Trusted path establishment system, method, apparatus and device, and storage medium

Abstract

The invention provides a trusted path establishment system, method, apparatus and device, and a storage medium, relates to the technical field of computers, and can effectively improve the reliability of a trusted path and ensure the security and privacy of data in the trusted path. The system comprises a network composer, a device verification network element connected with the network composer and a link management platform. And the link management platform is used for acquiring a link credible state corresponding to the network link and sending the link credible state to the network composer, and the link credible state is used for describing the reliability of the network link. And the equipment verification network element is used for acquiring the equipment credible state corresponding to the network equipment and sending the equipment credible state to the network composer, and the equipment credible state is used for describing the reliability of the network equipment. The network composer is used for receiving the link trusted state and the equipment trusted state; and obtaining a trusted path topology based on the link trusted state and the device trusted state, the trusted path topology comprising at least one trusted path.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a trusted path establishment system, method, apparatus, device and storage medium, which can effectively improve the reliability of the trusted path. Background Art

[0002] Software Defined Networking (SDN) is a network architecture that separates the control plane from the data plane of the network, which simplifies network management and enables efficient use and dynamic adjustment of network resources.

[0003] As specific services have increasingly higher requirements for data privacy and security, the security and reliability requirements for SDN architecture are also getting higher and higher. In related technologies, the network orchestrator generates a trusted path orchestration strategy based on the trusted path requirements and the trusted status of network devices, and then establishes a trusted path based on the trusted path orchestration strategy through the SDN controller.

[0004] However, the network orchestrator in the related art mainly performs path orchestration based on the trusted status of network devices, the orchestration method is relatively simple, and there is a data leakage problem. Summary of the invention

[0005] The present application provides a trusted path establishment system, method, apparatus, device and storage medium, which effectively improves the security and privacy of data.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a trusted path establishment system, the system comprising: a network orchestrator, a device verification network element connected to the network orchestrator, and a link management platform.

[0008] The link management platform is used to obtain the link trust status corresponding to the network link and send the link trust status to the network orchestrator.

[0009] The device verification network element is used to obtain the device trust status corresponding to the network device and send the device trust status to the network orchestrator.

[0010] The network orchestrator is used to receive the link trust state and the device trust state; and obtain the trusted path topology based on the link trust state and the device trust state.

[0011] The link trusted state is used to describe the reliability of the network link, the device trusted state is used to describe the reliability of the network device, and the trusted path topology includes at least one trusted path.

[0012] The solution provided by the present application, when performing trusted path orchestration, the network orchestrator constructs a trusted path topology based on the link trusted status obtained from the link management platform and the device trusted status obtained from the device verification network element, so that the security of network devices and network links is guaranteed at the same time, thereby improving the reliability of the trusted path in the trusted path topology and effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0013] In a possible implementation, the link management platform is further used to: receive link status information corresponding to the network link. Perform link credibility analysis on the link status information to obtain the link credibility status. Link credibility analysis refers to evaluating the reliability of the network link based on the link status information. According to the link status information, the link credibility status is analyzed and obtained. The link status information includes information on multiple aspects such as bandwidth, delay, and packet loss rate of the network link, thereby achieving a comprehensive evaluation of the reliability of the network link and making the evaluation of the link credibility status more accurate.

[0014] In another possible implementation, the link management platform is further used to: send a link status query request to the link monitoring device. Receive link status information reported by the link monitoring device based on the link status query request. By sending the link status query request to the link monitoring device, the real-time status of the network link can be obtained in time, so as to quickly understand the network operation status.

[0015] In another possible implementation, the link management platform is further used to: receive link status information actively reported by the link monitoring device after the link status reporting condition is triggered. The link monitoring device actively reports the link status information, and the reporting or updating of the link status information is more timely and efficient.

[0016] In another possible implementation, the link status reporting condition includes at least one of: a change in the network link status and periodic reporting of link status information. Multiple link reporting conditions can flexibly adjust the reporting of link status information according to different situations and requirements, and adapt to reporting requirements in different scenarios; in addition, multiple reporting conditions can also improve the efficiency and reliability of information reporting, and avoid loss or omission of reported information.

[0017] In another possible implementation, the device verification network element is further used to: receive device status information corresponding to the network device. Perform device credibility analysis on the device status information to obtain the device credibility status. Device credibility analysis refers to evaluating the reliability of network devices based on device status information. The device credibility status is obtained based on the device status information analysis. The device status information includes information on multiple aspects of the network device, such as device performance, reliability, and security, to achieve a comprehensive evaluation of the credibility of the network device, and to make the evaluation of the device credibility status more accurate.

[0018] In another possible implementation, the device verification network element is further used to: send a device status query request to the network device. Receive device status information reported by the network device based on the device status query request. The device verification network element actively queries the device status information of the network device, and can obtain the real-time status of the network device in a timely manner, so as to quickly understand the network operation status.

[0019] In another possible implementation, the device verification network element is further used to: receive device status information actively reported by the network device after the device status reporting condition is triggered. The device verification network element actively reports the device status information, and the reporting or updating of the device status information is more timely and efficient.

[0020] In another possible implementation, the device status reporting condition includes at least one of: a change in the network device status and periodic reporting of device status information. Multiple device reporting conditions can flexibly adjust the reporting of device status information according to different situations and needs, and adapt to reporting needs in different scenarios; in addition, multiple reporting conditions can also improve the efficiency and reliability of information reporting, and avoid loss or omission of reported information.

