[go: up one dir, main page]

WO2023061366A1 - Procédé et appareil d'accès à des ressources - Google Patents

Procédé et appareil d'accès à des ressources Download PDF

Info

Publication number
WO2023061366A1
WO2023061366A1 PCT/CN2022/124629 CN2022124629W WO2023061366A1 WO 2023061366 A1 WO2023061366 A1 WO 2023061366A1 CN 2022124629 W CN2022124629 W CN 2022124629W WO 2023061366 A1 WO2023061366 A1 WO 2023061366A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource
network element
host
information
mobile edge
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/124629
Other languages
English (en)
Chinese (zh)
Inventor
陈学梁
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of WO2023061366A1 publication Critical patent/WO2023061366A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/67—Risk-dependent, e.g. selecting a security level depending on risk profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/30—Network data restoration; Network data reliability; Network data fault tolerance

Definitions

  • the present application relates to the field of communication technologies, and in particular to a resource access method and device.
  • the multi-access edge computing (MEC) architecture provides a cloud computing and information technology (IT) service environment for network operators and service providers.
  • the MEC architecture includes mobile edge system level and ME host level.
  • the ME system layer is used to control the ME host layer globally.
  • the ME host layer includes the ME host and a mobile edge platform manager (MEPM) for managing the ME host.
  • MEPM mobile edge platform manager
  • a third-party client for example, an application (application, APP) provider
  • third-party customers can be understood as users of resources in the MEC architecture, which do not belong to the MEC architecture.
  • a security access mechanism is currently provided, through which the identity of the external user who requests to access the application on the ME host can be verified, and if the authentication passes, the external user is allowed to access Applications on the ME host.
  • This security access mechanism can verify the identity of external users, and can exclude external users with illegal identities.
  • this security access mechanism only authenticates external users, but does not consider possible security risks inside the ME host.
  • Embodiments of the present application provide a resource access method and device, which are used to provide a mechanism for determining possible security risks of an ME host.
  • the embodiment of the present application provides a resource access method, which can be executed by a first network element, such as an operation support system OSS or MEPM, or a communication network element with OSS or MEPM functions.
  • a first network element such as an operation support system OSS or MEPM, or a communication network element with OSS or MEPM functions.
  • the device, or the first network element is a chip system with an OSS or MEPM function.
  • the method includes: the first network element receives information of a mobile edge host from a second network element, and the information of the mobile edge host includes first information of a first resource and/or second information indicating a behavior of accessing the mobile edge host Information, the first resource is a resource provided by the mobile edge host; the first network element determines the risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has security Risk: the first network element determines a resource policy according to the risk state, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.
  • the second network element is, for example, an ME host or an MEPM, or the second network element is a communication device having the ME host or the MEPM, or the second network element is a chip system having the ME host or the MEPM, and the like.
  • the first network element can analyze the risk status of the ME host according to the first information and/or the second information, and provide a mechanism for determining the risk status of the ME host, so as to determine the possible security risks of the ME host.
  • Risks because the embodiment of the present application considers the security issues that may occur inside the ME host, so the security of the ME host can be improved, and the security of the MEC architecture can also be improved.
  • corresponding resource policies can be adopted to reduce the security risk of the ME host in a timely manner, further ensuring the security of the MEC architecture.
  • the first network element determining the risk status according to the information of the mobile edge host includes: the first network element determining whether the second resource corresponding to the first information is abnormal, wherein , if the resource corresponding to the first information is abnormal, determining that the risk status is that the mobile edge host has a risk of being invaded, and the second resource belongs to the first resource; and/or, the first network The element determines whether the behavior corresponding to the second information is abnormal, wherein, if the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the mobile edge host has a risk of being invaded.
  • multiple ways of determining the risk status of the ME host are provided. Since the first network element receives the first information and/or the second information from the second network element, the way for the first network element to obtain the first information and/or the second information is relatively simple, and the first network element can directly By analyzing the first information and/or the second information, the risk status of the ME host can be determined. In this way, the process for the first network element to determine the risk status of the ME host is also simple.
  • the second resource includes first hardware, and the first information includes a first identifier, where the first identifier is an identifier of the first hardware; the first network element determines Whether the second resource corresponding to the first information is abnormal includes: if the first identifier does not match the pre-stored second identifier, and/or the first identifier does not match the third identifier, the first network The element determines that the first hardware is abnormal, the third identifier is an identifier received from a third network element, and is an identifier of second hardware, and the second hardware is hardware after the first hardware has been changed.
  • the first network element may analyze whether the first identification of the first hardware included in the first information matches the pre-stored second identification, and/or analyze the first identification and the third identification received from the third network element. Whether the identifiers match, and then determine whether the first hardware in the ME host is abnormal provides a way to determine whether the second resource is abnormal. Moreover, matching different identifiers to determine whether the first hardware of the ME host is abnormal does not involve a complex data analysis process, making it relatively simple to determine the risk status of the ME host. Moreover, the third identification is the identification of the hardware after the first hardware change, and the first identification is matched with the third identification, which takes into account the normal change of the first hardware, so that the determined risk status of the ME host is reliable. Sex is higher.
  • the second resource includes a first type port of the mobile edge host, and the first type port belongs to an opened port in the mobile edge host;
  • the first network element Determining whether the second resource corresponding to the first information is abnormal includes: the first network element receiving information about a port of a second type from a third network element, where the port of the second type is the port that the third network element has sent to The mobile edge host applies for open ports; if one or more ports in the first type of ports do not belong to the second type of ports, the first network element determines that the one or more ports are abnormal.
  • a manner of determining whether the resource provided by the ME host is abnormal is provided.
  • the first network element can analyze whether there are unauthorized ports in the first type of ports opened by the ME host, and then determine whether the second resource is abnormal, without complex data analysis and processing, and the method of determining whether the second resource is abnormal is relatively simple. Moreover, this method can clearly determine which ports are opened but not authorized ports in the ME host, so that these ports can be closed later, which is beneficial to reduce the risk of the ME host in a targeted manner.
  • the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is closing the one or more ports.
  • the first network element determines that there are one or more unauthorized ports on the ports that the ME host has opened, then the first network element can determine that the resource policy is to close the one or more ports, and the follow-up can be timely Close one or more ports, thereby reducing the risk of the ME host and improving the security of the MEC architecture.
  • the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is to deactivate the mobile edge host or reduce the security level of the mobile edge host, wherein, if the security level of the mobile edge host is reduced to the first security level, the mobile edge host does not support deployment priority
  • the first priority is the highest priority of the application that can support deployment when the security level of the mobile edge host is the first security level.
  • the ME host may be deactivated, so as to avoid other more serious risks caused by continuing to use the ME host.
  • applications with higher priority run more stably.
  • applications with relatively low priority can still be deployed on ME hosts with lower security levels, which can make rational use of resources on each ME host.
  • the determining the risk status by the first network element according to the information of the mobile edge host includes: the first network element receives an access request from a fourth network element, and the access request is used to Requesting access to a third resource of the mobile edge host; the first network element determines whether the third resource satisfies the first condition according to the information of the mobile edge host; if the third resource does not meet the first condition A condition, determining that the risk status is that the mobile edge host has a risk of being intruded, or, if the third resource satisfies the first condition, determining that the risk status is that the mobile edge host is not intruded risks of.
  • the first network element can analyze whether the third resource requested by the access request satisfies the first condition according to the information of the ME host, so as to determine the risk status of the ME host. Request to analyze the legitimacy of the requested third resource to check the possible security risks of the fourth network element, thereby reducing the situation that the fourth network element has security risks and then invades the ME host, and improves the security of the ME host. This improves the security of the MEC architecture.
  • the first condition includes one or more of the following: the number of resources included in the third resource does not exceed the upper limit of the number of resources, and the upper limit of the number of resources is determined according to the determined by the information; the third resource belongs to the resources available in the first resource, the first information includes availability status information of the first resource, and the availability status information is used to indicate the first resource or, the third resource belongs to a resource whose importance level is lower than a preset importance level among the first resources, and the first information includes the importance level of the first resource.
  • the first network element can determine the upper limit of the number of resources according to the information of the ME host. For example, the first network element can determine the number of the first resource as the upper limit of the number of resources, and then the first network element can determine the number of resources requested by the access request. Whether the third resource exceeds the upper limit of the number of resources. If the third resource does not exceed the upper limit of the number of resources, it is determined that the first network element does not have the risk of being invaded, so that the situation that the access request exhausts the resources of the ME host can be avoided. Ensure the security of the ME host.
  • the first network element may also determine whether the third resource belongs to the resource available in the first resource according to the availability status information of the first resource, and determine whether the third resource belongs to the available resource in the first resource.
  • the first network element does not have the risk of being invaded, which can avoid the use of unavailable resources in the ME host after the access request, and improve the security of the resources of the ME host.
  • the first network element may also determine whether the third resource belongs to the resources whose importance degree is lower than the preset importance degree among the first resources according to the importance degree of the first resource, and whether the third resource is important among the first resources In the case of a resource whose level is lower than the preset importance level, it is determined that the first network element does not have the risk of being invaded, so that access requests for resources that are too important can be avoided, so as to ensure the security of important resources in the ME host.
  • the determining the resource policy by the first network element according to the risk status includes: if the risk status indicates that the mobile edge host has a risk of being intruded, the first network element determines The resource policy is denying access to the third resource; or, if the mobile edge host in the risk state is not at risk of being invaded, the first network element determines that the resource policy is allowing access to the third resource. resource.
  • the first network element determines the corresponding resource policy according to the risk status of the ME host, for example, if the ME host has the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to deny access to the ME host.
  • the third resource which can prevent the fourth network element from invading the ME host on the grounds of accessing resources, which improves the security of the ME host, thereby improving the security of the MEC architecture.
  • the method further includes: the first network element sending the resource policy to a fifth network element.
  • the first network element can send the resource policy to the fifth network element, so that the fifth network element can access the resources in the ME host in a timely manner according to the resource policy, which is beneficial to timely control the possible security of the ME host. risk.
  • the method further includes: the first network element determining the risk status according to the information of the mobile edge host, including: the first network element sending the mobile Information about edge hosts; the first network element receives information about the risk status from the sixth network element.
  • the first network element can send the information of the ME host to the sixth network element, and then the sixth network element determines the risk status, so that the first network element does not need to determine the risk status, reducing the first network element's throughput.
  • the first network element is an OSS or an MEPM.
  • the second network element is an ME host or an MEPM.
  • the third network element is an OSS.
  • the fourth network element is an OSS, a VIM, or a CISM.
  • the fifth network element is a MEPM, a virtual facility manager VIM, an ME host, or a container infrastructure service CISM.
  • the sixth network element is an OSS or a multi-edge orchestrator MEO.
  • the embodiment of the present application provides a resource policy acquisition method, which can be executed by a second network element, such as an ME host or MEPM, or a communication device with the ME host or MEPM function, or a System-on-a-chip for ME host or MEPM functions.
  • the method includes: the second network element obtains the information of the mobile edge host, and the information of the mobile edge host includes first information of resources provided by the mobile edge host and/or second information indicating a behavior of accessing the mobile edge host information; the second network element sends the information of the mobile edge host to the first network element; the second network element receives a resource policy from the first network element, and the resource policy is used to indicate access to the mobile edge host The resource policy of the edge host.
  • the second network element after the second network element obtains the information of the ME host, it can send the information of the ME host to the first network element, so that the first network element can determine the risk status of the ME host, and according to the risk status of the ME host Determine the corresponding resource policy, and send the resource policy to the second network element, so that the second network element forwards the resource policy in time, or accesses the resource provided by the ME host in time according to the resource policy.
  • the method before the second network element sends the information of the mobile edge host to the first network element, the method further includes: determining that the Are mobile edge hosts at risk?
  • the information of the ME host can be sent to the first network elements, so that the first network element can determine the risk state of the ME host in time.
  • the embodiment of the present application provides a resource access method, including: a fifth network element receives a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of a mobile edge host, and the resource The policy is determined based on the risk status of the mobile edge host, the risk status is determined based on the information of the mobile edge host, the information of the mobile edge host includes the first information of the first resource and/or indicates the access The second information about the behavior of the mobile edge host, the risk status is used to indicate whether the mobile edge host is at risk, the first resource is a resource provided by the mobile edge host; the fifth network element according to The resource policy accesses resources in the mobile edge host.
  • the fifth network element is an MEPM, a VIM, an ME host, or a CISM.
  • the embodiment of the present application provides a method for accessing resources, which can be implemented through a communication system, where the communication system includes a first network element and a second network element, where the specific details of the first network element and the second network element
  • the first network element may execute any method in the first aspect above
  • the second network element may execute any method in the second aspect above.
  • the communication system may further include a fourth network element, and reference may be made to the foregoing for an implementation manner of the fourth network element.
  • the fourth network element may execute any method in the third aspect above.
  • the communication system may further include a third network element, and reference may be made to the foregoing for an implementation manner of the third network element.
  • the third network element sends the information of the second type of port to the first network element.
  • the embodiment of the present application provides a communication system, including the first network element in the above first aspect and the second network element in the above second aspect.
  • the communication system further includes the fourth network element in the above third aspect.
  • the communications system further includes the foregoing third network element.
