WO2023061366A1 - Resource access method and apparatus - Google Patents

Abstract

The present application relates to the technical field of communications, and is used for providing a mechanism for determining a security risk that may occur in a mobile edge (ME) host. Provided are a resource access method and apparatus. The resource access method comprises: a first network element receiving information of a mobile edge host from a second network element, wherein the information of the mobile edge host comprises first information of a resource, which is provided by the mobile edge host, and/or second information that indicates behavior of accessing the mobile edge host; and determining a risk state according to the information of the mobile edge host, so as to provide a mechanism for determining a security risk of the ME host. In addition, the first network element determines a resource policy according to the risk state, and uses the corresponding resource policy, such that the security risk of the ME host is reduced in a timely manner, and the security of the ME host is improved, thereby improving the security of an MEC architecture.

Description

Resource access method and device

Cross References to Related Applications

This application claims the priority of the Chinese patent application with the application number 202111198509.8 and the application title "A resource access method and device" submitted to the China Patent Office on October 14, 2021, the entire contents of which are incorporated by reference in this application .

technical field

The present application relates to the field of communication technologies, and in particular to a resource access method and device.

Background technique

The multi-access edge computing (MEC) architecture provides a cloud computing and information technology (IT) service environment for network operators and service providers. The MEC architecture includes mobile edge system level and ME host level. The ME system layer is used to control the ME host layer globally. The ME host layer includes the ME host and a mobile edge platform manager (MEPM) for managing the ME host. A third-party client (for example, an application (application, APP) provider) may deploy the APP on the ME host in the MEC architecture, and the APP runs using resources on the ME host. Among them, third-party customers can be understood as users of resources in the MEC architecture, which do not belong to the MEC architecture.

In order to ensure the security of the MEC architecture, a security access mechanism is currently provided, through which the identity of the external user who requests to access the application on the ME host can be verified, and if the authentication passes, the external user is allowed to access Applications on the ME host. This security access mechanism can verify the identity of external users, and can exclude external users with illegal identities. However, this security access mechanism only authenticates external users, but does not consider possible security risks inside the ME host.

Contents of the invention

Embodiments of the present application provide a resource access method and device, which are used to provide a mechanism for determining possible security risks of an ME host.

In the first aspect, the embodiment of the present application provides a resource access method, which can be executed by a first network element, such as an operation support system OSS or MEPM, or a communication network element with OSS or MEPM functions. The device, or the first network element is a chip system with an OSS or MEPM function. The method includes: the first network element receives information of a mobile edge host from a second network element, and the information of the mobile edge host includes first information of a first resource and/or second information indicating a behavior of accessing the mobile edge host Information, the first resource is a resource provided by the mobile edge host; the first network element determines the risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has security Risk: the first network element determines a resource policy according to the risk state, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host. Wherein, the second network element is, for example, an ME host or an MEPM, or the second network element is a communication device having the ME host or the MEPM, or the second network element is a chip system having the ME host or the MEPM, and the like.

In the embodiment of this application, the first network element can analyze the risk status of the ME host according to the first information and/or the second information, and provide a mechanism for determining the risk status of the ME host, so as to determine the possible security risks of the ME host. Risks, because the embodiment of the present application considers the security issues that may occur inside the ME host, so the security of the ME host can be improved, and the security of the MEC architecture can also be improved. Moreover, if the ME host has a security risk, corresponding resource policies can be adopted to reduce the security risk of the ME host in a timely manner, further ensuring the security of the MEC architecture.

In a possible implementation manner, the first network element determining the risk status according to the information of the mobile edge host includes: the first network element determining whether the second resource corresponding to the first information is abnormal, wherein , if the resource corresponding to the first information is abnormal, determining that the risk status is that the mobile edge host has a risk of being invaded, and the second resource belongs to the first resource; and/or, the first network The element determines whether the behavior corresponding to the second information is abnormal, wherein, if the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the mobile edge host has a risk of being invaded.

In the above embodiments, multiple ways of determining the risk status of the ME host are provided. Since the first network element receives the first information and/or the second information from the second network element, the way for the first network element to obtain the first information and/or the second information is relatively simple, and the first network element can directly By analyzing the first information and/or the second information, the risk status of the ME host can be determined. In this way, the process for the first network element to determine the risk status of the ME host is also simple.

In a possible implementation manner, the second resource includes first hardware, and the first information includes a first identifier, where the first identifier is an identifier of the first hardware; the first network element determines Whether the second resource corresponding to the first information is abnormal includes: if the first identifier does not match the pre-stored second identifier, and/or the first identifier does not match the third identifier, the first network The element determines that the first hardware is abnormal, the third identifier is an identifier received from a third network element, and is an identifier of second hardware, and the second hardware is hardware after the first hardware has been changed.

In the above embodiment, the first network element may analyze whether the first identification of the first hardware included in the first information matches the pre-stored second identification, and/or analyze the first identification and the third identification received from the third network element. Whether the identifiers match, and then determine whether the first hardware in the ME host is abnormal provides a way to determine whether the second resource is abnormal. Moreover, matching different identifiers to determine whether the first hardware of the ME host is abnormal does not involve a complex data analysis process, making it relatively simple to determine the risk status of the ME host. Moreover, the third identification is the identification of the hardware after the first hardware change, and the first identification is matched with the third identification, which takes into account the normal change of the first hardware, so that the determined risk status of the ME host is reliable. Sex is higher.

In a possible implementation manner, the second resource includes a first type port of the mobile edge host, and the first type port belongs to an opened port in the mobile edge host; the first network element Determining whether the second resource corresponding to the first information is abnormal includes: the first network element receiving information about a port of a second type from a third network element, where the port of the second type is the port that the third network element has sent to The mobile edge host applies for open ports; if one or more ports in the first type of ports do not belong to the second type of ports, the first network element determines that the one or more ports are abnormal.

In the foregoing implementation manners, a manner of determining whether the resource provided by the ME host is abnormal is provided. The first network element can analyze whether there are unauthorized ports in the first type of ports opened by the ME host, and then determine whether the second resource is abnormal, without complex data analysis and processing, and the method of determining whether the second resource is abnormal is relatively simple. Moreover, this method can clearly determine which ports are opened but not authorized ports in the ME host, so that these ports can be closed later, which is beneficial to reduce the risk of the ME host in a targeted manner.

In a possible implementation manner, the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is closing the one or more ports.

In the above embodiment, if the first network element determines that there are one or more unauthorized ports on the ports that the ME host has opened, then the first network element can determine that the resource policy is to close the one or more ports, and the follow-up can be timely Close one or more ports, thereby reducing the risk of the ME host and improving the security of the MEC architecture.

In a possible implementation manner, the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is to deactivate the mobile edge host or reduce the security level of the mobile edge host, wherein, if the security level of the mobile edge host is reduced to the first security level, the mobile edge host does not support deployment priority The first priority is the highest priority of the application that can support deployment when the security level of the mobile edge host is the first security level.

In the above implementation manner, if the ME host has a risk of being invaded, the ME host may be deactivated, so as to avoid other more serious risks caused by continuing to use the ME host. Or, you can choose to lower the security level of the ME host, and the lower the security level, the lower the highest priority of the application that the ME host supports to deploy, so as to ensure that high-priority applications can be deployed on the ME with a higher security level. On the host to ensure that applications with higher priority run more stably. In addition, applications with relatively low priority can still be deployed on ME hosts with lower security levels, which can make rational use of resources on each ME host.

In a possible implementation manner, the determining the risk status by the first network element according to the information of the mobile edge host includes: the first network element receives an access request from a fourth network element, and the access request is used to Requesting access to a third resource of the mobile edge host; the first network element determines whether the third resource satisfies the first condition according to the information of the mobile edge host; if the third resource does not meet the first condition A condition, determining that the risk status is that the mobile edge host has a risk of being intruded, or, if the third resource satisfies the first condition, determining that the risk status is that the mobile edge host is not intruded risks of.

In the above embodiment, after receiving the access request, the first network element can analyze whether the third resource requested by the access request satisfies the first condition according to the information of the ME host, so as to determine the risk status of the ME host. Request to analyze the legitimacy of the requested third resource to check the possible security risks of the fourth network element, thereby reducing the situation that the fourth network element has security risks and then invades the ME host, and improves the security of the ME host. This improves the security of the MEC architecture.

In a possible implementation manner, the first condition includes one or more of the following: the number of resources included in the third resource does not exceed the upper limit of the number of resources, and the upper limit of the number of resources is determined according to the determined by the information; the third resource belongs to the resources available in the first resource, the first information includes availability status information of the first resource, and the availability status information is used to indicate the first resource or, the third resource belongs to a resource whose importance level is lower than a preset importance level among the first resources, and the first information includes the importance level of the first resource.

In the above embodiments, multiple possibilities of the first condition are provided. In the above embodiment, the first network element can determine the upper limit of the number of resources according to the information of the ME host. For example, the first network element can determine the number of the first resource as the upper limit of the number of resources, and then the first network element can determine the number of resources requested by the access request. Whether the third resource exceeds the upper limit of the number of resources. If the third resource does not exceed the upper limit of the number of resources, it is determined that the first network element does not have the risk of being invaded, so that the situation that the access request exhausts the resources of the ME host can be avoided. Ensure the security of the ME host. In the above embodiment, the first network element may also determine whether the third resource belongs to the resource available in the first resource according to the availability status information of the first resource, and determine whether the third resource belongs to the available resource in the first resource. The first network element does not have the risk of being invaded, which can avoid the use of unavailable resources in the ME host after the access request, and improve the security of the resources of the ME host. In the above implementation manner, the first network element may also determine whether the third resource belongs to the resources whose importance degree is lower than the preset importance degree among the first resources according to the importance degree of the first resource, and whether the third resource is important among the first resources In the case of a resource whose level is lower than the preset importance level, it is determined that the first network element does not have the risk of being invaded, so that access requests for resources that are too important can be avoided, so as to ensure the security of important resources in the ME host.

In a possible implementation manner, the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is denying access to the third resource; or, if the mobile edge host in the risk state is not at risk of being invaded, the first network element determines that the resource policy is allowing access to the third resource. resource.

In the above embodiments, if the first network element determines the corresponding resource policy according to the risk status of the ME host, for example, if the ME host has the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to deny access to the ME host. The third resource, which can prevent the fourth network element from invading the ME host on the grounds of accessing resources, which improves the security of the ME host, thereby improving the security of the MEC architecture.

In a possible implementation manner, the method further includes: the first network element sending the resource policy to a fifth network element.

In the above embodiment, the first network element can send the resource policy to the fifth network element, so that the fifth network element can access the resources in the ME host in a timely manner according to the resource policy, which is beneficial to timely control the possible security of the ME host. risk.

In a possible implementation manner, the method further includes: the first network element determining the risk status according to the information of the mobile edge host, including: the first network element sending the mobile Information about edge hosts; the first network element receives information about the risk status from the sixth network element.

In the above embodiment, the first network element can send the information of the ME host to the sixth network element, and then the sixth network element determines the risk status, so that the first network element does not need to determine the risk status, reducing the first network element's throughput.

In a possible implementation manner, the first network element is an OSS or an MEPM.

In a possible implementation manner, the second network element is an ME host or an MEPM.

In a possible implementation manner, the third network element is an OSS.

In a possible implementation manner, the fourth network element is an OSS, a VIM, or a CISM.

In a possible implementation manner, the fifth network element is a MEPM, a virtual facility manager VIM, an ME host, or a container infrastructure service CISM.

In a possible implementation manner, the sixth network element is an OSS or a multi-edge orchestrator MEO.

In the second aspect, the embodiment of the present application provides a resource policy acquisition method, which can be executed by a second network element, such as an ME host or MEPM, or a communication device with the ME host or MEPM function, or a System-on-a-chip for ME host or MEPM functions. The method includes: the second network element obtains the information of the mobile edge host, and the information of the mobile edge host includes first information of resources provided by the mobile edge host and/or second information indicating a behavior of accessing the mobile edge host information; the second network element sends the information of the mobile edge host to the first network element; the second network element receives a resource policy from the first network element, and the resource policy is used to indicate access to the mobile edge host The resource policy of the edge host.

In the above embodiment, after the second network element obtains the information of the ME host, it can send the information of the ME host to the first network element, so that the first network element can determine the risk status of the ME host, and according to the risk status of the ME host Determine the corresponding resource policy, and send the resource policy to the second network element, so that the second network element forwards the resource policy in time, or accesses the resource provided by the ME host in time according to the resource policy.

In a possible implementation manner, before the second network element sends the information of the mobile edge host to the first network element, the method further includes: determining that the Are mobile edge hosts at risk?

In the above embodiment, when the second network element determines whether the risk of the ME host cannot be determined according to the information of the ME host, when the second network element determines that the risk of the ME host cannot be determined, the information of the ME host can be sent to the first network elements, so that the first network element can determine the risk state of the ME host in time.

For the beneficial effects of the above-mentioned second aspect and its implementation manners, reference may be made to the description of the beneficial effects of the method of the first aspect and its implementation manners.

In a third aspect, the embodiment of the present application provides a resource access method, including: a fifth network element receives a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of a mobile edge host, and the resource The policy is determined based on the risk status of the mobile edge host, the risk status is determined based on the information of the mobile edge host, the information of the mobile edge host includes the first information of the first resource and/or indicates the access The second information about the behavior of the mobile edge host, the risk status is used to indicate whether the mobile edge host is at risk, the first resource is a resource provided by the mobile edge host; the fifth network element according to The resource policy accesses resources in the mobile edge host.

In a possible implementation manner, the fifth network element is an MEPM, a VIM, an ME host, or a CISM.

In a fourth aspect, the embodiment of the present application provides a method for accessing resources, which can be implemented through a communication system, where the communication system includes a first network element and a second network element, where the specific details of the first network element and the second network element For the implementation method, please refer to the above. In the resource access method, the first network element may execute any method in the first aspect above, and the second network element may execute any method in the second aspect above.

Optionally, the communication system may further include a fourth network element, and reference may be made to the foregoing for an implementation manner of the fourth network element. In the resource access method, the fourth network element may execute any method in the third aspect above.

Optionally, the communication system may further include a third network element, and reference may be made to the foregoing for an implementation manner of the third network element. In this resource access method, for example, the third network element sends the information of the second type of port to the first network element.

In a fifth aspect, the embodiment of the present application provides a communication system, including the first network element in the above first aspect and the second network element in the above second aspect.

Optionally, the communication system further includes the fourth network element in the above third aspect.

