WO2022267995A1 - Communication method and apparatus, related device, and storage medium - Google Patents

Abstract

Disclosed in the present application are a communication method and apparatus, a first device, a second device, and a storage medium. The method comprises: a first device determining a management request, the management request being used for requesting configuration of a security policy for an application service on an edge computing platform; and determining the security policy according to the management request, the security policy being used for providing a security management function for the application service on the edge computing platform.

Description

Communication method, device, related equipment and storage medium

Cross References to Related Applications

This application is based on a Chinese patent application with application number 202110703263.9 and a filing date of June 24, 2021, and claims the priority of this Chinese patent application. The entire content of this Chinese patent application is hereby incorporated by reference into this application.

technical field

The present application relates to the communication field, and in particular to a communication method, device, related equipment and storage medium.

Background technique

As a new generation of communication technology, the fifth-generation mobile communication technology (5G) has many advantages such as large bandwidth, low latency, high reliability, high connection, ubiquitous network, etc., thereby promoting the rapid development and change of vertical industries, such as smart medical, The rise of smart education and smart agriculture.

As one of the key technologies in the evolution of 5G, mobile edge computing (MEC) technology is a general information technology (IT) platform with wireless network information application programming interface (API) interaction capabilities, as well as computing, storage, and analysis functions; relying on MEC technology, It can pull traditional external applications into the mobile interior, get closer to users, and provide localized services, thereby improving user experience and giving full play to the value of edge networks.

The combination of 5G and MEC can introduce different technology combinations for different industry demand scenarios, such as quality of service (QoS), end-to-end network slicing, network capability exposure, edge cloud, etc., so as to provide customized solutions.

Among related technologies, the combination of 5G and MEC technology has security risks.

Contents of the invention

To solve related technical problems, embodiments of the present application provide a communication method, device, related equipment, and storage medium.

The technical scheme of the embodiment of the application is realized in this way:

An embodiment of the present application provides a communication method applied to a first device, including:

Determining a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform;

A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

Preferably, said determining the management request includes:

determining a first operation for the first device;

A first management request is determined based on the first operation; the first management request includes: a first security policy.

Preferably, said determining the management request includes:

Receive a second management request from the second device; the second management request includes: a second security policy.

Preferably, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

The method also includes:

Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

Preferably, said determining the management request includes:

A third management request from the edge computing platform is received; the third management request includes a third security policy.

Preferably, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The method also includes:

Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

Preferably, the method also includes:

Sending the update result to the second device; the update result at least represents whether the security policy on the first device is updated.

Preferably, the method also includes:

Sending an update result to the edge computing platform; the update result at least represents whether the security policy is updated.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

The third configuration strategy; the third configuration strategy is aimed at the Domain Name System (DNS, Domain Name System) of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication method applied to a second device, including:

Sending a second management request to the first device; the second management request is used to request configuration of a security policy for the application service on the edge computing platform; the security policy is used to provide security management for the application service on the edge computing platform Function.

Preferably, the method also includes:

An update result from the first device is received; the update result at least represents whether the security policy on the first device is updated.

Preferably, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level; the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication method applied to an edge computing platform, including:

Sending a third management request to the first device; the third management request is used to request configuration of a security policy for the application service on the edge computing platform; the security policy is used to provide security management for the application service on the edge computing platform Function.

Preferably, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

Preferably, the method also includes:

An update result from the first device is received; the update result at least indicates whether the security policy on the first device is updated.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication device, which is set on the first device, including:

The first processing unit is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform;

A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

Preferably, the first processing unit is configured to determine a first operation for the first device;

A first management request is determined based on the first operation; the first management request includes: a first security policy.

Preferably, the apparatus further includes: a first communication unit configured to receive a second management request from the second device; the second management request includes: a second security policy.

Preferably, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

The first processing unit is configured to determine whether to update the security policy stored by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy stored by the first device.

Preferably, the first communication unit is configured to receive a third management request from the edge computing platform; the third management request includes a third security policy.

Preferably, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The first processing unit is configured to determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

Preferably, the first communication unit is further configured to send the update result to the second device; the update result at least indicates whether the security policy on the first device is updated.

Preferably, the first communication unit is further configured to send an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

The third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication device, which is set on the second device, including:

The second communication unit is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to configure the edge computing platform The application service on the server provides security management functions.

Preferably, the second communication unit is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

Preferably, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication device, which is set on an edge computing platform, including:

The third communication unit is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to configure the edge computing platform The application service on the server provides security management functions.

Preferably, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

Preferably, the third communication unit is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

Preferably, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

Preferably, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level; the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

Preferably, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a first device, including: a first processor and a first communication interface; wherein,

The first processor is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform;

A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

An embodiment of the present application provides a second device, including: a second processor and a second communication interface; wherein,

The second communication interface is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; Application services on the computing platform provide security management functions.

An embodiment of the present application provides an edge computing platform, including: a third processor and a third communication interface; wherein,

The third communication interface is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; Application services on the computing platform provide security management functions.

An embodiment of the present application provides a network device, including: a processor and a memory configured to store a computer program that can run on the processor,

Wherein, the processor is configured to execute the steps of any one of the methods on the first device side above when running the computer program; or,

The processor is configured to execute the steps of any one of the methods described above on the second device side when running the computer program; or,

The processor is configured to, when running the computer program, execute the steps of any one of the methods described above on the third device side.

