Certificate acquiring method and device
A certificate acquiring method and device, where the method includes receiving a certificate application representation message sent by a newly installed virtualized network function component (VNFC) instance, sending a certificate request message to a certification authority, and acquiring a certificate issued by the certification authority. In this way, the newly installed VNFC instance does not need to use a current manner for a virtualized network function (VNF) to acquire a certificate, which effectively avoids a problem of a cumbersome and more complex process caused when the newly installed VNFC instance acquires a certificate.
1. A certificate acquiring device, comprising a hardware are processor coupled with a non-transitory storage medium storing executable instructions: wherein the executable instructions, when executed by the hardware processor, cause the certificate acquiring device to:
receive a certificate application representation message sent by a newly installed virtual network function component (VNFC) instance, wherein the certificate application representation message comprises a public key used by the newly installed VNFC instance to apply for a certificate;
send a certificate request message to a certification authority according to the certificate application representation message, to request the certification authority to issue the certificate to the newly installed VNFC instance, wherein the certificate request message comprises a certificate of a master VNFC instance and the public key used by the newly installed VNFC instance to apply for the certificate; and
acquire the certificate issued by the certification authority, wherein the certificate is issued by the certification authority using the public key used by the newly installed VNFC instance to apply for the certificate.
2. The device according to claim 1 , wherein before acquiring the certificate, the certificate acquiring device is further configured to receive a certificate response message sent by the certification authority, and further configured to perform authentication on the received certificate response message.
3. The device according to claim 2 , wherein the certificate response message comprises the certificate issued by the certification authority, and wherein the certificate acquiring device is further configured to acquire the certificate that is issued by the certification authority to the newly installed VNFC instance and that is comprised in the certificate response message, wherein the certificate of the newly installed VNFC instance is obtained by the certification authority by signing the public key that is used by the newly installed VNFC instance to apply for the certificate and that is comprised in the certificate request message after a certificate application request message sent by the master VNFC has been authenticated according to the certificate of the master VNFC instance.
4. The device according to claim 1 , wherein the certificate application representation message and the certificate request message further comprise private key proof of possession (POP) information.
5. The device according to claim 4 , wherein the POP information is obtained by the newly installed VNFC instance using a private key in a private-public key pair to sign a private key POP signing key field.
6. The device according to claim 5 , wherein the private-public key pair used by the newly installed VNFC instance is obtained in the following manner generating, by the newly installed VNFC instance, the private-public key pair.
7. The device according to claim 1 , wherein after the certificate is acquired, the certificate acquiring device is further configured to send, to the newly installed VNFC instance by means of an internal network, the acquired certificate issued by the certification authority to the newly installed VNFC instance.
8. The device according to claim 1 , wherein the master VNFC instance and the newly installed VNFC instance are different components of a same virtual network function (VNF) on a same network function virtualization infrastructure (NFVI) platform.
9. A certificate acquiring device, comprising a hardware processor coupled with a non-transitory storage medium storing executable instructions: wherein the executable instructions, when executed by the hardware processor, cause the certificate acquiring device to:
receive a certificate request message sent by a master virtual network function component (VNFC) instance, wherein the certificate request message comprises a certificate of the master VNFC instance and a public key used by a newly installed VNFC instance to apply for a certificate;
perform authentication on the certificate request message according to the certificate of the master VNFC instance;
obtain a to-be-issued certificate by signing the public key used by the newly installed VNFC instance to apply for the certificate when the authentication succeeds; and
send the to-be-issued certificate to the master VNFC instance.
10. The device according to claim 9 , wherein the certificate acquiring device is further configured to:
perform authentication on a signature of the certificate request message using the certificate of the master VNFC instance; and
perform authentication on the received certificate of the master VNFC instance using an issued root certification authority (CA) certificate or an issued intermediate certificate.
11. The device according to claim 9 , wherein the certificate request message further comprises private key proof of possession (POP) information.
12. The device according to claim 11 , wherein the certificate acquiring device is further configured to perform authentication on, by a certification authority, using the public key that is used to apply for the certificate and that is comprised in the certificate request message, the POP information comprised in the certificate request message.
13. A certificate acquiring device, comprising a hardware processor coupled with a non-transitory storage medium storing executable instructions: wherein the executable instructions, when executed by the hardware processor, cause the certificate acquiring device to:
send a certificate application representation message to a master virtualized network function component (VNFC) instance, wherein the certificate application representation message comprises a public key used by a newly installed VNFC instance to apply for a certificate, wherein the certificate application representation message is used to request the master VNFC instance to send a certificate request message to a certification authority, wherein the certificate request message is used to request the certification authority to issue the certificate to the newly installed VNFC instance, and wherein the certificate request message comprises a certificate of the master VNFC instance and the public key used by the newly installed VNFC instance to apply for the certificate; and
receive the certificate that is issued by the certification authority and that is sent by the master VNFC instance, wherein the certificate is obtained by the certification authority by signing the public key used by the newly installed VNFC instance to apply for the certificate.
14. The device according to claim 13 , wherein before the certificate application representation message is sent to the master VNFC, the certificate acquiring device is further configured to receive certificate application information sent by a network function virtualization orchestrator (NFVO) or a virtualized network function manager (VNFM), wherein the certificate application information comprises information about the master VNFC instance used as an agent for certificate application.
15. The device according to claim 14 , wherein before the certificate application representation message is sent to the master VNFC, the certificate acquiring device is configured to establish, according to the certificate application information, a network connection to the master VNFC instance used as the agent for certificate application, wherein the network connection is a network connection inside a virtualized network function (VNF) on a same network function virtualization infrastructure (NFVI) platform.
16. The device according to claim 14 , wherein during installation, the certificate acquiring device is further configured to receive the certificate application information injected by a network function virtualization infrastructure (NFVI).
17. The device according to claim 14 , wherein the information about the master VNFC used as the agent for the certificate application comprises an Internet protocol (IP) address, a Media Access Control (MAC) identifier, and a virtual network information center (NIC) address that are of the master VNFC instance.
18. The device according to claim 13 , wherein the public key used by the newly installed VNFC instance to apply for the certificate is obtained in the following manner generating, by the newly installed VNFC instance, a private-public key pair.
19. The device according to claim 13 , wherein a manner for triggering the newly installed VNFC instance to send the certificate application representation message to the master VNFC instance comprises triggering by means of virtualized network function (VNF) instantiation.
20. The device according to claim 13 , wherein a manner for triggering the newly installed VNFC instance to send the certificate application representation message to the master VNFC instance comprises triggering by means of virtualized network function (VNF) scale-out.