Method, system and apparatus for unified security configuration management
Methods and apparatus are disclosed for unified security configuration management. A method may comprise: determine a security configuration to be executed; determine at least one security application which is installed on at least one node and is associated with the security configuration; format for the security configuration, instructions corresponding to each of the at least one security application, respectively; and send the instructions to the at least one node for respective configuration for each of the at least one security application.
1. A method, comprising:
determining in a server a security configuration to be executed;
determining at least two different security applications which are installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols;
according to a security protocol used by each of the at least two different security applications, formatting for the security configuration, instructions corresponding to each of the at least two different security application, respectively; and
sending the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein determining at least two different security applications comprises obtaining address information of the at least one node on which the at least two different security applications are installed, and wherein the address information is obtained from a virtual network function management entity.
2. The method according to claim 1 , wherein the determining of the security configuration is triggered by the server.
3. The method according to claim 1 , wherein the determining of the security configuration is triggered in response to a request from one of the at least one node.
4. The method according to claim 1 , further comprising,
receiving a request for executing the security configuration; and
checking whether the security configuration is supported.
5. The method according to claim 1 , wherein the at least one node comprises different network slices, or different virtual network functions and virtual machines.
6. The method according to claim 1 , wherein the security configuration relates to at least one of the following: algorithms, keys, parameter for algorithms, seeds, algorithm implementations, security libraries and versions of a security protocol.
7. The method according to claim 1 , further comprising:
before the sending, signing the instructions with a cryptographic key bound to a certificate of the server.
8. The method according to claim 7 , further comprising:
signing a state of the server; and
sending the signed state to the at least one node.
9. The method according to claim 1 , further comprises:
predefining scripts for construction instructions according to a given security protocol;
storing the predefined scripts; and
retrieving the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol.
10. An apparatus, comprising:
at least one processor;
at least one memory including computer program code, the memory and the computer program code configured to, working with the at least one processor, cause the apparatus to:
determine a security configuration to be executed;
determine at least two different security applications which is installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols;
according to a security protocol used by each of the at least two different security applications, format for the security configuration, instructions corresponding to each of the at least one security application, respectively; and
send the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein information of the security applications comprises address information of the at least one node, and wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to obtain the information from a virtual network function management entity.
11. The apparatus according to claim 10 , wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to receive a request from one of the at least one node, to trigger the formatting of the instructions and the sending of the formatted instructions.
12. The apparatus according to claim 10 , wherein the security configuration relates to at least one of the following: algorithms, keys, parameter for algorithms, seeds, algorithm implementations, security libraries and versions of a security protocol.
13. The apparatus according to claim 10 , wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to sign the instructions with a cryptographic key bound to a certificate of the apparatus.
14. The apparatus according to claim 13 , wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to sign a state of the apparatus, and the configuration engine is further configured to send the signed state to the nodes on which the at least one security application is installed.
15. The apparatus according to claim 10 , wherein the memory and the computer program code are further configured, working with the at least one processor, to
predefine scripts for constructing instructions according to a given security protocol,
store the predefined scripts; and
retrieve the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol.
16. A non-transitory computer program product comprising instructions which when executed by at least one processor, cause the at least one processor to perform the following:
determining a security configuration to be executed;
determining at least two different security applications which are installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols;
according to a security protocol used by each of the at least two different security applications, formatting for the security configuration, instructions corresponding to each of the at least two different security applications, respectively; and
sending the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein determining at least two different security applications comprises obtaining address information of the at least one node on which the at least two different security applications are installed, and wherein the address information is obtained from a virtual network function management entity.
17. The non-transitory computer program product according to claim 16 , wherein the instructions cause the at least one processor to further perform the following:
predefining scripts for constructing instructions according to a given security protocol;
storing the predefined scripts; and
retrieving the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol.