registration request, it executes a reply operation; an application example is given for the reply operation, as shown in Table 13; if it does not follow the format of Table 6, it is an illegal identification.

Table 13

Step 903, MEAO sends the registered L-MEPM information to MEPM, provides a kind of application example, as shown in table 14;

Table 14

Step 904: After the MEPM resolves the identity information and IP address of the L-MEPM, an association relationship between the MEPM and multiple L-MEPMs is formed, as shown in FIG. 10 below.

MEPM and reply to MEAO. Regarding the content of the reply information, an application example is given, as shown in Table 15;

Table 15

Regarding the reply type and reply description, an application example is given, as shown in Table 16;

reply type reply instructions 0 success 1 illegal status

Table 16

For the IP address, an application example is given, as shown in Table 17;

Table 17

An example is given for L-MEPM identity information and IP address information, as follows:

Method 1: Implemented using a hash table, the key identifies the L-MEPM identity, and the value identifies the IP address of the L-MEPM.

Method 2: Use the JSON string method to implement.

In order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the first device, as shown in FIG. 12 , the device includes:

The first communication unit 1201 is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform;

The first processing unit 1202 is configured to provide a security management function for applications on the edge computing platform based on the first information and the security policy.

Wherein, in an embodiment, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

In an embodiment, the first communication unit 1201 is further configured to send third information to the second device; the third information is used to describe whether the configuration of the first information is successful.

In an embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

In an embodiment, the first communication unit 1202 is further configured to send the first access authentication information to the third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device.

In practical applications, the first communication unit 1201 and the first processing unit 1202 may be implemented by a processor in a communication device combined with a communication interface.

In order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the second device, as shown in FIG. 13 , the device includes:

The second communication unit 1301 is configured to receive second information from a third device; the second information is used to arrange applications on the edge computing platform;

The second processing unit 1302 is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge computing platform based on the first device and a security policy Configure the application above.

Wherein, in an embodiment, the first information includes configuration information of at least one of the following:

A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications;

A second configuration strategy; the second configuration strategy is directed at routing rules for different applications;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different applications;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications.

In an embodiment, the second information includes at least one of the following:

Application management information;

Application life cycle management information;

Application lifecycle change information.

In one embodiment, the security policy includes at least one of the following:

A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected;

A second security level; the second security level characterizes the configuration for some applications on the edge computing platform;

The third security level; the first security level characterizes the configuration for all applications on the edge computing platform.

In an embodiment, the second communication unit 1301 is further configured to receive third information from the first device; the third information is used to explain whether the configuration of the first information is successful;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

In an embodiment, the second communication unit 1301 is further configured to send second access authentication information to a third device; receive second authentication response information from the third device; the second authentication response information at least include: the identity of the first device;

The second communication unit 1301 is further configured to receive the identity of the first device.

In actual application, in actual application, the second communication unit 1301 and the second processing unit 1302 may be implemented by a processor in a communication device combined with a communication interface.

It should be noted that: when the communication device provided by the above-mentioned embodiment performs communication, the division of the above-mentioned program modules is used as an example for illustration. The internal structure of the program is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiments provided in the above embodiments belong to the same idea, and the specific implementation process thereof is detailed in the method embodiments, and will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application further provides a first device, as shown in FIG. 14 , the first device 1400 includes:

The first communication interface 1401 is capable of exchanging information with the second device;

The first processor 1402 is connected to the first communication interface 1401 to implement information interaction with the second device, and is configured to execute the methods provided by one or more technical solutions on the first device side when running a computer program. Instead, the computer program is stored on the first memory 1403 .

Specifically, the first communication interface 1401 is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform;

The first processor 1402 is configured to provide security management functions for applications on the edge computing platform based on the first information and the security policy.

Wherein, in an embodiment, the first communication interface 1401 is further configured to send third information to the second device; the third information is used to describe whether the configuration of the first information is successful.

In an embodiment, the first communication interface 1401 is further configured to send first access authentication information to a third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device.

It should be noted that the specific processing procedures of the first processor 1402 and the first communication interface 1401 can be understood with reference to the above method.

Of course, in practical applications, various components in the first device 1400 are coupled together through the bus system 1404 . It can be understood that the bus system 1404 is used to realize connection and communication among these components. In addition to the data bus, the bus system 1404 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 1404 in FIG. 14 .