[0021] In another possible implementation, the network orchestrator is also used to: establish a mapping relationship between network devices and network links based on the link trust state and the device trust state to obtain a trusted path topology. The trusted path topology intuitively displays the connection relationship between network devices and network links, realizes convenient network management and trusted path optimization selection, and can directly select the required trusted path in the trusted path topology.

[0022] In another possible implementation, the network orchestrator is further used to associate and map the device identifier corresponding to the network device and the link identifier corresponding to the network link to obtain a trusted path topology. By associating and mapping the device identifier and the link identifier, the relationship between each trusted network device and the trusted network link in the network can be clearly understood, the precise positioning of the network device and the network link is achieved, and the management of the trusted path topology structure is simplified.

[0023] In a second aspect, a trusted path establishment method is provided, the method being applied to a network orchestrator, the method comprising:

[0024] The link trust state corresponding to the network link and the device trust state corresponding to the network device are obtained. Based on the link trust state and the device trust state, a trusted path topology is obtained. The link trust state is used to describe the reliability of the network link, the device trust state is used to describe the reliability of the network device, and the trusted path topology includes at least one trusted path.

[0025] The trusted path establishment method provided in the present application is that the network orchestrator obtains the link trusted state and the device trusted state to build a trusted path topology, so that the security of network devices and network links is guaranteed at the same time, the reliability of the trusted path in the trusted path topology is improved, and the security risks of malicious tampering of the network system and data theft are effectively avoided.

[0026] In one possible implementation, the link trust status is obtained after the link management platform performs a link trust analysis on the link status information. The link status information includes information on the bandwidth, delay, packet loss rate, etc. of the network link. Through the trust analysis of the link status information, a comprehensive assessment of the reliability of the network link is achieved, and the assessment of the link trust status is more accurate.

[0027] In another possible implementation, the device trust status is obtained after the device verification network element performs device trust analysis on the device status information. The device status information includes information on the device performance, reliability, security, etc. of the network device. Through the trust analysis of the device status information, a comprehensive assessment of the network device trustworthiness is achieved, and the assessment of the device trust status is more accurate.

[0028] Another possible implementation method is to obtain a trusted path topology based on the link trusted state and the device trusted state, which can be specifically implemented as follows: based on the link trusted state and the device trusted state, a mapping relationship between network devices and network links is established to obtain a trusted path topology. The trusted path topology can intuitively display the connection relationship between network devices and network links, realize convenient network management and trusted path optimization selection, and can directly select the required trusted path in the trusted path topology.

[0029] Another possible implementation is to establish a mapping relationship between network devices and network links to obtain a trusted path topology, which can be specifically implemented as follows: associate and map the device identifier corresponding to the network device and the link identifier corresponding to the network link to obtain a trusted path topology. By associating and mapping the device identifier and the link identifier, the relationship between each trusted network device and the trusted network link in the network can be clearly understood, the precise positioning of network devices and network links is achieved, and the management of the trusted path topology structure is simplified.

[0030] In a third aspect, a trusted path establishment method is provided, the method being applied to a link management platform, the method comprising:

[0031] Get the link trust state corresponding to the network link. Send the link trust state to the network orchestrator. The link trust state is used to describe the reliability of the network link and is also used to build a trusted path topology; the trusted path topology includes at least one trusted path.

[0032] The trusted path establishment method provided by the present application is that the link management platform sends the acquired link trusted status to the network orchestrator, so that the network orchestrator can build a trusted path topology according to the link trusted status, ensure the security of the network link, and thus improve the reliability of the trusted path in the trusted path topology, effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0033] A possible implementation method is to obtain the link trust state corresponding to the network link, which can be specifically implemented as follows: receiving the link state information corresponding to the network link. Performing link trustworthiness analysis on the link state information to obtain the link trustworthiness state. Link trustworthiness analysis refers to evaluating the reliability of the network link based on the link state information. The link state information includes information on the bandwidth, delay, packet loss rate, etc. of the network link. Through the trustworthiness analysis of the link state information, a comprehensive evaluation of the reliability of the network link is achieved, and the evaluation of the link trustworthiness state is more accurate.

[0034] In another possible implementation, receiving the link status information corresponding to the network link can be specifically implemented as follows: sending a link status query request to a link monitoring device. Receiving the link status information reported by the link monitoring device based on the link status query request. By sending the link status query request to the link monitoring device, the real-time status of the network link can be obtained in time, thereby quickly understanding the network operation status.

[0035] In another possible implementation, receiving the link status information corresponding to the network link can be specifically implemented as follows: receiving the link status information actively reported by the link monitoring device after the link status reporting condition is triggered. The link monitoring device actively reports the link status information, and the reporting or updating of the link status information is more timely and efficient.

[0036] In another possible implementation, the link status reporting condition includes at least one of a change in the network link status and periodic reporting. Multiple link reporting conditions can flexibly adjust the reporting of link status information according to different situations and requirements, and adapt to reporting requirements in different scenarios; in addition, multiple reporting conditions can also improve the efficiency and reliability of information reporting, and avoid loss or omission of reported information.

[0037] In a fourth aspect, a trusted path establishment device is provided, the device comprising: an acquisition module and a construction module.