  • the third network element For the specific implementation of the third network element, reference may be made to the foregoing.
  • an embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the first network element, Or it is a larger device including the first network element.
  • the first network element includes corresponding means or modules for implementing the foregoing first aspect or any optional implementation manner.
  • the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).
  • the transceiver module is configured to receive information about the mobile edge host from the second network element, where the information about the mobile edge host includes first information about the first resource and/or second information indicating behavior of accessing the mobile edge host , the first resource is a resource provided by the mobile edge host; the processing module is configured to determine a risk status according to the information of the mobile edge host, and the risk status is used to indicate whether the mobile edge host has a security risk, And determining a resource policy according to the risk status, where the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.
  • the communication further includes other components, for example, an antenna, an input and output module, an interface and so on.
  • these components can be hardware, software, or a combination of software and hardware.
  • the processing module includes an edge risk engine module and an edge resource policy management module, for example, the edge risk engine module is used to determine the risk status according to the information of the mobile edge host; the edge resource policy management module A module for determining a resource policy based on the risk status.
  • the processing module includes a central risk engine module and a central resource policy management module, for example, the central risk engine module is used to determine the risk status according to the information of the mobile edge host; the central resource policy The management module is used to determine resource policies according to the risk status.
  • the embodiment of the present application provides a communication device, and the communication device may be the second network element in the above second aspect, or an electronic device (for example, a chip system) configured in the second network element, Or it is a larger device including the first network element.
  • the second network element includes corresponding means or modules for implementing the foregoing second aspect or any optional implementation manner.
  • the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).
  • the processing module is configured to obtain the information of the mobile edge host, and the information of the mobile edge host includes first information of resources provided by the mobile edge host and/or second information indicating the behavior of accessing the mobile edge host
  • the transceiving module is used to send the information of the mobile edge host to the first network element, and receive a resource policy from the first network element, the resource policy is used to indicate the policy for accessing the resources of the mobile edge host.
  • the communication device further includes other components, for example, an antenna, an input and output module, an interface, and the like.
  • these components can be hardware, software, or a combination of software and hardware.
  • the processing module includes a risk awareness agent module, for example, the risk awareness agent module is configured to obtain the information of the mobile edge host.
  • the processing module further includes a host policy execution module, where the host policy execution module is configured to receive a resource policy from the first network element.
  • an embodiment of the present application provides a communication device, which may be the fifth network element in the above third aspect, or an electronic device (for example, a chip system) configured in the fifth network element, Or it is a larger device including the fifth network element.
  • the fifth network element includes corresponding means or modules for implementing the above third aspect or any optional implementation manner.
  • the communication device includes a processing module (also called a processing unit sometimes) and a transceiver module (also called a transceiver unit sometimes).
  • the transceiving module is configured to receive a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of the mobile edge host, the resource policy is determined according to the risk status of the mobile edge host, the The risk status is determined according to the information of the mobile edge host, the information of the mobile edge host includes first information of the first resource and/or second information indicating the behavior of accessing the mobile edge host, and the risk The status is used to indicate whether the mobile edge host is at risk, and the first resource is a resource provided by the mobile edge host; the processing module is used to access resources in the mobile edge host according to the resource policy.
  • the communication device further includes other components, for example, an antenna, an input and output module, an interface, and the like.
  • these components can be hardware, software, or a combination of software and hardware.
  • the processing module includes a resource policy execution module, for example, the resource policy execution module is used to obtain information about the mobile edge host, and the host policy execution module is used to access the mobile edge host according to the resource policy. Resources in edge hosts.
  • an embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the first network element, or is a larger device including the first network element.
  • the first network element includes corresponding means or modules for implementing the foregoing first aspect or any optional implementation manner.
  • the communication device includes an edge risk engine module and an edge resource policy management module.
  • the edge risk engine module is configured to receive the information of the mobile edge host from the second network element, and the information of the mobile edge host includes the first information of the first resource and/or the first information indicating the behavior of accessing the mobile edge host Two information, the first resource is a resource provided by the mobile edge host, and the risk status is determined according to the information of the mobile edge host, and the risk status is used to indicate whether there is a security risk in the mobile edge host; the edge The resource policy management module is configured to determine a resource policy according to the risk status, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.
  • the communication device includes a central risk engine module and a central resource policy management module.
  • the central risk engine module is configured to receive the information of the mobile edge host from the second network element, and the information of the mobile edge host includes the first information of the first resource and/or the first information indicating the behavior of accessing the mobile edge host Two information, the first resource is a resource provided by the mobile edge host, and the risk status is determined according to the information of the mobile edge host, and the risk status is used to indicate whether there is a security risk in the mobile edge host; the center The resource policy management module is configured to determine a resource policy according to the risk status, and the resource policy is used to indicate a policy for accessing resources provided by the mobile edge host.
  • the embodiment of the present application provides a communication device, which may be the first network element in the above first aspect, or an electronic device (for example, a chip system) configured in the second network element, or is a larger device including the first network element.
  • the second network element includes corresponding means or modules for implementing the foregoing second aspect or any optional implementation manner.
  • the communication device includes a risk-aware proxy module and a host policy enforcement module.
  • the risk awareness agent module is used to obtain the information of the mobile edge host, and the information of the mobile edge host includes the first information of resources provided by the mobile edge host and/or the first information indicating the behavior of accessing the mobile edge host.
  • the host policy execution module is used to receive a resource policy from the first network element, and the resource policy is used to indicate access to the mobile edge host resource strategy.
  • the embodiment of the present application provides a communication device, which may be the fifth network element in the above third aspect, or an electronic device (for example, a chip system) configured in the fifth network element , or a larger device including the fifth network element.
  • the fifth network element includes corresponding means or modules for implementing the above third aspect or any optional implementation manner.
  • the communications device includes a resource policy enforcement module.
  • the resource policy execution module is configured to receive a resource policy from the first network element, the resource policy is used to indicate a policy for accessing resources of the mobile edge host, and the resource policy is determined according to the risk status of the mobile edge host , the risk status is determined according to the information of the mobile edge host, the information of the mobile edge host includes the first information of the first resource and/or the second information indicating the behavior of accessing the mobile edge host, the The risk status is used to indicate whether the mobile edge host is at risk, the first resource is a resource provided by the mobile edge host; and resources in the mobile edge host are accessed according to the resource policy.
  • an embodiment of the present application provides a communication system, where the communication system includes the device described in the sixth aspect and the device described in the seventh aspect.
  • the communication system further includes the device described in the eighth aspect.
  • an embodiment of the present application provides a communication system, where the communication system includes the device described in the ninth aspect and the device described in the tenth aspect.
  • the communication system further includes the device described in the eleventh aspect.
  • the embodiment of the present application provides a communication device, including: a processor and a memory; the memory is used to store one or more computer programs, and the one or more computer programs include computer-executable instructions, when the When the resource access device is running, the processor executes the one or more computer programs stored in the memory, so that the communication device executes any one of the first aspect, the second aspect, or the third aspect. described method.
  • an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer executes the first aspect , the method described in any one of the second aspect or the third aspect.
  • the embodiment of the present application provides a computer program product, the computer program product stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the first The method according to any one of the first aspect, the second aspect or the third aspect.
  • the present application provides a chip system, the chip system includes a processor and an interface, the processor is used to call and run instructions from the interface, and when the processor executes the instructions, the first The method described in one aspect, the second aspect or the third aspect.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the embodiment of the present application also provides a computer program, which when the computer program is run on the computer, causes the computer to execute the method described in any one of the first aspect, the second aspect or the third aspect.
  • FIG. 1A is a schematic diagram of an MEC architecture applicable to an embodiment of the present application.
  • FIG. 1B is a schematic diagram of an MEC architecture applicable to an embodiment of the present application.
  • FIG. 2 is a first schematic flow diagram of a resource access method provided by an embodiment of the present application
  • FIG. 3 is a schematic flow diagram II of a resource access method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flow diagram III of a resource access method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flow diagram 4 of a resource access method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flow diagram five of a resource access method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flow diagram VI of a resource access method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flow diagram VII of a resource access method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart eighth of a resource access method provided by an embodiment of the present application.
  • FIG. 10 is a first structural schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG. 11 is a second structural schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram III of a communication device provided in an embodiment of the present application.
  • FIG. 13A is a fourth schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 13B is a schematic diagram of a fifth structure of a communication device provided by an embodiment of the present application.
  • FIG. 14 is a sixth structural diagram of a communication device provided in an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram VII of a communication device provided in an embodiment of the present application.
  • Fig. 16 is a schematic diagram of deploying the devices shown in Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 in the MEC architecture in Fig. 1A provided by the embodiment of the present application;
  • Fig. 17 is another schematic diagram of deploying the devices shown in Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 in the MEC architecture in Fig. 1B provided by the embodiment of the present application;
  • FIG. 18 is a schematic structural diagram eighth of a communication device provided in an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a communication device provided in an embodiment of the present application (ninth);
  • FIG. 20 is a tenth schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the network element in the embodiment of the present application may be a single physical device, or may be a device integrating multiple devices.
  • the network element shown in the embodiment of the present application can also be a logical concept, such as a software module, or a network function corresponding to the service provided by each network device.
  • the network function can be understood as a virtualization function implemented under virtualization, or It can be understood as a network function that provides services under a service-based network, which is not specifically limited in this embodiment of the present application.
  • nouns for the number of nouns, unless otherwise specified, it means “singular noun or plural noun", that is, “one or more". “At least one” means one or more, and “plurality” means two or more. "And/or” describes the association relationship of associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character “/" generally indicates that the contextual objects are an "or” relationship. For example, A/B means: A or B. “At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • At least one item (piece) of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c Can be single or multiple.
  • ordinal numerals such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.
  • first information and “second information” in the embodiments of the present application are used to represent two kinds of information, and do not limit the appearance order, time sequence, priority or importance of the two information.
  • first network element and “second network element” in the embodiment of the present application are used to represent two network elements, and do not limit the priority or importance of the two network elements.
  • the first network element receives the information of the ME host from the second network element, the information of the ME host includes the first information and/or the second information indicating the behavior of accessing the ME host, and the first network element according to The information of the ME host determines the risk status of the ME host and provides a mechanism for determining the risk status of the ME host.
  • this technical solution pays attention to the possible security risks inside the ME host, which can improve the security of the ME host, and also improve the security of the MEC architecture.
  • corresponding resource policies can be adopted in a timely manner to reduce the security risk of the ME host, thereby ensuring the security of the MEC architecture.
  • the MEC architecture includes the ME system layer and the ME host layer.
  • ME system layer includes operations support system (operations support system, OSS), multi-edge orchestrator (mobile edge orchestrator, MEO), customer-facing service portal (customer-facing service portal, CFS Portal), user terminal application (user application, UE APP) and user application lifecycle management proxy (user app life cycle management proxy, UE APP LCM proxy).
  • the ME host layer includes ME host, MEPM, virtualized infrastructure manager (virtualized infrastructure manager, VIM) and other ME hosts.
  • OSS is the highest level management entity in the MEC architecture. OSS can receive service requests from the user-oriented service portal and send the service requests to MEO. MEO can further process the service request.
  • a business request is, for example, a request to instantiate an application or a request to terminate an application. The instantiation request is used to request the instantiation of ME APP, and the termination ME APP request is used to terminate the previously instantiated ME APP.
  • ME APP can be understood as an APP deployed in the ME host. For example, an APP that implements a certain business needs to deploy ME APP in the ME host to provide users with corresponding background support.
  • MEO belongs to the upper management entity in the MEC architecture.
  • MEO is used to macro-control the resources in the MEC architecture.
  • the MEO receives a service request from the OSS, and the MEO weighs the required resources of the service request and the available resources of each ME host, so as to select a suitable ME host to process the service request.
  • the resources in the MEC architecture can be divided into two categories: hardware or software according to the form of presentation.
  • the resources in the MEC architecture can be divided into multiple types according to the usage of the resources, for example, computing resources, storage resources, network resources, and application image resources.
  • the customer service portal is the portal for operators to subscribe and monitor ME APP for third-party customers.
  • Third-party customers for example, APP providers
  • third-party customers can connect the application provided by them to the ME host, and can also configure the time and place for using the application.
  • UE APP can be understood as an APP deployed on the user side.
  • UE APP is usually used to generate service requests based on user operations.
  • the user application lifecycle agent is used to provide forwarding agent services.
  • the user application life cycle agent can receive the corresponding service request from UE APP, and forward the service request to OSS or MEO, etc.
  • the customer service portal, UE APP and user application life cycle agent are illustrated, the actual customer service portal, UE APP and user application life cycle agent can be generally regarded as external network element.
  • the external network element here refers to a network element that does not belong to the MEC architecture.
  • ME host is realized through the server.
  • ME host includes ME platform (mobile edge platform, MEP), ME APP (one ME APP can include one or more services) and virtualization infrastructure (virtualization infrastructure, VI).