Optionally, the communications system further includes the foregoing third network element. For the specific implementation of the third network element, reference may be made to the foregoing.

In a sixth aspect, an embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the first network element, Or it is a larger device including the first network element. The first network element includes corresponding means or modules for implementing the foregoing first aspect or any optional implementation manner. For example, the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).

For example, the transceiver module is configured to receive information about the mobile edge host from the second network element, where the information about the mobile edge host includes first information about the first resource and/or second information indicating behavior of accessing the mobile edge host , the first resource is a resource provided by the mobile edge host; the processing module is configured to determine a risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has a security risk, And determining a resource policy according to the risk status, where the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.

Optionally, the communication further includes other components, for example, an antenna, an input and output module, an interface and so on. These components can be hardware, software, or a combination of software and hardware.

In a possible implementation manner, the processing module includes an edge risk engine module and an edge resource policy management module, for example, the edge risk engine module is used to determine the risk status according to the information of the mobile edge host; the edge resource policy management module A module for determining a resource policy based on the risk status.

In another possible implementation manner, the processing module includes a central risk engine module and a central resource policy management module, for example, the central risk engine module is used to determine the risk status according to the information of the mobile edge host; the central resource policy The management module is used to determine resource policies according to the risk status.

In the seventh aspect, the embodiment of the present application provides a communication device, and the communication device may be the second network element in the above second aspect, or an electronic device (for example, a chip system) configured in the second network element, Or it is a larger device including the first network element. The second network element includes corresponding means or modules for implementing the foregoing second aspect or any optional implementation manner. For example, the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).

For example, the processing module is configured to obtain the information of the mobile edge host, and the information of the mobile edge host includes first information of resources provided by the mobile edge host and/or second information indicating the behavior of accessing the mobile edge host The transceiving module is used to send the information of the mobile edge host to the first network element, and receive a resource policy from the first network element, the resource policy is used to indicate the policy for accessing the resources of the mobile edge host.

Optionally, the communication device further includes other components, for example, an antenna, an input and output module, an interface, and the like. These components can be hardware, software, or a combination of software and hardware.

In a possible implementation manner, the processing module includes a risk awareness agent module, for example, the risk awareness agent module is configured to obtain the information of the mobile edge host.

In a possible implementation manner, the processing module further includes a host policy execution module, where the host policy execution module is configured to receive a resource policy from the first network element.

In an eighth aspect, an embodiment of the present application provides a communication device, which may be the fifth network element in the above third aspect, or an electronic device (for example, a chip system) configured in the fifth network element, Or it is a larger device including the fifth network element. The fifth network element includes corresponding means or modules for implementing the above third aspect or any optional implementation manner. For example, the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).

For example, the transceiving module is configured to receive a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of the mobile edge host, the resource policy is determined according to the risk status of the mobile edge host, the The risk status is determined according to the information of the mobile edge host, the information of the mobile edge host includes first information of the first resource and/or second information indicating the behavior of accessing the mobile edge host, and the risk The status is used to indicate whether the mobile edge host is at risk, and the first resource is a resource provided by the mobile edge host; the processing module is used to access resources in the mobile edge host according to the resource policy.

Optionally, the communication device further includes other components, for example, an antenna, an input and output module, an interface, and the like. These components can be hardware, software, or a combination of software and hardware.

In a possible implementation manner, the processing module includes a resource policy execution module, for example, the resource policy execution module is used to obtain information about the mobile edge host, and the host policy execution module is used to access the mobile edge host according to the resource policy. Resources in edge hosts.

In a ninth aspect, an embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the first network element, or is a larger device including the first network element. The first network element includes corresponding means or modules for implementing the foregoing first aspect or any optional implementation manner.

In a possible implementation manner, the communication device includes an edge risk engine module and an edge resource policy management module.

For example, the edge risk engine module is configured to receive the information of the mobile edge host from the second network element, and the information of the mobile edge host includes the first information of the first resource and/or the first information indicating the behavior of accessing the mobile edge host Two information, the first resource is a resource provided by the mobile edge host, and the risk status is determined according to the information of the mobile edge host, and the risk status is used to indicate whether there is a security risk in the mobile edge host; the edge The resource policy management module is configured to determine a resource policy according to the risk status, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.

In another possible implementation manner, the communication device includes a central risk engine module and a central resource policy management module.

For example, the central risk engine module is configured to receive the information of the mobile edge host from the second network element, and the information of the mobile edge host includes the first information of the first resource and/or the first information indicating the behavior of accessing the mobile edge host Two information, the first resource is a resource provided by the mobile edge host, and the risk status is determined according to the information of the mobile edge host, and the risk status is used to indicate whether there is a security risk in the mobile edge host; the center The resource policy management module is configured to determine a resource policy according to the risk status, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.

In a tenth aspect, the embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the second network element, or is a larger device including the first network element. The second network element includes corresponding means or modules for implementing the foregoing second aspect or any optional implementation manner. For example, the communication device includes a risk-aware proxy module and a host policy enforcement module.

For example, the risk awareness agent module is used to obtain the information of the mobile edge host, and the information of the mobile edge host includes the first information of resources provided by the mobile edge host and/or the first information indicating the behavior of accessing the mobile edge host. Two information, and sending the information of the mobile edge host to the first network element; the host policy execution module is used to receive a resource policy from the first network element, and the resource policy is used to indicate access to the mobile edge host resource strategy.

In the eleventh aspect, the embodiment of the present application provides a communication device, which may be the fifth network element in the above third aspect, or an electronic device (for example, a chip system) configured in the fifth network element , or a larger device including the fifth network element. The fifth network element includes corresponding means or modules for implementing the above third aspect or any optional implementation manner. For example, the communications device includes a resource policy enforcement module.

For example, the resource policy execution module is configured to receive a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of the mobile edge host, and the resource policy is determined according to the risk status of the mobile edge host , the risk status is determined according to the information of the mobile edge host, the information of the mobile edge host includes the first information of the first resource and/or the second information indicating the behavior of accessing the mobile edge host, the The risk status is used to indicate whether the mobile edge host is at risk, the first resource is a resource provided by the mobile edge host; and resources in the mobile edge host are accessed according to the resource policy.

In a twelfth aspect, an embodiment of the present application provides a communication system, where the communication system includes the device described in the sixth aspect and the device described in the seventh aspect.

Optionally, the communication system further includes the device described in the eighth aspect.

In a thirteenth aspect, an embodiment of the present application provides a communication system, where the communication system includes the device described in the ninth aspect and the device described in the tenth aspect.

Optionally, the communication system further includes the device described in the eleventh aspect.

In a fourteenth aspect, the embodiment of the present application provides a communication device, including: a processor and a memory; the memory is used to store one or more computer programs, and the one or more computer programs include computer-executable instructions, when the When the resource access device is running, the processor executes the one or more computer programs stored in the memory, so that the communication device executes any one of the first aspect, the second aspect, or the third aspect. described method.

In a fifteenth aspect, an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer executes the first aspect , the method described in any one of the second aspect or the third aspect.

In a sixteenth aspect, the embodiment of the present application provides a computer program product, the computer program product stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the first The method according to any one of the first aspect, the second aspect or the third aspect.

In a seventeenth aspect, the present application provides a chip system, the chip system includes a processor and an interface, the processor is used to call and run instructions from the interface, and when the processor executes the instructions, the first The method described in one aspect, the second aspect or the third aspect. The system-on-a-chip may consist of chips, or may include chips and other discrete devices.

In the eighteenth aspect, the embodiment of the present application also provides a computer program, which when the computer program is run on the computer, causes the computer to execute the method described in any one of the first aspect, the second aspect or the third aspect.

For the beneficial effects of the above third aspect to the eighteenth aspect and the implementation manners thereof, reference may be made to the description of the beneficial effects of the method of the first aspect and the implementation manners thereof.

Description of drawings

FIG. 1A is a schematic diagram of an MEC architecture applicable to an embodiment of the present application;

FIG. 1B is a schematic diagram of an MEC architecture applicable to an embodiment of the present application;

FIG. 2 is a first schematic flow diagram of a resource access method provided by an embodiment of the present application;

FIG. 3 is a schematic flow diagram II of a resource access method provided by an embodiment of the present application;

FIG. 4 is a schematic flow diagram III of a resource access method provided by an embodiment of the present application;

FIG. 5 is a schematic flow diagram 4 of a resource access method provided by an embodiment of the present application;

FIG. 6 is a schematic flow diagram five of a resource access method provided by an embodiment of the present application;

FIG. 7 is a schematic flow diagram VI of a resource access method provided by an embodiment of the present application;

FIG. 8 is a schematic flow diagram VII of a resource access method provided by an embodiment of the present application;

FIG. 9 is a schematic flowchart eighth of a resource access method provided by an embodiment of the present application;

FIG. 10 is a first structural schematic diagram of a communication device provided by an embodiment of the present application;

FIG. 11 is a second structural schematic diagram of a communication device provided by an embodiment of the present application;

FIG. 12 is a schematic structural diagram III of a communication device provided in an embodiment of the present application;

FIG. 13A is a fourth schematic structural diagram of a communication device provided by an embodiment of the present application;

FIG. 13B is a schematic diagram of a fifth structure of a communication device provided by an embodiment of the present application;

FIG. 14 is a sixth structural diagram of a communication device provided in an embodiment of the present application;

FIG. 15 is a schematic structural diagram VII of a communication device provided in an embodiment of the present application;

Fig. 16 is a schematic diagram of deploying the devices shown in Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 in the MEC architecture in Fig. 1A provided by the embodiment of the present application;

Fig. 17 is another schematic diagram of deploying the devices shown in Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 in the MEC architecture in Fig. 1B provided by the embodiment of the present application;

FIG. 18 is a schematic structural diagram eighth of a communication device provided in an embodiment of the present application;

FIG. 19 is a schematic structural diagram of a communication device provided in an embodiment of the present application (ninth);

FIG. 20 is a tenth schematic structural diagram of a communication device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings. The specific operation methods in the method embodiments can also be applied to the device embodiments or system embodiments.

In the following, some terms used in the embodiments of the present application are explained, so as to facilitate the understanding of those skilled in the art.

1. The network element in the embodiment of the present application may be a single physical device, or may be a device integrating multiple devices. The network element shown in the embodiment of the present application can also be a logical concept, such as a software module, or a network function corresponding to the service provided by each network device. The network function can be understood as a virtualization function implemented under virtualization, or It can be understood as a network function that provides services under a service-based network, which is not specifically limited in this embodiment of the present application.

In the embodiments of the present application, for the number of nouns, unless otherwise specified, it means "singular noun or plural noun", that is, "one or more". "At least one" means one or more, and "plurality" means two or more. "And/or" describes the association relationship of associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. For example, A/B means: A or B. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c Can be single or multiple.

Unless otherwise specified, ordinal numerals such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects. For example, "first information" and "second information" in the embodiments of the present application are used to represent two kinds of information, and do not limit the appearance order, time sequence, priority or importance of the two information. As another example, the "first network element" and "second network element" in the embodiment of the present application are used to represent two network elements, and do not limit the priority or importance of the two network elements.

In order to improve the security of the MEC architecture, an embodiment of the present application provides a technical solution. In this technical solution, the first network element receives the information of the ME host from the second network element, the information of the ME host includes the first information and/or the second information indicating the behavior of accessing the ME host, and the first network element according to The information of the ME host determines the risk status of the ME host and provides a mechanism for determining the risk status of the ME host. Moreover, this technical solution pays attention to the possible security risks inside the ME host, which can improve the security of the ME host, and also improve the security of the MEC architecture. Moreover, according to the risk status of the ME host, corresponding resource policies can be adopted in a timely manner to reduce the security risk of the ME host, thereby ensuring the security of the MEC architecture.

The technical solutions provided in the embodiments of the present application may be applicable to any MEC architecture, and the following describes an example of the MEC architecture.

Please refer to FIG. 1A , which is a schematic diagram of an MEC architecture applicable to this embodiment of the present application. The MEC architecture includes the ME system layer and the ME host layer. ME system layer includes operations support system (operations support system, OSS), multi-edge orchestrator (mobile edge orchestrator, MEO), customer-facing service portal (customer-facing service portal, CFS Portal), user terminal application (user application, UE APP) and user application lifecycle management proxy (user app life cycle management proxy, UE APP LCM proxy). The ME host layer includes ME host, MEPM, virtualized infrastructure manager (virtualized infrastructure manager, VIM) and other ME hosts.

The functions of each part included in the ME system layer are firstly introduced below.

OSS is the highest level management entity in the MEC architecture. OSS can receive service requests from the user-oriented service portal and send the service requests to MEO. MEO can further process the service request. A business request is, for example, a request to instantiate an application or a request to terminate an application. The instantiation request is used to request the instantiation of ME APP, and the termination ME APP request is used to terminate the previously instantiated ME APP. Among them, ME APP can be understood as an APP deployed in the ME host. For example, an APP that implements a certain business needs to deploy ME APP in the ME host to provide users with corresponding background support.

MEO belongs to the upper management entity in the MEC architecture. MEO is used to macro-control the resources in the MEC architecture. For example, the MEO receives a service request from the OSS, and the MEO weighs the required resources of the service request and the available resources of each ME host, so as to select a suitable ME host to process the service request. Among them, the resources in the MEC architecture can be divided into two categories: hardware or software according to the form of presentation. The resources in the MEC architecture can be divided into multiple types according to the usage of the resources, for example, computing resources, storage resources, network resources, and application image resources.

The customer service portal is the portal for operators to subscribe and monitor ME APP for third-party customers. Third-party customers (for example, APP providers) can choose to order a set of ME APPs that meet their needs through the customer service portal. Or third-party customers can connect the application provided by them to the ME host, and can also configure the time and place for using the application.

UE APP can be understood as an APP deployed on the user side. UE APP is usually used to generate service requests based on user operations.

The user application lifecycle agent is used to provide forwarding agent services. For example, the user application life cycle agent can receive the corresponding service request from UE APP, and forward the service request to OSS or MEO, etc.

It should be noted that in the MEC architecture shown in Figure 1A, although the customer service portal, UE APP and user application life cycle agent are illustrated, the actual customer service portal, UE APP and user application life cycle agent can be generally regarded as external network element. The external network element here refers to a network element that does not belong to the MEC architecture.

The functions of each part in the ME host layer are introduced below.