[0038] The acquisition module is used to acquire the link trust status corresponding to the network link and the device trust status corresponding to the network device.

[0039] A building module is used to obtain a trusted path topology based on a link trusted state and a device trusted state.

[0040] The link trusted state is used to describe the reliability of the network link, the device trusted state is used to describe the reliability of the network device, and the trusted path topology includes at least one trusted path.

[0041] In a possible implementation manner, the link credibility state is obtained after the link management platform performs a link credibility analysis on the link status information.

[0042] In another possible implementation, the device trust status is obtained after the device verification network element performs a device trustworthiness analysis on the device status information.

[0043] In another possible implementation, the above-mentioned construction module is further used to: establish a mapping relationship between network devices and network links based on the link trust state and the device trust state to obtain a trusted path topology.

[0044] In another possible implementation, the above-mentioned construction module is further used to: associate and map the device identifier corresponding to the network device and the link identifier corresponding to the network link to obtain a trusted path topology.

[0045] The technical effects corresponding to any one of the implementation methods in the fourth aspect can be referred to the technical effects corresponding to any one of the implementation methods in the above-mentioned second aspect, and will not be repeated here.

[0046] In a fifth aspect, a trusted path establishment device is provided, the device comprising: an acquisition module and a sending module.

[0047] Acquisition module: used to obtain the link trust status corresponding to the network link.

[0048] Sending module: used to send link trust status to the network orchestrator.

[0049] The link trusted state is used to describe the reliability of the network link and is also used to construct a trusted path topology; the trusted path topology includes at least one trusted path.

[0050] In a possible implementation, the acquisition module is further used to: receive link status information corresponding to the network link; perform link credibility analysis on the link status information to obtain a link credibility status, wherein the link credibility analysis refers to evaluating the reliability of the network link based on the link status information.

[0051] In another possible implementation, the acquisition module is further used to: send a link status query request to the link monitoring device, and construct link status information reported by the link monitoring device based on the link status query request.

[0052] In another possible implementation, the acquisition module is further used to: receive link status information actively reported by the link monitoring device after a link status reporting condition is triggered.

[0053] In another possible implementation, the link status reporting condition includes at least one of a change in the network link status and periodic reporting.

[0054] The technical effects corresponding to any one of the implementation methods in the fifth aspect can be referred to the technical effects corresponding to any one of the implementation methods in the above-mentioned third aspect, and will not be repeated here.

[0055] In a sixth aspect, a computer device is provided, the computer device comprising: a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to implement the trusted path establishment method of the above aspect.

[0056] In a seventh aspect, a computer-readable storage medium is provided, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor to implement the trusted path establishment method of the above aspect.

[0057] In an eighth aspect, a computer program product is provided, the computer program product comprising a computer program or instructions, and when the computer program or instructions are executed by a processor, the trusted path establishment method of the above aspect is implemented.

[0058] In the ninth aspect, an embodiment of the present application provides a chip system, comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to at least one processor, and when the at least one processor executes the instructions, the at least one processor executes to implement the trusted path establishment method as described above.

[0059] The solutions provided in the sixth to ninth aspects are used to implement the methods provided in the second and third aspects, and their specific implementations are not described one by one. The technical effects corresponding to any one of the implementations of the solutions provided in the sixth to ninth aspects can be referred to the technical effects corresponding to any one of the implementations of the second and third aspects, and are not described here.

[0060] It should be noted that various possible implementation methods of any of the above aspects can be combined under the premise that the solutions are not contradictory. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A schematic diagram of the structure of an SDN architecture provided for an exemplary embodiment;

[0062] Figure 2 A schematic diagram of a TPCM framework structure provided as an exemplary embodiment;

[0063] Figure 3A schematic diagram of a computer system provided for an exemplary embodiment;

[0064] Figure 4 A schematic diagram of the structure of a trusted path establishment system provided for an exemplary embodiment;

[0065] Figure 5 An example diagram of a trusted path topology provided for an exemplary embodiment;

[0066] Figure 6 A flowchart of a trusted path establishment method provided for an exemplary embodiment;

[0067] Figure 7 A flowchart of a trusted path establishment method provided for an exemplary embodiment;

[0068] Figure 8 A schematic diagram of the structure of a link management platform provided for an exemplary embodiment;

[0069] Fig. 9 A flowchart of a trusted path establishment method provided for an exemplary embodiment;

[0070] Fig.10 A flowchart of a trusted path establishment method provided for an exemplary embodiment;

[0071] Fig.11 A schematic diagram of the structure of a trusted path establishment system provided for an exemplary embodiment;

[0072] Fig.12 A schematic diagram of the structure of a trusted path establishment device provided by an exemplary embodiment;

[0073] Fig.13 A schematic diagram of the structure of a trusted path establishment device provided by an exemplary embodiment;

[0074] Fig.14 A schematic diagram of the structure of a computer device is provided for an exemplary embodiment. DETAILED DESCRIPTION

[0075] In the embodiments of the present application, in order to clearly describe the technical solutions of the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially identical functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different. There is no order of precedence or size between the technical features described by the "first" and "second".

[0076] In the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0077] In the embodiments of the present application, at least one can also be described as one or more, and multiple can be two, three, four or more, which is not limited in the present application.

