CN115529144B - Communication system, method, apparatus, first device, second device, and storage medium - Google Patents

Abstract

The application discloses a communication system, a communication method, a communication device, a first device, a second device and a storage medium. Wherein, the system includes: a first device, a second device, and a third device; the first device is used for receiving first information from the second device, and providing a security management function for the application on the edge computing platform based on the first information and the security policy; the first information is used for configuring the application on the edge computing platform; the second device is configured to send the first information to the first device based on second information from a third device; the second information is used for programming the application on the edge computing platform.

Description

Communication system, method, device, first device, second device and storage medium

Technical Field

The present application relates to the field of communications, and in particular to a communication system, method, apparatus, first device, second device and storage medium.

Background technique

As a new generation of communication technology, the fifth generation mobile communication technology (5G) has many advantages such as large bandwidth, low latency, high reliability, high connectivity, and ubiquitous network, thus promoting the rapid development and change of vertical industries, such as the rise of smart medical care, smart education, and smart agriculture.

Mobile edge computing (MEC) technology, as one of the key technologies for 5G evolution, is an information technology (IT) general platform with wireless network information application program interface (API) interaction capabilities, as well as computing, storage, and analysis functions. Relying on MEC technology, traditional external applications can be pulled into the mobile internal, closer to users, and localized services can be provided, thereby improving user experience and unleashing more value from edge networks.

Combining 5G and MEC can introduce different technology combinations for different industry demand scenarios, such as quality of service (QoS), end-to-end network slicing, network capability exposure, edge cloud, etc., to provide customized solutions.

Among the related technologies, the combination of 5G and MEC technologies poses security risks.

Summary of the invention

To solve related technical problems, the embodiments of the present application provide a communication method, apparatus, related equipment and storage medium.

The technical solution of the embodiment of the present application is implemented as follows:

The embodiment of the present application provides a communication system, including: a first device, a second device, and a third device; wherein:

The first device is used to receive first information from the second device, and provide a security management function for the application on the edge computing platform based on the first information and the security policy; the first information is used to configure the application on the edge computing platform;

The second device is used to send the first information to the first device based on the second information from the third device; the second information is used to orchestrate the application on the edge computing platform.

In the above solution, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In the above solution, the first device is further used to send third information to the second device; the third information is used to indicate whether the first information is configured successfully;

The second device is further used to send fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In the above solution, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

The third configuration strategy; the third configuration strategy is for domain name systems (DNS, Domain Name System) of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In the above solution, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

In the above solution, the third device is further used to receive first access authentication information from the first device, and send first authentication response information to the first device; the first authentication response information at least includes: an identity identifier of the first device.

In the above solution, the third device is further used to receive second access authentication information from the second device, and send second authentication response information to the second device; the second authentication response information at least includes: an identity identifier of the second device;

The third device is further used to send the identity of the first device to the second device.

In the above solution, the number of the first devices is one or more.

An embodiment of the present application provides a communication method, which is applied to a first device, and the method includes:

Receiving first information from a second device; the first information is used to configure an application on the edge computing platform;

Based on the first information and security policies, security management functions are provided for applications on the edge computing platform.

In the above solution, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In the above solution, the method further comprises:

Sending third information to the second device; the third information is used to indicate whether the first information is configured successfully.

In the above solution, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In the above solution, the method further comprises:

Sending first access authentication information to a third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device.

An embodiment of the present application provides a communication method, which is applied to a second device, and the method includes:

receiving second information from a third device; the second information is used to orchestrate an application on an edge computing platform;

Sending first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

In the above solution, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In the above solution, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

In the above solution, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In the above solution, the method further comprises:

receiving third information from the first device; the third information is used to indicate whether the first information is configured successfully;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In the above scheme, the method further includes:

Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information at least includes: an identity identifier of the first device;

The method also includes: receiving an identity of the first device.

The present application provides a communication device, which is provided on a first device and includes:

A first communication unit, configured to receive first information from a second device; the first information is used to configure an application on the edge computing platform;

The first processing unit is used to provide security management functions for applications on the edge computing platform based on the first information and security policies.

In the above solution, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In the above scheme, the first communication unit is also used to send third information to the second device; the third information is used to indicate whether the first information is configured successfully.

In the above solution, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In the above solution, the first communication unit is further used to send the first access authentication information to the third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device.

The embodiment of the present application provides a first device, including: a first processor and a first communication interface; wherein,

The first communication interface is used to receive first information from a second device; the first information is used to configure an application on the edge computing platform;

The first processor is used to provide security management functions for applications on the edge computing platform based on the first information and security policies.