An embodiment of the present application provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the methods described above on the first device side are implemented; or,

When the computer program is executed by the processor, the steps of any one of the methods described above on the second device side are implemented; or,

When the computer program is executed by the processor, the steps of any one of the methods described above on the third device side are implemented.

The communication system, method, device, first device, second device, and storage medium provided in the embodiments of the present application, the method includes: the first device determines a management request; the management request is used to request an application service on an edge computing platform Configure the security policy; determine the security policy according to the management request; the security policy is used to provide security management functions for the application services on the edge computing platform. The solution of the embodiment of this application implements the configuration of the security policy on the first device, so that the first device can provide security management functions for the application services on the edge computing platform based on the security policy; The security management and control capability of the configuration data of the computing platform.

Description of drawings

FIG. 1 is a schematic diagram of a system structure of an MEC in the related art;

FIG. 2 is a schematic structural diagram of a host layer and a system layer of an MEC in the related art;

FIG. 3 is a schematic structural diagram of a system for 5G industry cloud-network integration according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a communication system of an application embodiment of the present application;

FIG. 5 is a schematic flowchart of a communication method according to an embodiment of the present application;

FIG. 6 is a schematic flowchart of another communication method according to an embodiment of the present application;

FIG. 7 is a schematic flowchart of another communication method according to an embodiment of the present application;

FIG. 8 is a schematic flowchart of a communication method in an application embodiment of the present application;

FIG. 9 is a schematic flowchart of another communication method in an application embodiment of the present application;

FIG. 10 is a schematic diagram of a permission authorization method according to an embodiment of the present application;

FIG. 11 is a schematic structural diagram of a communication device according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram of another communication device according to an embodiment of the present application;

FIG. 13 is a schematic structural diagram of another communication device according to an embodiment of the present application;

Fig. 14 is a schematic structural diagram of the first device of the embodiment of the present application;

Fig. 15 is a schematic structural diagram of the second device of the embodiment of the present application;

FIG. 16 is a schematic structural diagram of a third device according to an embodiment of the present application.

detailed description

The application will be further described in detail below in conjunction with the accompanying drawings and embodiments.

In related technologies, MEC is a multi-access edge computing platform standard led by the European Telecommunications Standards Institute (ETSI, European Telecommunications Standards Institute). Connect to the edge computing platform, and provide more efficient business operation services by virtualizing and serving MEC applications, platforms, and resources to meet the differentiated needs of different businesses in terms of processing capabilities. The ETSI standard organization defines the The framework of the MEC system shown.

The MEC system mainly includes: MEC system-level (MEC system-level), MEC host level (MEC host level), and network layer (Networks). in,

The MEC system layer is responsible for the allocation, recovery and coordination of the entire MEC resources to meet the needs of different services for computing and transmission resources. MEC system-level management supports MEC system-level management functions and host-level management functions. MEC system-level management functions include user application lifecycle management agents, operation support systems, and MEC orchestrators. MEC host-level management functions can include MEC platform managers and virtualized infrastructure managers. MEC services provided to terminals and third-party customers (such as commercial enterprises) are managed through the MEC management layer.

The MEC host layer is used to provide necessary computing, storage and transmission functions for MEC applications and MEC platforms.

The network layer is used to provide different network options (such as 3GPP wireless network, non-3GPP wireless network, and wired network) for upper-layer applications, and dynamically adjust routing strategies according to upper-layer signaling to meet the transmission requirements of different services on the network.

Among them, as shown in Figure 2, the MEC host (MEC host) includes: MEC platform and virtual infrastructure (computing, storage, network). The virtual facility includes the data plane, which is used to execute the routing rules received from the MEC platform, in the application (also called MEC app, MEC application or MEP application), service (also called MEC service or MEP service), DNS service/proxy, 3GPP Forward traffic between the network, other access networks, local networks, and external networks. Wherein, the MEP enables the application to provide and invoke the service, and the MEP itself can also provide the service. Specifically, the application runs on a virtual machine or a container, and can provide a variety of services (such as: location, wireless network information, traffic management), and the application can also use services provided by other applications, for example: Application A The provided services such as location and traffic management can be used by application B and application C. The service may be provided by the MEP or a certain application. When a certain service is provided by the application, the service may be registered in the service list of the MEP.

MEC platform (MEP, MEC platform), supported functions include:

1) Provide an environment where MEC applications can discover, notify, use and provide MEC services, including MEC services provided by other platforms (optional).

2) Receive routing rules from MEC platform management, applications or services to control data plane traffic.

3) Manage and receive DNS records from the MEC platform, and configure DNS proxy/server;

4) Managed MEC services;

5) Provide access to permanent storage and time of day information;

MEC orchestrator (MEO, MEC orchestrator), also known as MEC application orchestrator (MEAO, MEC application orchestrator), is the core of MEC system layer management. The supported functions include:

1) Maintain the overall view of the MEC system (that is, the overall deployment); such as MEC host deployment, MEC available resource allocation, available MEC service calls, system topology, etc.;

2) Manage the launch of the MEC application package, including: checking the integrity and authenticity of the application package; confirming the application rules and requirements, and judging whether the application rules and requirements need to be adjusted; conform to the vendor's policy; keep a record of the application package's rollout, and prepare the virtual infrastructure manager for handling the application;

3) Select an appropriate MEC host for application initialization based on constraints (such as delay, available resources, available services, etc.);

4) Trigger the start and end of the application;

5) Trigger on-demand migration of applications.