The ME host is realized through the server. ME host includes ME platform (mobile edge platform, MEP), ME APP (one ME APP can include one or more services) and virtualization infrastructure (virtualization infrastructure, VI). MEP can implement one or more functions of ME service, service registration, flow rule control and DNS processing. VI is used to provide ME APP with a virtualization management program running a carrier, such as a virtual machine (virtual machine, VM) instance. VI includes the data plane (Data Plane, DP), also known as the data forwarding plane, which can realize functions such as data forwarding and traffic routing. ME APP is an application running on the carrier provided by VI.

MEPM belongs to the upper management entity in the MEC architecture. MEPM is used to manage MEP elements, manage ME APP life cycle, and manage ME application rules and requirements, etc. Managing ME APP life cycle includes creating ME APP and terminating ME APP. Among them, the ME application rules and requirements include, for example, MEAPP authentication, traffic rules, domain name system (domain name system, DNS) configuration, conflict coordination, and the like.

VIM is used to manage the allocation and release of virtualized resources of ME APP. VIM can also manage the mirror resources of ME APP. In addition, the VIM can also be responsible for collecting the information of the virtualized resources, and sending the information of the virtualized resources to the MEO and the MEPM respectively.

The interfaces involved in the MEC architecture in FIG. 1A are introduced below.

Interfaces in the MEC architecture are also called reference points. The interface includes three types of interfaces, specifically including the interface for interaction between the MEC architecture and external network elements (indicated by Mx), the interface for interaction with the management entity in the MEC architecture (indicated by Mm), and the interface for interaction with the MEP (indicated by Mp indicates). Each interface shown in FIG. 1A is introduced below.

Mx1 is for the communication interface between the user service portal (considered as a kind of external network element) and the OSS.

Mx2, the communication interface between the user application lifecycle agent (considered as a kind of external network element) and UEAPP.

Mm1, communication interface between OSS and MEO.

Mm2, communication interface between OSS and MEPM.

Mm3, the communication interface between MEO and MEPM, for example, ME APP-related policies can be provided through the interface Mm3 between MEO and MEPM.

Mm4, the communication interface between MEO and VIM. For example, the interface Mm4 can be used between MEO and VIM to manage virtualization resources and ME APP images, while maintaining information about available resources.

Mm5, communication interface between MEMP and MEP.

Mm6, communication interface between MEMP and VIM.

Mm7, communication interface between VIM and VI.

Mm8, the communication interface between the user application lifecycle agent and OSS.

Mm9, communication interface between user application lifecycle agent and MEO.

Mp1, communication interface between ME APP and MEP.

Mp2, the communication interface between MEP and VI.

Mp3, the communication interface between MEP and other MEPs.

It should be understood that the introduction of each network element (such as ME host, VIM, MEPM, OSS, MEO, etc.) in FIG. The executed functions may be further divided or combined, which is not limited in this embodiment of the present application.

Please refer to FIG. 1B , which is another schematic diagram of the MEC architecture applicable to the embodiment of the present application. Compared with the MEC architecture shown in FIG. 1A , a container infrastructure service (container infrastructure service management, CISM) is added to the MEC architecture shown in FIG. 1B .

CISM is used to manage container resources, including container creation, updating, querying, scaling, and terminating. In the architecture shown in Figure 1B, in addition to running on virtual machines, ME APP can also run on containers managed by CISM. In addition, CISM can also communicate with MEPM through Mm10. For example, CISM can also be responsible for collecting container information and sending container information to MEPM via Mm10.

Optionally, the MEC architecture shown in FIG. 1B may also include a container engine (container runtime). The container engine can be used to manage the running of containers. In FIG. 1B , the container engine is indicated as an optional part by a dotted box.

In addition, functions of network elements other than the CISM (eg, ME host, VIM, MEPM, OSS, MEO, etc.) in FIG. 1B can refer to the content discussed in FIG. 1A , and will not be listed here.

It should be understood that the introduction of each network element (such as ME host, VIM, MEPM, OSS, MEO, CISM, etc.) in FIG. The functions performed by the network elements may be further divided or combined, which is not limited in this embodiment of the present application.

It should be noted that the above-mentioned FIG. 1A and FIG. 1B are two examples of the MEC architecture applicable to the embodiment of the present application, and the actual method in the embodiment of the application is applicable to but not limited to the MEC architecture shown in FIG. 1A and FIG. 1B .

As shown in FIG. 2 , it is a schematic flow chart of a resource access method provided by the embodiment of the present application.

S201. The second network element determines information about the first ME host.

The second network element is, for example, the ME host or MEPM shown in FIG. 1A or FIG. 1B . If the second network element is the first ME host, then the first ME host can directly collect the information of the first ME host, which is equivalent to determining the information of the first ME host. If the second network element is the MEPM, the MEPM may receive the information of the first ME host from the first ME host, which is equivalent to determining the information of the first ME host. It should be noted that the MEC architecture includes one or more ME hosts. In the embodiment of this application, the ME host is used as the first ME host as an example. The first ME host can be regarded as one or more ME hosts. Any ME host.

Wherein, the information of the first ME host includes the first information and/or the second information. The first information is the information of the first resource, the first resource is the resource provided by the first ME host, and the second information is used to indicate the behavior of accessing the first ME host. The first information and the second information are introduced respectively below.

1. The first message.

The first resource includes hardware and/or software provided by the first ME host. The hardware provided by the first ME host refers to the whole machine of the first ME host, and each component that the first ME host includes. Each component includes, for example, a network card in the first ME host, a central processing unit (CPU) in the first ME host. Central processing unit (CPU), the hard disk in the first ME mainframe, or one or more items of hardware such as the mainboard in the first ME mainframe. The software provided by the first ME host includes, for example, one or more items of software such as a port of the first ME host or a VM deployed by the first ME host. It should be noted that the port of the first ME host refers to the logical port on the software, as opposed to the physical port. For example, the port that can be opened to other network elements in the operating system installed on the first ME host can also be called Operating system port, protocol port or network port, etc. Other network elements here may be understood as network elements other than the first ME host. Unless otherwise specified, the ports involved in the embodiments of the present application refer to logical ports on software.

Optionally, the first information includes one or more of the following (1) to (4).

(1) The identifier of the first resource.

The first resource is a general term for the resources that the first ME host can provide, but the resources that the first ME host can provide may include one or more types of resources, and the number of each type of resource may be one or more, Correspondingly, the first resource also includes the one or more types of resources. The identification of the first resource includes an identification of each type of resource of the one or more types. The first resource may also include an identification of each resource of each type of resource. The ID is used to indicate the corresponding resource.

(2) Type information of the first resource. For example, the type information of the first resource includes type information of each type of resource of the one or more types. The type information of one type of resource is used to describe the type corresponding to this type of resource. Optionally, the one or more types may be a general category to which the resources included in the first resource belong, and the one or more types include, for example, software or hardware. Alternatively, the one or more types may also be specific types of resources included in the first resource, such as CPU, port, hard disk, and motherboard.

(3) The quantity of the first resource and the usage information of the first resource.

The quantity of the first resource includes the quantity of each type of resource in one or more types, which may be understood as the total quantity of resources belonging to the type. The usage information of the first resource includes usage information of each type of resource of the one or more types. The use information of each type of resource can be understood as the use information of all resources belonging to that type. The usage information of the first resource also includes usage information of each resource belonging to the corresponding type. The following uses the usage information of each resource as an example to introduce the meaning of the usage information. As for the use information of each type of resource, it includes the use information of each resource belonging to this type of resource, which will not be listed one by one below.

The usage information for one of the resources is used to describe the usage of the resource. For example, the usage information of a resource includes one or more of the following A, B, or C. Wherein A is available status information or unavailable status information corresponding to a resource, B is usage status information of a resource, and C is usage progress information of a resource. These types of information are introduced below.

A, available status information or unavailable status information of a resource.

The first resource includes one or more resources, one of which is either an available resource or an unavailable resource. If a resource is an available resource, the first information may include availability status information of the resource, and the availability status information of a resource is used to indicate that the resource is an available resource. For example, available status information is represented by "0". The set of available status information of available resources in the first resource may be referred to as the available status information of the first resource.

If a resource is an unavailable resource, the first information may include unavailable status information of the resource, and the unavailable status information of a resource is used to indicate that the resource belongs to an unavailable resource. For example, the unavailable status information uses "1" express. For example, if a resource is port 4, and the availability status information of the port 4 is set to "1", it indicates that the port 4 is an unavailable resource. A collection of unavailable status information of unavailable resources in the first resource may be referred to as unavailable status information of the first resource.

Optionally, the first information may only include availability status information of the first resource. In this case, resources that do not have availability status information among the first resources belong to unavailable resources among the first resources.

Optionally, whether the resource included in the first resource is an available resource or an unavailable resource may be pre-configured in the first ME host, or may also be predefined through a protocol, which is not limited in this embodiment of the present application. Alternatively, whether the resources included in the first resource are available resources or unavailable resources can be set according to actual needs. For example, although the ME host can provide some resources, some resources may cause risks to the ME host after they are available, then The availability status information of these resources may be set to belong to unavailable resources, and correspondingly, the first information may also include the unavailability status information of these resources.

B, the usage status information of a resource.

The usage state information of a resource is used to indicate whether the resource has been used. The usage status information of a resource may be a third status indicating that the resource is not used, or a fourth status indicating that the resource is used. Wherein, the resource is used may be understood as the use of all or part of the resources included in the resource. For example, the third state is represented by "0", indicating that the resource is not used, and the fourth state is represented by "1", representing that part or all of the resource has been used.

It should be noted that whether a resource is available is not necessarily related to whether the resource is used. For example, a certain type of resource is an available resource, but this type of resource may not be used or may be used. For another example, a certain type of resource is an unavailable resource, and this type of resource may also be unused or illegally used.

C, the usage progress information of a resource.

The usage progress information of a resource is used to indicate the extent to which the resource is used. For example, the use progress information is represented by a ratio between the part of the resource that has been used and the total amount of the resource. For example, if the usage progress information of the CPU is 20%, it may be understood that 20% of the CPU has been used currently.

(4) The importance of the first resource.

The importance of the first resource includes the importance of each type of resource in one or more types, and the importance of each type of resource is used to represent the importance of the resource. The importance of resources of the same type may be the same, and the importance of resources of different types may be the same or different. The importance of each type of resource may be pre-configured in the first network element, or stipulated in a protocol, which is not limited in this embodiment of the present application. There are many ways to express the importance. For example, the importance of a resource can be expressed by a number. The larger the number, the higher the importance of the resource.

2. Second information.

The second information is used to describe the behavior of accessing the first ME host. The behavior of accessing the first ME host can be further understood as the behavior of accessing the resources provided by the first ME host.

Optionally, the second information includes resource information of the first ME host requested by the historical access request and specific event information of accessing the first ME host. A historical access request refers to a request for accessing resources of the first ME host before the current time. There may be one or more historical access requests, and the second information corresponds to the resource information of the first ME host requested by each of the one or more historical access requests and the specific event information of accessing the first ME host .

Exemplarily, the second information includes, for example, one or more items of information such as interface call information, container engine running information, or system running information of the first ME host. The interface calling information is, for example, information about calling a kernel-based virtual machine (kernel-based virtual machine, KVM) interface. Wherein, the KVM interface is used to create a virtual machine monitoring program in the operating system installed on the first ME host, so that the first ME host can run multiple isolated virtual environments (such as VM). The container engine running information is used to describe the behavior of the container engine. Wherein, the container engine can be deployed in the ME host, and the container engine can provide mutually isolated operating environments (such as containers) for the ME host.

S202. The second network element sends information about the first ME host to the first network element. Correspondingly, the first network element receives the information of the first ME host from the second network element.

For information about the first ME host, refer to the foregoing. The first network element is, for example, the MEPM, OSS or MEO shown in FIG. 1A or FIG. 1B . If the first network element is a MEPM, the second network element may be the first ME host. If the first network element is OSS or MEO, then the second network element can be MEPM.

S203, the first network element determines the risk status according to the information of the first ME host.

The risk status is used to indicate whether the first ME host has a security risk. The risk state is divided into two types, that is, the first ME host does not have a security risk and the first ME host has a security risk. That the first ME host does not have a security risk can be understood as that the first ME host does not have the risk of being invaded. The fact that the first ME host has a security risk can be understood as that the first ME host has a risk of being invaded. The following is an introduction to the determination methods of the two risk states.

The security risk of the first ME host may already exist, or the security risk of the first ME host may be caused by the access of the fourth network element. The fourth network element is a network element in the MEC architecture that can access the first ME host, such as OSS, VIM or CISM. Correspondingly, the risk status of the first ME host may also be determined with the first ME host and the fourth network element as risk investigation subjects. The meanings of the risk status of the first ME host are respectively introduced below when the first ME host and the fourth network element are used as different risk investigation subjects.

The first one is to take the first ME host as the subject of risk investigation.

Taking the first ME host as the subject of risk investigation, if it is determined that the probability of the first ME host being the risk subject is less than or equal to the first probability, it is considered that the first ME host is currently safe, that is, the risk status of the first ME host is There is no risk of being invaded by the first ME host. The first probability may be preconfigured in the first network element. The value of the first probability may be set according to requirements, which is not limited in this embodiment of the present application.

Taking the first ME host as the subject of risk investigation, if it is determined that the probability that the first ME host belongs to the risk subject is greater than or equal to the second probability, it is considered that the first ME host is currently unsafe, that is, the risk status of the first ME host There is no risk of intrusion for the first ME host. The second probability may be pre-configured in the first network element, and the value of the second probability may be set according to requirements, which is not limited in this embodiment of the present application. The value of the second probability is greater than or equal to the value of the first probability.

Optionally, if the value of the second probability is greater than the value of the first probability, then take the first ME host as the security risk investigation subject, if it is determined that the probability that the first ME host belongs to the risk subject is greater than the first probability and less than the second Probability, determining the risk status of the first ME host cannot be judged temporarily.

The second is to use the fourth network element as the main body of risk investigation.

Take the fourth network element as the subject of security risk investigation, if it is determined that the probability that the fourth network element belongs to the risk subject is less than or equal to the third probability, it is considered that the fourth network element is currently safe, because the fourth network element is safe , it is determined that the fourth network element's access to the ME host is a legal access process, and correspondingly, it is determined that there is no risk of the ME host being intruded. The third probability may be preconfigured in the first network element. The value of the third probability may be set according to requirements, which is not limited in this embodiment of the present application. The value of the third probability and the value of the first probability can be the same, for example, the value of the third probability and the value of the first probability are both 0; or, the value of the third probability and the value of the first probability It can also be different.

Taking the fourth network element as the subject of risk investigation, if it is determined that the probability that the fourth network element belongs to the risk subject is greater than the fourth probability, it is considered that the fourth network element is currently unsafe. Since the fourth network element is safe, it is determined that the fourth network element Accessing the ME host by the four network elements is an illegal access process, and accordingly, it is determined that the ME host is at risk of being invaded. The fourth probability may be pre-configured in the first network element, and the value of the fourth probability may be set according to requirements, which is not limited in this embodiment of the present application. The value of the fourth probability is greater than or equal to the value of the third probability.

Optionally, if the value of the fourth probability is greater than or equal to the value of the third probability, then take the first ME host as the security risk investigation subject, if it is determined that the probability that the first ME host belongs to the risk subject is greater than the third probability and less than the third probability Four probabilities, determining the risk status of the first ME host cannot be judged temporarily.

Since the manner in which the first network element determines the risk status based on the information of the first ME host is related to the subject of risk investigation, the following describes how to determine the risk status.

Method 1: The first ME host is used as the subject of risk investigation, and the first network element determines the risk status of the first ME host according to the information of the first ME host.

The first network element determines the information of the first ME host, analyzes the first ME host, and determines that the risk status of the first ME host is that the first ME host has a risk of being intruded, or that there is no risk of being intruded.

Wherein, the information of the first ME host is different, and the analysis content and determination method of the first network element will be correspondingly different, which will be introduced respectively below.

In a first implementation manner of mode 1, the information of the ME host includes first information, and the first network element determines the risk status of the first ME host according to the first information.

For the meaning of the first information, refer to the foregoing. The first network element analyzes the first information to determine whether the second resource corresponding to the first information is abnormal. The second resource is part or all of the first resource. If the second resource is abnormal, it is determined that the risk status of the first ME host is that the first ME host has a risk of being invaded. If the second resource is normal, or there is no abnormality, it is determined that the risk status of the first ME host is that the first ME host does not have a risk of being invaded.

If the types of resources included in the second resource are different, then there are different analysis methods for analyzing whether the second resource is abnormal, which will be introduced separately below.

In the sub-implementation mode 1 of the first implementation mode of the mode 1, the second resource includes hardware.

If the second resource includes hardware, the hardware may be replaced by hardware implanted with malicious software, or the hardware may be illegally disassembled, or the first ME host may be loaded with additional illegal hardware, etc. The data is stolen, and even lead to paralysis of the first ME host and the ME site where the first ME host is located. It can be seen that it is of great significance to analyze whether the hardware of the first ME host is abnormal. Therefore, the embodiment of the present application provides a mechanism for judging whether the hardware is abnormal. For example, the first network element analyzes the change of the identification of the first hardware in the first ME host to determine whether the first hardware is abnormal, and the first hardware includes part or all of the hardware in the first ME host. If the first hardware includes multiple pieces of hardware in the first ME host, the pieces of hardware may be the same type of hardware, or may be multiple types of hardware.

In a first possible implementation manner, the first information includes a first identifier of the first hardware, for example, the first identifier is received from the second network element. The first network element determines whether the first hardware is abnormal according to a matching result between the first identifier and the second identifier prestored by the first network element. If the first network element determines that the first identifier matches the second identifier successfully, indicating that the identifier of the first hardware has not changed, the first network element can determine that the first hardware is not abnormal, that is, the first hardware is normal, and then determine the first ME There is no risk of the host being compromised. And if the first identification does not match the second identification, or if the matching fails, it means that the identification of the first hardware has changed, and the first network element can determine that the first hardware is abnormal, thereby determining that the first ME host has a risk of being invaded.

Exemplarily, if the first identifier is the same as the second identifier, or a preset algorithm is used, the result of processing the second identifier is the same as the first identifier, or the result of processing the first identifier using a preset algorithm is the same as The second identifier is the same, and it is determined that the first identifier matches the second identifier. Wherein, the preset algorithm is, for example, hash algorithm or elliptic curve cryptography (elliptic curve cryptography), which is not limited in this embodiment of the present application. If the first logo is not the same as the second logo, or the result of processing the second logo is different from the first logo using a preset algorithm, or the result of processing the first logo using a preset algorithm is different from the second logo. The identifiers are different, and it is determined that the first identifier does not match the second identifier.

The following uses the first identifier as an example to introduce the representation form of the first identifier in the embodiment of the present application.

If the first hardware includes a piece of hardware in the first ME host, the first identification may be a hardware identification of the first hardware, and the hardware identification of the first hardware includes a media access control (media access control, MAC) of the first hardware Address, serial number, universally unique identifier (UUID), or globally unique identifier (globally unique identifier, GUID), etc.

Alternatively, the first identification may also be generated by processing the hardware identification of the first hardware according to a preset algorithm. The first algorithm may be preconfigured in the first network element. For the preset algorithm, please refer to the above.

For example, if the first hardware is a network card, and the MAC address of the network card is 123, then the first identifier is 123. Alternatively, the first network element may calculate the MAC address of the network card according to a hash algorithm, and use the obtained information as the first identifier, for example, "40bd001563085fc35165329ea1ff5c5ecbdbbeef".

If the first hardware includes multiple pieces of hardware, the first identification may be obtained from the identifications of the multiple pieces of hardware, for example, one piece of hardware corresponds to one piece of identification. Optionally, the first identifier is a combination of multiple hardware identifiers of multiple hardware, and the combination sequence of the multiple identifiers may be pre-configured in the first network element. Alternatively, the first identifier may be generated by processing a combination of multiple hardware identifiers according to a preset algorithm.

For example, the first hardware includes a plurality of hardware, and the plurality of hardware includes a first network card, a CPU, a hard disk, and a motherboard. The hardware identification of the network card is the MAC address of the network card; the hardware identification of the CPU is the hardware model of the CPU; the hardware identification of the first ME host machine is the GUID of the first ME host; the hardware identification of the main board is the UUID of the main board. Among them, the MAC address of the network card is 123, the hardware model of the CPU is AS, the GUID of the first ME host is 234, and the UUID of the main board is 789. For example, the first identifier is represented by a combination of multiple hardware identifiers, for example, the first identifier is 123AS234789. Alternatively, the first identifier is information obtained by calculating a combination of multiple hardware identifiers (namely 123AS234789) using a hash algorithm, for example, the first identifier is f314669c651cc4b6f1d7014397766325b0ca5189.

It should be noted that the expression form of the second logo can also refer to the expression form of the first logo, and the expression form of the second logo can be the same as or different from that of the first logo. For example, the first identification is obtained by processing the hardware identification using a preset algorithm, and the second identification is the hardware identification. In this case, if the result of processing the second identifier by using a preset algorithm is the same as the first identifier, the first network element determines that the first identifier matches the second identifier.

In summary, the first identifier is the current identifier of the first hardware in the first ME host collected by the second network element, and the first identifier indicates the first hardware of the first ME host. The second identifier pre-stored by the first network element may be the identifier of the first hardware reported by the first ME host. Alternatively, the second identifier is obtained by the first network element actively requesting from the first ME host. Since there may be a certain time interval between the first network element determining the first identification and the first network element determining the second identification, for example, the second identification is received by the first network element from the first ME host before receiving the first identification. , then the second identification can be understood as the identification before the first hardware. If the first ME host is illegally invaded within this time interval, the first identification may not match the second identification, so according to the matching of the first identification and the second identification, it can be determined whether the first hardware is abnormal .

In a second possible implementation manner, the first information includes a first identifier of the first hardware, and the meaning and expression form of the first identifier may refer to the foregoing. The first network element determines whether the first hardware is abnormal according to the matching result between the first identifier and the third identifier. The third identifier, for example, is received by the first network element from the third network element, and is used to represent the identifier of the second hardware after the first hardware is changed, and the third network element is, for example, the OSS in FIG. 1A or FIG. 1B . If the first network element determines that the first identifier matches the third identifier, which means that the current identifier of the first hardware matches the third identifier of the second hardware, the first network element can determine that there is no abnormality in the first hardware, that is, the first hardware is normal , so as to determine that the first ME host does not have the risk of being invaded. If the first network element determines that the first identification does not match the third identification, or that the matching fails, it means that the current first identification of the first hardware does not match the third identification of the second hardware, and the first network element determines that the first hardware abnormality, so that it is determined that the first ME host has a risk of being invaded. Wherein, the meanings of successful matching and unsuccessful matching can refer to the content discussed above.

Wherein, if the first hardware is normally changed to the second hardware, the third network element may record the third identifier of the second hardware and the first identifier of the first hardware. At this time, the first identifier of the first hardware received by the first network element from the second network element is actually the identifier of the second hardware after the first hardware has been changed, that is, the third identifier. Correspondingly, the first network element determines that the first identifier matches the third identifier. If the first hardware is illegally invaded and the identification of the first hardware is illegally changed, then the illegally changed identification cannot be recorded in the third network element. At this time, the first identification received by the first network element from the second network element In fact, it is the identification after the first hardware has been illegally invaded, so the first identification cannot match the third identification.

Optionally, when the first hardware is changed normally, the third network element may also record the time when the first hardware is changed, record the first identifier of the first hardware, and the like.

It should be noted that the expression form of the third mark may also refer to the expression form of the first mark, and the expression form of the third mark may be the same as or different from that of the first mark. For example, the first identification is obtained by processing the hardware identification by using a preset algorithm, and the third identification is the hardware identification. In this case, if the result of processing the third identifier using a preset algorithm is the same as the first identifier, it is determined that the first identifier matches the third identifier.

In a third possible implementation manner, the first information includes a first identifier of the first hardware. The first network element determines whether the first hardware is abnormal according to the matching result of the first identification and the second identification, and the matching result of the first identification and the third identification. If the first identification does not match the second identification, and the first identification does not match the third identification, it means that the current first identification of the first hardware is different from the pre-stored second identification, and is different from the second identification of the changed second hardware. The three identifications are also different, which means that the first hardware is likely to be illegally replaced. The first network element determines that the first hardware is abnormal, thereby determining that the first ME host has a risk of being invaded. If the first identifier matches the second identifier, the first identifier and the third identifier also match, or if the first identifier matches the second identifier, the first identifier does not match the third identifier, or if the first identifier matches the second identifier No match, the first identifier matches the third identifier, and the first network element determines that the first hardware is normal, thereby determining that the first ME host does not have a risk of being invaded.

In the sub-implementation mode 2 of the first implementation mode, the second resource includes software.

If the second resource includes software, the software may be tampered with or implanted with illegal software, which may cause the unavailable software of the first ME host to be enabled, or even cause the first ME host to be paralyzed and where the first ME host is located. It can be seen that it is of great significance to analyze whether the software of the first ME host is abnormal. For this reason, the embodiment of the present application provides a mechanism for judging whether the software is abnormal. For example, the first network element may analyze whether the ports in the first ME host are abnormal according to whether the ports on the first ME host are opened but not authorized. If one or more ports in the first type of ports do not belong to the second type of ports, it means that the one or more ports belong to unauthorized ports, and the first network element determines that the one or more ports are abnormal, thereby determining that the first The ME host is at risk of being hacked. If all the ports in the first type of ports belong to the second type of ports, the first network element determines that all the first type of ports are normal, thereby determining that the first ME host does not have a risk of being invaded.

Wherein, the first information includes the information of the first type of port, and the second resource includes the first type of port in the ME host. The first type of ports refers to the ports that have been opened in the first ME host. The first type of ports may be further understood as a collection of opened ports in the first ME host. The first type of ports may include one or more ports. The fourth network element can access the first ME host through the first type of port. For the meaning of the fourth network element, reference may be made to the foregoing. The information of the first type of port is, for example, the port number of the port belonging to the first type of port.

Under normal circumstances, the ports in the first ME host are not directly open to the outside world, but need to apply for opening to the first ME host through the third network element, and the third network element will record the ports that have been applied for opening to the first ME host. Information, that is, the information of the second type of port. The information of the second type of port is, for example, the port number of the port belonging to the second type of port. However, if the first ME host is illegally invaded, some ports in the first ME host may be illegally opened, but in this case, the third network element cannot obtain the information of these ports. Therefore, in the embodiment of the present application, the first network element can compare whether the ports of the first type belong to the ports of the second type, thereby analyzing whether the first ME host has opened an unauthorized port, thereby determining whether the ports in the ME host are abnormal.

It should be noted that the first type of ports may include ports belonging to the first state, and may also include ports belonging to the second state, which is not limited in this embodiment of the present application.

If the ports of the first type include ports belonging to the second state, it means that the first ME host has opened an unusable port, and the first ME host is more likely to have a security risk. Optionally, the first network element may determine the risk status of the first ME host by comparing the ports of the first type with the ports of the second type when determining that the ports of the first type include ports belonging to the second state. The risk status of the first ME host determined in this way is that the possibility that the first ME host has a security risk is higher. In addition, the number of times the first network element determines that the port is abnormal can be relatively reduced, thereby reducing the processing amount of the first network element.

In the sub-implementation mode 3 of the first implementation mode, the second resource includes hardware and software.

If the first network element determines that at least one of hardware and software is abnormal, then the first network element determines that the first ME host has a risk of being invaded. If the first network element determines that both the hardware and the software are normal, the first network element determines that the first ME host does not have a risk of being invaded. The methods for determining whether the hardware is abnormal and whether the software is abnormal can be referred to above, and will not be listed here.

In a second implementation manner, the information of the first ME host includes the second information, and the first network element determines the risk status of the first ME host according to the second information.

Specifically, the first network element determines whether the behavior corresponding to the second information is abnormal, and then determines the risk status of the first ME host. If the behavior corresponding to the second information is abnormal, the first network element determines that the risk status is that the first ME host has a risk of being invaded. If the behavior corresponding to the second information is normal, it is determined that the risk status is that the mobile edge host does not have a risk of being invaded.

Exemplarily, the first network element may be preconfigured with at least one abnormal behavior. If the first network element determines that the behavior corresponding to the second information belongs to at least one abnormal behavior, then the first network element determines that the first ME host has a risk of being invaded. If the first network element determines that the behavior corresponding to the second information does not belong to at least one abnormal behavior, then the first network element determines that the first ME host does not have a risk of being invaded.

For example, if the first network element is pre-configured with at least one abnormal behavior including pods (pods) accessing containers that are not managed by the pod, this is an abnormal behavior. If the first network element determines that the pod has accessed a container that is not managed by the pod according to the second information, the first network element determines that the behavior of the first ME host is abnormal, and then determines that the risk status of the first ME host is present risk of being hacked.

Method 2: The fourth network element is used as the subject of risk investigation, and the first network element determines whether the third resource requested by the access request sent by the fourth network element satisfies the first condition based on the information of the first ME host, and then determines whether the first The risk status of the ME host. If the third resource satisfies the first condition, it means that the access request is legal, then it means that the fourth network element sending the access request has no risk, or the probability of risk is less than the third probability, and correspondingly, determine the risk status as the first There is no risk of the ME host being invaded. If the third resource does not meet the first condition, it means that the access request is illegal, then it means that the fourth network element sending the access request has a risk, or the probability of the risk is greater than or equal to the fourth probability, and correspondingly, determine the risk status There is a risk that the first ME host is invaded by the fourth network element.

If the fourth network element needs to access the third resource of the first ME host, the fourth network element may send an access request to the first network element. The access request is used to request access to the third resource of the ME host. It should be noted that the fourth network element may not know the resources that the first ME host can provide, or in the case of the fourth network element being invaded, so although the fourth network element wants to request the resources of the first ME host, However, some or all of the third resources actually requested by the fourth network element may be resources that cannot be provided by the first ME host, that is, some or all of the third resources may not belong to the first resource . Of course, all the third resources may also belong to the first resources.

As an example, the first condition includes one or more of the following ① to ③.

① The third resource belongs to the resources available in the first ME host.

Exemplarily, the information of the first ME host includes first information, and the first information includes usage information of each type of resource among one or more types, specifically, for example, the first information includes one of the first resources or available status information for each type of resource of multiple types. Then the first network element determines available resources in the first ME host according to the first information. In this case, the first network element may determine the resources available in the first ME host according to usage information of each type of resource of one or more types. Furthermore, the first network element may determine whether the third resource belongs to the resources available in the first ME host.

② The quantity of resources included in the third resource does not exceed the upper limit of resource quantity, which is determined according to the information of the first ME host.

Exemplarily, the information of the first ME host includes first information, and the first information includes usage progress information of the first resource and an identifier of the first resource. Then the first network element may determine the information of the currently unused resources in the first ME host according to the first information, and determine the upper limit of the number of resources as the number of currently unused resources of the first ME host. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.

Alternatively, the information of the first ME host includes first information and second information, the first information includes the quantity of the first resource, and the second information includes information about resources of the first ME host requested by one or more historical access requests. According to the first information and the second information, for example, the first network element excludes resources that have been requested to be accessed by historical access requests from the first resources, thereby determining information about resources that are not currently used by the first ME host, And the upper limit of the resource quantity is determined as the quantity of resources not currently used by the first ME host. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.

Alternatively, the information of the first ME host includes first information, and the first information includes the quantity of the first resource. The first network element may determine the upper limit of the resource quantity as the quantity of the first resource. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.

Alternatively, the information of the first ME host includes second information, and the second information includes information about resources of the first ME host requested by one or more historical access requests. According to the second information, the first network element determines the first historical access request that requests the largest number of resources among the one or more historical access requests, and determines the upper limit of the number of resources as the resource requested by the first historical access request the number of resources. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.

It should be noted that if the first resource includes multiple types of resources, each type of resource may also have a corresponding upper limit on the number of resources. For the setting method of the upper limit on the number of resources corresponding to each type of resource, refer to the foregoing.

③ The third resource belongs to the first resource, and belongs to resources in the first ME host whose importance is lower than the preset importance.

Exemplarily, the information of the first ME host includes first information, and the first information includes the importance of the first resource. The first network element may determine whether the third resource belongs to resources in the first ME host whose importance is lower than a preset importance. The preset importance can be preconfigured in the first network element.

Optionally, the first network element may configure different first conditions for different access requests, and an example is introduced below.

Example 1, the access request is a port opening request. The port opening request is used to apply for opening the port of the first ME host. The port for which the port opening request applies for opening is the third resource.

If the first condition includes resources available in the first ME host, the first network element may determine whether the third resource belongs to the resources available in the first ME host, and if the third resource belongs to the resources available in the first ME host, Then the first network element determines that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is no risk of intrusion. If part or all of the third resource does not belong to the resources available in the first ME host, the first network element determines that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is a risk of being invaded .

Alternatively, if the first condition includes resources available in the first ME host and the upper limit of the number of resources is not exceeded, then the first network element may determine whether the third resource belongs to the resources available in the first ME host, and determine whether the third resource Whether the resource limit is exceeded. If the third resource belongs to the resources available in the first ME host, and the quantity of the third resource exceeds the upper limit of the resource quantity, the first network element determines that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is not There is a risk of being hacked. If the third resource does not belong to the resources available in the first ME host and/or the quantity of the third resource exceeds the resource limit, the first network element determines that the third resource does not meet the first condition, thereby determining the risk of the first ME host The status is at risk of being compromised.

In the second example, the access request is a request for instantiating an application. The instantiated application request is used to request resources in the first ME host to deploy corresponding ME APP. The resource requested by the instantiation application request is the third resource.

If the first condition includes that the upper limit of resource quantity is not exceeded, then the first network element may determine whether the quantity of the third resource exceeds the upper limit of resource quantity. If the third resource includes multiple types of resources, if none of the multiple types of resources in the third resource exceeds the upper limit of the number of resources of the corresponding type, it is determined that the third resource satisfies the first condition, thereby determining the risk of the first ME host The status is not at risk of being compromised. If the first network element determines that the quantity of at least one type of resource in the third resource exceeds the upper limit of the resource quantity of this type, then determine that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is present risk of being hacked.

If the first condition includes not exceeding the upper limit of the number of resources and belonging to the resources available in the first ME host, then the first network element may determine whether the number of the third resource exceeds the upper limit of the number of resources, determine whether the third resource belongs to the first ME The resources available in the host. If the third resource includes multiple types of resources, if the multiple types of resources in the third resource do not exceed the upper limit of the number of resources of the corresponding type, and the third resource belongs to the resources available to the first ME host, then determine the third resource The first condition is met, so it is determined that the risk status of the first ME host is no risk of intrusion. If the first network element determines that the number of at least one type of resource in the third resource exceeds the upper limit of the number of resources of this type and/or the third resource does not belong to the resources available to the first ME host, then it is determined that the third resource does not meet the requirements. The first condition is to determine that the risk status of the first ME host is a risk of being invaded.

Example 3, the access request is a resource deletion request. The resource deletion request is used to request to delete resources in the first ME host. The resource requested to be deleted by the resource deletion request is the third resource.

If the first condition includes resources belonging to the first ME host whose importance is lower than the preset importance, then the first network element determines whether the third resource belongs to the resources of the first ME host whose importance is lower than the preset importance. If the third resource belongs to a resource whose importance level is lower than a preset importance level in the first ME host, it is determined that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is no risk of intrusion. If the third resource belongs to a resource whose importance is higher than a preset importance in the first ME host, it is determined that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is a risk of intrusion.

Example 4, the access request is a VM creation request. The VM creation request is used to request to create a VM in the first ME host, and the VM requested by the VM request is regarded as a third resource. If the first condition includes that the resource quantity upper limit is not exceeded, then the third network element determines whether the third resource satisfies the first condition. For a manner of determining whether the third resource satisfies the first condition, reference may be made to the content discussed above.

It should be noted that the above is an example description of the access request, and the access request in the embodiment of the present application includes but is not limited to the several types listed above.

In a third implementation manner, the information of the first ME host includes first information and second information, and the first network element determines the risk status of the first ME host according to the first information and the second information.

If the second resource is abnormal, and it is determined that the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the first ME host has a risk of being invaded. If the first network element determines that the second resource is normal and/or the behavior corresponding to the second information is normal, it is determined that the risk status is that the first ME host does not have a risk of being invaded. For the manner of determining whether the second resource is abnormal, refer to the foregoing, and for the manner of determining whether the behavior corresponding to the second information is abnormal, refer to the foregoing.

In the third implementation manner, the first network element determines that the first ME host has a risk of being invaded only when it is determined that the second resource is abnormal and the behavior corresponding to the second information is abnormal, which reduces the risk of the second The risk status of a ME host is misjudged as a situation where there is a security risk, so that the determined risk status of the first ME host is more reliable.

It should be noted that, both of the first method and the second method above take an example in which the first network element directly determines the risk status of the first ME host. But in fact, the first network element can obtain the risk status of the first ME host from other network elements. In the following manner three, an introduction is made by taking the other network element as the sixth network element as an example. Wherein, the sixth network element is, for example, the OSS or MEO shown in FIG. 1A or FIG. 1B .

Mode 3, the sixth network element may determine the risk status of the first ME host by using the first ME host as a subject of risk investigation. The sixth network element may also use the first ME host as a risk investigation subject to determine the risk status of the first ME host.

Exemplarily, after receiving the information of the first ME host, the first network element may send the information of the first ME host to the sixth network element. The sixth network element determines the risk status of the first ME host according to the information of the first ME host. Wherein, the method for determining the risk state by the sixth network element may refer to the method for determining the risk state by the first network element above, and will not be listed here. After the sixth network element determines the risk status of the first ME host, it may send the risk status to the first network element. Correspondingly, the first network element receives the risk status from the sixth network element.

As an example, if the first network element is an MEPM, after the MEPM receives the information of the first ME host, if the MEPM determines that the risk status of the first ME host cannot be determined according to the information of the ME host, the The information is sent to the sixth network element. Since the sixth network element can acquire more information about ME hosts, the sixth network element can determine the Risk status of the first ME host.

S204. The first network element determines a resource policy according to the risk state. The resource policy is used to indicate a policy for accessing resources provided by the first ME host.

Exemplarily, the first network element may prestore different risk states and resource policies corresponding to each risk state. After the first network element determines the risk status of the first ME host, it may determine a resource policy corresponding to the risk status of the first ME host. And send the resource policy to the fifth network element, so that the fifth network element can access the resource in the first ME host according to the resource policy. The fifth network element is, for example, the ME host, MEPM, VIM, or CISM in FIG. 1A or FIG. 1B .

Among them, the risk investigation subject selected by the first ME host is different, the method of determining the risk status is different, and the determined risk status is different, and the resource strategy determined by the first network element is also different. The following will introduce the situation.

Situation one.

If the first network element takes the first ME host as the subject of risk investigation, use the sub-implementation method 1 of the first implementation method of the above method 1 to determine the risk status of the first ME host as the risk of the first ME host being intruded , then the first network element determines that the resource policy is to deactivate the first ME host, or lower the security level of the first ME host. If it is determined that the risk state of the ME host is that there is no risk of the ME host being intruded, the first network element determines that the resource policy is empty. The resource policy being empty may mean that the currently used resource policy for accessing the ME host is not changed.

Exemplarily, deactivating the first ME host includes shutting down the first ME host, or deleting the first ME host from the resource pool. The resource pool includes multiple ME hosts managed by the fifth network element.

Each security level corresponds to the application with the highest priority that it can support deployment. For example, the security level of the first ME host is 1, and the highest priority of the application that the first ME host can support deployment is 3, that is, The first ME host can support the deployment of applications with a priority of 3 and a priority lower than 3. Or for example, the security level of the first ME host is 2, and the highest priority of the first ME host that can support the deployment of applications is 4, that is, the first ME host can deploy applications with a priority of 4 or less than 4 application. Wherein, a larger value of the security level indicates that the first ME host is more secure, and a larger value of the application priority indicates a higher priority of the application. If the security level of the first ME host is reduced to the first security level, then the first ME host does not support the deployment of applications with a higher priority than the first priority. The first priority is that the security level of the first ME host is the The highest priority of applications that can be supported for deployment in the case of the first security level. Optionally, the priority of each application may be preconfigured in the fifth network element, and the highest priority of the application supported for deployment corresponding to each security level may also be preconfigured in the fifth network element.

Case two.

If the first network element takes the first ME host as the subject of risk investigation, use sub-implementation 2 under the first implementation above, or sub-implementation 3 under the first implementation above, to determine the risk status of the ME host There is a risk of the ME host being invaded, the first network element determines that the resource policy includes at least one of closing the one or more ports and disabling the ME host, or the first network element determines that the resource policy includes closing the one or multiple ports and lowering the security level of the ME host, or the first network element determines that the resource policy is at least one of deactivating the ME host and lowering the security level of the ME host. If it is determined that the risk state of the first ME host is that the first ME host has no risk of being invaded, the first network element determines that the resource policy is empty. The meaning of the resource policy being empty can be referred to above. For the meaning or specific implementation of deactivating the first ME host and lowering the security level of the first ME host, please refer to the above.

Case three.

If the first network element takes the first ME host as the subject of risk investigation, and adopts the second implementation method above to determine that the risk status of the ME host is that the first ME host has a risk of being invaded, the first network element determines that the resource policy includes stopping Use the ME host, or, lower the security level of the first ME host. If it is determined that the risk status of the first ME host is that the first ME host has no risk of being invaded, it is determined that the resource policy is empty. The meaning of the resource policy being empty can be referred to above. For the meaning or specific implementation of deactivating the first ME host and lowering the security level of the first ME host, reference may be made to the foregoing.

Situation four.

If the first network element takes the fourth network element as the subject of risk investigation, adopt the above method 2 to determine that the risk status of the first ME host is that the first ME host has the risk of being invaded by the fourth network element, and the first network element determines that the The resource policy is to deny access to the third resource. If the first network element adopts the above method 2 and determines that the risk status of the first ME host is that the first ME host does not have the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to allow access to the third resource. For the meaning of the third resource, please refer to the above.

Situation five.

If the first network element uses method 3 to determine the risk status of the first ME host, the first ME host may be the main body of risk investigation, and the fourth network element may be the main body of risk investigation. Examples are introduced below.

For example, if the first network element takes the first ME host as the subject of risk investigation and determines that the first ME host is at risk of being invaded, the first network element determines that the resource policy includes disabling the ME host or lowering the security level of the ME host. Or the first network element determines that the resource policy also includes closing one or more ports. If it is determined that the first ME host does not have the risk of being invaded, the first network element determines that the resource policy is empty.

Or for example, if the first network element takes the fourth network element as the subject of risk investigation and determines that the first ME host has a risk of being invaded by the fourth network element, the first network element determines that the resource policy includes denying access to the third resource. If it is determined that the first ME host does not have the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to allow access to the third resource.

S205. The first network element sends the resource policy to the fifth network element. Correspondingly, the fifth network element receives the resource policy from the first network element. The resource policy is used to indicate a policy for accessing resources provided by the first ME host.

If the fifth network element is the first ME host, VIM or CISM, then the fifth network element can access resources in the ME host according to the resource policy.

If the fifth network element is the MEPM, the MEPM can forward the resource policy to the first ME host, VIM or CISM, and so on.

Optionally, if the specific content of the resource policy is different, the fifth network element may be specifically a different network element, and an example is introduced below.

If the resource policy is to close the one or more ports, then the fifth network element may be the first ME host. The first network element may send the resource policy to the first ME host. The first ME host closes the first or multiple ports according to the resource policy.

If the resource policy is to deactivate the first ME host, or lower the security level of the first ME host, the fifth network element can be a VIM or a CISM. The first network element may send the resource policy to the VIM or the CISM. According to the resource policy, the VIM or CISM deactivates the first ME host, or lowers the security level of the first ME host.

If the resource policy is to deny access to the third resource, the fifth network element is the first ME host, VIM or CISM. The first network element sends the resource policy to the first ME host, VIM or CISM. The first ME host, VIM or CISM denies access to the third resource.

If the resource policy is to allow access to the third resource, the fifth network element is the first ME host, VIM or CISM. The first network element sends the resource policy to the first ME host, VIM or CISM. The first ME host, VIM or CISM allows access to this third resource.

As an example, S205 in FIG. 2 is an optional step. This optional step is illustrated in dashed lines in FIG. 2 .

In the embodiment shown in FIG. 2 , the first network element can determine the risk status of the first ME host according to the information of the first ME host, so as to provide a mechanism for determining the risk status of the first ME host. Since this embodiment considers possible security risks inside the first ME host, the security of the MEC architecture can be improved. Moreover, according to the risk status of the ME host, the resource policy of the ME host is determined, so as to reduce the security risk of the ME host in time and improve the security of the MEC architecture. Moreover, in the embodiment shown in FIG. 2 , multiple ways of determining the risk status of the first ME host are provided, and multiple resource strategies for dealing with the risk status of the first ME host are provided.

In the following, the first NE is MEPM, the second NE is the first ME host, the third NE is OSS, and the fifth NE is VIM. Implementation mode 1, taking determining the risk state of the ME host as an example, introduces the interaction process between various network elements. As shown in FIG. 3 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.

S301. The first ME host determines a first identifier.

For the meaning of the first identifier, please refer to the above. It should be noted that, in the embodiment of the present application, any one of the one or more ME hosts in the MEC architecture is taken as the first ME host as an example for introduction.

S302. The first ME host sends the first identifier to the MEPM. Correspondingly, the MEPM receives the first identifier from the first ME host.

S303. The MEPM determines that the first identifier does not match the prestored second identifier.

For the meaning of the second identifier and the manner in which the MEPM determines that the first identifier does not match the second identifier, reference may be made to the foregoing. It should be noted that, in the embodiment shown in FIG. 3 , the first identification does not match the second identification as an example for introduction, and the situation of the first identification matching the second identification can refer to the content discussed above.

S304. The MEPM sends a first request to the OSS through the MEO. Correspondingly, the OSS receives the first request from the MEPM through the MEO. The first request is used to request to acquire the second identification of the second hardware. For the meaning of the second hardware and the third identification, please refer to the above.

S304 includes S304a, that is, the MEPM sends the first request to the MEO, and includes S304b, that is, the MEO sends the first request to the OSS.

It should be noted that, in the embodiment of the present application, the MEPM sends the first request to the OSS through the MEO as an example for introduction, but in fact, the MEPM may also directly send the first request to the OSS.

S305. The OSS sends the third identifier to the MEPM through the MEO. Correspondingly, the MEPM receives the third identifier from the OSS through the MEO.

It should be noted that, in the embodiment of the present application, the OSS sends the third identifier to the MEPM through the MEO as an example for introduction, but in fact, the OSS may also directly send the third identifier to the MEPM.

S305 includes S305a, that is, the OSS sends the third identifier to the MEO, and includes S305b, that is, the MEO sends the third identifier to the MEPM.

S306. The MEPM determines that the third identifier does not match the first identifier.

For a manner of determining that the third identifier does not match the first identifier, reference may be made to the foregoing. It should be noted that, in the embodiment shown in FIG. 3 , an example in which the third identifier does not match the first identifier is used as an example. For the case where the first identifier matches the third identifier, reference may be made to the content discussed above.

It should be noted that, the MEPM may execute S303 first, and then execute S306. MEPM can also execute S303 and S306 at the same time. The MEPM may also execute S306 first, and then execute S303, which is not specifically limited in this embodiment of the present application.

S307. The MEPM determines that the risk status of the first ME host is that the first ME host has a risk of being invaded.

For meanings of the risk status and the risk that the first ME host is intruded, reference may be made to the foregoing.

S308. According to the determined risk state, the MEPM determines that the resource policy is to lower the security level of the first ME host.

The meaning of lowering the security level of the first ME host can be referred to above. It should be noted that, in the embodiment of the present application, the resource policy is to lower the security level of the first ME host as an example for illustration.

S309. The MEPM sends the resource policy to the VIM. Correspondingly, the VIM receives the resource policy from the MEPM.

S310, the VIM sends a stop instruction to the first ME host. Correspondingly, the first ME host receives the stop instruction from the VIM. The stop instruction is used to instruct to stop the first application running on the first ME host whose priority is higher than the preset priority. After receiving the stop instruction, the first ME host can stop running the first application.

In the embodiment of the present application, the application whose priority on the first ME host is higher than the preset priority is taken as the first application as an example for illustration.

S311. The VIM determines to deploy the first application on the second ME host.

The VIM migrates and deploys the first application with too high priority running on the first ME host to the second ME host, and runs the first application on the second ME host, so as to ensure the security of the data of the first application.

It should be noted that, in the embodiment of the present application, the second ME host is used as an example to introduce the ME host whose security level is higher than that of the first ME host.

As an example, S309-S311 are optional steps, and these optional steps are indicated by dotted lines in FIG. 3 .

In the embodiment shown in FIG. 3, the MEPM can analyze whether the hardware in the first ME host is abnormal according to the change of the hardware identification of the first ME host, thereby determining whether the first ME host has a risk of being invaded, providing A mechanism for determining the risk status of a first ME host is provided. Moreover, if the hardware in the first ME host is abnormal, the VIM will lower the security level of the first ME host to ensure that applications with higher priority can always be deployed on the ME host with higher security level and ensure higher priority The stability of the application operation.

In the following, the first network element is MEPM, the third network element is OSS, the second network element and the fifth network element are both the first ME host as an example, and the first network element is implemented according to the first implementation mode above Method 2, taking determining the risk status of the ME host as an example, introduces the interaction process between various network elements. As shown in FIG. 4 , it is a schematic flowchart of a resource access method provided in the embodiment of the present application.

S401. The OSS acquires a port opening request.

The OSS can receive a port opening request from an external network element, which is equivalent to obtaining the port opening request. The port opening request and the meaning of the external network element can be referred to above. Alternatively, the OSS can generate a port opening request according to the user's port opening operation, which is equivalent to obtaining the port opening request.

S402. The OSS records information about the port requested to be opened by the port opening request.

The OSS obtains the port opening request, and records the information of the port requested to be opened by the port opening request, where the port information is, for example, a port number. By analogy, the OSS can obtain the information of the second type of port in the first ME host. For the meaning of the second type of port, please refer to the previous section.

It should be noted that S401-S402 is an example of how the OSS obtains the information of the second type of port in the first ME host. In fact, there are many ways for the OSS to obtain the information of the second type of port. This application implements Examples are not limited to this.

S403, the first ME host determines the information of the first type of port in the first ME host.

The first ME host detects all the ports currently opened by itself, so as to obtain the information of the first type of ports. For the meaning of the first type of port, please refer to the previous section.

S404, the first ME host sends the information of the first type of port to the MEPM. Correspondingly, the MEPM receives the information of the first type of port from the first ME host.

S405. The MEPM sends a second request to the OSS. Correspondingly, the OSS receives the second request from the MEPM. The second request is used to request information about ports that have been applied to the first ME host for opening.

S406. The OSS sends the information of the second type of port to the MEPM. Correspondingly, the MEPM sends the information of the second type of port to the OSS.

It should be noted that, in the embodiment of the present application, the OSS sends the information of the second-type port to the MEPM as an example, and the actual OSS may also send the information of the second-type port to the MEPM through the MEO.

S407. If one or more ports in the first type of ports do not belong to the second type of ports, the MEPM determines that the risk state of the first ME host is that the first ME host has a risk of being invaded.

S408. According to the first state, the MEPM determines that the resource policy is to close one or more ports.

S409, the MEPM sends the resource policy to the first ME host. Correspondingly, the first ME host receives the resource policy from the MEPM.

S410, the first ME host closes the first or multiple ports.

S411. The first ME host sends a shutdown success response to the MEPM. Correspondingly, the MEPM receives the shutdown success response from the first ME host. The closing success response is used to indicate that the first ME host has successfully closed the first or multiple ports.

As an example, S409-S411 are optional steps. These optional steps are illustrated in dashed lines in FIG. 4 .

In the embodiment shown in Fig. 4, MEPM can judge whether the ports of the first type belong to the ports of the second type to determine whether there are unauthorized but opened ports in the first ME host. The port indicates that the first ME host is abnormal, so the MEPM determines that the first ME host has a risk of being invaded, and provides a mechanism for determining the security risk of the first ME host. Moreover, if there are unauthorized but opened ports on the first ME host, the first ME host closes these ports to reduce the risk of the first ME host in a timely and targeted manner and improve the security of the first ME host.

In the following, the first network element is MEPM, the second network element is ME host, the third network element is OSS, and the fifth network element is VIM. The first network element determines the ME host according to the second implementation method. Taking the risk status as an example, the interaction process between each network element is introduced. As shown in FIG. 5 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.

S501. The first ME host sends second information to the MEPM. Correspondingly, the MEPM receives the second information from the first ME host. The meaning of the second information can be referred to above.

S502. The MEPM determines that the behavior corresponding to the second information of the VIM is abnormal, and determines that the risk status of the first ME host is that the first ME host has a risk of being invaded.

It should be noted that S502 is an example where the MEPM determines the risk status of the first ME host. In another possible example, the MEPM may send the second information to the OSS, and the OSS determines the risk status of the first ME host. The MEPM receives the risk status of the first ME host from the OSS. At this time, the OSS is equivalent to an instance of the sixth network element, and in this case, it is equivalent to the MEPM adopting the third method above to determine the risk status of the first ME host.

In FIG. 5 , S502 is represented by a double arrow line, and the double arrow indicates that the MEPM can receive the risk status of the first ME host from the OSS.

S503. The MEPM determines that the resource policy is to disable the first ME host.

S504. The MEPM sends the resource policy to the VIM. Correspondingly, the VIM receives the resource policy from the MEPM.

S505. The VIM removes the first ME host from the resource pool, and migrates the application deployed on the first ME host to the second ME host.

As an example, S504-S505 are optional steps. These optional steps are illustrated in dashed lines in FIG. 5 .

In the embodiment shown in Figure 5, the MEPM determines whether the behavior of accessing the first ME host is abnormal according to the second information, and if the behavior of accessing the first ME host is abnormal, it determines that the first ME host is at risk of being invaded, providing A mechanism for the risk status of the first ME host. Moreover, if the behavior of accessing the first ME host is abnormal, the VIM will deactivate the first ME host, avoiding the paralysis of the MEC architecture due to the intrusion of the first ME host, and improving the security of the MEC architecture.

In the following, the first NE is MEPM, the second NE is the ME host, the fourth NE is OSS, and the fifth NE is VIM. The first NE determines the risk status of the ME host according to the above method 2. For example, taking the access request as a port opening request as an example, the interaction process between various network elements is introduced. As shown in FIG. 6 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.

S601. The OSS acquires a port opening request.

For how OSS obtains the port opening request, refer to the previous section.

S602. The OSS sends a port opening request to the MEPM. Correspondingly, the MEPM receives the port opening request from the OSS.

S603. The first ME host sends first information to the MEPM. Correspondingly, the MEPM receives the first information from the first ME host. The first information includes information about resources available in the first ME host, and specifically includes information about ports available to the first ME host.

S604. If the MEPM determines that the port requested to be opened by the port opening request belongs to available resources in the first ME host, determine that the risk status of the first ME host is that the first ME host does not have a risk of being invaded by the OSS.

It should be noted that, in this embodiment of the present application, the introduction is made by taking the first condition including that the first resource belongs to available resources in the first ME host as an example.

In a possible embodiment, the MEPM may also verify whether the port requested by the port opening request belongs to the first type of port, and the meaning of the first type of port can be referred to above. If the port requested by the port opening request belongs to the first type of port, steps S605-S607 do not need to be performed. If the port requested by the port opening request does not belong to the first type of port, continue to perform subsequent steps.

S605. The MEPM determines that the resource policy is to allow opening of the port requested by the port opening request.

S606. The MEPM sends the resource policy to the first ME host. Correspondingly, the first ME host receives the resource policy from the MEPM.

S607, the first ME host opens the port requested by the open port request.

As an example, S606-S607 are optional steps. These optional steps are illustrated in dashed lines in FIG. 6 .

In the embodiment shown in Figure 6, after the MEPM receives the port opening request, it determines whether the port requested by the port opening request belongs to the information of the port available to the first ME host, and if it does, determines that the first ME host does not exist and is used by the second ME host. The risk of four network element intrusions provides a mechanism to determine the possible security risks of ME hosts. Moreover, the embodiment of the present application verifies the port opening request, thereby avoiding illegal opening of unusable ports, improving the security of the first ME host, thereby improving the security of the MEC architecture.

In the following, the first NE is MEPM, the second NE is the ME host, the fourth NE is OSS, and the fifth NE is VIM. The first NE determines the risk status of the ME host according to the above method 2. As an example, taking an access request as an instantiated application request as an example, the interaction process between various network elements is introduced. As shown in FIG. 7 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.

The following describes the resource access method in the embodiment of the present application with reference to the flow chart of the resource access method shown in FIG. 7 .

S701. The OSS sends an application instantiation request to the MEPM through the MEO. Correspondingly, the MEPM receives the application instantiation request from the OSS through the MEO. The meaning of the instantiated application can be referred to above.

S701 includes S701a, that is, the OSS sends an application instantiation request to the MEO, and S701b, that is, the MEO sends the application instantiation request to the MEPM.

S702. The first ME host sends the information of the first host to the MEPM. Correspondingly, the MEPM receives the information of the first host from the first ME host.

S703. If the MEPM determines that the first resource requested by the instantiated application exceeds the resource limit, determine that the risk state of the first ME host is that the first ME host has a risk of being invaded by the OSS.

S704. The MEPM determines that the resource policy is denying access to the first resource.