[0078] In addition, the network architecture and scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0079] To facilitate understanding, the terms involved in the embodiments of the present application are first explained.

[0080] SDN architecture: is a network architecture whose core idea is to separate the network control function from network devices (such as switches and routers) and concentrate it in an independent control plane, so that network devices only need to forward data according to the instructions of the controller, while complex routing decisions and policy configurations are centrally handled by the controller. Figure 1 The structural diagram of the SDN architecture shown in the figure shows that the SDN architecture can be divided into three layers. The top layer is the business layer, which includes various business applications. The middle control layer mainly includes the software-defined network controller, which is responsible for providing network services such as the orchestration of data plane resources, maintenance of network topology and status information. The bottom forwarding layer includes several network devices, which are responsible for data processing, forwarding and status collection. The network control function of this architecture is transferred from the network device to the external computing device (controller), so that the network administrator can configure, manage and monitor the network more conveniently, thereby achieving more refined network resource allocation and traffic management. The network device generates a forwarding table by receiving the control signaling of the control layer, and processes the traffic data according to the forwarding table, without the need for complex distributed network protocols to forward data.

[0081] Trusted computing: Trusted computing is a computer system security technology that combines cryptographic operations with protection, and aims to ensure that every link in the computing process is detectable and monitorable. The principle of trusted computing is to improve the security of computer systems by introducing trusted platform modules (TPM), trusted platform control modules (TPCM) and trusted cryptography modules (TCM) on the hardware platform. Trusted computing uses a whitelist mechanism, which only allows authenticated kernels, kernel modules, applications, etc. to run on the system. If they cannot be authenticated, they will not run, thereby improving the security of the system.

[0082] TPM: is a security chip or module that is integrated into the computer motherboard and is designed to provide basic security-related functions. For example, sensitive data can be encrypted through encryption keys generated by TPM to ensure the security of data during transmission and storage. Specifically, TPM uses a hardware bus to communicate with the rest of the system. Devices containing TPM can create encryption keys and encrypt them so that these keys can only be decrypted by TPM. This process is usually called "wrapping" or "binding" keys to avoid key leakage. Each TPM has a master wrapping key, called the storage root key, which is stored in the TPM itself. The private part of the storage root key or endorsement key will never be disclosed to any other component, software, process or user. TPM has platform integrity measurement and remote attestation functions, which can evaluate the integrity of the platform startup process and running process and the integrity of the running code, as well as prove the credibility of the TPM platform itself. TPM can also obtain the trusted feature values ​​of the software and hardware of the device platform, record the execution integrity status of all software and hardware modules of the platform, and thus build a trust chain for the trusted computing platform. When any software and hardware module is infected by malicious software, the value of the trust chain will also change.

[0083] TPCM: It is a hardware core control module integrated in the trusted computing platform and used to establish and protect the trust source point. It can provide trusted computing with trusted platform control, integrity measurement, secure storage, trusted reporting, and cryptographic services. Figure 2The figure shows the framework structure of TPCM. TPCM mainly includes basic software, basic hardware and functional service modules. It interacts with computing components through computing component interfaces, interacts with TCM through trusted cryptographic module interfaces, and interacts with trusted software base and trusted platform control module management through functional interfaces. TCM is a trusted cryptographic module that uses the commercial cryptographic (SM) series of national secret algorithms to provide trusted roots and cryptographic operation functions. Similar to TPM, TPCM and TCM also have integrity measurement and remote attestation functions.

[0084] Network link: refers to a passive point-to-point physical connection used to transmit data between devices. In wired communications, a link refers to a physical line between two nodes, such as a cable or optical fiber; in radio communications, a link refers to the path space for electromagnetic waves to propagate between a base station and a terminal, or the path space in underwater acoustic communications.

[0085] Trusted path: A communication path established and maintained between security functions and users to protect communication data from modification and leakage in order to achieve trusted communication between users and database management systems or other security functions. The establishment of a trusted path usually involves selecting and arranging a verified and secure communication path in the network, aiming to improve the security and reliability of network communications and protect the transmission of sensitive information and services.

[0086] It should be noted that the information (including but not limited to device information, subject personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the subject or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards. For example, the link trust status, link status information, device trust status and device status information involved in this application are all obtained with full authorization.

[0087] Exemplarily, a commonly used trusted path establishment method in the industry is often established based on the requirement information of the trusted path and the device trusted status corresponding to the network device, which is briefly described below.

[0088] The network orchestrator obtains the device trusted status corresponding to the network device from the device verification network element, obtains the trusted path requirement information such as the source address information and the target address information of the trusted path from the business system, and generates the trusted path orchestration strategy based on the device trusted status corresponding to the network device and the trusted path requirement information, so that the controller and other execution devices can establish the trusted path based on the orchestration strategy. This method ensures the trustworthiness of the network devices in the trusted path and avoids problems such as data leakage or unauthorized access.

[0089] However, the solution of establishing a trusted path based on the trusted status of network devices can only ensure the trustworthiness of the network devices themselves on the trusted path, and cannot solve the problem of data leakage when data is transmitted between network devices. In addition, the establishment of a trusted path also needs to be based on the demand information (business demand information) of the trusted path. The trusted path is established when business demand arises, which cannot guarantee the efficiency of the trusted path establishment process.