MEC platform management (MEPM, MEC platform manager), supported functions include:

1), MEC application life cycle management (LCM, Life Cycle Management), such as: notify MEAO of related application events;

2) Provide the element management (Element mgmt) function of the MEC platform (MEP, MEC Platform), including virtual network function (VNF, Virtualized Network Function) element management and network service (NS, Network Service) element management, where the NS information element Including physical network function (PNF, Physical Network Function) information element, virtual link information element, VNF forwarding graph (VNF Forwarding Graph) information element;

3), MEC application rules and requirements management (MEC app rules & reqts mgmt), such as: service authorization, routing rules, Domain Name System (DNS) configuration and conflict handling;

4) Receive error reports and performance measurement data of virtual resources from a virtualization infrastructure manager (VIM, Virtualization Infrastructure Manager). The main functions of VIM include: allocating, managing, and releasing virtualized resources of virtualized infrastructure, receiving and storing software images, collecting and reporting performance and fault information of virtualized resources.

From the functional description of each module of MEC, it can be seen that the rules applied by MEC (including routing rules, DNS configuration, business rules, etc.) are managed by MEPM, received by MEP, and finally executed on the user plane of the MEC host.

Mx1 , Mx2 , Mp1 , Mp2 , Mp3 , Mm1 , Mm2 . . . Mm9 in FIG. 2 indicate that various devices or modules can call interfaces and/or use corresponding communication protocols for communication.

In practical applications, there are many types of terminal access technologies in vertical industries. In addition to 5G, third-party networks also have non-5G networks (such as 4G, WiFi, Bluetooth, Zigbee, NB-IoT, SPN, infrared network, dedicated line network, Wireline, etc.) ), the data of these terminals may be transmitted to the MEP through different networks. In order to ensure the network and data security of MEP and realize ubiquitous network access and control functions, an industry gateway (iGW, industry GateWay) is introduced into a 5G industry cloud-network integration system architecture. The 5G industry cloud-network integration architecture is as follows: Figure 3 shows.

MEC platform management (MEPM) is generally set on the industry gateway. The data on the MEP can be directly connected to the external network, that is, the third-party network through the industry gateway. The existing ETSI protocol does not protect data security in place and cannot adapt to the increasingly There are more and more management requirements for data security and privacy protection.

In some typical application scenarios with sensitive data such as medical care, education, and finance, some applications and available resources (hardware resources, network resources, etc.) External) MEPM for management and configuration, the management configuration information (or management configuration data) sent by MEPM to MEP must be subject to strict security control. Based on this, in the embodiment of the present application, it is proposed to introduce a local MEPM (L-MEPM) on the existing system architecture for local management and configuration of the applications provided by the MEP, as shown in Figure 4, wherein,

The L-MEPM receives the first information from the MEPM, and provides security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used to perform security management on the applications on the edge computing platform configuration;

The MEPM may receive the second information from the MEAO, and send the first information to the first device according to the second information; the second information is used to arrange applications on the edge computing platform.

The edge computing platform may be called MEP. The orchestration of applications on the edge computing platform can be understood as: implementing by orchestrating the application programs and/or available resources of each application.

The system architecture shown in FIG. 4 needs to provide an effective method for managing security policies, so as to ensure the security protection of the management configuration data on the MEP side.

Based on this, in various embodiments of the present application, the first device determines a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform; according to the management request, the security policy is determined ; The security policy is used to provide security management functions for application services on the edge computing platform.

An embodiment of the present application provides a communication method applied to a first device, as shown in FIG. 5 , the method includes:

Step 501. Determine a management request; the management request is used to request configuration of security policies for application services on the edge computing platform;

Step 502: Determine a security policy according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

In practical application, a first device is set on the side of the edge computing platform, and the first device can communicate with the second device.

In actual application, the first device may be a locally set MEPM, which can be understood as the user sets up a local MEPM, and can perform local management and configuration on applications provided by the MEP. The first device can be deployed locally or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In practical applications, the second device may be an MEPM, and the embodiment of the present application does not limit the name of the second device, as long as the functions of the second device can be realized.

In practical application, the edge computing platform may be called MEP.

In actual application, the security policy can be directly configured by the local administrator through the human-computer interaction interface provided by the first device, that is, the local MEPM.

Based on this, in an embodiment, the determining the management request includes:

determining a first operation for the first device;

A first management request is determined based on the first operation; the first management request includes: a first security policy.

Here, the local administrator performs the first operation through the human-computer interaction interface of the local MEPM, the first device determines the first operation for the first device, and determines the management request based on the first operation, that is, the first management request; based on the The first management request may determine a corresponding security policy, which is referred to as the first security policy.

In actual application, the security policy can be directly configured remotely by the remote administrator through the man-machine interaction interface provided by the second device, namely MEPM.

Based on this, in an embodiment, the determining the management request includes:

Receive a second management request from the second device; the second management request includes: a second security policy.