  • MEP can implement one or more functions of ME service, service registration, flow rule control and DNS processing.
  • VI is used to provide ME APP with a virtualization management program running a carrier, such as a virtual machine (virtual machine, VM) instance.
  • VI includes the data plane (Data Plane, DP), also known as the data forwarding plane, which can realize functions such as data forwarding and traffic routing.
  • ME APP is an application running on the carrier provided by VI.
  • MEPM belongs to the upper management entity in the MEC architecture.
  • MEPM is used to manage MEP elements, manage ME APP life cycle, and manage ME application rules and requirements, etc.
  • Managing ME APP life cycle includes creating ME APP and terminating ME APP.
  • the ME application rules and requirements include, for example, MEAPP authentication, traffic rules, domain name system (domain name system, DNS) configuration, conflict coordination, and the like.
  • VIM is used to manage the allocation and release of virtualized resources of ME APP.
  • VIM can also manage the mirror resources of ME APP.
  • the VIM can also be responsible for collecting the information of the virtualized resources, and sending the information of the virtualized resources to the MEO and the MEPM respectively.
  • Interfaces in the MEC architecture are also called reference points.
  • the interface includes three types of interfaces, specifically including the interface for interaction between the MEC architecture and external network elements (indicated by Mx), the interface for interaction with the management entity in the MEC architecture (indicated by Mm), and the interface for interaction with the MEP (indicated by Mp indicates).
  • Mx the interface for interaction between the MEC architecture and external network elements
  • Mm the interface for interaction with the management entity in the MEC architecture
  • Mp the interface for interaction with the MEP
  • Mx1 is for the communication interface between the user service portal (considered as a kind of external network element) and the OSS.
  • Mx2 the communication interface between the user application lifecycle agent (considered as a kind of external network element) and UEAPP.
  • Mm1 communication interface between OSS and MEO.
  • the communication interface between MEO and MEPM, for example, ME APP-related policies can be provided through the interface Mm3 between MEO and MEPM.
  • the communication interface between MEO and VIM can be used between MEO and VIM to manage virtualization resources and ME APP images, while maintaining information about available resources.
  • Mm8 the communication interface between the user application lifecycle agent and OSS.
  • Mm9 communication interface between user application lifecycle agent and MEO.
  • Mp1 communication interface between ME APP and MEP.
  • Mp2 the communication interface between MEP and VI.
  • Mp3 the communication interface between MEP and other MEPs.
  • each network element such as ME host, VIM, MEPM, OSS, MEO, etc.
  • the executed functions may be further divided or combined, which is not limited in this embodiment of the present application.
  • FIG. 1B is another schematic diagram of the MEC architecture applicable to the embodiment of the present application.
  • a container infrastructure service (container infrastructure service management, CISM) is added to the MEC architecture shown in FIG. 1B .
  • CISM container infrastructure service management
  • CISM is used to manage container resources, including container creation, updating, querying, scaling, and terminating.
  • ME APP in addition to running on virtual machines, ME APP can also run on containers managed by CISM.
  • CISM can also communicate with MEPM through Mm10.
  • CISM can also be responsible for collecting container information and sending container information to MEPM via Mm10.
  • the MEC architecture shown in FIG. 1B may also include a container engine (container runtime).
  • the container engine can be used to manage the running of containers.
  • the container engine is indicated as an optional part by a dotted box.
  • functions of network elements other than the CISM eg, ME host, VIM, MEPM, OSS, MEO, etc.
  • functions of network elements other than the CISM eg, ME host, VIM, MEPM, OSS, MEO, etc.
  • FIG. 1B functions of network elements other than the CISM (eg, ME host, VIM, MEPM, OSS, MEO, etc.) in FIG. 1B can refer to the content discussed in FIG. 1A , and will not be listed here.
  • each network element such as ME host, VIM, MEPM, OSS, MEO, CISM, etc.
  • the functions performed by the network elements may be further divided or combined, which is not limited in this embodiment of the present application.
  • FIG. 1A and FIG. 1B are two examples of the MEC architecture applicable to the embodiment of the present application, and the actual method in the embodiment of the application is applicable to but not limited to the MEC architecture shown in FIG. 1A and FIG. 1B .
  • FIG. 2 it is a schematic flow chart of a resource access method provided by the embodiment of the present application.
  • the second network element determines information about the first ME host.
  • the second network element is, for example, the ME host or MEPM shown in FIG. 1A or FIG. 1B . If the second network element is the first ME host, then the first ME host can directly collect the information of the first ME host, which is equivalent to determining the information of the first ME host. If the second network element is the MEPM, the MEPM may receive the information of the first ME host from the first ME host, which is equivalent to determining the information of the first ME host.
  • the MEC architecture includes one or more ME hosts. In the embodiment of this application, the ME host is used as the first ME host as an example. The first ME host can be regarded as one or more ME hosts. Any ME host.
  • the information of the first ME host includes the first information and/or the second information.
  • the first information is the information of the first resource
  • the first resource is the resource provided by the first ME host
  • the second information is used to indicate the behavior of accessing the first ME host.
  • the first information and the second information are introduced respectively below.
  • the first resource includes hardware and/or software provided by the first ME host.
  • the hardware provided by the first ME host refers to the whole machine of the first ME host, and each component that the first ME host includes.
  • Each component includes, for example, a network card in the first ME host, a central processing unit (CPU) in the first ME host.
  • Central processing unit (CPU) Central processing unit (CPU), the hard disk in the first ME mainframe, or one or more items of hardware such as the mainboard in the first ME mainframe.
  • the software provided by the first ME host includes, for example, one or more items of software such as a port of the first ME host or a VM deployed by the first ME host. It should be noted that the port of the first ME host refers to the logical port on the software, as opposed to the physical port.
  • the port that can be opened to other network elements in the operating system installed on the first ME host can also be called Operating system port, protocol port or network port, etc.
  • Other network elements here may be understood as network elements other than the first ME host.
  • the ports involved in the embodiments of the present application refer to logical ports on software.
  • the first information includes one or more of the following (1) to (4).
  • the first resource is a general term for the resources that the first ME host can provide, but the resources that the first ME host can provide may include one or more types of resources, and the number of each type of resource may be one or more, Correspondingly, the first resource also includes the one or more types of resources.
  • the identification of the first resource includes an identification of each type of resource of the one or more types.
  • the first resource may also include an identification of each resource of each type of resource. The ID is used to indicate the corresponding resource.
  • Type information of the first resource includes type information of each type of resource of the one or more types.
  • the type information of one type of resource is used to describe the type corresponding to this type of resource.
  • the one or more types may be a general category to which the resources included in the first resource belong, and the one or more types include, for example, software or hardware.
  • the one or more types may also be specific types of resources included in the first resource, such as CPU, port, hard disk, and motherboard.
  • the quantity of the first resource includes the quantity of each type of resource in one or more types, which may be understood as the total quantity of resources belonging to the type.
  • the usage information of the first resource includes usage information of each type of resource of the one or more types.
  • the use information of each type of resource can be understood as the use information of all resources belonging to that type.
  • the usage information of the first resource also includes usage information of each resource belonging to the corresponding type.
  • the following uses the usage information of each resource as an example to introduce the meaning of the usage information.
  • the use information of each type of resource it includes the use information of each resource belonging to this type of resource, which will not be listed one by one below.
  • the usage information for one of the resources is used to describe the usage of the resource.
  • the usage information of a resource includes one or more of the following A, B, or C.
  • A is available status information or unavailable status information corresponding to a resource
  • B is usage status information of a resource
  • C is usage progress information of a resource.
  • A available status information or unavailable status information of a resource.
  • the first resource includes one or more resources, one of which is either an available resource or an unavailable resource. If a resource is an available resource, the first information may include availability status information of the resource, and the availability status information of a resource is used to indicate that the resource is an available resource. For example, available status information is represented by "0".
  • the set of available status information of available resources in the first resource may be referred to as the available status information of the first resource.
  • the first information may include unavailable status information of the resource, and the unavailable status information of a resource is used to indicate that the resource belongs to an unavailable resource.
  • the unavailable status information uses "1" express. For example, if a resource is port 4, and the availability status information of the port 4 is set to "1", it indicates that the port 4 is an unavailable resource.
  • a collection of unavailable status information of unavailable resources in the first resource may be referred to as unavailable status information of the first resource.
  • the first information may only include availability status information of the first resource.
  • resources that do not have availability status information among the first resources belong to unavailable resources among the first resources.
  • whether the resource included in the first resource is an available resource or an unavailable resource may be pre-configured in the first ME host, or may also be predefined through a protocol, which is not limited in this embodiment of the present application.
  • whether the resources included in the first resource are available resources or unavailable resources can be set according to actual needs. For example, although the ME host can provide some resources, some resources may cause risks to the ME host after they are available, then The availability status information of these resources may be set to belong to unavailable resources, and correspondingly, the first information may also include the unavailability status information of these resources.
  • the usage state information of a resource is used to indicate whether the resource has been used.
  • the usage status information of a resource may be a third status indicating that the resource is not used, or a fourth status indicating that the resource is used.
  • the resource is used may be understood as the use of all or part of the resources included in the resource.
  • the third state is represented by "0”, indicating that the resource is not used
  • the fourth state is represented by "1", representing that part or all of the resource has been used.
  • whether a resource is available is not necessarily related to whether the resource is used. For example, a certain type of resource is an available resource, but this type of resource may not be used or may be used. For another example, a certain type of resource is an unavailable resource, and this type of resource may also be unused or illegally used.
  • the usage progress information of a resource is used to indicate the extent to which the resource is used.
  • the use progress information is represented by a ratio between the part of the resource that has been used and the total amount of the resource. For example, if the usage progress information of the CPU is 20%, it may be understood that 20% of the CPU has been used currently.
  • the importance of the first resource includes the importance of each type of resource in one or more types, and the importance of each type of resource is used to represent the importance of the resource.
  • the importance of resources of the same type may be the same, and the importance of resources of different types may be the same or different.
  • the importance of each type of resource may be pre-configured in the first network element, or stipulated in a protocol, which is not limited in this embodiment of the present application. There are many ways to express the importance. For example, the importance of a resource can be expressed by a number. The larger the number, the higher the importance of the resource.
  • the second information is used to describe the behavior of accessing the first ME host.
  • the behavior of accessing the first ME host can be further understood as the behavior of accessing the resources provided by the first ME host.
  • the second information includes resource information of the first ME host requested by the historical access request and specific event information of accessing the first ME host.
  • a historical access request refers to a request for accessing resources of the first ME host before the current time.
  • the second information includes, for example, one or more items of information such as interface call information, container engine running information, or system running information of the first ME host.
  • the interface calling information is, for example, information about calling a kernel-based virtual machine (kernel-based virtual machine, KVM) interface.
  • KVM kernel-based virtual machine
  • the KVM interface is used to create a virtual machine monitoring program in the operating system installed on the first ME host, so that the first ME host can run multiple isolated virtual environments (such as VM).
  • the container engine running information is used to describe the behavior of the container engine.
  • the container engine can be deployed in the ME host, and the container engine can provide mutually isolated operating environments (such as containers) for the ME host.
  • the second network element sends information about the first ME host to the first network element.
  • the first network element receives the information of the first ME host from the second network element.
  • the first network element is, for example, the MEPM, OSS or MEO shown in FIG. 1A or FIG. 1B . If the first network element is a MEPM, the second network element may be the first ME host. If the first network element is OSS or MEO, then the second network element can be MEPM.
  • the first network element determines the risk status according to the information of the first ME host.
  • the risk status is used to indicate whether the first ME host has a security risk.
  • the risk state is divided into two types, that is, the first ME host does not have a security risk and the first ME host has a security risk. That the first ME host does not have a security risk can be understood as that the first ME host does not have the risk of being invaded. The fact that the first ME host has a security risk can be understood as that the first ME host has a risk of being invaded. The following is an introduction to the determination methods of the two risk states.
  • the security risk of the first ME host may already exist, or the security risk of the first ME host may be caused by the access of the fourth network element.
  • the fourth network element is a network element in the MEC architecture that can access the first ME host, such as OSS, VIM or CISM.
  • the risk status of the first ME host may also be determined with the first ME host and the fourth network element as risk investigation subjects. The meanings of the risk status of the first ME host are respectively introduced below when the first ME host and the fourth network element are used as different risk investigation subjects.
  • the first one is to take the first ME host as the subject of risk investigation.
  • the first probability may be preconfigured in the first network element.
  • the value of the first probability may be set according to requirements, which is not limited in this embodiment of the present application.
  • the second probability may be pre-configured in the first network element, and the value of the second probability may be set according to requirements, which is not limited in this embodiment of the present application. The value of the second probability is greater than or equal to the value of the first probability.
  • the value of the second probability is greater than the value of the first probability, then take the first ME host as the security risk investigation subject, if it is determined that the probability that the first ME host belongs to the risk subject is greater than the first probability and less than the second Probability, determining the risk status of the first ME host cannot be judged temporarily.
  • the second is to use the fourth network element as the main body of risk investigation.
  • the third probability may be preconfigured in the first network element.
  • the value of the third probability may be set according to requirements, which is not limited in this embodiment of the present application.
  • the value of the third probability and the value of the first probability can be the same, for example, the value of the third probability and the value of the first probability are both 0; or, the value of the third probability and the value of the first probability It can also be different.
  • the fourth network element Taking the fourth network element as the subject of risk investigation, if it is determined that the probability that the fourth network element belongs to the risk subject is greater than the fourth probability, it is considered that the fourth network element is currently unsafe. Since the fourth network element is safe, it is determined that the fourth network element Accessing the ME host by the four network elements is an illegal access process, and accordingly, it is determined that the ME host is at risk of being invaded.
  • the fourth probability may be pre-configured in the first network element, and the value of the fourth probability may be set according to requirements, which is not limited in this embodiment of the present application. The value of the fourth probability is greater than or equal to the value of the third probability.
  • the value of the fourth probability is greater than or equal to the value of the third probability, then take the first ME host as the security risk investigation subject, if it is determined that the probability that the first ME host belongs to the risk subject is greater than the third probability and less than the third probability Four probabilities, determining the risk status of the first ME host cannot be judged temporarily.