[0090] Based on this, the present application provides a trusted path establishment system, which includes a network orchestrator, a link management platform connected to the network orchestrator, and a device verification network element. When performing trusted path orchestration, the network orchestrator constructs a trusted path topology based on the link trusted status obtained from the link management platform and the device trusted status obtained from the device verification network element, so that the security of network devices and network links is guaranteed at the same time, thereby improving the reliability of the trusted path in the trusted path topology and effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0091] The solution provided by the embodiments of the present application is described in detail below in conjunction with the accompanying drawings.

[0092] The solution provided in this application can be applied to Figure 3 In the computer system shown, Figure 3 The computer system shown is a schematic diagram of the architecture of the computer system. The computer system may include a network orchestrator 300 , a link management platform 301 , a device verification network element 302 , and an SDN controller 303 .

[0093] The link management platform 301 may be a platform for creating, managing, monitoring, and configuring link connections between network devices, server devices, video devices, microwave devices, and PON devices.

[0094] Specifically, the link management platform 301 can automatically discover the link connections of various devices; can create links by selecting link types, devices and ports, and supports batch creation of planned links between devices; after the link accesses the platform, the link management platform 301 also supports viewing the basic information of the link, performing quick search, export, deletion, and positioning of the link to the topology; in addition, the link can be configured as needed to meet specific business needs. The link management platform 301 of the embodiment of the present application is mainly used to monitor or analyze the status and information of the link, and realize the collection, update and maintenance of the link trust status of the network link. The status and information of the link include link status, name, bandwidth, network element name at both ends, network element IP, network element MAC, and port IP at both ends, port management status and port operation status, etc., and the link trust status corresponding to the network link obtained by monitoring or analysis is sent to the network orchestrator 300. When the link management platform 301 is running, it can be supported by hardware such as routers, switches, and servers.

[0095] The device verification network element 302 can be a network element for managing information related to network devices. Network devices are basic elements in the network system, including Internet Protocol (IP), network devices (switches, routers), transmission network devices, access network devices and other non-transparent forwarding network devices. Responsible for data transmission, processing, storage, etc. The device verification network element 302 can verify the identity and authority of network devices, ensure that only legitimate network devices can access the network, and can also check the performance and stability of network devices, monitor the operating status of network devices, and ensure that network devices can meet the needs of the network.

[0096] Specifically, the device verification network element 302 remotely obtains the security status information of the network device through network communication, for example, obtains the device status information of the network device from chips such as TPM and TPCM, and then evaluates or obtains the device trust status corresponding to the network device according to the device status information, and finally sends the device trust status to the network orchestrator 300. When the device verification network element 302 is running, it can be supported by an identity authentication server, a security router, or other network monitoring and management equipment.

[0097] The network orchestrator 300 is a technical tool for managing and arranging network resources and services. Specifically, through automated processes and policies, various devices, connections and services in the network are coordinated and managed to achieve effective management and scheduling of network resources to meet business needs and improve the efficiency and quality of network services. In the embodiment of the present application, the network orchestrator 300 is mainly used to collect, verify, update and maintain the device trusted status corresponding to the network device, and is also used to establish and maintain the trusted path topology. When the network orchestrator 300 is running, it can be supported by hardware such as servers, storage devices, and network interface cards.

[0098] The SDN controller 303 is an application in the SDN, which is used to collect network status information, make routing decisions and policy configurations, and send instructions to data forwarding devices (network devices) to manage and coordinate traffic in the network. The SDN controller 303 communicates and controls specifically through an open and standardized interface established with network devices. Specifically, communication with network devices is achieved through the southbound interface (Southbound Interface), and communication with network management applications or third-party services is achieved through the northbound interface (NorthboundInterface). The most commonly used protocol for the southbound interface is the OpenFlow protocol (OpenFlow), which defines how the SDN controller 303 controls the behavior of data forwarding devices, such as link discovery, topology management, and flow table delivery. The northbound interface enables network administrators or applications to programmatically control network resources, effectively schedule and configure resources for the underlying network, and achieve automatic and flexible management and control of the network.

[0099] The SDN controller 303 in the embodiment of the present application is mainly used to establish a trusted path according to the trusted path topology, orchestration strategy, etc. sent by the network orchestrator 300. The SDN controller can issue control instructions to the network device to instruct the network device to forward traffic, but does not execute the control instructions itself. When the SDN controller 303 is running, it can be supported by hardware such as high-performance and high-reliability servers and processors.

[0100] In some embodiments, the network orchestrator 300, the link management platform 301, the device verification network element 302, and the SDN controller 303 can be deployed in the same hardware device such as a server or a processor, or can be deployed in different hardware devices. The network orchestrator 300, the link management platform 301, the device verification network element 302, and the software defined network SDN controller 303 can all be replaced by applications or platforms with the same functions.

[0101] The network orchestrator 300 , the link management platform 301 , the device verification network element 302 , and the SDN controller 303 may communicate with each other via a network, such as a wired or wireless network.

[0102] Figure 3 The diagram exemplarily shows a network orchestrator 300, a link management platform 301, a device verification network element 302 and an SDN controller 303. Figure 3 The number and name of each device in the embodiment of the present application are not limited. Figure 3 The implementation methods and application scenarios of each device in the system are not limited. Figure 3 In addition to the devices shown in , the computer system may also include other devices, such as network devices, business management devices, etc.

[0103] Figure 4 It is a structural diagram of a trusted path establishment system provided in an embodiment of the present application.

[0104] like Figure 4 As shown, the trusted path establishment system of the embodiment of the present application includes: a network orchestrator 400, a link management platform 401 connected to the network orchestrator 400, and a device verification network element 402. The link management platform 401 is connected to at least one link monitoring device 403, and the device verification network element 402 is connected to at least one network device 404.

[0105] The link management platform 401 is used to obtain the link trust status corresponding to the network link and send the link trust status to the network orchestrator 400.

[0106] The link trust status is used to describe the reliability of the network link. The link trust status can be divided into different levels, reflecting the current operating status and trustworthiness of the link.

[0107] Optionally, the link trust status includes: good link status, normal link status, abnormal link status, faulty link status, etc., but is not limited to these, and the embodiments of the present application do not specifically limit this.

[0108] A good link status means that the link operates normally and the data transmission quality is good. For example, the bit error rate and packet loss rate during data transmission are low, and the bandwidth utilization rate is high, both exceeding the standard level.

[0109] The bit error rate refers to the ratio of the number of erroneous bits received by the data receiving end to the total number of transmitted bits during data transmission, which reflects the accuracy of data transmission. The packet loss rate refers to the ratio of data packets lost due to various reasons such as network congestion, hardware failure, and routing errors during data transmission, which reflects the stability and reliability of the network. The broadband utilization rate, also known as the bandwidth utilization rate, is the ratio of the actual bandwidth used during network transmission to the available bandwidth, which is used to measure the efficiency of network resource utilization. If the equipment operation data is stable and all status quantities meet the standards, it means that the equipment is running efficiently and without any problems.

[0110] A normal link status means that the link is running normally and the data transmission quality is within the standard range. For example, the bit error rate, packet loss rate and bandwidth utilization rate during data transmission are all within the standard range.

[0111] Abnormal link status means that the link connection is unstable and the data transmission quality is significantly lower than the standard level. For example, the bit error rate, packet loss rate and / or bandwidth utilization rate during data transmission are lower than the standard level. In this case, although the link can still operate, the reliability of data transmission is low.

[0112] A link status failure means that the link is completely unable to work normally, resulting in a complete interruption of network communication, seriously affecting the normal transmission process of data, and requires timely maintenance and repair.

[0113] In some embodiments, the link management platform 401 is further used to receive link status information corresponding to the network link, perform link credibility analysis on the link status information, and obtain a link credibility status.

[0114] The link state information is information describing the parameters and states of the link and the signals transmitted in the link. For example, the link state information includes the frequency, bandwidth, attenuation, interference noise, strength, transmission bit error rate, signal-to-noise ratio, link transmission rate, encoding mode, etc. of the signal, but is not limited thereto, and the embodiments of the present application do not specifically limit this.

[0115] Link reliability analysis refers to evaluating the reliability of network links based on link status information.

[0116] Exemplarily, link credibility analysis evaluates the reliability of a network link based on bit error rate, packet loss rate, and bandwidth utilization. The lower the bit error rate and / or packet loss rate and the higher the bandwidth utilization, the higher the reliability of the network link.

[0117] For example, the link credibility analysis may be at least one of the following methods, but is not limited thereto, and the embodiments of the present application do not specifically limit this.

[0118] Method 1: When the bit error rate and packet loss rate of the network link are lower than their corresponding standard ranges, and the bandwidth utilization is higher than the standard range corresponding to the bandwidth utilization, the network link is evaluated as being in good link status.

[0119] When one of the bit error rate and packet loss rate of the network link is lower than the corresponding standard range, and the bandwidth utilization is higher than the standard range corresponding to the broadband utilization; or the bit error rate and packet loss rate of the network link are lower than the corresponding standard range, the network link is evaluated as being in normal link status.

[0120] When one of the bit error rate and packet loss rate of the network link is higher than the corresponding standard range, and the bandwidth utilization is lower than the standard range corresponding to the broadband utilization; or the bit error rate and packet loss rate are higher than the corresponding standard range, the network link is evaluated as having an abnormal link status.

[0121] When the bit error rate and packet loss rate of a network link are higher than their respective standard ranges, and the bandwidth utilization is lower than the standard range corresponding to the bandwidth utilization, the network link is evaluated as a link status failure.

[0122] The network links with good link status and normal link status are taken as the trusted network links, and the network links with good link status are preferentially taken as the trusted network links.

[0123] Method 2: Evaluate the bit error rate, packet loss rate, and (1-bandwidth utilization) of the network link, and determine whether the weighted sum is lower than the trust threshold. If so, the network link is evaluated as a trustworthy network link.

[0124] Among them, the standard range and the credible threshold are default values, or artificially preset values ​​but are not limited to these, and the embodiments of the present application do not specifically limit this.

[0125] In some embodiments, the link management platform 401 is further connected to a link monitoring device 403. The link monitoring device 403 is used to monitor network links and obtain link status information.

[0126] Optionally, the link monitoring device 403 may be at least one of a link anti-eavesdropping device, an optical fiber link monitoring device, and a network link monitoring device, but is not limited thereto and is not specifically limited in the embodiments of the present application.

[0127] Link anti-eavesdropping equipment refers to equipment that protects the security of network communication links and prevents illegal eavesdropping and data leakage. It can detect and prevent potential eavesdropping by real-time monitoring and analysis of signals and data traffic in network links. For example: intrusion detection system, intrusion prevention system, etc.

[0128] Optical fiber link monitoring equipment is used to ensure the stable operation of optical fiber-connected communication networks. For example: optical time domain reflectometer, optical power meter, etc.

[0129] Network link monitoring equipment is used to ensure the stability and safe operation of network communication links. For example: network performance tester, network analyzer, link tester, etc.

[0130] In some embodiments, the link monitoring device 403 may obtain the link status information through an active monitoring method or a passive monitoring method.

[0131] The active monitoring method detects the status of the link by sending test data packets.

[0132] Exemplarily, the connectivity status of the network link is detected through a specific network protocol.

[0133] For example, the connectivity status of a network link is detected through the User Datagram Protocol (UDP). Specifically, a specific string is sent to the monitoring target, and the reply content is checked to see whether it contains the specific string. If it does, it means that the network link between the monitoring target and the monitoring target is connected normally.

[0134] The passive monitoring method is to obtain link status information by monitoring the communication between network devices 404.

[0135] Exemplarily, network traffic is captured and analyzed by a traffic analysis tool to extract link status information.

[0136] For example: send test data packets to the monitoring target through the traffic analysis tool and receive the return packets, analyze the number and content of the return packets, and calculate the bit error rate and packet loss rate of the network link between the monitoring target and the monitoring target.

[0137] In some embodiments, the link management platform 401 receives the link status information sent by the link monitoring device 403 in at least one of the following ways, but is not limited thereto, and the embodiments of the present application do not specifically limit this.

[0138] Mode 1: The link management platform 401 sends a link status query request to the link monitoring device 403 ; and receives link status information reported by the link monitoring device 403 based on the link status query request.

[0139] Exemplarily, the link management platform 401 sends a link status query request to all link monitoring devices 403 , and receives link status information reported by all link monitoring devices 403 .

[0140] In some embodiments, the link management platform 401 sends a link status query request to the designated link monitoring device 403 according to the link identifier, and receives link status information reported by the designated link monitoring device 403 .

[0141] The link identifier refers to an identifier used to identify different links in communication, and the link monitoring device 403 can report the link status information corresponding to the network link according to the link identifier.

[0142] For example, in a multi-protocol label switching network, the link identifier may be a multi-protocol label switching (MPLS) label.

[0143] Mode 2: The link management platform 401 receives the link status information actively reported by the link monitoring device 403 after the link status reporting condition is triggered.

[0144] The link status reporting condition includes at least one of a change in the network link status and periodic reporting of link status information.

[0145] A change in the network link status refers to a change in link status information or a change in the link trust status.

[0146] Exemplarily, the link monitoring device 403 analyzes whether the link status information has changed, for example, if the bit error rate of the network link changes from above the standard range to below the standard range, the link monitoring device 403 reports the changed bit error rate of the network link to the link management platform 401 .

[0147] Periodically reporting link status information refers to automatically or manually reporting link status information according to a predetermined time period.

[0148] Exemplarily, the link monitoring device 403 actively reports the link status information at a certain time interval, for example, the link monitoring device 403 reports the link status information once every hour.

[0149] In some embodiments, the link monitoring device 403 can also directly perform link credibility analysis based on the link status information to obtain the link credibility status. Afterwards, the link monitoring device 403 reports the link credibility status to the link management platform 401 .

[0150] The link monitoring device 403 reports the link trust status to the link management platform 401 in at least one of the following ways, but is not limited thereto, and the embodiments of the present application do not specifically limit this.

[0151] Method 1: The link management platform 401 sends a link query request to the link monitoring device 403 ; and receives the link trust status reported by the link monitoring device 403 based on the link query request.

[0152] Exemplarily, the link management platform 401 sends a link query request to all link monitoring devices 403 , and receives link trust states reported by all link monitoring devices 403 .

[0153] In some embodiments, the link management platform 401 sends a link query request to the designated link monitoring device 403 according to the link identifier, and receives the link trust status reported by the designated link monitoring device 403 .

[0154] Mode 2: The link management platform 401 receives the link trust status actively reported by the link monitoring device 403 after the link status reporting condition is triggered.

[0155] Exemplarily, the link monitoring device 403 analyzes whether the link trust state has changed. For example, if the link trust state changes from the normal link state to the abnormal link state, the link monitoring device 403 reports the changed link trust state to the link management platform 401 .

[0156] In some embodiments, the device verification network element 402 is used to obtain the device trust status corresponding to the network device 404 and send the device trust status to the network orchestrator 400.

[0157] The device trust status is used to describe the reliability of the network device 404. The device trust status can be divided into different levels, reflecting the current operation status and trustworthiness of the device.

[0158] Optionally, the trusted status of the device includes: normal device status, abnormal device status, faulty device status, etc., but is not limited to these, and the embodiments of the present application do not specifically limit this.

[0159] The device status is normal, which means that the performance indicators, security and reliability of the network device 404 are within the standard range. For example, the performance indicators of the network device 404 such as memory and resource utilization are within or exceed the standard range, the network device 404 has no known security vulnerabilities or potential security risks, and the integrity of the code or data in the network device 404 is high.