Here, the remote administrator performs the second operation through the human-computer interaction interface of MEPM, the second device determines the second operation for the second device, and determines the management request based on the second operation, that is, the second management request; the second device sends The first device sends a second management request; the first device receives the second management request, and the second security policy may be determined based on the second management request.

In practical application, in order to improve the security of security policy configuration, the priority of security policy is proposed, and based on the priority, it is determined whether the security policy can be configured or updated based on the corresponding management request.

Based on this, in an embodiment, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to the initial priority;

Correspondingly, the method also includes:

Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

In actual application, the security policy may be configured through a request reported by the edge computing platform.

Based on this, in an embodiment, the determining the management request includes:

A third management request from the edge computing platform is received; the third management request includes a third security policy.

In practical application, in order to improve the security of security policy configuration, the priority of security policy is proposed, and based on the priority, it is determined whether the security policy can be configured or updated based on the corresponding management request.

Based on this, in an embodiment, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The method also includes:

Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

For example, the first security policy can also have a corresponding priority. The priority of the first security policy, the priority of the second security policy, and the priority of the third security policy can be set by different operators, such as the first The local administrator on the first device side, the remote administrator on the second device side, and the operator on the third device side are set accordingly; the first device receives the first management request, the second management request, and the third management request at the same time. When two or three of the requests are requested, the security policy with the highest priority is determined by comparing the priorities, such as the above-mentioned first security policy, and the security policy saved by the first device is updated according to the first security policy.

The priority of the first security policy, the priority of the second security policy, and the priority of the third security policy can also be determined based on their corresponding devices, for example, set the priority of the first device to 1, and the priority of the second device The priority is 2, and the priority of the edge computing platform is 3. Correspondingly, the first security policy can also have a priority of 1, the priority of the second security policy is 2, and the priority of the third security policy is 3; when the first device receives two or three of the first management request, the second management request, and the third management request at the same time, by comparing the priorities, determine the security policy with the highest priority, as described in the first security policy, update the security policy stored in the first device according to the first security policy.

When considering practical applications, there may be scenarios where different operators set the same priority, such as the local administrator on the first device side, the remote administrator on the second device side, and the operator on the third device side for the first security policy, the second security policy, and the third security policy have the same priority respectively; considering this situation, the above scheme of setting priority by the operator and determining the priority based on the corresponding equipment can be combined, that is, for each security policy setting Set two priorities, one of which is set by the operator (local administrator, remote administrator, etc.), and the other is set according to different devices (first device, second device, third device); in the first When the device receives two or three of the first management request, the second management request, and the third management request at the same time, and compares and finds that the priorities set by the operator are the same, further compare the priorities set by different devices , whichever takes precedence. For example: the two priorities corresponding to the first security policy are 2 (set by the local administrator) and 1 (determined based on the first device), and the two priorities corresponding to the second security policy are 2 (set by the remote administrator) , 2 (determined based on the second device), it is found that the priorities set by the operator are all 2, further comparison is made based on the priorities determined by the device, and it is determined that the priority of the first security policy is higher, then according to the first security policy The policy updates the security policy saved by the first device.

For the remote administrator on the second device side, there may be multiple remote administrators, and different permissions can be assigned to each remote administrator; for the local administrator on the first device side, there may also be multiple remote administrators. In the case of local administrators, different permissions can be assigned to each local administrator. That is to say, various local administrators on the first device side, remote administrators on the second device side, and edge computing platforms can be considered comprehensively, and different permissions (corresponding to different priorities) can be assigned. The above is only based on device configuration priorities. It is just an example and does not make a limitation. In actual application, it should be configured according to actual needs.

The above are just several priority setting and specific application examples given, and the priority can be set based on requirements in actual application, without limitation.

In actual application, the first device may notify the second device of an update result of the security policy.

Based on this, in an embodiment, the method further includes:

Sending the update result to the second device; the update result at least represents whether the security policy on the first device is updated.

In actual application, the first device may notify the edge computing platform of the update result of the security policy, especially in the case of updating the security policy based on the third management request, notify the update result.

Based on this, in an embodiment, the method further includes:

Sending an update result to the edge computing platform; the update result at least represents whether the security policy is updated.

In an embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

The third configuration strategy; the third configuration strategy is aimed at Domain Name System (DNS) of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication method applied to a second device, as shown in FIG. 6, the method includes:

Step 601: Send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to serve applications on the edge computing platform Provides security management functions.

In actual application, the first device may notify the second device of an update result of the security policy.

Based on this, in an embodiment, the method further includes:

An update result from the first device is received; the update result at least represents whether the security policy on the first device is updated.

In actual application, in order to improve the security of security policy configuration, the priority of the security policy is proposed, and the first device determines whether the security policy can be configured or updated based on the corresponding management request based on the priority.

Based on this, in an embodiment, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to the initial priority;

The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

In one embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

An embodiment of the present application provides a communication method applied to an edge computing platform, as shown in FIG. 7 , the method includes:

Step 701: Send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to serve applications on the edge computing platform Provides security management functions.

In actual application, in order to improve the security of security policy configuration, the priority of the security policy is proposed, and the first device determines whether the security policy can be configured or updated based on the corresponding management request based on the priority.

Based on this, in an embodiment, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

In actual application, the first device may notify the edge computing platform of the update result of the security policy, especially in the case of updating the security policy based on the third management request, notify the update result.