S705. The MEPM sends a first rejection response to the OSS through the MEO. Correspondingly, the OSS receives the first rejection response from the MEPM through the MEO. The first rejection response is used to indicate rejection of the application instantiation request initiated by the OSS.

S705 includes S705a, that is, the MEPM sends the first rejection response to the MEO, and S705b, that is, the MEO sends the first rejection response to the OSS.

As an example, S705 is an optional step. This optional step is illustrated in dashed lines in FIG. 7 .

In the embodiment shown in FIG. 7, after receiving the instantiation application request, the MEPM determines whether the resource requested by the instantiation application request exceeds the upper limit of the resource quantity, and if the resource requested by the instantiation application request exceeds the upper limit of the resource quantity, determine The first ME host has a risk of being invaded by the fourth network element, and a mechanism for determining the possible security risk of the first ME host is provided. Moreover, in this embodiment, the instantiation application request can be verified, thereby avoiding situations such as illegal instantiation application requests exhausting the resources of the first ME host, improving the security of the first ME host, thereby improving the reliability of the MEC architecture. safety.

In the following, the first network element is MEPM, the second network element is ME host, the fourth network element is CISM, and the fifth network element is VIM. The first network element determines the risk status of ME host according to the above method 2. For example, taking an access request as a resource deletion request as an example, the interaction process between various network elements is introduced. As shown in FIG. 8 , it is a schematic flowchart of a resource access method provided in the embodiment of the present application.

S801. The CISM sends a resource deletion request to the MEPM. Correspondingly, the MEPM receives the resource deletion request from the CISM.

S802. The first ME host sends information about the first ME host to the MEPM.

S803. If the MEPM determines that the importance of the first resource requested to be deleted by the resource deletion request is higher than the preset importance, determine that the risk status of the first ME host is that the first ME host has a risk of being invaded by the CISM.

S804. The MEPM determines that the resource policy is to refuse to delete the first resource.

S805. The MEPM sends a second rejection response to the CISM. Correspondingly, the CISM receives the second rejection response from the MEPM. The second rejection response is used to reject the resource deletion request.

As an example, S805 is an optional step. These optional steps are illustrated in dashed lines in FIG. 8 .

In the embodiment shown in FIG. 8 , after receiving the resource deletion request, the MEPM determines whether the importance of the resource deleted requested by the resource deletion request is lower than the preset importance level, if the resource deleted requested by the resource deletion request The importance degree is higher than the preset importance degree, and it is determined that the first ME host has a risk of being invaded by the fourth network element, and a mechanism for determining whether the first ME host has a security risk is provided. Moreover, in this embodiment, the resource deletion request can be verified, thereby avoiding illegal resource deletion requests from deleting important resources of the first ME host, improving the security of the first ME host, thereby improving the security of the MEC architecture.

In the following, the first network element is MEPM, the second network element is ME host, the fourth network element is CISM, and the fifth network element is VIM. The first network element determines the risk status of ME host according to the above method 2. For example, taking the access request as a VM creation request as an example, the interaction process between various network elements is introduced. As shown in FIG. 9 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.

S901. The CISM sends a VM creation request to the MEPM. Correspondingly, the MEPM receives the VM creation request from the CISM. The meaning of the VM creation request can be referred to above.

S902. The first ME host sends information about the first ME host to the MEPM. Correspondingly, the MEPM receives the information of the first ME host from the first ME host.

S903. If the first resource requested by the VM creation request exceeds the upper limit of resource quantity, determine that the risk status of the first ME host is that the risk status of the first ME host is that the first ME host has a risk of being invaded by the CISM.

Optionally, the upper limit of the number of resources is the maximum number of resources requested by historical access requests. In this case, the embodiment of the present application is equivalent to finding out whether the first resource requested by this VM creation request is abnormal according to the number of resources requested by historical access requests.

S904. The MEPM determines that the resource policy is denying access to the first resource.

S905. The MEPM sends a third rejection response to the CISM. Correspondingly, the CISM receives the third rejection response from the MEPM. The third rejection response is used to reject the VM creation request.

As an example, S905 is an optional step. In FIG. 9 , S905 is indicated by a dotted line as an optional step.

In the embodiment shown in FIG. 9 , after the MEPM receives the VM creation request, it determines whether the creation resource requested by the VM creation request exceeds the upper limit of the number of resources, and if the creation resource requested by the VM creation request exceeds the upper limit of the number of resources, determine the first An ME host has a risk of being invaded by the fourth network element, and a mechanism for determining the risk status of the ME host is provided. Moreover, in this embodiment, the VM creation request can be verified, thereby avoiding that the illegal VM creation request exhausts the resources of the first ME host, or occupies a large amount of resources in the first ME host, and improves the security of the first ME host. Security, thereby improving the security of the MEC architecture.

Fig. 10 shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the first network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices. The communication device may include a transceiver module 1001 and a processing module 1002 .

For example, the transceiver module 1001 can be used to perform the step of receiving the information of the first ME host from the second network element, and can also perform the step of sending the resource policy to the fifth network element, and can also be used to support the technology described herein other processes. The transceiver module 1001 is used for the communication device to communicate with other modules, and it may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication. Exemplarily, the transceiving module 1001 may be configured to execute S202 in the embodiment shown in FIG. 2 , that is, receive the information of the first ME host from the second network element. S205 in FIG. 2 may also be executed, that is, sending the resource policy to the fifth network element. For example, the processing module 1002 may be used to execute S203 and S204 in FIG. 2 .

Optionally, the processing module 1002 includes an edge risk engine module and an edge resource policy management module (not shown in FIG. 10 ), for example, the edge risk engine module is used to execute S203; the edge resource policy management module is used to execute S204 .

Optionally, the processing module 1002 includes a central risk engine module and a central resource policy management module (not shown in FIG. 10 ), for example, the central risk engine module is used to perform S203; the central resource policy management module is used to perform S204 .

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 11 shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the aforementioned second network element. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices. The communication device may include a transceiver module 1101 and a processing module 1102 .

For example, the processing module 1102 may be used to execute S201 in FIG. 2 , and may also be used to support other processes of the technology described herein. For example, the transceiver module 1101 is used by the communication device to communicate with other modules, which may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication. Exemplarily, the transceiver module 1101 may be configured to execute the step of sending the information of the first ME host to the first network element in the embodiment shown in FIG. 2 .

Optionally, the processing module 1102 includes a risk awareness agent module (not shown in FIG. 11 ), for example, the risk awareness agent module is used to execute S201.

Optionally, if the second network element and the fifth network element are the same network element, the processing module 1102 further includes a host policy enforcement module (not shown in FIG. 11 ), and the host policy enforcement module may be used to execute S205.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 12 shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the fifth network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices. The communication device may include a transceiver module 1201 and a processing module 1202 .

For example, the transceiver module 1201 can be used to execute the step of receiving the resource policy from the first network element in FIG. 2 , and can also be used to support other processes of the technology described herein. For example, the processing module 1202 is used by a communication device to communicate with other modules, which may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication. Exemplarily, the processing module 1202 may be configured to access resources in the ME host according to a resource policy, for example, execute S310 and S311 as shown in FIG. 3 .

Optionally, the processing module 1202 includes a resource policy execution module (not shown in FIG. 12 ), the resource policy execution module is used for resources in the ME host according to the resource policy.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

An embodiment of the present application also provides a communication system, and the communication system may include devices as shown in FIG. 10 and FIG. 11 . Optionally, the communication system further includes an apparatus as shown in FIG. 12 .

FIG. 13A shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the first network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be realized by a chip system. In the embodiment of the present application, the system-on-a-chip may consist of chips, or may include chips and other discrete devices. The communication device may include an edge risk engine module 1301 and an edge resource policy management module 1302. For example, the edge risk engine module 1301 is used to receive the information of the first ME host from the second network element, and S203; the edge resource policy The management module 1302 is configured to execute S204.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 13B shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the first network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.

The communication device may include a central risk engine module 1303 and a central resource policy management module 1304. For example, the central risk engine module 1303 is used to receive the first ME host information from the second network element, and S203; the central resource policy The management module 1304 is configured to execute S204.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 14 shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the fifth network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices. The communication device may include a risk awareness agent module 1401, for example, the risk awareness agent module 1401 is configured to perform S201.

Optionally, the communication device may further include a host policy execution module 1402, which is configured to access resources in the ME host according to resource policies. In FIG. 14 , the host policy enforcement module 1402 is indicated by a dotted line box, which is optional.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 15 shows a schematic structural diagram of a communication device. Wherein, the communication device can realize the function of the fifth network element mentioned above. The communication device may be a hardware structure, a software module, or a hardware structure plus a software module. The communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices. The communication device may include a resource policy execution module 1501, and the resource policy execution module 1501 may be used to access resources in the ME host according to the resource policy.

Wherein, all relevant content of each step involved in the above-mentioned method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

Fig. 10, Fig. 11, Fig. 12, Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 are schematic for the division of modules, which are only a logical function division, and there may be other division methods in actual implementation. In addition, in Each functional module in each embodiment of the present application may be integrated into one processor, or physically exist separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.

An embodiment of the present application provides a communication system, and the communication system may include devices as shown in FIG. 13A and FIG. 14 . Optionally, the communication system further includes an apparatus as shown in FIG. 15 .

An embodiment of the present application provides a communication system, and the communication system may include devices as shown in FIG. 13B and FIG. 14 . Optionally, the communication system further includes an apparatus as shown in FIG. 15 .

Please refer to Figure 16, which is a schematic diagram of deploying the communication devices shown in Figure 13A, Figure 13B, Figure 14 and Figure 15 in the MEC architecture shown in Figure 1A provided by the embodiment of this application, or it can be understood as this A schematic structural diagram of a communication system provided in an embodiment of the application.

As shown in Figure 16, OSS includes a central risk engine module and a central policy management module; MEPM includes an edge risk engine module and edge resource policy management; ME host (an example of a second network element) includes a risk-aware agent module and a host policy Execution module; the VIM (as an example of the fifth network element) includes a policy enforcement module.

Optionally, the fourth network element may be the OSS and/or VIM in FIG. 16 . Wherein, the function of each module in Fig. 16 can refer to the above.

Optionally, a service policy execution module is deployed in the MEP in the ME host, and the service policy execution module is used to receive the service policy sent by the MEPM and execute corresponding services.

Optionally, the risk awareness agent module may communicate with the MEPM through the interface Mm12, for example, the risk awareness agent module sends information about the ME host to the MEPM through Mm12. For information about the ME host, please refer to the preceding text.

Optionally, the host policy enforcement module in the VIM can communicate with the MEPM through the interface Mm13, for example, the MEPM can send resource policies to the host policy enforcement module in the VIM through Mm12. Among them, the meaning of the resource policy can refer to the above.

In a possible implementation, when the edge risk engine module in MEPM cannot determine the risk status of the ME host according to the information of the ME host, it can send the information of the ME host to OSS, and the central risk engine module can information, determine the risk status of the ME host, and determine the resource policy of the ME host by the central policy management module.

It should be noted that, in FIG. 16 , the newly added modules in FIG. 1A are shown in dotted boxes, and the functions of each network element or interface in FIG. 16 can refer to the content discussed in FIG. 1A .

Please refer to FIG. 17, which is another schematic diagram of deploying the communication devices shown in FIG. 13A, FIG. 13B, FIG. 14 and FIG. 15 in the MEC architecture shown in FIG. 1B provided by the embodiment of this application, or it can be understood as A schematic structural diagram of a communication system provided in an embodiment of the present application.

As shown in Figure 17, OSS (as an example of the third network element) includes a central risk engine module and a central policy management module; MEPM (as an example of the first network element) includes an edge risk engine module and an edge resource policy Management; ME host (an example of the second network element) includes a risk awareness agent module and a host policy execution module; VIM (as an example of the fifth network element) includes a policy execution module; CISM (as the fifth network element One example) includes a policy enforcement module.

Optionally, the fourth network element may be one or more of the OSS, CISM, or VIM in FIG. 17 .

Optionally, a service policy execution module may also be deployed in the MEP in the ME host, and the function of the service policy execution module may refer to the foregoing.

Optionally, the resource policy execution module in the CISM can communicate with the container engine in the ME host through Mm14 to manage the running status of the container. In addition, the resource policy execution module in the CISM can communicate with the MEPM through Mm15, for example, the MEPM can send the resource policy to the CISM through Mm15.

In a possible implementation, when the edge risk engine module in MEPM cannot determine the risk status of the ME host according to the information of the ME host, it can send the information of the ME host to OSS, and the central risk engine module can information, determine the risk status of the ME host, and determine the resource policy of the ME host by the central policy management module.

It should be noted that in Figure 17, the modules newly added in Figure 1B are shown in dotted boxes, and the functions of each network element or interface in Figure 17 can refer to the content discussed in Figure 1B.

FIG. 18 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a first network element, or be capable of implementing functions of the first network element. Wherein, the communication device may be a system on a chip. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.

The communication device includes at least one processor 1801, configured to implement or support the communication device to implement the functions of the first network element in FIG. 2 to FIG. 9 . Exemplarily, the processor 1801 can determine the risk status of the ME host according to the information of the ME host, and determine the resource policy according to the risk status of the ME host. For details, refer to the detailed description in the method example, and details are not repeated here.

The communication device may also include an interface 1802 for communicating with other devices through a transmission medium, so that the communication device communicates with other devices. Exemplarily, the other device may be a server. The processor 1801 can use the interface 1802 to send and receive data.

The communication device may also include at least one memory 1803 for storing program instructions and/or data. The memory 1803 is coupled to the processor 1801. The coupling in the embodiments of the present application is an indirect coupling or a communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules. The processor 1801 may cooperate with the memory 1803 . Processor 1801 may execute program instructions stored in memory 1803 . At least one of the at least one memory 1803 may be included in the processor 1801 . When the processor 1801 executes the program instructions in the memory 1803, any resource access method in the embodiments shown in FIG. 2 to FIG. 9 may be implemented.

As an example, the memory 1803 in FIG. 18 is an optional part, which is indicated by a dashed box in FIG. 18 . For example, the memory 1803 is coupled with the processor 1801.

The embodiment of the present application does not limit the specific connection medium among the interface 1802, the processor 1801, and the memory 1803. In the embodiment of the present application, in FIG. 18, the interface 1802, the processor 1801, and the memory 1803 are connected through a bus. The bus is represented by a thick line in FIG. Do not limit yourself. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 18 , but it does not mean that there is only one bus or one type of bus.

In this embodiment of the application, the processor 1801 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement Or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be implemented by a hardware processor, or by a combination of hardware and software modules in the processor.