The present application provides a communication device, which is arranged on a second device and includes:

A second communication unit is used to receive second information from a third device; the second information is used to orchestrate an application on an edge computing platform;

The second processing unit is used to send the first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

In the above solution, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for domain name systems of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In the above solution, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

In the above solution, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In the above solution, the second communication unit is further used to receive third information from the first device; the third information is used to indicate whether the first information is configured successfully;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In the above solution, the second communication unit is further used to send second access authentication information to the third device; receive second authentication response information from the third device; the second authentication response information at least includes: the identity of the first device;

And, receiving the identity of the first device.

The embodiment of the present application provides a second device, including: a second processor and a second communication interface; wherein,

The second communication interface is used to receive second information from a third device; the second information is used to orchestrate applications on the edge computing platform;

The second processor is used to send first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

An embodiment of the present application provides a network device, comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, when the processor is used to run the computer program, the processor executes the steps of any one of the methods described above on the first device side; or,

When the processor is used to run the computer program, it executes the steps of any one of the methods described above on the second device side.

The embodiment of the present application provides a storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods described in the first device side are implemented; or,

When the computer program is executed by the processor, the steps of any one of the methods described above on the second device side are implemented.

The communication system, method, apparatus, first device, second device and storage medium provided in the embodiment of the present application, the system includes: a first device, a second device and a third device; the first device is used to receive the first information from the second device, and provide security management functions for the applications on the edge computing platform based on the first information and the security policy; the first information is used to configure the applications on the edge computing platform; the second device is used to send the first information to the first device based on the second information from the third device; the second information is used to orchestrate the applications on the edge computing platform. In the scheme of the embodiment of the present application, the first device provides security management functions for the applications on the edge computing platform based on the security policy, so that the first device can determine whether to orchestrate according to the first information according to the security policy; in this way, the security management and control capabilities of the first device for configuring the applications on the edge computing platform can be improved.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the system structure of MEC in the related art;

FIG2 is a schematic diagram of the structure of the host layer and system layer of MEC in the related art;

FIG3 is a schematic diagram of the system structure of 5G industry cloud network integration according to an embodiment of the present application;

FIG4 is a schematic diagram of the structure of a communication system according to an embodiment of the present application;

FIG5 is a flow chart of a communication method according to an embodiment of the present application;

FIG6 is a flow chart of another communication method according to an embodiment of the present application;

FIG7 is a schematic diagram of the structure of a communication system according to an embodiment of the present application;

FIG8 is a flow chart of a communication method according to an embodiment of the present application;

FIG9 is a schematic diagram of the registration and authentication process of an application example of the present application;

FIG10 is a schematic diagram showing the relationship between a MEPM and an L-MEPM according to an embodiment of the present application;

FIG11 is a schematic diagram of a permission authorization method according to an embodiment of the present application;

FIG12 is a schematic diagram of the structure of a communication device according to an embodiment of the present application;

FIG13 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

FIG14 is a schematic diagram of the structure of the first device according to an embodiment of the present application;

FIG. 15 is a schematic diagram of the structure of the second device according to an embodiment of the present application.

Detailed ways

The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

In the related technologies, MEC, as a multi-access edge computing platform standard led by the European Telecommunications Standards Institute (ETSI), has evolved from the original mobile edge computing platform to a multi-access edge computing platform based on virtual network functions (VNF, Virtual Network Feature). By virtualizing and servitizing MEC applications, platforms, and resources, it provides more efficient business operation services to meet the differentiated processing capabilities of different businesses. The ETSI standard organization defines the MEC system framework shown in Figure 1.

The MEC system mainly includes: MEC system layer (MEC system-level), MEC host layer (MEC hostlevel), and network layer (Networks).

Among them, the MEC system layer is responsible for the allocation, recovery and coordination of the entire MEC resources to meet the needs of different businesses for computing and transmission resources. MEC system layer management supports MEC system-level management functions and host-level management functions. MEC system-level management functions include user application lifecycle management agents, operation support systems, and MEC orchestrators. MEC host-level management functions can include MEC platform managers and virtualized infrastructure managers. MEC services provided to terminals and third-party customers (such as commercial enterprises) are managed through the MEC management layer.

The MEC host layer is used to provide necessary computing, storage, and transmission functions for MEC applications, MEC platforms, etc.

The network layer is used to provide different network options (such as 3GPP wireless networks, non-3GPP wireless networks, and wired networks) for upper-layer applications, and dynamically adjust routing strategies based on upper-layer signaling to meet the transmission requirements of different services on the network.

As shown in FIG2 , the MEC host includes: a MEC platform and a virtual infrastructure (computing, storage, and network). The virtual infrastructure includes a data plane, which is used to execute routing rules received from the MEC platform, and forward traffic between applications (also called MEC applications or MEP applications), services (also called MEC services or MEP services), DNS services/proxy, 3GPP networks, other access networks, local networks, and external networks. Among them, the MEP enables the application to provide and call the service, and the MEP itself can also provide services. Specifically, the application runs on a virtual machine or container, and can provide a variety of services (such as location, wireless network information, and traffic management) to the outside world. The application can also use services provided by other applications. For example, the location, traffic management, and other services provided by application A can be used by application B and application C. The service can be provided by the MEP or an application. When a service is provided by the application, the service can be registered in the service list of the MEP.

MEC platform (MEP) supports the following functions:

1) Provide an environment in which MEC applications can discover, notify, use and provide MEC services, including MEC services provided by other platforms (optional).

2) Receive routing rules from MEC platform management, applications or services to control data plane traffic.

3) Manage and receive DNS records from the MEC platform and configure DNS proxy/server;

4) Managed MEC services

5) Provide access to permanent storage and time of day information;

MEC orchestrator (MEO), also known as MEC application orchestrator (MEAO), is the core of MEC system layer management and supports the following functions:

1) Maintain the overall view of the MEC system (i.e., overall deployment); such as MEC host deployment, MEC available resource allocation, available MEC service calls, system topology, etc.;

2) Manage the launch of MEC application packages, including: checking the integrity and authenticity of the application packages; confirming the application rules and requirements, and determining whether the application rules and requirements need to be adjusted. If so, adjust the application rules and requirements to comply with the operator's policies; save the launch records of the application packages, and prepare the virtual infrastructure manager for processing the application;

3) Selecting a suitable MEC host for application initialization based on constraints (e.g. latency, available resources, available services, etc.);

4) Trigger the start and end of the application;

5) Trigger on-demand migration of applications.

MEC platform manager (MEPM) supports the following functions:

1) Manage the application life cycle, such as notifying MEAO of events related to the application;

2) Provide MEP element management functions, including virtualized network function (VNF) element management and network service (NS) element management, where NS information elements include physical network function (PNF) information elements, virtual link information elements, and VNF forwarding graph (VNF Forwarding Graph) information elements;

3) Manage the rules and requirements of MEC applications, such as service authorization, routing rules, domain name system (DNS) configuration, and conflict handling;

4) Receive error reports and performance measurement data of virtual resources from the Virtualization Infrastructure Manager (VIM). The main functions of VIM include: allocating, managing, and releasing virtualized resources of the virtualized infrastructure, receiving and storing software images, and collecting and reporting performance and fault information of virtualized resources.

From the functional description of each MEC module, it can be seen that the rules of MEC applications (including routing rules, DNS configuration, business rules, etc.) are managed by MEPM, received by MEP, and finally executed on the user plane of the MEC host.

In actual applications, there are many types of terminal access technologies in vertical industries. In addition to 5G, third-party networks also include non-5G networks (such as 4G, WiFi, Bluetooth, Zigbee, NB-IoT, SPN, infrared network, dedicated line network, Wireline, etc.). The data of these terminals may be transmitted to MEP through different networks. In order to ensure the network and data security of MEP and realize ubiquitous network access and control functions, an industry gateway (iGW, industryGateWay) is introduced in a 5G industry cloud network integration system architecture. The 5G industry cloud network integration architecture is shown in Figure 3.

MEC platform management (MEPM) is generally set up on the industry gateway. The data on the MEP can be directly accessed to the external network, that is, the third-party network, through the industry gateway. The existing ETSI protocol does not provide adequate protection for data security and cannot adapt to the increasing management requirements for data security and privacy protection.

In some typical data-sensitive application scenarios such as medical care, education, and finance, some applications and available resources (hardware resources, network resources, etc.) provided by MEP cannot be managed and configured by remote (external) MEPM for the sake of protecting user privacy and commercial secrets. The management configuration information (or management configuration data) sent by MEPM to MEP must be subject to strict security control. In related technologies, MEPM lacks the necessary security protection and authorization management mechanism for the management configuration information on MEP, and the security management control mechanism of MEPM for MEP is not clearly defined.

Based on this, in various embodiments of the present application, the first device is used to receive the first information from the second device, and provide security management functions for the application on the edge computing platform based on the first information and security policies; the first information is used to configure the application on the edge computing platform; the second device is used to send the first information to the first device based on the second information from the third device; the second information is used to orchestrate the application on the edge computing platform. In this way, the management and control capabilities of configuring the application on the edge computing platform in the first device can be improved.

The embodiment of the present application provides a communication system, as shown in FIG4 , the system includes: a first device, a second device, and a third device; wherein:

The first device is used to receive first information from the second device, and provide a security management function for the application on the edge computing platform based on the first information and the security policy; the first information is used to configure the application on the edge computing platform;

The second device is used to send the first information to the first device based on the second information from the third device; the second information is used to orchestrate the application on the edge computing platform.

In actual application, the second device is arranged between the first device and the third device.