Based on this, in an embodiment, the method further includes:

An update result from the first device is received; the update result at least indicates whether the security policy on the first device is updated.

In an embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

The third configuration strategy; the third configuration strategy is aimed at Domain Name System (DNS) of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

The present application will be further described in detail below in conjunction with application examples.

In this application embodiment, the first device is called a local MEPM (L-MEPM, Local MEPM); the second device is a MEPM; and the edge computing platform is called an MEP.

Three ways of managing security policies on L-MEPM are proposed:

1), the local administrator directly performs operation configuration on the L-MEPM; corresponding to the above configuration through the first management request;

2), the remote administrator configures through the MEPM remote management request; corresponding to the above configuration through the second management request;

3) Configuration is performed through a local request reported by the MEP; corresponding to the above configuration through a third management request.

Considering that L-MEPM has the default security policy of each application on the MEP, if several methods are operated at the same time, there may be conflicts or security issues, and it is proposed to configure according to the priority of the security policy.

Mode 2) For example, the security policy on the L-MEPM corresponds to save:

Authorized remote operators: Each remote operator can be stored in an array or other ways.

Examples are as follows:

Here, in order to uniformly perform the same operation on multiple applications, an application group is proposed, and the application group is used to manage multiple application lists of the same security level.

In this application embodiment, a communication method is provided, which is configured through a remote management request (equivalent to the above-mentioned second management request) sent by MEPM, as shown in FIG. 8, the method includes:

Step 801, MEPM sends a remote management request to L-MEPM;

Specifically, the remote administrator initiates a security policy configuration request on the operation and maintenance management device, and initiates a remote management request to the L-MEPM through the MEPM, and the remote management request is used to request configuration or update of the security policy.

An example is given for the content of the request information, which includes but is not limited to the content in Table 1.

Table 1

Here, an example is given for task request types, as shown in Table 2.

Table 2

Here, an example is given for the unique ID in the system, as shown in Table 3.

table 3

Here, an example is provided for security policy priority. Specifically,

Method 1. Use a number (Int or Long) to represent the security policy priority. The smaller the number, the higher the priority. The highest priority is set to 0, and the sequence from high to low is 0/1/2/3/4.

Method 1: Use a JSON string to indicate the priority of the security policy applied on the MEP

Method 2. Use a hash table to represent, Key is the application name, and value is the priority of the security policy.

1), when the security policy priority parameter in the request is less than or equal to the priority stored in L-MEPM, update the security policy; for example: the priority of the remote management request is 1, and the existing priority parameter is 3, then update the security policy .

2) When the security policy priority parameter in the request is greater than the priority stored in L-MEPM, the security policy will not be updated; for example, if the priority of the remote management request is 1, and the existing priority parameter is 0, the security policy will not be updated. Strategy.

Here, an example is given for the security policy information, which may include the security policy information shown in Table 4 for each application on the MEP.

Table 4

Here, an example is given for the configuration information, as shown in Table 5 below:

table 5

Specifically, when the security level of the application on the MEP is set or updated to "strict", the management configuration data operation of all applications on the MEP is prohibited to configure the MEP, and L-MEPM will actively cut off the management configuration operation of the MEPM.

When the security level of the application on the MEP is set or updated to "Normal", only allowed applications can be managed and configured by the MEPM, and the application is used to distinguish them.

When the security level of the application on the MEP is set or updated to "loose", all management configuration data of the application is allowed to be operated.

Step 802, the L-MEPM responds to the remote management request.

Specifically, after the L-MEPM receives the remote management request for the security policy, it judges the security policy according to the "security policy priority" in the remote management request;

If it is possible/unable to update the security policy on the L-MEPM for the application on the MEP, the L-MEPM sends a message reply to the MEPM.

An example is given for the reply message, and the request information includes but not limited to the content in Table 6.

Table 6

Here, an example is given for the reply type and reply description sent by the L-MEPM to the MEPM, as shown in Table 7.

reply type reply instructions 0 Successfully set or updated security policy 1 Security policy priority parameter error 2 The priority of the security policy is lower than that of the existing application and cannot be changed.

the new 3 The remote administrator does not have permission

Table 7

If the security policy applied on the MEP changes, it can also proactively report the updated security policy to the L-MEPM, and the priority of the security policy can be higher than the existing security policy of the L-MEPM.

In this application embodiment, a communication method is also provided, which is configured through a local request (equivalent to the above-mentioned third management request) reported by the MEP, as shown in FIG. 9 , the method includes:

Step 901, MEP sends a local request to L-MEPM;

Specifically, when the security policy of an application on the MEP changes, the changed security policy information is sent to the L-MEPM; the content can be shown in Table 8 below:

Table 8

Step 902, the L-MEPM responds to the local request.

Specifically, L-MEPM performs a security policy judgment after receiving a security policy management request. When L-MEPM detects that the "Security Policy Priority" parameter in the request message is less than or equal to the existing "Security Policy Priority" parameter , the security policy is updated. The L-MEPM sends a message reply to the MEP, and the reply information may include the information shown in Table 9 below:

Table 9

An example is provided for the reply message and reply description sent by the L-MEPM to the MEP, as shown in Table 10.