The first memory 1403 in the embodiment of the present application is used to store various types of data to support the operation of the first device 1400. Examples of such data include: any computer programs for operating on the first device 1400 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the first processor 1402 or implemented by the first processor 1402 . The first processor 1402 may be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the above method may be implemented by an integrated logic circuit of hardware in the first processor 1402 or an instruction in the form of software. The aforementioned first processor 1402 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The first processor 1402 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 1403. The first processor 1402 reads the information in the first memory 1403, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the first device 1400 may be implemented by one or more Application Specific Integrated Circuits (ASIC, Application Specific Integrated Circuit), DSP, Programmable Logic Device (PLD, Programmable Logic Device), complex programmable logic device ( CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or others Electronic components are implemented for performing the aforementioned methods.

Based on the hardware implementation of the above program modules, and in order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a second device, as shown in FIG. 15 , the second device 1500 includes:

The second communication interface 1501 is capable of information interaction with the first device and the third device;

The second processor 1502 is connected to the second communication interface 1501 to implement information interaction with the first device and the third device, and is used to execute one or more technical solutions on the second device side when running the computer program. Methods. Instead, the computer program is stored on the second memory 1503 .

Specifically, the second communication interface 1501 is configured to receive second information from a third device; the second information is used to arrange applications on the edge computing platform;

The second processor 1502 is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge based on the first device and a security policy The application on the computing platform is configured.

Wherein, in an embodiment, the second communication interface 1501 is further configured to receive third information from the first device; the third information is used to explain whether the configuration of the first information is successful;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful.

In an embodiment, the second communication interface 1501 is further configured to send second access authentication information to a third device; receive second authentication response information from the third device; the second authentication response information at least include: the identity of the first device;

And, receiving the identity of the first device.

It should be noted that the specific processing procedures of the second communication interface 1501 and the second processor 1502 can be understood with reference to the above methods.

Of course, in practical applications, various components in the second device 1500 are coupled together through the bus system 1504 . It can be understood that the bus system 1504 is used to realize connection and communication between these components. In addition to the data bus, the bus system 1504 also includes a power bus, a control bus and a status signal bus. However, the various buses are labeled as bus system 1504 in FIG. 15 for clarity of illustration.

The second memory 1503 in the embodiment of the present application is used to store various types of data to support the operation of the second device 1500. Examples of such data include: any computer programs for operating on the second device 1500 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the second processor 1502 or implemented by the second processor 1502 . The second processor 1502 may be an integrated circuit chip and has signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the second processor 1502 or instructions in the form of software. The aforementioned second processor 1502 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The second processor 1502 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the second storage 1503, and the second processor 1502 reads information in the second storage 1503, and completes the steps of the aforementioned method in combination with its hardware.

In an exemplary embodiment, the second device 1500 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.

It can be understood that the memory (the first memory 1403 and the second memory 1503 ) in this embodiment of the present application may be a volatile memory or a nonvolatile memory, and may also include both volatile and nonvolatile memories. Among them, the non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory) Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (Flash Memory), Magnetic Surface Memory , CD, or CD-ROM (Compact Disc Read-Only Memory); magnetic surface storage can be disk storage or tape storage. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM, Static Random Access Memory), Synchronous Static Random Access Memory (SSRAM, Synchronous Static Random Access Memory), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory ). The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific order or sequence.

In addition, the technical solutions described in the embodiments of the present application may be combined arbitrarily if there is no conflict.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (25)

A communication system, comprising: a first device, a second device, and a third device; wherein, The first device is configured to receive first information from the second device, and provide security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used for the Configure applications on the edge computing platform; The second device is configured to send the first information to the first device based on the second information from the third device; the second information is used to arrange applications on the edge computing platform. The system according to claim 1, wherein the security policy includes at least one of the following: A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected; A second security level; the second security level characterizes the configuration for some applications on the edge computing platform; The third security level; the first security level characterizes the configuration for all applications on the edge computing platform. The system according to claim 1, wherein the first device is further configured to send third information to the second device; the third information is used to indicate whether the configuration of the first information is successful; The second device is further configured to send fourth information to a third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful. The system according to claim 1, wherein the first information includes configuration information of at least one of the following: A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications; A second configuration strategy; the second configuration strategy is directed at routing rules for different applications; A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications. The system according to claim 4, wherein the second information includes at least one of the following: Application management information; Application life cycle management information; Application lifecycle change information. The system according to claim 1, wherein the third device is further configured to receive first access authentication information from the first device, and send first authentication response information to the first device; the first The authentication response information at least includes: the identity of the first device. The system according to claim 1, wherein the third device is further configured to receive second access authentication information from the second device, and send second authentication response information to the second device; the second The authentication response information at least includes: the identity of the second device; The third device is further configured to send the identity of the first device to the second device. The system according to any one of claims 1 to 7, wherein the number of the first devices is one or more. A communication method, applied to a first device, the method comprising: receiving first information from a second device; the first information is used to configure applications on the edge computing platform; A security management function is provided for applications on the edge computing platform based on the first information and the security policy. The method according to claim 9, wherein the security policy includes at least one of the following: The first security level; the first security level characterizes denial of configuration for all applications on the edge computing platform; A second security level; the second security level characterizes the configuration for some applications on the edge computing platform; The third security level; the first security level characterizes the configuration for all applications on the edge computing platform. The method according to claim 9, wherein the method further comprises: Sending third information to the second device; the third information is used to indicate whether the configuration of the first information is successful. The method according to claim 9, wherein the first information includes configuration information of at least one of the following: A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications; A second configuration strategy; the second configuration strategy is directed at routing rules for different applications; A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications. The method according to claim 9, wherein the method further comprises: sending the first access authentication information to the third device; Receive first authentication response information from the third device; the first authentication response information at least includes: an identity of the first device. A communication method applied to a second device, the method comprising: receiving second information from a third device; the second information is used to arrange applications on the edge computing platform; Sending first information to the first device based on the second information; the first information is used to instruct the first device to configure applications on the edge computing platform based on the first device and a security policy. The method according to claim 14, wherein the first information includes configuration information of at least one of the following: A first configuration strategy; the first configuration strategy is aimed at operating permissions of different applications; A second configuration strategy; the second configuration strategy is directed at routing rules for different applications; A third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS for different applications; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different applications. The method according to claim 14, wherein the second information includes at least one of the following: Application management information; Application life cycle management information; Application lifecycle change information. The method according to claim 14, wherein the security policy includes at least one of the following: A first security level; the first security level indicates that configurations for all applications on the edge computing platform are rejected; The second security level; the second security level characterizes the configuration for some applications on the edge computing platform; The third security level; the first security level characterizes the configuration for all applications on the edge computing platform. The method according to claim 14, wherein said method further comprises: receiving third information from the first device; the third information is used to indicate whether the configuration of the first information is successful; Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the configuration of the second information is successful. The method according to claim 14, wherein said method further comprises: Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information includes at least: the identity of the first device; The method further includes: receiving an identity of the first device. A communication device, set on a first device, comprising: The first communication unit is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform; The first processing unit is configured to provide security management functions for applications on the edge computing platform based on the first information and the security policy. A first device, comprising: a first processor and a first communication interface; wherein, The first communication interface is configured to receive first information from the second device; the first information is used to configure applications on the edge computing platform; The first processor is configured to provide security management functions for applications on the edge computing platform based on the first information and security policies. A communication device, set on a second device, comprising: The second communication unit is configured to receive second information from the third device; the second information is used to arrange applications on the edge computing platform; The second processing unit is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge computing platform based on the first device and the security policy configuration for the application. A second device, comprising: a second processor and a second communication interface; wherein, The second communication interface is configured to receive second information from a third device; the second information is used to arrange applications on the edge computing platform; The second processor is configured to send first information to the first device based on the second information; the first information is used to instruct the first device to target the edge computing based on the first device and a security policy Configure applications on the platform. A network device comprising: a processor and a memory configured to store a computer program capable of running on the processor, Wherein, the processor is configured to execute the steps of the method according to any one of claims 9 to 13 when running the computer program; or, The processor is configured to execute the steps of the method according to any one of claims 14 to 19 when running the computer program. A storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method according to any one of claims 9 to 13 are realized; or, When the computer program is executed by a processor, the steps of the method described in any one of claims 14 to 19 are implemented.

Images