In actual application, the first device can be a locally set MEPM, which can be understood as the user setting a local MEPM, and can locally manage and configure the applications provided by the MEP. The first device can be deployed locally alone or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In actual application, the second device may be an MEPM. The embodiment of the present application does not limit the name of the second device as long as the function of the second device can be realized.

In actual application, the third device may be MEO or MEAO. The embodiment of the present application does not limit the name of the third device, as long as the function of the third device can be realized.

In actual application, the edge computing platform can be called MEP.

The orchestration of applications on the edge computing platform can be understood as being implemented by orchestrating the application program and/or available resources of each application.

In one embodiment, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

The first device stores a security policy, which is used to set a security level. Different security levels are used to manage whether the configuration of some applications on the edge computing platform is allowed in the first device.

In actual application, the second device may be informed whether the configuration is successful, that is, whether the orchestration is completed.

Based on this, in one embodiment, the first device is further used to send third information to the second device; the third information is used to indicate whether the first information is configured successfully;

The second device is further used to send fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In one embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for a domain name system (DNS) of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In one embodiment, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

Here, the management information of the application may include: management of application packages, such as: loading application packages, enabling application packages, disabling application packages, etc.

The lifecycle management information of the application may include: instantiating an application package, operating (using) an application instance, and terminating an application instance.

The application lifecycle change notification may include: the application is not instantiated, the application has been started and is running, and the application has stopped running.

In actual application, the third device can perform identity authentication on the first device, and communication can be carried out after the authentication is passed.

Based on this, in one embodiment, the third device is further used to receive first access authentication information from the first device, and send first authentication response information to the first device; the first authentication response information at least includes: an identity identifier of the first device.

In actual application, the third device can perform identity authentication on the second device, and communication can be carried out after the authentication is passed.

Based on this, in one embodiment, the third device is further used to receive second access authentication information from the second device, and send second authentication response information to the second device; the second authentication response information at least includes: an identity identifier of the second device;

The third device is further used to send the identity of the first device to the second device.

In one embodiment, the number of the first devices is one or more.

Accordingly, an embodiment of the present application further provides a communication method, which is applied to a first device, as shown in FIG5 , and includes:

Step 501: Receive first information from a second device; the first information is used to configure an application on the edge computing platform;

Step 502: Provide security management functions for applications on the edge computing platform based on the first information and security policies.

In actual application, the first device can be a locally set MEPM, which can be understood as the user setting a local MEPM, and can locally manage and configure the applications provided by the MEP. The first device can be deployed locally alone or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In actual application, the second device may be an MEPM. The embodiment of the present application does not limit the name of the second device as long as the function of the second device can be realized.

In actual application, the edge computing platform can be called MEP.

In one embodiment, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

The first device stores a security policy, which is used to set a security level. Different security levels are used to manage whether the configuration of some applications on the edge computing platform is allowed in the first device.

In one embodiment, the first device may request the second device to authenticate itself, and communication may be performed after the authentication is passed.

Based on this, in one embodiment, the method further includes:

Sending third information to the second device; the third information is used to indicate whether the first information is configured successfully.

In one embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for domain name systems of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In actual application, the first device can request the third device to authenticate itself, and communication can be carried out after the authentication is passed.

Based on this, in one embodiment, the method further includes:

Sending first access authentication information to a third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device.

Accordingly, an embodiment of the present application further provides a communication method, which is applied to a second device. As shown in FIG6 , the method includes:

Step 601: Receive second information from a third device; the second information is used to orchestrate applications on the edge computing platform;

Step 602: Send first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

In actual application, the first device can be a locally set MEPM, which can be understood as the user setting a local MEPM, and can locally manage and configure the applications provided by the MEP. The first device can be deployed locally alone or integrated into the MEP. The embodiment of the present application does not limit the name of the first device, as long as the function of the first device can be realized.

In actual application, the second device may be an MEPM. The embodiment of the present application does not limit the name of the second device as long as the function of the second device can be realized.

In actual application, the third device may be MEO or MEAO. The embodiment of the present application does not limit the name of the third device, as long as the function of the third device can be realized.

In actual application, the edge computing platform can be called MEP.

In actual application, the orchestration of applications on the edge computing platform can be understood as being implemented by orchestrating the application program and/or available resources of each application.

In one embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for domain name systems of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In one embodiment, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

In one embodiment, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

The first device stores a security policy, which is used to set a security level. Different security levels are used to manage whether the configuration of some applications on the edge computing platform is allowed in the first device.

In actual application, the second device can perform identity authentication on the first device, and communication can be carried out after the authentication is passed.

Based on this, in one embodiment, the method further includes:

receiving third information from the first device; the third information is used to indicate whether the first information is configured successfully;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In actual application, the second device can request the third device to authenticate itself, and communication can be carried out after the authentication is passed.

Based on this, in one embodiment, the method further includes:

Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information at least includes: an identity identifier of the first device;

The method also includes: receiving an identity of the first device.