Table 10

The method may also include:

Step 903, reporting the suspension of the security management authority to the MEPM;

After the security policy is updated, there may be changes in the security level of some applications. For example, if it is changed from "General" to "Strict", the update result can be sent to MEPM, as shown in Table 11, to inform the suspension of the security management authority of the application. , that is to tell the MEPM not to send configuration information to the L-MEPM, and the MEPM will not be able to manage and configure the application on the MEP.

Table 11

Step 904, L-MEPM responds to MEPM with a suspension situation;

That is, the L-MEPM informs the MEPM that it has received and knows that it will not be able to manage and configure this application on the MEP.

Here, an example of the response reply is given, as shown in Table 12.

Table 12

In order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the first device, as shown in FIG. 11 , the device includes:

The first processing unit 1102 is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform;

A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

In an embodiment, the first processing unit 1102 is configured to determine a first operation for the first device;

A first management request is determined based on the first operation; the first management request includes: a first security policy.

In an embodiment, the apparatus further includes: a first communication unit 1101 configured to receive a second management request from the second device; the second management request includes: a second security policy.

Wherein, the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to the initial priority;

The first processing unit 1102 is configured to determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device.

In an embodiment, the first communication unit 1101 is configured to receive a third management request from the edge computing platform; the third management request includes a third security policy.

Wherein, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The first processing unit 1102 is configured to determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device.

In an embodiment, the first communication unit 1101 is further configured to send the update result to the second device; the update result at least indicates whether to update the security policy on the first device.

In an embodiment, the first communication unit 1101 is further configured to send an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

In an embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

In practical applications, the first communication unit 1101 and the first processing unit 1102 may be implemented by a processor in a communication device combined with a communication interface.

In order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the second device, as shown in FIG. 12 , the device includes:

The second communication unit 1201 is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used for edge computing Application services on the platform provide security management functions.

In an embodiment, the second communication unit 1201 is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

The second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to the initial priority;

The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

In an embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level; the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

In actual application, the second communication unit 1201 may be implemented by a communication interface in a communication device.

It should be noted that: when the communication device provided by the above-mentioned embodiment performs communication, the division of the above-mentioned program modules is used as an example for illustration. The internal structure of the program is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiments provided in the above embodiments belong to the same idea, and the specific implementation process thereof is detailed in the method embodiments, and will not be repeated here.

In order to implement the method on the third device side of the embodiment of the present application, the embodiment of the present application also provides a communication device, which is set on the third device, as shown in FIG. 13 , the device includes:

The third communication unit 1301 is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used for edge computing Application services on the platform provide security management functions.

In an embodiment, the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority;

The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy.

In an embodiment, the third communication unit 1301 is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

In an embodiment, the security policy includes: a security level for each application service in at least one application service;

The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes:

Fully agree, partially agree, reject, exception information.

In one embodiment, the security policy includes at least one of the following:

The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform;

The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform;

The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform.

In an embodiment, the configuration information includes at least one of the following:

A first configuration strategy; the operation authority of the first configuration strategy for different application services;

A second configuration strategy; the second configuration strategy is directed at routing rules for different application services;

A third configuration strategy; the third configuration strategy is aimed at domain name systems of different application services;

A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services.

In practical applications, the third communication unit 1301 may be implemented by a communication interface in a communication device.

It should be noted that: when the communication device provided by the above-mentioned embodiment performs communication, the division of the above-mentioned program modules is used as an example for illustration. The internal structure of the program is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiments provided in the above embodiments belong to the same idea, and the specific implementation process thereof is detailed in the method embodiments, and will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a first device, as shown in Figure 14, the first device 1400 includes:

The first communication interface 1401 is capable of exchanging information with the second device;

The first processor 1402 is connected to the first communication interface 1401 to implement information interaction with the second device, and is configured to execute the methods provided by one or more technical solutions on the first device side when running a computer program. Instead, the computer program is stored on the first memory 1403 .

Specifically, the first communication interface 1401 is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform;

The first processor 1402 is configured to determine a security policy according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform.

Wherein, in an embodiment, the first communication interface 1401 is configured to determine a first operation for the first device;

A first management request is determined based on the first operation; the first management request includes: a first security policy.

In an embodiment, the first communication interface 1401 is configured to receive a second management request from the second device; the second management request includes: a second security policy.

In an embodiment, the first processor 1402 is configured to determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device. security policy.

In an embodiment, the first communication interface 1401 is configured to receive a third management request from the edge computing platform; the third management request includes a third security policy.

In an embodiment, the first processor 1402 is configured to determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device. security policy.

In an embodiment, the first communication interface 1401 is further configured to send the update result to the second device; the update result at least indicates whether to update the security policy on the first device.

In an embodiment, the first communication interface 1401 is further configured to send an update result to the edge computing platform; the update result at least indicates whether the security policy is updated.

It should be noted that the specific processing procedures of the first processor 1402 and the first communication interface 1401 can be understood with reference to the above method.

Of course, in practical applications, various components in the first device 1400 are coupled together through the bus system 1404 . It can be understood that the bus system 1404 is used to realize connection and communication between these components. In addition to the data bus, the bus system 1404 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 1404 in FIG. 14 .