  • the first network element determines the risk status based on the information of the first ME host Since the manner in which the first network element determines the risk status based on the information of the first ME host is related to the subject of risk investigation, the following describes how to determine the risk status.
  • Method 1 The first ME host is used as the subject of risk investigation, and the first network element determines the risk status of the first ME host according to the information of the first ME host.
  • the first network element determines the information of the first ME host, analyzes the first ME host, and determines that the risk status of the first ME host is that the first ME host has a risk of being intruded, or that there is no risk of being intruded.
  • the information of the first ME host is different, and the analysis content and determination method of the first network element will be correspondingly different, which will be introduced respectively below.
  • the information of the ME host includes first information, and the first network element determines the risk status of the first ME host according to the first information.
  • the first network element analyzes the first information to determine whether the second resource corresponding to the first information is abnormal.
  • the second resource is part or all of the first resource. If the second resource is abnormal, it is determined that the risk status of the first ME host is that the first ME host has a risk of being invaded. If the second resource is normal, or there is no abnormality, it is determined that the risk status of the first ME host is that the first ME host does not have a risk of being invaded.
  • the second resource includes hardware.
  • the hardware may be replaced by hardware implanted with malicious software, or the hardware may be illegally disassembled, or the first ME host may be loaded with additional illegal hardware, etc.
  • the data is stolen, and even lead to paralysis of the first ME host and the ME site where the first ME host is located. It can be seen that it is of great significance to analyze whether the hardware of the first ME host is abnormal. Therefore, the embodiment of the present application provides a mechanism for judging whether the hardware is abnormal.
  • the first network element analyzes the change of the identification of the first hardware in the first ME host to determine whether the first hardware is abnormal, and the first hardware includes part or all of the hardware in the first ME host. If the first hardware includes multiple pieces of hardware in the first ME host, the pieces of hardware may be the same type of hardware, or may be multiple types of hardware.
  • the first information includes a first identifier of the first hardware, for example, the first identifier is received from the second network element.
  • the first network element determines whether the first hardware is abnormal according to a matching result between the first identifier and the second identifier prestored by the first network element. If the first network element determines that the first identifier matches the second identifier successfully, indicating that the identifier of the first hardware has not changed, the first network element can determine that the first hardware is not abnormal, that is, the first hardware is normal, and then determine the first ME There is no risk of the host being compromised.
  • the first network element can determine that the first hardware is abnormal, thereby determining that the first ME host has a risk of being invaded.
  • the result of processing the second identifier is the same as the first identifier, or the result of processing the first identifier using a preset algorithm is the same as The second identifier is the same, and it is determined that the first identifier matches the second identifier.
  • the preset algorithm is, for example, hash algorithm or elliptic curve cryptography (elliptic curve cryptography), which is not limited in this embodiment of the present application. If the first logo is not the same as the second logo, or the result of processing the second logo is different from the first logo using a preset algorithm, or the result of processing the first logo using a preset algorithm is different from the second logo. The identifiers are different, and it is determined that the first identifier does not match the second identifier.
  • the following uses the first identifier as an example to introduce the representation form of the first identifier in the embodiment of the present application.
  • the first identification may be a hardware identification of the first hardware, and the hardware identification of the first hardware includes a media access control (media access control, MAC) of the first hardware Address, serial number, universally unique identifier (UUID), or globally unique identifier (globally unique identifier, GUID), etc.
  • media access control media access control, MAC
  • UUID universally unique identifier
  • GUID globally unique identifier
  • the first identification may also be generated by processing the hardware identification of the first hardware according to a preset algorithm.
  • the first algorithm may be preconfigured in the first network element.
  • the preset algorithm please refer to the above.
  • the first hardware is a network card
  • the MAC address of the network card is 123
  • the first identifier is 123.
  • the first network element may calculate the MAC address of the network card according to a hash algorithm, and use the obtained information as the first identifier, for example, "40bd001563085fc35165329ea1ff5c5ecbdbbeef".
  • the first identification may be obtained from the identifications of the multiple pieces of hardware, for example, one piece of hardware corresponds to one piece of identification.
  • the first identifier is a combination of multiple hardware identifiers of multiple hardware, and the combination sequence of the multiple identifiers may be pre-configured in the first network element.
  • the first identifier may be generated by processing a combination of multiple hardware identifiers according to a preset algorithm.
  • the first hardware includes a plurality of hardware, and the plurality of hardware includes a first network card, a CPU, a hard disk, and a motherboard.
  • the hardware identification of the network card is the MAC address of the network card;
  • the hardware identification of the CPU is the hardware model of the CPU;
  • the hardware identification of the first ME host machine is the GUID of the first ME host;
  • the hardware identification of the main board is the UUID of the main board.
  • the MAC address of the network card is 123
  • the hardware model of the CPU is AS
  • the GUID of the first ME host is 234, and the UUID of the main board is 789.
  • the first identifier is represented by a combination of multiple hardware identifiers, for example, the first identifier is 123AS234789.
  • the first identifier is information obtained by calculating a combination of multiple hardware identifiers (namely 123AS234789) using a hash algorithm, for example, the first identifier is f314669c651cc4b6f1d7014397766325b0ca5189.
  • the expression form of the second logo can also refer to the expression form of the first logo, and the expression form of the second logo can be the same as or different from that of the first logo.
  • the first identification is obtained by processing the hardware identification using a preset algorithm
  • the second identification is the hardware identification. In this case, if the result of processing the second identifier by using a preset algorithm is the same as the first identifier, the first network element determines that the first identifier matches the second identifier.
  • the first identifier is the current identifier of the first hardware in the first ME host collected by the second network element, and the first identifier indicates the first hardware of the first ME host.
  • the second identifier pre-stored by the first network element may be the identifier of the first hardware reported by the first ME host.
  • the second identifier is obtained by the first network element actively requesting from the first ME host. Since there may be a certain time interval between the first network element determining the first identification and the first network element determining the second identification, for example, the second identification is received by the first network element from the first ME host before receiving the first identification. , then the second identification can be understood as the identification before the first hardware. If the first ME host is illegally invaded within this time interval, the first identification may not match the second identification, so according to the matching of the first identification and the second identification, it can be determined whether the first hardware is abnormal .
  • the first information includes a first identifier of the first hardware, and the meaning and expression form of the first identifier may refer to the foregoing.
  • the first network element determines whether the first hardware is abnormal according to the matching result between the first identifier and the third identifier.
  • the third identifier for example, is received by the first network element from the third network element, and is used to represent the identifier of the second hardware after the first hardware is changed, and the third network element is, for example, the OSS in FIG. 1A or FIG. 1B .
  • the first network element determines that the first identifier matches the third identifier, which means that the current identifier of the first hardware matches the third identifier of the second hardware, the first network element can determine that there is no abnormality in the first hardware, that is, the first hardware is normal , so as to determine that the first ME host does not have the risk of being invaded. If the first network element determines that the first identification does not match the third identification, or that the matching fails, it means that the current first identification of the first hardware does not match the third identification of the second hardware, and the first network element determines that the first hardware abnormality, so that it is determined that the first ME host has a risk of being invaded.
  • the meanings of successful matching and unsuccessful matching can refer to the content discussed above.
  • the third network element may record the third identifier of the second hardware and the first identifier of the first hardware.
  • the first identifier of the first hardware received by the first network element from the second network element is actually the identifier of the second hardware after the first hardware has been changed, that is, the third identifier.
  • the first network element determines that the first identifier matches the third identifier. If the first hardware is illegally invaded and the identification of the first hardware is illegally changed, then the illegally changed identification cannot be recorded in the third network element.
  • the first identification received by the first network element from the second network element In fact, it is the identification after the first hardware has been illegally invaded, so the first identification cannot match the third identification.
  • the third network element may also record the time when the first hardware is changed, record the first identifier of the first hardware, and the like.
  • the expression form of the third mark may also refer to the expression form of the first mark, and the expression form of the third mark may be the same as or different from that of the first mark.
  • the first identification is obtained by processing the hardware identification by using a preset algorithm
  • the third identification is the hardware identification. In this case, if the result of processing the third identifier using a preset algorithm is the same as the first identifier, it is determined that the first identifier matches the third identifier.
  • the first information includes a first identifier of the first hardware.
  • the first network element determines whether the first hardware is abnormal according to the matching result of the first identification and the second identification, and the matching result of the first identification and the third identification. If the first identification does not match the second identification, and the first identification does not match the third identification, it means that the current first identification of the first hardware is different from the pre-stored second identification, and is different from the second identification of the changed second hardware.
  • the three identifications are also different, which means that the first hardware is likely to be illegally replaced.
  • the first network element determines that the first hardware is abnormal, thereby determining that the first ME host has a risk of being invaded.
  • the first identifier matches the second identifier, the first identifier and the third identifier also match, or if the first identifier matches the second identifier, the first identifier does not match the third identifier, or if the first identifier matches the second identifier No match, the first identifier matches the third identifier, and the first network element determines that the first hardware is normal, thereby determining that the first ME host does not have a risk of being invaded.
  • the second resource includes software.
  • the software may be tampered with or implanted with illegal software, which may cause the unavailable software of the first ME host to be enabled, or even cause the first ME host to be paralyzed and where the first ME host is located. It can be seen that it is of great significance to analyze whether the software of the first ME host is abnormal. For this reason, the embodiment of the present application provides a mechanism for judging whether the software is abnormal.
  • the first network element may analyze whether the ports in the first ME host are abnormal according to whether the ports on the first ME host are opened but not authorized.
  • the first network element determines that the one or more ports are abnormal, thereby determining that the first The ME host is at risk of being hacked. If all the ports in the first type of ports belong to the second type of ports, the first network element determines that all the first type of ports are normal, thereby determining that the first ME host does not have a risk of being invaded.
  • the first information includes the information of the first type of port
  • the second resource includes the first type of port in the ME host.
  • the first type of ports refers to the ports that have been opened in the first ME host.
  • the first type of ports may be further understood as a collection of opened ports in the first ME host.
  • the first type of ports may include one or more ports.
  • the fourth network element can access the first ME host through the first type of port. For the meaning of the fourth network element, reference may be made to the foregoing.
  • the information of the first type of port is, for example, the port number of the port belonging to the first type of port.
  • the ports in the first ME host are not directly open to the outside world, but need to apply for opening to the first ME host through the third network element, and the third network element will record the ports that have been applied for opening to the first ME host.
  • Information that is, the information of the second type of port.
  • the information of the second type of port is, for example, the port number of the port belonging to the second type of port.
  • the first network element can compare whether the ports of the first type belong to the ports of the second type, thereby analyzing whether the first ME host has opened an unauthorized port, thereby determining whether the ports in the ME host are abnormal.
  • first type of ports may include ports belonging to the first state, and may also include ports belonging to the second state, which is not limited in this embodiment of the present application.
  • the first network element may determine the risk status of the first ME host by comparing the ports of the first type with the ports of the second type when determining that the ports of the first type include ports belonging to the second state.
  • the risk status of the first ME host determined in this way is that the possibility that the first ME host has a security risk is higher.
  • the number of times the first network element determines that the port is abnormal can be relatively reduced, thereby reducing the processing amount of the first network element.
  • the second resource includes hardware and software.
  • the first network element determines that at least one of hardware and software is abnormal, then the first network element determines that the first ME host has a risk of being invaded. If the first network element determines that both the hardware and the software are normal, the first network element determines that the first ME host does not have a risk of being invaded.
  • the methods for determining whether the hardware is abnormal and whether the software is abnormal can be referred to above, and will not be listed here.
  • the information of the first ME host includes the second information
  • the first network element determines the risk status of the first ME host according to the second information
  • the first network element determines whether the behavior corresponding to the second information is abnormal, and then determines the risk status of the first ME host. If the behavior corresponding to the second information is abnormal, the first network element determines that the risk status is that the first ME host has a risk of being invaded. If the behavior corresponding to the second information is normal, it is determined that the risk status is that the mobile edge host does not have a risk of being invaded.
  • the first network element may be preconfigured with at least one abnormal behavior. If the first network element determines that the behavior corresponding to the second information belongs to at least one abnormal behavior, then the first network element determines that the first ME host has a risk of being invaded. If the first network element determines that the behavior corresponding to the second information does not belong to at least one abnormal behavior, then the first network element determines that the first ME host does not have a risk of being invaded.
  • the first network element For example, if the first network element is pre-configured with at least one abnormal behavior including pods (pods) accessing containers that are not managed by the pod, this is an abnormal behavior. If the first network element determines that the pod has accessed a container that is not managed by the pod according to the second information, the first network element determines that the behavior of the first ME host is abnormal, and then determines that the risk status of the first ME host is present risk of being hacked.
  • pods pods
  • Method 2 The fourth network element is used as the subject of risk investigation, and the first network element determines whether the third resource requested by the access request sent by the fourth network element satisfies the first condition based on the information of the first ME host, and then determines whether the first The risk status of the ME host. If the third resource satisfies the first condition, it means that the access request is legal, then it means that the fourth network element sending the access request has no risk, or the probability of risk is less than the third probability, and correspondingly, determine the risk status as the first There is no risk of the ME host being invaded.
  • the third resource does not meet the first condition, it means that the access request is illegal, then it means that the fourth network element sending the access request has a risk, or the probability of the risk is greater than or equal to the fourth probability, and correspondingly, determine the risk status There is a risk that the first ME host is invaded by the fourth network element.
  • the fourth network element may send an access request to the first network element.
  • the access request is used to request access to the third resource of the ME host.
  • the fourth network element may not know the resources that the first ME host can provide, or in the case of the fourth network element being invaded, so although the fourth network element wants to request the resources of the first ME host, However, some or all of the third resources actually requested by the fourth network element may be resources that cannot be provided by the first ME host, that is, some or all of the third resources may not belong to the first resource . Of course, all the third resources may also belong to the first resources.
  • the first condition includes one or more of the following 1 to 3.
  • the third resource belongs to the resources available in the first ME host.
  • the information of the first ME host includes first information, and the first information includes usage information of each type of resource among one or more types, specifically, for example, the first information includes one of the first resources or available status information for each type of resource of multiple types. Then the first network element determines available resources in the first ME host according to the first information. In this case, the first network element may determine the resources available in the first ME host according to usage information of each type of resource of one or more types. Furthermore, the first network element may determine whether the third resource belongs to the resources available in the first ME host.
  • the quantity of resources included in the third resource does not exceed the upper limit of resource quantity, which is determined according to the information of the first ME host.
  • the information of the first ME host includes first information, and the first information includes usage progress information of the first resource and an identifier of the first resource. Then the first network element may determine the information of the currently unused resources in the first ME host according to the first information, and determine the upper limit of the number of resources as the number of currently unused resources of the first ME host. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.
  • the information of the first ME host includes first information and second information
  • the first information includes the quantity of the first resource
  • the second information includes information about resources of the first ME host requested by one or more historical access requests.
  • the first network element excludes resources that have been requested to be accessed by historical access requests from the first resources, thereby determining information about resources that are not currently used by the first ME host, And the upper limit of the resource quantity is determined as the quantity of resources not currently used by the first ME host.
  • the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.
  • the information of the first ME host includes first information, and the first information includes the quantity of the first resource.
  • the first network element may determine the upper limit of the resource quantity as the quantity of the first resource. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.
  • the information of the first ME host includes second information
  • the second information includes information about resources of the first ME host requested by one or more historical access requests.
  • the first network element determines the first historical access request that requests the largest number of resources among the one or more historical access requests, and determines the upper limit of the number of resources as the resource requested by the first historical access request the number of resources. Furthermore, the first network element may determine whether the third resource exceeds the upper limit of the resource quantity.
  • each type of resource may also have a corresponding upper limit on the number of resources.
  • the upper limit on the number of resources corresponding to each type of resource refer to the foregoing.
  • the third resource belongs to the first resource, and belongs to resources in the first ME host whose importance is lower than the preset importance.
  • the information of the first ME host includes first information, and the first information includes the importance of the first resource.
  • the first network element may determine whether the third resource belongs to resources in the first ME host whose importance is lower than a preset importance.
  • the preset importance can be preconfigured in the first network element.
  • the first network element may configure different first conditions for different access requests, and an example is introduced below.
  • the access request is a port opening request.
  • the port opening request is used to apply for opening the port of the first ME host.
  • the port for which the port opening request applies for opening is the third resource.
  • the first network element may determine whether the third resource belongs to the resources available in the first ME host, and if the third resource belongs to the resources available in the first ME host, Then the first network element determines that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is no risk of intrusion. If part or all of the third resource does not belong to the resources available in the first ME host, the first network element determines that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is a risk of being invaded .
  • the first network element may determine whether the third resource belongs to the resources available in the first ME host, and determine whether the third resource Whether the resource limit is exceeded. If the third resource belongs to the resources available in the first ME host, and the quantity of the third resource exceeds the upper limit of the resource quantity, the first network element determines that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is not There is a risk of being hacked.
  • the first network element determines that the third resource does not meet the first condition, thereby determining the risk of the first ME host The status is at risk of being compromised.
  • the access request is a request for instantiating an application.
  • the instantiated application request is used to request resources in the first ME host to deploy corresponding ME APP.
  • the resource requested by the instantiation application request is the third resource.
  • the first network element may determine whether the quantity of the third resource exceeds the upper limit of resource quantity. If the third resource includes multiple types of resources, if none of the multiple types of resources in the third resource exceeds the upper limit of the number of resources of the corresponding type, it is determined that the third resource satisfies the first condition, thereby determining the risk of the first ME host The status is not at risk of being compromised. If the first network element determines that the quantity of at least one type of resource in the third resource exceeds the upper limit of the resource quantity of this type, then determine that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is present risk of being hacked.
  • the first network element may determine whether the number of the third resource exceeds the upper limit of the number of resources, determine whether the third resource belongs to the first ME The resources available in the host. If the third resource includes multiple types of resources, if the multiple types of resources in the third resource do not exceed the upper limit of the number of resources of the corresponding type, and the third resource belongs to the resources available to the first ME host, then determine the third resource The first condition is met, so it is determined that the risk status of the first ME host is no risk of intrusion.
  • the first condition is to determine that the risk status of the first ME host is a risk of being invaded.
  • the access request is a resource deletion request.
  • the resource deletion request is used to request to delete resources in the first ME host.
  • the resource requested to be deleted by the resource deletion request is the third resource.
  • the first network element determines whether the third resource belongs to the resources of the first ME host whose importance is lower than the preset importance. If the third resource belongs to a resource whose importance level is lower than a preset importance level in the first ME host, it is determined that the third resource satisfies the first condition, thereby determining that the risk status of the first ME host is no risk of intrusion. If the third resource belongs to a resource whose importance is higher than a preset importance in the first ME host, it is determined that the third resource does not meet the first condition, thereby determining that the risk status of the first ME host is a risk of intrusion.
  • the access request is a VM creation request.
  • the VM creation request is used to request to create a VM in the first ME host, and the VM requested by the VM request is regarded as a third resource. If the first condition includes that the resource quantity upper limit is not exceeded, then the third network element determines whether the third resource satisfies the first condition. For a manner of determining whether the third resource satisfies the first condition, reference may be made to the content discussed above.
  • the information of the first ME host includes first information and second information
  • the first network element determines the risk status of the first ME host according to the first information and the second information.
  • the second resource is abnormal, and it is determined that the behavior corresponding to the second information is abnormal, it is determined that the risk status is that the first ME host has a risk of being invaded. If the first network element determines that the second resource is normal and/or the behavior corresponding to the second information is normal, it is determined that the risk status is that the first ME host does not have a risk of being invaded. For the manner of determining whether the second resource is abnormal, refer to the foregoing, and for the manner of determining whether the behavior corresponding to the second information is abnormal, refer to the foregoing.
  • the first network element determines that the first ME host has a risk of being invaded only when it is determined that the second resource is abnormal and the behavior corresponding to the second information is abnormal, which reduces the risk of the second
  • the risk status of a ME host is misjudged as a situation where there is a security risk, so that the determined risk status of the first ME host is more reliable.
  • both of the first method and the second method above take an example in which the first network element directly determines the risk status of the first ME host. But in fact, the first network element can obtain the risk status of the first ME host from other network elements.
  • the other network element is, for example, the OSS or MEO shown in FIG. 1A or FIG. 1B .
  • the sixth network element may determine the risk status of the first ME host by using the first ME host as a subject of risk investigation.
  • the sixth network element may also use the first ME host as a risk investigation subject to determine the risk status of the first ME host.
  • the first network element may send the information of the first ME host to the sixth network element.
  • the sixth network element determines the risk status of the first ME host according to the information of the first ME host.
  • the method for determining the risk state by the sixth network element may refer to the method for determining the risk state by the first network element above, and will not be listed here.
  • the sixth network element may send the risk status to the first network element.
  • the first network element receives the risk status from the sixth network element.
  • the first network element is an MEPM
  • the MEPM receives the information of the first ME host
  • the MEPM determines that the risk status of the first ME host cannot be determined according to the information of the ME host
  • the The information is sent to the sixth network element. Since the sixth network element can acquire more information about ME hosts, the sixth network element can determine the Risk status of the first ME host.
  • the first network element determines a resource policy according to the risk state.
  • the resource policy is used to indicate a policy for accessing resources provided by the first ME host.
  • the first network element may prestore different risk states and resource policies corresponding to each risk state. After the first network element determines the risk status of the first ME host, it may determine a resource policy corresponding to the risk status of the first ME host. And send the resource policy to the fifth network element, so that the fifth network element can access the resource in the first ME host according to the resource policy.
  • the fifth network element is, for example, the ME host, MEPM, VIM, or CISM in FIG. 1A or FIG. 1B .
  • the risk investigation subject selected by the first ME host is different, the method of determining the risk status is different, and the determined risk status is different, and the resource strategy determined by the first network element is also different. The following will introduce the situation.
  • the first network element takes the first ME host as the subject of risk investigation, use the sub-implementation method 1 of the first implementation method of the above method 1 to determine the risk status of the first ME host as the risk of the first ME host being intruded , then the first network element determines that the resource policy is to deactivate the first ME host, or lower the security level of the first ME host. If it is determined that the risk state of the ME host is that there is no risk of the ME host being intruded, the first network element determines that the resource policy is empty. The resource policy being empty may mean that the currently used resource policy for accessing the ME host is not changed.
  • deactivating the first ME host includes shutting down the first ME host, or deleting the first ME host from the resource pool.
  • the resource pool includes multiple ME hosts managed by the fifth network element.
  • Each security level corresponds to the application with the highest priority that it can support deployment.
  • the security level of the first ME host is 1, and the highest priority of the application that the first ME host can support deployment is 3, that is, The first ME host can support the deployment of applications with a priority of 3 and a priority lower than 3.
  • the security level of the first ME host is 2, and the highest priority of the first ME host that can support the deployment of applications is 4, that is, the first ME host can deploy applications with a priority of 4 or less than 4 application.
  • a larger value of the security level indicates that the first ME host is more secure, and a larger value of the application priority indicates a higher priority of the application.
  • the first ME host does not support the deployment of applications with a higher priority than the first priority.
  • the first priority is that the security level of the first ME host is the The highest priority of applications that can be supported for deployment in the case of the first security level.
  • the priority of each application may be preconfigured in the fifth network element, and the highest priority of the application supported for deployment corresponding to each security level may also be preconfigured in the fifth network element.
  • the first network element determines that the resource policy includes at least one of closing the one or more ports and disabling the ME host, or the first network element determines that the resource policy includes closing the one or multiple ports and lowering the security level of the ME host, or the first network element determines that the resource policy is at least one of deactivating the ME host and lowering the security level of the ME host.
  • the first network element determines that the resource policy is empty.
  • the meaning of the resource policy being empty can be referred to above.
  • deactivating the first ME host and lowering the security level of the first ME host please refer to the above.
  • the first network element determines that the resource policy includes stopping Use the ME host, or, lower the security level of the first ME host. If it is determined that the risk status of the first ME host is that the first ME host has no risk of being invaded, it is determined that the resource policy is empty.
  • the meaning of the resource policy being empty can be referred to above. For the meaning or specific implementation of deactivating the first ME host and lowering the security level of the first ME host, reference may be made to the foregoing.
  • the first network element takes the fourth network element as the subject of risk investigation, adopt the above method 2 to determine that the risk status of the first ME host is that the first ME host has the risk of being invaded by the fourth network element, and the first network element determines that the The resource policy is to deny access to the third resource. If the first network element adopts the above method 2 and determines that the risk status of the first ME host is that the first ME host does not have the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to allow access to the third resource.
  • the third resource please refer to the above.
  • the first ME host may be the main body of risk investigation
  • the fourth network element may be the main body of risk investigation. Examples are introduced below.
  • the first network element determines that the resource policy includes disabling the ME host or lowering the security level of the ME host. Or the first network element determines that the resource policy also includes closing one or more ports. If it is determined that the first ME host does not have the risk of being invaded, the first network element determines that the resource policy is empty.
  • the first network element determines that the resource policy includes denying access to the third resource. If it is determined that the first ME host does not have the risk of being invaded by the fourth network element, the first network element determines that the resource policy is to allow access to the third resource.
  • the first network element sends the resource policy to the fifth network element.
  • the fifth network element receives the resource policy from the first network element.
  • the resource policy is used to indicate a policy for accessing resources provided by the first ME host.
  • the fifth network element is the first ME host, VIM or CISM, then the fifth network element can access resources in the ME host according to the resource policy.
  • the MEPM can forward the resource policy to the first ME host, VIM or CISM, and so on.
  • the fifth network element may be specifically a different network element, and an example is introduced below.
  • the fifth network element may be the first ME host.
  • the first network element may send the resource policy to the first ME host.
  • the first ME host closes the first or multiple ports according to the resource policy.
  • the fifth network element can be a VIM or a CISM.
  • the first network element may send the resource policy to the VIM or the CISM.
  • the VIM or CISM deactivates the first ME host, or lowers the security level of the first ME host.
  • the fifth network element is the first ME host, VIM or CISM.
  • the first network element sends the resource policy to the first ME host, VIM or CISM.
  • the first ME host, VIM or CISM denies access to the third resource.
  • the fifth network element is the first ME host, VIM or CISM.
  • the first network element sends the resource policy to the first ME host, VIM or CISM.
  • the first ME host, VIM or CISM allows access to this third resource.