The present application is further described in detail below in conjunction with application examples.

In this application embodiment, the first device is called local MEPM (L-MEPM); the second device is MEPM; the third device is called MEAO or MEO; and the edge computing platform is called MEP.

In this application embodiment, an L-MEPM deployed on the MEP side is introduced, which is mainly responsible for signaling interaction with MEPM and/or MEAO, and is responsible for security supervision of MEP local management configuration data, as shown in FIG7 .

Among them, L-MEPM supports the following functions:

1) Manage the management configuration requests of MEPM, and manage the configuration requests according to the security policies applied on MEP;

2) Save the security policy and manage the management configuration data from MEPM (i.e., the first information from the second device) based on the security policy. The security policy may include three levels: strict, general, and loose. For example, at the strict level, the management configuration data from MEPM cannot configure the application on the MEP; at the general level, L-MEPM determines whether the management configuration data from MEPM can configure the application on the MEP based on the security policy; at the loose level, L-MEPM is only responsible for forwarding the management configuration data of MEPM (the management configuration data is determined based on the management configuration request from MEPM) to MEP for configuration of different applications.

Of course, in actual application, the level division can be further subdivided, which is not limited here.

In this application embodiment, as shown in FIG8 , MEAO is orchestrated and managed through MEPM, and L-MEPM is locally configured with a security policy to perform data security management and control on the control plane (specifically, the management configuration data of the application provided by MEP) so that the data on the control plane cannot arbitrarily configure the application of MEP. The communication method includes:

Step 801: MEAO (an example of a third device) sends second information to MEPM (an example of a second device);

The second information includes: MEPM identity and arrangement information;

The second information is used to orchestrate applications on the edge computing platform.

An example is given for the second information, where the second information includes but is not limited to the content in Table 1:

Table 1

Step 802: After receiving the second information, the MEPM sends the first information to the L-MEPM (an example of a third device);

The first information includes: L-MEPM identity identification and management configuration information;

The first information is used to configure the application on the edge computing platform.

An example is given for the first information, as shown in Table 2;

parameter name type illustrate L-MEPM Identity Label As shown in Table 5 L-MEPM unique identification Managing configuration information As shown in Table 8 Managing configuration information

Table 2

Step 803: After receiving the first information, the L-MEPM checks the local security policy; performs corresponding operations based on the first information and the security policy and replies with the third information;

The L-MEPM local security policy includes:

At the "strict" level (equivalent to the first security level mentioned above), L-MEPM rejects all management configuration information for MEP;

At the "general" level (equivalent to the second security level mentioned above), L-MEPM allows partial management configuration information for MEPs;

At the "relaxed" level (equivalent to the third security level mentioned above), L-MEPM allows all management configuration information for MEP.

Each application in L-MEPM has a unique identifier. The security policy is marked with the identifier of each application and the corresponding mark is used to check whether it meets the requirements.

Check the local security policy, configure the application on the MEP according to the situation that complies with the security policy, and reply to the MEPM with a successful configuration message after the configuration is completed;

According to the situation that some security policies are met, the application information on the MEP is partially configured, and after the configuration is completed, the MEPM is replied with a successful configuration message;

If it does not comply with the local security policy, a configuration failure message will be directly sent to MEPM.

That is to say, the third information includes: MEPM identity identification and management configuration result information; as shown in Table 3.

table 3

Step 804: After receiving the third message from L-MEPM, MEPM replies with a fourth message to MEAO;

The fourth information is used to illustrate a result of arrangement based on the second information.

The fourth information may include: MEAO identity identification and management configuration result information; as shown in Table 4.

parameter name type illustrate MEAO Identity As shown in Table 5 Unique ID of MEAO Management configuration result information As shown in Table 10 Success or failure

Table 4

The embodiments of the present invention can be used for unique ID identification, such as the embodiment of Table 5;

table 5

In various embodiments of the present invention, the MEPM type can be distinguished by a number or a string identifier, such as the embodiment of Table 6;

type of data illustrate number 1 means ordinary MEPM; 2 means L-MEPM String "1" indicates ordinary MEPM; "2" indicates L-MEPM

Table 6

The orchestration information sent by MEAO in each embodiment of the present invention is shown in Table 7, which is designed according to the provisions of the ETSI MEC010-2 standard protocol, for each application package:

Table 7

The management configuration information sent by MEPM to L-MEPM is given as an application example, as shown in Table 8;

Table 8

The reply message of L-MEPM to MEPM, i.e., the third message, provides an application example, as shown in Table 9;

Table 9

The reply message of MEPM to MEAO, i.e., the fourth message, provides an application example, as shown in Table 10;

Table 10

In actual application, in order to obtain the MEPM identity and the L-MEPM identity, the method further includes: identity registration; as shown in FIG9 , including:

Step 901, MEPM (an example of a second device) and L-MEPM (an example of a first device) respectively request registration with MEAO (an example of a third device);

The registration request is the identity authentication information, which is used to request MEAO to register its identity; after receiving the registration request and performing the registration operation, MEAO stores the corresponding identity identification of MEPM and L-MEPM. The registered identity information may include the following contents as shown in Table 11:

Table 11

Step 902: After receiving the registration request, MEAO registers and responds with information, including the following content as shown in Table 12:

Table 12

After receiving the MEPM registration request, MEAO performs a reply operation; an application example is given for the reply operation, as shown in Table 13; if it does not follow the format of Table 6, it is an illegal identity.

Table 13

Step 903, MEAO sends the registered L-MEPM information to MEPM, and an application example is given, as shown in Table 14;

Table 14

Step 904: After MEPM parses the identity information and IP address of L-MEPM, an association relationship between MEPM and multiple L-MEPMs is formed, as shown in FIG. 10 below.

MEPM also replies to MEAO. Regarding the content of the reply information, an application example is given, as shown in Table 15;

Table 15

Regarding the reply type and reply description, an application example is given, as shown in Table 16;

Response Type Reply Instructions 0 success 1 Illegal status

Table 16

For IP addresses, an application example is given, as shown in Table 17;

Table 17

An example is given for L-MEPM identity information and IP address information as follows:

Method 1: Use a hash table, where the key identifies the L-MEPM identity and the value identifies the IP address of the L-MEPM.

Method 2: Use JSON string method.

{

"880e8400-e29b-41d4-a716-446655440000":"156.123.52.41",

"990e8400-e29b-41d4-a716-446655440000":"156.123.52.42",

"770e8400-e29b-41d4-a716-446655440000":"156.123.52.43",

"660e8400-e29b-41d4-a716-446655440000":"156.123.52.44"

}

In order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application further provides a communication device, which is arranged on the first device, as shown in FIG12, and the device includes:

The first communication unit 1201 is used to receive first information from a second device; the first information is used to configure an application on the edge computing platform;

The first processing unit 1202 is used to provide security management functions for applications on the edge computing platform based on the first information and security policies.

In one embodiment, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In one embodiment, the first communication unit 1201 is further used to send third information to the second device; the third information is used to indicate whether the first information is configured successfully.

In one embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for domain name systems of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In one embodiment, the first communication unit 1202 is further configured to send first access authentication information to a third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device.

In actual application, the first communication unit 1201 and the first processing unit 1202 can be implemented by a processor in a communication device in combination with a communication interface.

In order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application further provides a communication device, which is arranged on the second device, as shown in FIG13, and the device includes:

The second communication unit 1301 is used to receive second information from a third device; the second information is used to orchestrate applications on the edge computing platform;

The second processing unit 1302 is used to send first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

In one embodiment, the first information includes at least one of the following configuration information:

A first configuration strategy; the first configuration strategy is for operation permissions of different applications;

The second configuration strategy; the second configuration strategy is for routing rules of different applications;

A third configuration strategy; the third configuration strategy is for domain name systems of different applications;

Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications.

In one embodiment, the second information includes at least one of the following:

Management information of the application;

Application lifecycle management information;

Application lifecycle change information.

In one embodiment, the security policy includes at least one of the following:

The first security level represents the rejection of configuration for all applications on the edge computing platform;

The second security level indicates that configuration of some applications on the edge computing platform is allowed;

Third security level: The first security level represents that configuration is allowed for all applications on the edge computing platform.

In one embodiment, the second communication unit 1301 is further used to receive third information from the first device; the third information is used to indicate whether the first information is configured successfully;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In one embodiment, the second communication unit 1301 is further configured to send second access authentication information to a third device; receive second authentication response information from the third device; the second authentication response information at least includes: an identity identifier of the first device;

The second communication unit 1301 is further configured to receive an identity of the first device.

In actual application, the second communication unit 1301 and the second processing unit 1302 can be implemented by a processor in a communication device in combination with a communication interface.

It should be noted that: when the communication device provided in the above embodiment performs communication, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the communication device and the communication method embodiment provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

Based on the hardware implementation of the above program module, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application further provides a first device, as shown in FIG. 14 , the first device 1400 includes:

The first communication interface 1401 is capable of exchanging information with the second device;

The first processor 1402 is connected to the first communication interface 1401 to implement information exchange with the second device, and is used to execute the method provided by one or more technical solutions on the first device side when running a computer program. The computer program is stored in the first memory 1403.

Specifically, the first communication interface 1401 is used to receive first information from a second device; the first information is used to configure an application on the edge computing platform;

The first processor 1402 is used to provide security management functions for applications on the edge computing platform based on the first information and security policies.

In one embodiment, the first communication interface 1401 is further used for:

Sending third information to the second device; the third information is used to indicate whether the first information is configured successfully.

In one embodiment, the first communication interface 1401 is further used for:

Sending first access authentication information to a third device;

Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device.

It should be noted that the specific processing process of the first processor 1402 and the first communication interface 1401 can be understood by referring to the above method.

Of course, in actual application, the various components in the first device 1400 are coupled together through the bus system 1404. It can be understood that the bus system 1404 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1404 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 1404 in Figure 14.

The first memory 1403 in the embodiment of the present application is used to store various types of data to support the operation of the first device 1400. Examples of such data include: any computer program used to operate on the first device 1400.

The method disclosed in the above embodiment of the present application can be applied to the first processor 1402, or implemented by the first processor 1402. The first processor 1402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 1402. The above-mentioned first processor 1402 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1402 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1403, and the first processor 1402 reads the information in the first memory 1403 and completes the steps of the above method in combination with its hardware.

In an exemplary embodiment, the first device 1400 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

Based on the hardware implementation of the above program module, and in order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application further provides a second device, as shown in FIG. 15 , the second device 1500 includes:

The second communication interface 1501 is capable of exchanging information with the first device and the third device;

The second processor 1502 is connected to the second communication interface 1501 to implement information exchange with the first device and the third device, and is used to execute the method provided by one or more technical solutions on the second device side when running the computer program. The computer program is stored in the second memory 1503.

Specifically, the second communication interface 1501 is used to receive second information from a third device; the second information is used to orchestrate applications on the edge computing platform;

The second processor 1502 is used to send first information to the first device based on the second information; the first information is used to instruct the first device to configure the application on the edge computing platform based on the first device and the security policy.

In one embodiment, the second communication interface 1501 is further used for:

receiving third information from the first device; the third information is used to indicate whether the first information is configured successfully;

Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully.

In one embodiment, the second communication interface 1501 is further used to send second access authentication information to a third device; receive second authentication response information from the third device; the second authentication response information at least includes: an identity identifier of the first device;

And, receiving the identity of the first device.

It should be noted that the specific processing process of the second communication interface 1501 and the second processor 1502 can be understood by referring to the above method.

Of course, in actual application, the various components in the second device 1500 are coupled together through the bus system 1504. It can be understood that the bus system 1504 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1504 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are marked as bus system 1504 in Figure 15.

The second memory 1503 in the embodiment of the present application is used to store various types of data to support the operation of the second device 1500. Examples of such data include: any computer program used to operate on the second device 1500.

The method disclosed in the above embodiment of the present application can be applied to the second processor 1502, or implemented by the second processor 1502. The second processor 1502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 1502. The above-mentioned second processor 1502 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1502 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1503, and the second processor 1502 reads the information in the second memory 1503 and completes the steps of the above method in combination with its hardware.

In an exemplary embodiment, the second device 1500 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

It can be understood that the memory (first memory 1403, second memory 1503) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims (25)

1. A communication system, comprising: a first device, a second device, and a third device; wherein: The first device is used to receive first information from the second device, and provide a security management function for the application on the edge computing platform based on the first information and the security policy; the first information is used to configure the application on the edge computing platform; The second device is used to send the first information to the first device based on the second information from the third device; the second information is used to orchestrate the application on the edge computing platform; wherein, the first device is the local mobile edge computing platform manager MEPM, the second device is MEPM, and the third device is the mobile edge computing orchestrator MEO or the mobile edge computing application orchestrator MEAO. 2. The system according to claim 1, wherein the security policy comprises at least one of the following: The first security level represents the rejection of configuration for all applications on the edge computing platform; The second security level indicates that configuration of some applications on the edge computing platform is allowed; Third security level: The third security level represents the configuration allowed for all applications on the edge computing platform. 3. The system according to claim 1, wherein the first device is further used to send third information to the second device; the third information is used to indicate whether the first information is successfully configured; The second device is further used to send fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully. 4. The system according to claim 1, wherein the first information comprises at least one of the following configuration information: A first configuration strategy; the first configuration strategy is for operation permissions of different applications; The second configuration strategy; the second configuration strategy is for routing rules of different applications; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications. 5. The system according to claim 4, wherein the second information comprises at least one of the following: Management information of the application; Application lifecycle management information; Application lifecycle change information. 6. The system according to claim 1 is characterized in that the third device is also used to receive first access authentication information from the first device and send first authentication response information to the first device; the first authentication response information at least includes: an identity identifier of the first device. 7. The system according to claim 1, characterized in that the third device is further used to receive second access authentication information from the second device, and send second authentication response information to the second device; the second authentication response information at least includes: an identity identifier of the second device; The third device is further used to send the identity of the first device to the second device. 8. The system according to any one of claims 1 to 7, characterized in that the number of the first devices is one or more. 9. A communication method, characterized in that it is applied to a first device, the method comprising: receiving first information from a second device; the first information is used to configure an application on an edge computing platform; the first information is sent by the second device to the first device based on second information from a third device; the second information is used to orchestrate the application on the edge computing platform; Based on the first information and security policy, a security management function is provided for applications on the edge computing platform; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 10. The method according to claim 9, wherein the security policy comprises at least one of the following: The first security level represents the rejection of configuration for all applications on the edge computing platform; The second security level indicates that configuration of some applications on the edge computing platform is allowed; Third security level: The third security level represents the configuration allowed for all applications on the edge computing platform. 11. The method according to claim 9, characterized in that the method further comprises: Sending third information to the second device; the third information is used to indicate whether the first information is configured successfully. 12. The method according to claim 9, wherein the first information comprises at least one of the following configuration information: A first configuration strategy; the first configuration strategy is for operation permissions of different applications; The second configuration strategy; the second configuration strategy is for routing rules of different applications; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications. 13. The method according to claim 9, characterized in that the method further comprises: Sending first access authentication information to a third device; Receive first authentication response information from the third device; the first authentication response information at least includes: an identity identifier of the first device. 14. A communication method, characterized in that it is applied to a second device, the method comprising: receiving second information from a third device; the second information is used to orchestrate an application on an edge computing platform; Sending first information to the first device based on the second information; the first information is used to instruct the first device to provide security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used to configure the applications on the edge computing platform; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 15. The method according to claim 14, wherein the first information comprises at least one of the following configuration information: A first configuration strategy; the first configuration strategy is for operation permissions of different applications; The second configuration strategy; the second configuration strategy is for routing rules of different applications; The third configuration strategy; the third configuration strategy is for the domain name system DNS of different applications; Fourth configuration strategy: The fourth configuration strategy is aimed at the life cycle of different applications. 16. The method according to claim 14, wherein the second information comprises at least one of the following: Management information of the application; Application lifecycle management information; Application lifecycle change information. 17. The method according to claim 14, wherein the security policy comprises at least one of the following: The first security level represents the rejection of configuration for all applications on the edge computing platform; The second security level indicates that configuration of some applications on the edge computing platform is allowed; Third security level: The third security level represents the configuration allowed for all applications on the edge computing platform. 18. The method according to claim 14, characterized in that the method further comprises: receiving third information from the first device; the third information is used to indicate whether the first information is configured successfully; Sending fourth information to the third device based on the third information; the fourth information is used to indicate whether the second information is configured successfully. 19. The method according to claim 14, characterized in that the method further comprises: Sending second access authentication information to a third device; receiving second authentication response information from the third device; the second authentication response information at least includes: an identity identifier of the first device; The method also includes: receiving an identity of the first device. 20. A communication device, characterized in that it is arranged on a first device, comprising: A first communication unit is configured to receive first information from a second device; the first information is used to configure an application on an edge computing platform; the first information is sent by the second device to the first device based on second information of a third device; the second information is used to orchestrate the application on the edge computing platform; The first processing unit is used to provide security management functions for applications on the edge computing platform based on the first information and security policies; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 21. A first device, comprising: a first processor and a first communication interface; wherein: The first communication interface is used to receive first information from a second device; the first information is used to configure an application on an edge computing platform; the first information is sent by the second device to the first device based on second information from a third device; the second information is used to orchestrate the application on the edge computing platform; The first processor is used to provide security management functions for applications on the edge computing platform based on the first information and security policies; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 22. A communication device, characterized in that it is arranged on a second device, comprising: A second communication unit is used to receive second information from a third device; the second information is used to orchestrate an application on an edge computing platform; The second processing unit is used to send the first information to the first device based on the second information; the first information is used to instruct the first device to provide security management functions for the application on the edge computing platform based on the first information and the security policy; the first information is used to configure the application on the edge computing platform; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 23. A second device, comprising: a second processor and a second communication interface; wherein: The second communication interface is used to receive second information from a third device; the second information is used to orchestrate applications on the edge computing platform; The second processor is used to send first information to the first device based on the second information; the first information is used to instruct the first device to provide security management functions for applications on the edge computing platform based on the first information and security policies; the first information is used to configure the applications on the edge computing platform; wherein the first device is a local MEPM, the second device is a MEPM, and the third device is a MEO or MEAO. 24. A network device, comprising: a processor and a memory for storing a computer program that can be run on the processor, Wherein, when the processor is used to run the computer program, the steps of the method according to any one of claims 9 to 13 are performed; or, When the processor is used to run the computer program, the steps of the method according to any one of claims 14 to 19 are performed. 25. A storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 9 to 13 are implemented; or When the computer program is executed by a processor, the steps of the method according to any one of claims 14 to 19 are implemented.