The first memory 1403 in the embodiment of the present application is used to store various types of data to support the operation of the first device 1400 . Examples of such data include: any computer programs for operating on the first device 1400 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the first processor 1402 or implemented by the first processor 1402 . The first processor 1402 may be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the above method may be implemented by an integrated logic circuit of hardware in the first processor 1402 or an instruction in the form of software. The aforementioned first processor 1402 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The first processor 1402 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 1403, and the first processor 1402 reads the information in the first memory 1403, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the first device 1400 may be implemented by one or more Application Specific Integrated Circuits (ASIC, Application Specific Integrated Circuit), DSP, Programmable Logic Device (PLD, Programmable Logic Device), complex programmable logic device ( CPLD, Complex Programmable Logic Device), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or others Electronic components are implemented for performing the aforementioned methods.

Based on the hardware implementation of the above program modules, and in order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a second device, as shown in FIG. 15 , the second device 1500 includes:

The second communication interface 1501 is capable of information interaction with the first device and the third device;

The second processor 1502 is connected to the second communication interface 1501 to realize information interaction with the first device and the third device, and is configured to execute one or more technical solutions on the second device side when running a computer program. Methods. Instead, the computer program is stored on the second memory 1503 .

Specifically, the second communication interface 1501 is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy It is used to provide security management functions for application services on the edge computing platform.

Wherein, in an embodiment, the second communication interface 1501 is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

It should be noted that the specific processing procedures of the second communication interface 1501 and the second processor 1502 can be understood with reference to the above methods.

Of course, in actual application, various components in the second device 1500 are coupled together through the bus system 1504 . It can be understood that the bus system 1504 is used to realize connection and communication between these components. In addition to the data bus, the bus system 1504 also includes a power bus, a control bus and a status signal bus. However, the various buses are labeled as bus system 1504 in FIG. 15 for clarity of illustration.

The second memory 1503 in the embodiment of the present application is used to store various types of data to support the operation of the second device 1500 . Examples of such data include: any computer programs for operating on the second device 1500 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the second processor 1502 or implemented by the second processor 1502 . The second processor 1502 may be an integrated circuit chip and has signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the second processor 1502 or instructions in the form of software. The aforementioned second processor 1502 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The second processor 1502 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the second storage 1503, and the second processor 1502 reads information in the second storage 1503, and completes the steps of the aforementioned method in combination with its hardware.

In an exemplary embodiment, the second device 1500 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.

Based on the hardware implementation of the above program modules, and in order to implement the method on the third device side of the embodiment of the present application, the embodiment of the present application further provides a third device, as shown in FIG. 16 , the third device 1600 includes:

The third communication interface 1601 is capable of exchanging information with the first device and the third device;

The third processor 1602 is connected to the third communication interface 1601 to realize information interaction with the first device and the third device, and is configured to execute one or more technical solutions on the third device side when running a computer program. Methods. Instead, the computer program is stored on the third memory 1603 .

Specifically, the third communication interface 1601 is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy It is used to provide security management functions for application services on the edge computing platform.

Wherein, in an embodiment, the third communication interface 1601 is further configured to receive an update result from the first device; the update result at least indicates whether to update the security policy on the first device.

It should be noted that the specific processing procedures of the third communication interface 1601 and the third processor 1602 can be understood with reference to the above methods.

Of course, in practical application, various components in the third device 1600 are coupled together through the bus system 1604 . It can be understood that the bus system 1604 is used to realize connection and communication between these components. In addition to the data bus, the bus system 1604 also includes a power bus, a control bus and a status signal bus. However, the various buses are labeled as bus system 1604 in FIG. 16 for clarity of illustration.

The third memory 1603 in the embodiment of the present application is used to store various types of data to support the operation of the third device 1600 . Examples of such data include: any computer programs for operating on the third device 1600 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the third processor 1602 or implemented by the third processor 1602 . The third processor 1602 may be an integrated circuit chip and has signal processing capability. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the third processor 1602 or an instruction in the form of software. The aforementioned third processor 1602 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The third processor 1602 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the third storage 1603, and the third processor 1602 reads information in the third storage 1603, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the third device 1600 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.

It can be understood that the memory (the first memory 1403, the second memory 1503, and the third memory 1603) in the embodiment of the present application may be a volatile memory or a nonvolatile memory, and may also include volatile and nonvolatile memory both. Among them, the non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory) Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (Flash Memory), Magnetic Surface Memory , CD, or CD-ROM (Compact Disc Read-Only Memory); magnetic surface storage can be disk storage or tape storage. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM, Static Random Access Memory), Synchronous Static Random Access Memory (SSRAM, Synchronous Static Random Access Memory), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory ). The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific order or sequence.