  • S205 in FIG. 2 is an optional step. This optional step is illustrated in dashed lines in FIG. 2 .
  • the first network element can determine the risk status of the first ME host according to the information of the first ME host, so as to provide a mechanism for determining the risk status of the first ME host. Since this embodiment considers possible security risks inside the first ME host, the security of the MEC architecture can be improved. Moreover, according to the risk status of the ME host, the resource policy of the ME host is determined, so as to reduce the security risk of the ME host in time and improve the security of the MEC architecture. Moreover, in the embodiment shown in FIG. 2 , multiple ways of determining the risk status of the first ME host are provided, and multiple resource strategies for dealing with the risk status of the first ME host are provided.
  • the first NE is MEPM
  • the second NE is the first ME host
  • the third NE is OSS
  • the fifth NE is VIM.
  • Implementation mode 1 taking determining the risk state of the ME host as an example, introduces the interaction process between various network elements.
  • FIG. 3 it is a schematic flow chart of the resource access method provided by the embodiment of the present application.
  • the first ME host determines a first identifier.
  • any one of the one or more ME hosts in the MEC architecture is taken as the first ME host as an example for introduction.
  • the first ME host sends the first identifier to the MEPM.
  • the MEPM receives the first identifier from the first ME host.
  • the MEPM determines that the first identifier does not match the prestored second identifier.
  • the first identification does not match the second identification as an example for introduction, and the situation of the first identification matching the second identification can refer to the content discussed above.
  • the MEPM sends a first request to the OSS through the MEO.
  • the OSS receives the first request from the MEPM through the MEO.
  • the first request is used to request to acquire the second identification of the second hardware.
  • the second hardware and the third identification please refer to the above.
  • S304 includes S304a, that is, the MEPM sends the first request to the MEO, and includes S304b, that is, the MEO sends the first request to the OSS.
  • the MEPM sends the first request to the OSS through the MEO as an example for introduction, but in fact, the MEPM may also directly send the first request to the OSS.
  • the OSS sends the third identifier to the MEPM through the MEO.
  • the MEPM receives the third identifier from the OSS through the MEO.
  • the OSS sends the third identifier to the MEPM through the MEO as an example for introduction, but in fact, the OSS may also directly send the third identifier to the MEPM.
  • S305 includes S305a, that is, the OSS sends the third identifier to the MEO, and includes S305b, that is, the MEO sends the third identifier to the MEPM.
  • the MEPM determines that the third identifier does not match the first identifier.
  • the MEPM may execute S303 first, and then execute S306.
  • MEPM can also execute S303 and S306 at the same time.
  • the MEPM may also execute S306 first, and then execute S303, which is not specifically limited in this embodiment of the present application.
  • the MEPM determines that the risk status of the first ME host is that the first ME host has a risk of being invaded.
  • the MEPM determines that the resource policy is to lower the security level of the first ME host.
  • the resource policy is to lower the security level of the first ME host as an example for illustration.
  • the MEPM sends the resource policy to the VIM.
  • the VIM receives the resource policy from the MEPM.
  • the VIM sends a stop instruction to the first ME host.
  • the first ME host receives the stop instruction from the VIM.
  • the stop instruction is used to instruct to stop the first application running on the first ME host whose priority is higher than the preset priority. After receiving the stop instruction, the first ME host can stop running the first application.
  • the application whose priority on the first ME host is higher than the preset priority is taken as the first application as an example for illustration.
  • the VIM determines to deploy the first application on the second ME host.
  • the VIM migrates and deploys the first application with too high priority running on the first ME host to the second ME host, and runs the first application on the second ME host, so as to ensure the security of the data of the first application.
  • the second ME host is used as an example to introduce the ME host whose security level is higher than that of the first ME host.
  • S309-S311 are optional steps, and these optional steps are indicated by dotted lines in FIG. 3 .
  • the MEPM can analyze whether the hardware in the first ME host is abnormal according to the change of the hardware identification of the first ME host, thereby determining whether the first ME host has a risk of being invaded, providing A mechanism for determining the risk status of a first ME host is provided. Moreover, if the hardware in the first ME host is abnormal, the VIM will lower the security level of the first ME host to ensure that applications with higher priority can always be deployed on the ME host with higher security level and ensure higher priority The stability of the application operation.
  • the first network element is MEPM
  • the third network element is OSS
  • the second network element and the fifth network element are both the first ME host as an example
  • the first network element is implemented according to the first implementation mode above Method 2, taking determining the risk status of the ME host as an example, introduces the interaction process between various network elements.
  • FIG. 4 it is a schematic flowchart of a resource access method provided in the embodiment of the present application.
  • the OSS acquires a port opening request.
  • the OSS can receive a port opening request from an external network element, which is equivalent to obtaining the port opening request.
  • the port opening request and the meaning of the external network element can be referred to above.
  • the OSS can generate a port opening request according to the user's port opening operation, which is equivalent to obtaining the port opening request.
  • the OSS records information about the port requested to be opened by the port opening request.
  • the OSS obtains the port opening request, and records the information of the port requested to be opened by the port opening request, where the port information is, for example, a port number.
  • the OSS can obtain the information of the second type of port in the first ME host.
  • the meaning of the second type of port please refer to the previous section.
  • S401-S402 is an example of how the OSS obtains the information of the second type of port in the first ME host. In fact, there are many ways for the OSS to obtain the information of the second type of port. This application implements Examples are not limited to this.
  • the first ME host determines the information of the first type of port in the first ME host.
  • the first ME host detects all the ports currently opened by itself, so as to obtain the information of the first type of ports.
  • the meaning of the first type of port please refer to the previous section.
  • the first ME host sends the information of the first type of port to the MEPM.
  • the MEPM receives the information of the first type of port from the first ME host.
  • the MEPM sends a second request to the OSS.
  • the OSS receives the second request from the MEPM.
  • the second request is used to request information about ports that have been applied to the first ME host for opening.
  • the OSS sends the information of the second type of port to the MEPM.
  • the MEPM sends the information of the second type of port to the OSS.
  • the OSS sends the information of the second-type port to the MEPM as an example, and the actual OSS may also send the information of the second-type port to the MEPM through the MEO.
  • the MEPM determines that the risk state of the first ME host is that the first ME host has a risk of being invaded.
  • the MEPM determines that the resource policy is to close one or more ports.
  • the MEPM sends the resource policy to the first ME host.
  • the first ME host receives the resource policy from the MEPM.
  • the first ME host closes the first or multiple ports.
  • the first ME host sends a shutdown success response to the MEPM.
  • the MEPM receives the shutdown success response from the first ME host.
  • the closing success response is used to indicate that the first ME host has successfully closed the first or multiple ports.
  • S409-S411 are optional steps. These optional steps are illustrated in dashed lines in FIG. 4 .
  • MEPM can judge whether the ports of the first type belong to the ports of the second type to determine whether there are unauthorized but opened ports in the first ME host.
  • the port indicates that the first ME host is abnormal, so the MEPM determines that the first ME host has a risk of being invaded, and provides a mechanism for determining the security risk of the first ME host.
  • the first ME host closes these ports to reduce the risk of the first ME host in a timely and targeted manner and improve the security of the first ME host.
  • the first network element is MEPM
  • the second network element is ME host
  • the third network element is OSS
  • the fifth network element is VIM.
  • the first network element determines the ME host according to the second implementation method. Taking the risk status as an example, the interaction process between each network element is introduced. As shown in FIG. 5 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.
  • the first ME host sends second information to the MEPM.
  • the MEPM receives the second information from the first ME host.
  • the meaning of the second information can be referred to above.
  • the MEPM determines that the behavior corresponding to the second information of the VIM is abnormal, and determines that the risk status of the first ME host is that the first ME host has a risk of being invaded.
  • S502 is an example where the MEPM determines the risk status of the first ME host.
  • the MEPM may send the second information to the OSS, and the OSS determines the risk status of the first ME host.
  • the MEPM receives the risk status of the first ME host from the OSS.
  • the OSS is equivalent to an instance of the sixth network element, and in this case, it is equivalent to the MEPM adopting the third method above to determine the risk status of the first ME host.
  • S502 is represented by a double arrow line, and the double arrow indicates that the MEPM can receive the risk status of the first ME host from the OSS.
  • the MEPM determines that the resource policy is to disable the first ME host.
  • the MEPM sends the resource policy to the VIM.
  • the VIM receives the resource policy from the MEPM.
  • the VIM removes the first ME host from the resource pool, and migrates the application deployed on the first ME host to the second ME host.
  • S504-S505 are optional steps. These optional steps are illustrated in dashed lines in FIG. 5 .
  • the MEPM determines whether the behavior of accessing the first ME host is abnormal according to the second information, and if the behavior of accessing the first ME host is abnormal, it determines that the first ME host is at risk of being invaded, providing A mechanism for the risk status of the first ME host. Moreover, if the behavior of accessing the first ME host is abnormal, the VIM will deactivate the first ME host, avoiding the paralysis of the MEC architecture due to the intrusion of the first ME host, and improving the security of the MEC architecture.
  • the first NE is MEPM
  • the second NE is the ME host
  • the fourth NE is OSS
  • the fifth NE is VIM.
  • the first NE determines the risk status of the ME host according to the above method 2. For example, taking the access request as a port opening request as an example, the interaction process between various network elements is introduced. As shown in FIG. 6 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.
  • the OSS acquires a port opening request.
  • the OSS sends a port opening request to the MEPM.
  • the MEPM receives the port opening request from the OSS.
  • the first ME host sends first information to the MEPM.
  • the MEPM receives the first information from the first ME host.
  • the first information includes information about resources available in the first ME host, and specifically includes information about ports available to the first ME host.
  • the MEPM determines that the port requested to be opened by the port opening request belongs to available resources in the first ME host, determine that the risk status of the first ME host is that the first ME host does not have a risk of being invaded by the OSS.
  • the introduction is made by taking the first condition including that the first resource belongs to available resources in the first ME host as an example.
  • the MEPM may also verify whether the port requested by the port opening request belongs to the first type of port, and the meaning of the first type of port can be referred to above. If the port requested by the port opening request belongs to the first type of port, steps S605-S607 do not need to be performed. If the port requested by the port opening request does not belong to the first type of port, continue to perform subsequent steps.
  • the MEPM determines that the resource policy is to allow opening of the port requested by the port opening request.
  • the MEPM sends the resource policy to the first ME host.
  • the first ME host receives the resource policy from the MEPM.
  • the first ME host opens the port requested by the open port request.
  • S606-S607 are optional steps. These optional steps are illustrated in dashed lines in FIG. 6 .
  • the MEPM after the MEPM receives the port opening request, it determines whether the port requested by the port opening request belongs to the information of the port available to the first ME host, and if it does, determines that the first ME host does not exist and is used by the second ME host.
  • the risk of four network element intrusions provides a mechanism to determine the possible security risks of ME hosts.
  • the embodiment of the present application verifies the port opening request, thereby avoiding illegal opening of unusable ports, improving the security of the first ME host, thereby improving the security of the MEC architecture.
  • the first NE is MEPM
  • the second NE is the ME host
  • the fourth NE is OSS
  • the fifth NE is VIM.
  • the first NE determines the risk status of the ME host according to the above method 2.
  • taking an access request as an instantiated application request as an example the interaction process between various network elements is introduced.
  • FIG. 7 it is a schematic flow chart of the resource access method provided by the embodiment of the present application.
  • the OSS sends an application instantiation request to the MEPM through the MEO.
  • the MEPM receives the application instantiation request from the OSS through the MEO.
  • the meaning of the instantiated application can be referred to above.
  • S701 includes S701a, that is, the OSS sends an application instantiation request to the MEO, and S701b, that is, the MEO sends the application instantiation request to the MEPM.
  • the first ME host sends the information of the first host to the MEPM.
  • the MEPM receives the information of the first host from the first ME host.
  • the MEPM determines that the first resource requested by the instantiated application exceeds the resource limit, determine that the risk state of the first ME host is that the first ME host has a risk of being invaded by the OSS.
  • the MEPM determines that the resource policy is denying access to the first resource.
  • the MEPM sends a first rejection response to the OSS through the MEO.
  • the OSS receives the first rejection response from the MEPM through the MEO.
  • the first rejection response is used to indicate rejection of the application instantiation request initiated by the OSS.
  • S705 includes S705a, that is, the MEPM sends the first rejection response to the MEO, and S705b, that is, the MEO sends the first rejection response to the OSS.
  • S705 is an optional step. This optional step is illustrated in dashed lines in FIG. 7 .
  • the MEPM determines whether the resource requested by the instantiation application request exceeds the upper limit of the resource quantity, and if the resource requested by the instantiation application request exceeds the upper limit of the resource quantity, determine The first ME host has a risk of being invaded by the fourth network element, and a mechanism for determining the possible security risk of the first ME host is provided. Moreover, in this embodiment, the instantiation application request can be verified, thereby avoiding situations such as illegal instantiation application requests exhausting the resources of the first ME host, improving the security of the first ME host, thereby improving the reliability of the MEC architecture. safety.
  • the first network element is MEPM
  • the second network element is ME host
  • the fourth network element is CISM
  • the fifth network element is VIM.
  • the first network element determines the risk status of ME host according to the above method 2. For example, taking an access request as a resource deletion request as an example, the interaction process between various network elements is introduced. As shown in FIG. 8 , it is a schematic flowchart of a resource access method provided in the embodiment of the present application.
  • the CISM sends a resource deletion request to the MEPM.
  • the MEPM receives the resource deletion request from the CISM.
  • the first ME host sends information about the first ME host to the MEPM.
  • the MEPM determines that the importance of the first resource requested to be deleted by the resource deletion request is higher than the preset importance, determine that the risk status of the first ME host is that the first ME host has a risk of being invaded by the CISM.
  • the MEPM determines that the resource policy is to refuse to delete the first resource.
  • the MEPM sends a second rejection response to the CISM.
  • the CISM receives the second rejection response from the MEPM.
  • the second rejection response is used to reject the resource deletion request.
  • S805 is an optional step. These optional steps are illustrated in dashed lines in FIG. 8 .
  • the MEPM determines whether the importance of the resource deleted requested by the resource deletion request is lower than the preset importance level, if the resource deleted requested by the resource deletion request The importance degree is higher than the preset importance degree, and it is determined that the first ME host has a risk of being invaded by the fourth network element, and a mechanism for determining whether the first ME host has a security risk is provided.
  • the resource deletion request can be verified, thereby avoiding illegal resource deletion requests from deleting important resources of the first ME host, improving the security of the first ME host, thereby improving the security of the MEC architecture.
  • the first network element is MEPM
  • the second network element is ME host
  • the fourth network element is CISM
  • the fifth network element is VIM.
  • the first network element determines the risk status of ME host according to the above method 2. For example, taking the access request as a VM creation request as an example, the interaction process between various network elements is introduced. As shown in FIG. 9 , it is a schematic flow chart of the resource access method provided by the embodiment of the present application.
  • the CISM sends a VM creation request to the MEPM.
  • the MEPM receives the VM creation request from the CISM.
  • the meaning of the VM creation request can be referred to above.
  • the first ME host sends information about the first ME host to the MEPM.
  • the MEPM receives the information of the first ME host from the first ME host.
  • the upper limit of the number of resources is the maximum number of resources requested by historical access requests.
  • the embodiment of the present application is equivalent to finding out whether the first resource requested by this VM creation request is abnormal according to the number of resources requested by historical access requests.
  • the MEPM determines that the resource policy is denying access to the first resource.
  • the MEPM sends a third rejection response to the CISM.
  • the CISM receives the third rejection response from the MEPM.
  • the third rejection response is used to reject the VM creation request.
  • S905 is an optional step.
  • S905 is indicated by a dotted line as an optional step.
  • the MEPM After the MEPM receives the VM creation request, it determines whether the creation resource requested by the VM creation request exceeds the upper limit of the number of resources, and if the creation resource requested by the VM creation request exceeds the upper limit of the number of resources, determine the first An ME host has a risk of being invaded by the fourth network element, and a mechanism for determining the risk status of the ME host is provided. Moreover, in this embodiment, the VM creation request can be verified, thereby avoiding that the illegal VM creation request exhausts the resources of the first ME host, or occupies a large amount of resources in the first ME host, and improves the security of the first ME host. Security, thereby improving the security of the MEC architecture.
  • Fig. 10 shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the first network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a transceiver module 1001 and a processing module 1002 .
  • the transceiver module 1001 can be used to perform the step of receiving the information of the first ME host from the second network element, and can also perform the step of sending the resource policy to the fifth network element, and can also be used to support the technology described herein other processes.
  • the transceiver module 1001 is used for the communication device to communicate with other modules, and it may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication.
  • the transceiving module 1001 may be configured to execute S202 in the embodiment shown in FIG. 2 , that is, receive the information of the first ME host from the second network element.
  • S205 in FIG. 2 may also be executed, that is, sending the resource policy to the fifth network element.
  • the processing module 1002 may be used to execute S203 and S204 in FIG. 2 .
  • the processing module 1002 includes an edge risk engine module and an edge resource policy management module (not shown in FIG. 10 ), for example, the edge risk engine module is used to execute S203; the edge resource policy management module is used to execute S204 .
  • the processing module 1002 includes a central risk engine module and a central resource policy management module (not shown in FIG. 10 ), for example, the central risk engine module is used to perform S203; the central resource policy management module is used to perform S204 .
  • Fig. 11 shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the aforementioned second network element.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a transceiver module 1101 and a processing module 1102 .
  • the processing module 1102 may be used to execute S201 in FIG. 2 , and may also be used to support other processes of the technology described herein.
  • the transceiver module 1101 is used by the communication device to communicate with other modules, which may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication.
  • the transceiver module 1101 may be configured to execute the step of sending the information of the first ME host to the first network element in the embodiment shown in FIG. 2 .
  • the processing module 1102 includes a risk awareness agent module (not shown in FIG. 11 ), for example, the risk awareness agent module is used to execute S201.
  • the processing module 1102 further includes a host policy enforcement module (not shown in FIG. 11 ), and the host policy enforcement module may be used to execute S205.
  • Fig. 12 shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the fifth network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system. In the embodiment of the present application, the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a transceiver module 1201 and a processing module 1202 .
  • the transceiver module 1201 can be used to execute the step of receiving the resource policy from the first network element in FIG. 2 , and can also be used to support other processes of the technology described herein.
  • the processing module 1202 is used by a communication device to communicate with other modules, which may be a circuit, device, interface, bus, software module, transceiver or any other device capable of realizing communication.
  • the processing module 1202 may be configured to access resources in the ME host according to a resource policy, for example, execute S310 and S311 as shown in FIG. 3 .
  • the processing module 1202 includes a resource policy execution module (not shown in FIG. 12 ), the resource policy execution module is used for resources in the ME host according to the resource policy.
  • An embodiment of the present application also provides a communication system, and the communication system may include devices as shown in FIG. 10 and FIG. 11 .
  • the communication system further includes an apparatus as shown in FIG. 12 .
  • FIG. 13A shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the first network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be realized by a chip system.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the communication device may include an edge risk engine module 1301 and an edge resource policy management module 1302.
  • the edge risk engine module 1301 is used to receive the information of the first ME host from the second network element, and S203; the edge resource policy The management module 1302 is configured to execute S204.
  • Fig. 13B shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the first network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a central risk engine module 1303 and a central resource policy management module 1304.
  • the central risk engine module 1303 is used to receive the first ME host information from the second network element, and S203; the central resource policy The management module 1304 is configured to execute S204.
  • Fig. 14 shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the fifth network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a risk awareness agent module 1401, for example, the risk awareness agent module 1401 is configured to perform S201.
  • the communication device may further include a host policy execution module 1402, which is configured to access resources in the ME host according to resource policies.
  • a host policy execution module 1402 is indicated by a dotted line box, which is optional.
  • Fig. 15 shows a schematic structural diagram of a communication device.
  • the communication device can realize the function of the fifth network element mentioned above.
  • the communication device may be a hardware structure, a software module, or a hardware structure plus a software module.
  • the communication device can be implemented by a chip system.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device may include a resource policy execution module 1501, and the resource policy execution module 1501 may be used to access resources in the ME host according to the resource policy.
  • Fig. 10, Fig. 11, Fig. 12, Fig. 13A, Fig. 13B, Fig. 14 and Fig. 15 are schematic for the division of modules, which are only a logical function division, and there may be other division methods in actual implementation.
  • Each functional module in each embodiment of the present application may be integrated into one processor, or physically exist separately, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.
  • An embodiment of the present application provides a communication system, and the communication system may include devices as shown in FIG. 13A and FIG. 14 .
  • the communication system further includes an apparatus as shown in FIG. 15 .
  • An embodiment of the present application provides a communication system, and the communication system may include devices as shown in FIG. 13B and FIG. 14 .
  • the communication system further includes an apparatus as shown in FIG. 15 .
  • Figure 16 is a schematic diagram of deploying the communication devices shown in Figure 13A, Figure 13B, Figure 14 and Figure 15 in the MEC architecture shown in Figure 1A provided by the embodiment of this application, or it can be understood as this A schematic structural diagram of a communication system provided in an embodiment of the application.
  • OSS includes a central risk engine module and a central policy management module
  • MEPM includes an edge risk engine module and edge resource policy management
  • ME host includes a risk-aware agent module and a host policy Execution module
  • the VIM (as an example of the fifth network element) includes a policy enforcement module.
  • the fourth network element may be the OSS and/or VIM in FIG. 16 .
  • the function of each module in Fig. 16 can refer to the above.
  • a service policy execution module is deployed in the MEP in the ME host, and the service policy execution module is used to receive the service policy sent by the MEPM and execute corresponding services.
  • the risk awareness agent module may communicate with the MEPM through the interface Mm12, for example, the risk awareness agent module sends information about the ME host to the MEPM through Mm12.
  • the risk awareness agent module sends information about the ME host to the MEPM through Mm12.
  • the host policy enforcement module in the VIM can communicate with the MEPM through the interface Mm13, for example, the MEPM can send resource policies to the host policy enforcement module in the VIM through Mm12.
  • the meaning of the resource policy can refer to the above.
  • the edge risk engine module in MEPM when it cannot determine the risk status of the ME host according to the information of the ME host, it can send the information of the ME host to OSS, and the central risk engine module can information, determine the risk status of the ME host, and determine the resource policy of the ME host by the central policy management module.
  • FIG. 16 the newly added modules in FIG. 1A are shown in dotted boxes, and the functions of each network element or interface in FIG. 16 can refer to the content discussed in FIG. 1A .
  • FIG. 17 is another schematic diagram of deploying the communication devices shown in FIG. 13A, FIG. 13B, FIG. 14 and FIG. 15 in the MEC architecture shown in FIG. 1B provided by the embodiment of this application, or it can be understood as A schematic structural diagram of a communication system provided in an embodiment of the present application.
  • OSS (as an example of the third network element) includes a central risk engine module and a central policy management module;
  • MEPM (as an example of the first network element) includes an edge risk engine module and an edge resource policy Management;
  • ME host (an example of the second network element) includes a risk awareness agent module and a host policy execution module;
  • VIM (as an example of the fifth network element) includes a policy execution module;
  • CISM (as the fifth network element One example) includes a policy enforcement module.
  • the fourth network element may be one or more of the OSS, CISM, or VIM in FIG. 17 .
  • a service policy execution module may also be deployed in the MEP in the ME host, and the function of the service policy execution module may refer to the foregoing.
  • the resource policy execution module in the CISM can communicate with the container engine in the ME host through Mm14 to manage the running status of the container.
  • the resource policy execution module in the CISM can communicate with the MEPM through Mm15, for example, the MEPM can send the resource policy to the CISM through Mm15.
  • the edge risk engine module in MEPM when it cannot determine the risk status of the ME host according to the information of the ME host, it can send the information of the ME host to OSS, and the central risk engine module can information, determine the risk status of the ME host, and determine the resource policy of the ME host by the central policy management module.
  • FIG. 18 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a first network element, or be capable of implementing functions of the first network element.
  • the communication device may be a system on a chip.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device includes at least one processor 1801, configured to implement or support the communication device to implement the functions of the first network element in FIG. 2 to FIG. 9 .
  • the processor 1801 can determine the risk status of the ME host according to the information of the ME host, and determine the resource policy according to the risk status of the ME host. For details, refer to the detailed description in the method example, and details are not repeated here.
  • the communication device may also include an interface 1802 for communicating with other devices through a transmission medium, so that the communication device communicates with other devices.
  • the other device may be a server.
  • the processor 1801 can use the interface 1802 to send and receive data.
  • the communication device may also include at least one memory 1803 for storing program instructions and/or data.
  • the memory 1803 is coupled to the processor 1801.
  • the coupling in the embodiments of the present application is an indirect coupling or a communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • the processor 1801 may cooperate with the memory 1803 .
  • Processor 1801 may execute program instructions stored in memory 1803 . At least one of the at least one memory 1803 may be included in the processor 1801 .
  • any resource access method in the embodiments shown in FIG. 2 to FIG. 9 may be implemented.
  • the memory 1803 in FIG. 18 is an optional part, which is indicated by a dashed box in FIG. 18 .
  • the memory 1803 is coupled with the processor 1801.
  • the embodiment of the present application does not limit the specific connection medium among the interface 1802, the processor 1801, and the memory 1803.
  • the interface 1802, the processor 1801, and the memory 1803 are connected through a bus.
  • the bus is represented by a thick line in FIG. Do not limit yourself.
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 18 , but it does not mean that there is only one bus or one type of bus.
  • the processor 1801 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement Or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.
  • a general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be implemented by a hardware processor, or by a combination of hardware and software modules in the processor.
  • the memory 1803 may be a non-volatile memory, such as a hard disk (hard disk drive, HDD) or a solid-state drive (solid-state drive, SSD), etc., and may also be a volatile memory (volatile memory), For example random-access memory (random-access memory, RAM).
  • a memory is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.
  • FIG. 19 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a second network element, or be capable of implementing a function of the second network element.
  • the communication device may be a system on a chip.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device includes at least one processor 1901, configured to implement or support the communication device to implement the functions of the second network element in FIG. 2 of this application, or implement the functions of the second network element in FIGS. 2 to 9 .
  • the processor 1901 may obtain the information of the ME host, for details, refer to the detailed description in the method example, and details are not repeated here.
  • the communications device may further include an interface 1902 .
  • the communication device further includes a memory 1903, which is indicated by a dashed box in FIG. 19 as an optional part.
  • FIG. 20 is a schematic structural diagram of a communication device provided by an embodiment of the present application, where the communication device may be a second network element, or be capable of implementing a function of the second network element.
  • the communication device may be a system on a chip.
  • the system-on-a-chip may be composed of chips, or may include chips and other discrete devices.
  • the communication device includes at least one processor 2001, configured to implement or support the communication device to implement the functions of the second network element in FIG. 2 of the present application, or implement the functions of the second network element in FIGS. 2 to 9 .
  • the processor 2001 may obtain the information of the ME host, for details, refer to the detailed description in the method example, and details are not repeated here.
  • the communication device may further include an interface 2002 .
  • the communication device further includes a memory 2003, which is indicated by a dashed box in FIG. 20 as an optional part.
  • a dashed box in FIG. 20 for specific implementation manners of the processor 2001, the interface 2002, and the memory 2003, reference may be made to the foregoing.
  • An embodiment of the present application provides a chip system.
  • the chip system includes a processor and may also include an interface for implementing the first network element, the second network element, the third network element, the fourth network element, or the first network element in the foregoing method.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • An embodiment of the present application also provides a computer-readable storage medium, which is used to store a computer program, and when the computer program is run on a computer, the computer executes the computer program shown in FIGS. 2 to 9.
  • the resource access method in any one of the embodiments.
  • An embodiment of the present application also provides a computer program product, the computer program product stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the steps shown in Fig. 2 to Fig. 9 .
  • the resource access method in any one of the embodiments.
  • the methods provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, network equipment, user equipment or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL) or wireless (such as infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media.
  • the available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), optical media (for example, digital video disc (digital video disc, DVD for short)), or semiconductor media (for example, SSD).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande concerne le domaine technique des communications et est utilisée pour fournir un mécanisme de détermination d'un risque de sécurité, qui peut survenir dans un hôte de périphérie mobile (ME). L'invention concerne un procédé et un appareil d'accès à des ressources. Le procédé d'accès à des ressources comprend les étapes selon lesquelles un premier élément de réseau : reçoit des informations d'un hôte de périphérie mobile, à partir d'un deuxième élément de réseau, les informations de l'hôte de périphérie mobile comprenant des premières informations d'une ressource, qui sont fournies par l'hôte de périphérie mobile, et/ou des secondes informations qui indiquent un comportement d'accès à l'hôte de périphérie mobile ; et détermine un état de risque conformément aux informations de l'hôte de périphérie mobile, de façon à fournir un mécanisme de détermination d'un risque de sécurité de l'hôte ME. De plus, le premier élément de réseau détermine une politique de ressources, conformément à l'état de risque, et utilise la politique de ressources correspondante, de telle sorte que le risque de sécurité de l'hôte ME est réduit d'une manière opportune, et la sécurité de l'hôte ME est améliorée, ce qui permet d'améliorer la sécurité d'une architecture MEC.
PCT/CN2022/124629 2021-10-14 2022-10-11 Procédé et appareil d'accès à des ressources Ceased WO2023061366A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111198509.8A CN115987534A (zh) 2021-10-14 2021-10-14 一种资源访问方法及装置
CN202111198509.8 2021-10-14

Publications (1)

Publication Number Publication Date
WO2023061366A1 true WO2023061366A1 (fr) 2023-04-20

Family

ID=85968646

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/124629 Ceased WO2023061366A1 (fr) 2021-10-14 2022-10-11 Procédé et appareil d'accès à des ressources

Country Status (2)

Country Link
CN (1) CN115987534A (fr)
WO (1) WO2023061366A1 (fr)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170251368A1 (en) * 2016-02-25 2017-08-31 ACS (US), Inc. Platform for computing at the mobile edge
US20190042319A1 (en) * 2018-09-28 2019-02-07 Kapil Sood Mobile edge-cloud security infrastructure
CN111182551A (zh) * 2020-01-07 2020-05-19 中国联合网络通信集团有限公司 网络安全防护方法和系统
CN111614657A (zh) * 2020-05-18 2020-09-01 北京邮电大学 基于模式选择的移动边缘安全服务方法及系统
US20200288302A1 (en) * 2017-11-22 2020-09-10 Huawei Technologies Co., Ltd. Service Notification Method For Mobile Edge Host And Apparatus
US20210136716A1 (en) * 2018-07-16 2021-05-06 Huawei Technologies Co., Ltd. Mec information obtaining method and apparatus

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170251368A1 (en) * 2016-02-25 2017-08-31 ACS (US), Inc. Platform for computing at the mobile edge
US20200288302A1 (en) * 2017-11-22 2020-09-10 Huawei Technologies Co., Ltd. Service Notification Method For Mobile Edge Host And Apparatus
US20210136716A1 (en) * 2018-07-16 2021-05-06 Huawei Technologies Co., Ltd. Mec information obtaining method and apparatus
US20190042319A1 (en) * 2018-09-28 2019-02-07 Kapil Sood Mobile edge-cloud security infrastructure
CN111182551A (zh) * 2020-01-07 2020-05-19 中国联合网络通信集团有限公司 网络安全防护方法和系统
CN111614657A (zh) * 2020-05-18 2020-09-01 北京邮电大学 基于模式选择的移动边缘安全服务方法及系统

Also Published As

Publication number Publication date
CN115987534A (zh) 2023-04-18

Similar Documents

Publication Publication Date Title
CN113169975B (zh) 用于网络微分段和纳分段的安全规则的自动生成
US10977361B2 (en) Systems and methods for controlling privileged operations
CN104903910B (zh) 控制移动装置对安全数据的访问
CN105379223B (zh) 管理对企业资源的访问的方法和装置
US7890627B1 (en) Hierarchical statistical model of internet reputation
US20220070206A1 (en) Secure device selection based on sensitive content detection
JP5293580B2 (ja) ウェブサービスシステム、ウェブサービス方法及びプログラム
US20230199018A1 (en) Risk based virtual workspace delivery
CN104903861B (zh) 剪贴板管理
WO2015096695A1 (fr) Procédé, système et dispositif de commande d'installation de programme d'application
US12332995B2 (en) Containers system auditing through system call emulation
US9882921B1 (en) Systems and methods for detecting cache-poisoning attacks in networks using service discovery protocols
US11062041B2 (en) Scrubbing log files using scrubbing engines
CN115033190A (zh) 基于位置的装置可用性
CN116438895A (zh) 基于许可的网络切片选择
US12010126B2 (en) Method and system for automatically curating intrusion detection signatures for workloads based on contextual attributes in an SDDC
US20230013808A1 (en) Method and system for implementing an intent-based intrusion detection and prevention system using contextual attributes
RU2498398C2 (ru) Система и способ эффективной реализации улучшенного маршрутизаторного устройства
US20230021269A1 (en) Method and system for implementing intrusion detection signatures curated for workloads based on contextual attributes in an sddc
US20250211622A1 (en) Systems and methods for automatically rendering and deploying network security policies
US12095780B2 (en) Method and system for enforcing intrusion detection signatures curated for workloads based on contextual attributes in an SDDC
US20220374255A1 (en) Configuration techniques for managed virtual machines
CN103309722A (zh) 一种云计算系统及其应用访问方法
WO2023061366A1 (fr) Procédé et appareil d'accès à des ressources
CN103218172A (zh) 处理存取控制信息的方法及其通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22880303

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22880303

Country of ref document: EP

Kind code of ref document: A1