In the embodiment of the present application, the memory 1803 may be a non-volatile memory, such as a hard disk (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD), etc., and may also be a volatile memory (volatile memory), For example random-access memory (random-access memory, RAM). A memory is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.

FIG. 19 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a second network element, or be capable of implementing a function of the second network element. Wherein, the communication device may be a system on a chip. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.

The communication device includes at least one processor 1901, configured to implement or support the communication device to implement the functions of the second network element in FIG. 2 of this application, or implement the functions of the second network element in FIGS. 2 to 9 . Exemplarily, the processor 1901 may obtain the information of the ME host, for details, refer to the detailed description in the method example, and details are not repeated here.

In addition, the communications device may further include an interface 1902 . Optionally, the communication device further includes a memory 1903, which is indicated by a dashed box in FIG. 19 as an optional part. For specific implementation manners of the processor 1901, the interface 1902, and the memory 1903, reference may be made to the foregoing.

FIG. 20 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a second network element, or be capable of implementing a function of the second network element. Wherein, the communication device may be a system on a chip. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.

The communication device includes at least one processor 2001, configured to implement or support the communication device to implement the functions of the second network element in FIG. 2 of the present application, or implement the functions of the second network element in FIGS. 2 to 9 . Exemplarily, the processor 2001 may obtain the information of the ME host, for details, refer to the detailed description in the method example, and details are not repeated here.

In addition, the communication device may further include an interface 2002 . Optionally, the communication device further includes a memory 2003, which is indicated by a dashed box in FIG. 20 as an optional part. For specific implementation manners of the processor 2001, the interface 2002, and the memory 2003, reference may be made to the foregoing.

An embodiment of the present application provides a chip system. The chip system includes a processor and may also include an interface for implementing the first network element, the second network element, the third network element, the fourth network element, or the first network element in the foregoing method. The functions of the five network elements. The system-on-a-chip may consist of chips, or may include chips and other discrete devices.

An embodiment of the present application also provides a computer-readable storage medium, which is used to store a computer program, and when the computer program is run on a computer, the computer executes the computer program shown in FIGS. 2 to 9. The resource access method in any one of the embodiments.

An embodiment of the present application also provides a computer program product, the computer program product stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the steps shown in Fig. 2 to Fig. 9 . The resource access method in any one of the embodiments.

The methods provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, network equipment, user equipment or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL) or wireless (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), optical media (for example, digital video disc (digital video disc, DVD for short)), or semiconductor media (for example, SSD).

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (36)

A resource access method, characterized by comprising: The first network element receives the information of the mobile edge host from the second network element, the information of the mobile edge host includes first information of the first resource and/or second information indicating a behavior of accessing the mobile edge host, the said The first resource is a resource provided by the mobile edge host; The first network element determines a risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has a security risk; The first network element determines a resource policy according to the risk status, where the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host. The method according to claim 1, wherein the first network element determines the risk status according to the information of the mobile edge host, comprising: The first network element determines whether the second resource corresponding to the first information is abnormal, wherein, if the resource corresponding to the first information is abnormal, determining that the risk status is that the mobile edge host has a risk of being invaded, said second resource belongs to said first resource; and/or, The first network element determines whether the behavior corresponding to the second information is abnormal, wherein, if the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the mobile edge host has a risk of being invaded. The method according to claim 2, wherein the second resource includes first hardware, the first information includes a first identifier, and the first identifier is an identifier of the first hardware; The first network element determining whether the second resource corresponding to the first information is abnormal includes: If the first identifier does not match the prestored second identifier, and/or the first identifier does not match the third identifier, the first network element determines that the first hardware is abnormal, and the third identifier is The identifier received from the third network element is the identifier of the second hardware, and the second hardware is the modified hardware of the first hardware. The method according to claim 2 or 3, wherein the second resource includes a first type port of the mobile edge host, and the first type port belongs to an opened port in the mobile edge host; The first network element determining whether the second resource corresponding to the first information is abnormal includes: The first network element receives information of a second type of port from a third network element, and the second type of port is a port that the third network element has applied for opening from the mobile edge host; If one or more ports in the first type of ports do not belong to the second type of ports, the first network element determines that the one or more ports are abnormal. The method according to claim 4, wherein the first network element determines a resource policy according to the risk status, comprising: If the risk state is that the mobile edge host has a risk of being invaded, the first network element determines that the resource policy is to close the one or more ports. The method according to any one of claims 2-5, wherein the first network element determines a resource policy according to the risk status, comprising: If the risk status is that the mobile edge host has a risk of being intruded, the first network element determines that the resource policy is to disable the mobile edge host or reduce the security level of the mobile edge host, wherein, if The security level of the mobile edge host is reduced to a first security level, and the mobile edge host does not support applications with a deployment priority higher than the first priority, and the first priority is that the security level of the mobile edge host is The case of the first security level may support the highest priority of deployed applications. The method according to claim 1, wherein the first network element determines the risk status according to the information of the mobile edge host, comprising: The first network element receives an access request from a fourth network element, where the access request is used to request access to a third resource of the mobile edge host; The first network element determines whether the third resource satisfies the first condition according to the information of the mobile edge host; If the third resource does not meet the first condition, determine that the risk status is that the mobile edge host has a risk of being intruded, or, if the third resource meets the first condition, determine the risk The status is that the mobile edge host does not have the risk of being intruded. The method according to claim 7, wherein the first condition includes one or more of the following: The number of resources included in the third resource does not exceed the upper limit of the number of resources, and the upper limit of the number of resources is determined according to the information of the mobile edge host; The third resource belongs to available resources among the first resources, the first information includes available status information of the first resource, and the available status information is used to indicate available resources among the first resources; or, The third resource belongs to resources whose importance is lower than a preset importance among the first resources, and the first information includes the importance of the first resource. The method according to claim 7 or 8, wherein the first network element determines a resource policy according to the risk status, comprising: If the risk state is that the mobile edge host has a risk of being invaded, the first network element determines that the resource policy is to deny access to the third resource; or, If the risk status of the mobile edge host does not have a risk of intrusion, the first network element determines that the resource policy is to allow access to the third resource. The method according to any one of claims 1-9, wherein the method further comprises: The first network element sends the resource policy to a fifth network element. The method according to claim 1, wherein the first network element determines the risk status according to the information of the mobile edge host, comprising: The first network element sends the information of the mobile edge host to a sixth network element; The first network element receives the risk status information from the sixth network element. A resource access method, characterized by comprising: The second network element obtains the information of the mobile edge host, where the information of the mobile edge host includes first information of a first resource and/or second information indicating a behavior of accessing the mobile edge host, where the first resource is the resources provided by the mobile edge host; The second network element sends the information of the mobile edge host to the first network element; The second network element receives a resource policy from the first network element, where the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host. The method according to claim 12, wherein before the second network element sends the information of the mobile edge host to the first network element, the method further comprises: The second network element determines that it cannot be determined whether the mobile edge host is at risk according to the information of the mobile edge host. A resource access method, characterized by comprising: The second network element obtains the information of the mobile edge host, where the information of the mobile edge host includes first information of a first resource and/or second information indicating a behavior of accessing the mobile edge host, where the first resource is the resources provided by the mobile edge host; The second network element sends the information of the mobile edge host to the first network element; The first network element determines a risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has a security risk; The first network element determines a resource policy according to the risk state, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host; The first network element sends the resource policy to the second network element. The method according to claim 14, wherein the first network element determines the risk status according to the information of the mobile edge host, comprising: The first network element determines whether the second resource corresponding to the first information is abnormal, wherein, if the resource corresponding to the first information is abnormal, determining that the risk status is that the mobile edge host has a risk of being invaded, said second resource belongs to said first resource; and/or, The first network element determines whether the behavior corresponding to the second information is abnormal, wherein, if the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the mobile edge host has a risk of being invaded. The method according to claim 15, wherein the second resource includes first hardware, the first information includes a first identifier, and the first identifier is an identifier of the first hardware; The first network element determining whether the second resource corresponding to the first information is abnormal includes: If the first identifier does not match the prestored second identifier, and/or the first identifier does not match the third identifier, the first network element determines that the first hardware is abnormal, and the third identifier is The identifier received from the third network element is the identifier of the second hardware, and the second hardware is the modified hardware of the first hardware. The method according to claim 15 or 16, wherein the second resource includes a first type port of the mobile edge host, and the first type port belongs to an opened port in the mobile edge host; The first network element determining whether the second resource corresponding to the first information is abnormal includes: The first network element receives information of a second type of port from a third network element, and the second type of port is a port that the third network element has applied for opening from the mobile edge host; If one or more ports in the first type of ports do not belong to the second type of ports, the first network element determines that the one or more ports are abnormal. The method according to claim 14, characterized in that the method further comprises: The first network element receives an access request from a fourth network element, where the access request is used to request access to a third resource of the mobile edge host; The first network element determines whether the third resource satisfies the first condition according to the information of the mobile edge host; If the first network element determines that the third resource does not meet the first condition, determine that the risk status is that the mobile edge host has a risk of being intruded, or if it determines that the third resource meets the The first condition is to determine that the risk status is that the mobile edge host does not have a risk of being invaded. The method according to claim 18, wherein the first condition includes one or more of the following: The number of resources included in the third resource does not exceed the upper limit of the number of resources, and the upper limit of the number of resources is determined according to the information of the mobile edge host; The third resource belongs to available resources among the first resources, the first information includes available status information of the first resource, and the available status information is used to indicate available resources among the first resources; or, The third resource belongs to resources whose importance is lower than a preset importance among the first resources, and the first information includes the importance of the first resource. A communication device, characterized by comprising: A transceiver module, configured to receive information about a mobile edge host from a second network element, where the information about the mobile edge host includes first information about a first resource and/or second information indicating a behavior of accessing the mobile edge host, so The first resource is a resource provided by the mobile edge host; A processing module, configured to determine a risk status according to the information of the mobile edge host, where the risk status is used to indicate whether the mobile edge host has a security risk, and to determine a resource policy according to the risk status, the resource policy A policy used to indicate access to resources provided by the mobile edge host. The device according to claim 20, wherein the processing module is specifically used for: Determine whether the second resource corresponding to the first information is abnormal, wherein, if the resource corresponding to the first information is abnormal, determine that the risk status is that the mobile edge host has a risk of being invaded, and the second resource belongs to The first resource; and/or, determining whether the behavior corresponding to the second information is abnormal, wherein, if the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the mobile edge host has an intruded risk. The device according to claim 21, wherein the second resource includes first hardware, the first information includes a first identifier, and the first identifier is an identifier of the first hardware; the processing Modules are used specifically for: If the first identifier does not match the prestored second identifier, and/or the first identifier does not match the third identifier, it is determined that the first hardware is abnormal, and the third identifier is received from a third network element is the identifier of the second hardware, and the second hardware is the modified hardware of the first hardware. The device according to claim 21 or 22, wherein the second resource includes a first type port of the mobile edge host, and the first type port belongs to an opened port in the mobile edge host; The transceiver module is further configured to receive information of a second type of port from a third network element, and the second type of port is a port that the third network element has applied to the mobile edge host for opening; The processing module is specifically configured to, if one or more ports in the first type of ports do not belong to the second type of ports, determine that the one or more ports are abnormal. The device according to claim 23, wherein the processing module is specifically used for: If the risk status is that the mobile edge host has a risk of being invaded, it is determined that the resource policy is to close the one or more ports. The device according to any one of claims 21-24, wherein the processing module is specifically used for: If the risk state is that the mobile edge host has a risk of being intruded, determine that the resource policy is to disable the mobile edge host or reduce the security level of the mobile edge host, wherein, if the mobile edge host's The security level is reduced to the first security level, the mobile edge host does not support the deployment of applications with a higher priority than the first priority, and the first priority is that the security level of the mobile edge host is the first security level The highest priority of the application that can support deployment under the circumstances. The device according to claim 20, characterized in that, The transceiver module is further configured to receive an access request from a fourth network element, where the access request is used to request access to a third resource of the mobile edge host; The processing module is specifically configured to determine whether the third resource meets the first condition according to the information of the mobile edge host, and if the third resource does not meet the first condition, determine that the risk status is The mobile edge host has a risk of intrusion, or, if the third resource satisfies the first condition, determine that the risk status is that the mobile edge host has no risk of intrusion. The device according to claim 26, wherein the first condition includes one or more of the following: The number of resources included in the third resource does not exceed the upper limit of the number of resources, and the upper limit of the number of resources is determined according to the information of the mobile edge host; The third resource belongs to available resources among the first resources, the first information includes available status information of the first resource, and the available status information is used to indicate available resources among the first resources; or, The third resource belongs to resources whose importance is lower than a preset importance among the first resources, and the first information includes the importance of the first resource. The device according to claim 26 or 27, wherein the processing module is specifically used for: If the risk status is that the mobile edge host has a risk of being invaded, determine that the resource policy is to deny access to the third resource; or, If there is no risk of the mobile edge host being intruded in the risk state, determine that the resource policy is to allow access to the third resource. The device according to any one of claims 20-28, wherein the transceiver module is also used for: Send the resource policy to the fifth network element. The device according to claim 20, wherein the transceiver module is further configured to send information about the mobile edge host to a sixth network element, and receive information about the risk status from the sixth network element ; The processing module is specifically configured to acquire the risk status information from the transceiver module. A communication device, characterized by comprising: A processing module, configured to obtain the information of the mobile edge host, and obtain the information of the mobile edge host, where the information of the mobile edge host includes first information of the first resource and/or second information indicating the behavior of accessing the mobile edge host , the first resource is a resource provided by the mobile edge host; A transceiver module, configured to send information about the mobile edge host to a first network element, and receive a resource policy from the first network element, where the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host. The device according to claim 31, wherein the processing module is also used for: It is determined that whether the mobile edge host is at risk cannot be determined according to the information of the mobile edge host. A communication system, characterized by comprising: the device according to any one of claims 20-30 and the device according to any one of claims 31-32. A communication device, characterized in that it includes: a processor and a memory; the memory is used to store one or more computer programs, the one or more computer programs include computer-executable instructions, and when the resource access device is running , the processor executes the one or more computer programs stored in the memory, so that the communication device executes the method according to any one of claims 1-13. A chip system, characterized in that the chip system includes: A processor and an interface, the processor is used to call and execute instructions from the interface, and when the processor executes the instructions, the method according to any one of claims 1-19 is implemented. A computer-readable storage medium, characterized in that, the computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer executes any one of claims 1-19 the method described.

Images