In addition, the technical solutions described in the embodiments of the present application may be combined arbitrarily if there is no conflict.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (31)

A communication method, applied to a first device, comprising: Determining a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform; A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform. The method according to claim 1, wherein said determining a management request comprises: determining a first operation for the first device; A first management request is determined based on the first operation; the first management request includes: a first security policy. The method according to claim 1, wherein said determining a management request comprises: Receive a second management request from the second device; the second management request includes: a second security policy. The method according to claim 3, wherein the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority; The method also includes: Determine whether to update the security policy saved by the first device according to the priority of the second security policy and the initial priority corresponding to the security policy saved by the first device. The method according to claim 1, wherein said determining a management request comprises: A third management request from the edge computing platform is received; the third management request includes a third security policy. The method according to claim 5, wherein the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority; The method also includes: Determine whether to update the security policy saved by the first device according to the priority of the third security policy and the initial priority corresponding to the security policy saved by the first device. The method according to any one of claims 1 to 6, wherein the method further comprises: Sending the update result to the second device; the update result at least represents whether the security policy on the first device is updated. The method according to claim 4, wherein the method further comprises: Sending an update result to the edge computing platform; the update result at least represents whether the security policy is updated. The method according to any one of claims 1 to 7, wherein the security policy includes: a security level for each application service in at least one application service; The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes: Fully agree, partially agree, reject, exception information. The method according to claim 9, wherein the security policy includes at least one of the following: The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform; The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform; The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform. The method according to claim 10, wherein the configuration information includes at least one of the following: A first configuration strategy; the operation authority of the first configuration strategy for different application services; A second configuration strategy; the second configuration strategy is directed at routing rules for different application services; The third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS of different application services; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services. A communication method, applied to a second device, comprising: Sending a second management request to the first device; the second management request is used to request configuration of a security policy for the application service on the edge computing platform; the security policy is used to provide security management for the application service on the edge computing platform Function. The method according to claim 12, wherein said method further comprises: An update result from the first device is received; the update result at least represents whether the security policy on the first device is updated. The method according to claim 12, wherein the second management request further includes: the priority of the second security policy; the security policy saved by the first device corresponds to an initial priority; The priority of the second security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy. The method according to any one of claims 12 to 14, wherein the security policy includes: a security level for each application service in at least one application service; The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes: Fully agree, partially agree, reject, exception information. The method according to claim 12, wherein the security policy includes at least one of the following: The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform; The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform; The third security level; the first security level characterizes the configuration information allowed for all application services on the edge computing platform. The method according to claim 16, wherein the configuration information includes at least one of the following: A first configuration strategy; the operation authority of the first configuration strategy for different application services; A second configuration strategy; the second configuration strategy is directed at routing rules for different application services; The third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS of different application services; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services. A communication method, applied to an edge computing platform, comprising: Sending a third management request to the first device; the third management request is used to request configuration of a security policy for the application service on the edge computing platform; the security policy is used to provide security management for the application service on the edge computing platform Function. The method according to claim 18, wherein the third management request further includes: the priority of the third security policy; the security policy saved by the first device corresponds to an initial priority; The priority of the third security policy and the initial priority corresponding to the security policy saved by the first device are used by the first device to determine whether to update the security policy. The method according to claim 19, wherein said method further comprises: An update result from the first device is received; the update result at least indicates whether the security policy on the first device is updated. The method according to claim 20, wherein the security policy includes: a security level for each application service in at least one application service; The update result includes a configuration response for the security policy of each application service; the type of the configuration response includes: Fully agree, partially agree, reject, exception information. The method according to any one of claims 18 to 21, wherein the security policy includes at least one of the following: The first security level; the first security level represents the denial of configuration information for all application services on the edge computing platform; The second security level; the second security level characterizes the configuration information allowed for some application services on the edge computing platform; The third security level: the first security level characterizes the configuration information allowed for all application services on the edge computing platform. The method according to claim 22, wherein the configuration information includes at least one of the following: A first configuration strategy; the operation authority of the first configuration strategy for different application services; A second configuration strategy; the second configuration strategy is directed at routing rules for different application services; The third configuration strategy; the third configuration strategy is aimed at Domain Name System DNS of different application services; A fourth configuration strategy; the fourth configuration strategy is aimed at the life cycles of different application services. A communication device, set on a first device, comprising: The first processing unit is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform; A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform. A communication device, set on a second device, comprising: The second communication unit is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to configure the edge computing platform The application service on the server provides security management functions. A communication device, set on an edge computing platform, comprising: The third communication unit is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; the security policy is used to configure the edge computing platform The application service on the server provides security management functions. A first device, comprising: a first processor and a first communication interface; wherein, The first processor is configured to determine a management request; the management request is used to request configuration of a security policy for application services on the edge computing platform; A security policy is determined according to the management request; the security policy is used to provide security management functions for application services on the edge computing platform. A second device, comprising: a second processor and a second communication interface; wherein, The second communication interface is configured to send a second management request to the first device; the second management request is used to request configuration of a security policy for application services on the edge computing platform; Application services on the computing platform provide security management functions. An edge computing platform, comprising: a third processor and a third communication interface; wherein, The third communication interface is configured to send a third management request to the first device; the third management request is used to request configuration of a security policy for application services on the edge computing platform; Application services on the computing platform provide security management functions. A network device comprising: a processor and a memory configured to store a computer program capable of running on the processor, Wherein, the processor is configured to execute the steps of the method according to any one of claims 1 to 11 when running the computer program; or, The processor is configured to execute the steps of the method according to any one of claims 12 to 17 when running the computer program; or, The processor is configured to execute the steps of the method according to any one of claims 18 to 23 when running the computer program. A storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are realized; or, When said computer program is executed by a processor, it implements the steps of any one of claims 12 to 17; or, When the computer program is executed by a processor, the steps of the method described in any one of claims 18 to 23 are realized.

Images