[0160] The abnormal device status means that the performance indicators, security and / or reliability of the network device 404 are below the standard range.

[0161] Equipment status failure means that the equipment is completely unable to guarantee the security and integrity of data and requires timely maintenance and repair.

[0162] Specifically, the device verification network element 402 is used to receive device status information corresponding to the network device 404, perform device credibility analysis on the device status information, and obtain a device credibility status.

[0163] The device status information refers to various types of information describing the current operating status, security performance, and identity credibility of the network device 404. For example, the device status information may be credibility measurement information of the network device 404.

[0164] The trust measurement information includes information on the network device 404 such as identity authentication, configuration and status, security performance, integrity and credibility verification, log and audit, etc.

[0165] Device credibility analysis refers to evaluating the reliability of network device 404 based on device status information.

[0166] Exemplarily, the device verification network element 402 compares the trust metric information with a preset reference value, and performs a quantitative score or grade classification on the device trust status of the network device 404 .

[0167] For example, when the trust metric information of the network device 404 is higher than the reference value, the network device 404 is a trustworthy network device.

[0168] Among them, the device verification network element 402 can be a network device remote certification and verification function network element.

[0169] Optionally, the network device 404 includes at least one of a TPM module, a TPCM module and a TCM module, but is not limited thereto and is not specifically limited in the embodiments of the present application.

[0170] In some embodiments, the device verification network element 402 receives the device status information sent by the network device 404 in at least one of the following ways, but is not limited thereto, and the embodiments of the present application do not specifically limit this:

[0171] Method 1: Device verification The network element 402 sends a device status query request to the network device 404, and receives device status information reported by the network device 404 based on the device status query request.

[0172] Exemplarily, the device verification network element 402 sends a network status query request to all network devices 404 , and receives device status information reported by all network devices 404 .

[0173] In some embodiments, the device verification network element 402 sends a device status query request to the designated network device 404 according to the device identification, and receives device status information reported by the designated network device 404 .

[0174] The device identification refers to an identifier used to identify different devices in communication, and the device verification network element 402 can report the device status information corresponding to the network device 404 according to the device identification.

[0175] For example, the device identifier may be a serial number, a physical address (Media Access Control Address, MAC address), a universal unique identification code, etc. of the device.

[0176] Mode 2: Device verification The network element 402 receives the device status information actively reported by the network device 404 after the device status reporting condition is triggered.

[0177] The device status reporting condition includes at least one of a change in network device status and periodic reporting of device status information.

[0178] A change in the state of a network device refers to a change in the state information of the device, or a change in the trust state of the device obtained after a device trustworthiness analysis.

[0179] Exemplarily, the network device 404 analyzes whether the device status information has changed. For example, when the trust measurement information of the network device 404 has changed, the changed trust measurement information is reported to the device verification network element 402 .

[0180] Exemplarily, when the network device 404 performs device credibility analysis based on the device status information, it analyzes whether the device credibility status has changed. For example, if the device credibility status changes from the normal device status to the abnormal device status, the network device 404 reports the changed device credibility status to the device verification network element 402.

[0181] Periodic reporting of device status information refers to automatic or manual reporting of device status information at a predetermined time period.

[0182] Exemplarily, the network device 404 actively reports the device status information at a certain time interval, for example, the network device 404 reports the device status information once every hour.

[0183] In some embodiments, the device verification network element 402 can verify the device status information reported by the network device 404 .

[0184] Exemplarily, the trusted computing module in the network device 404 generates a pair of public and private keys to perform access key identifier (Access Key Id, AK) signature verification.

[0185] Among them, AK signature verification is an identity authentication and authorization mechanism.

[0186] Exemplarily, the device status query request sent by the device verification network element 402 to the network device 404 includes the generated random number (nonce). The network device 404 performs an AK signature on the random number (nonce) and the device status information based on the private key, and sends the device status information, AK signature, AK certificate, etc. to the device verification network element 402.

[0187] Among them, the trusted computing module includes security chips and application systems such as TPM, TPCM, TCM and secure element (SE), and has the capabilities of network device 404 software and hardware and runtime status trust measurement, key generation, key storage and remote certification.

[0188] Exemplarily, the network device 404 has one or more trusted computing modules inside according to actual deployment conditions.

[0189] In some embodiments, the network orchestrator 400 is used to receive a link trust state and a device trust state, and obtain a trusted path topology based on the link trust state and the device trust state.

[0190] The trusted path topology refers to a network structure composed of trusted paths to ensure the reliability and security of data transmission in network communications. The trusted path topology includes at least two network devices 404 and at least one trusted path.

[0191] The specific manner in which the network orchestrator 400 constructs a trusted path is as follows, but is not limited thereto:

[0192] The network orchestrator 400 establishes a mapping relationship between the network device 404 and the network link based on the link trust state and the device trust state to obtain a trusted path topology.

[0193] The mapping relationship refers to the connection and correspondence between the network device 404 and the network link in the network environment. The connection between the network device 404 and the network link includes a physical connection and a logical connection.

[0194] Exemplarily, the network device 404 is physically connected to the network link through a physical interface (such as an Ethernet port, a fiber optic interface, etc.) Based on the physical connection, a logical connection is established between the network devices 404, such as a virtual local area network, a virtual private network, etc.

[0195] In some embodiments, the network orchestrator 400 establishes a mapping relationship by associating and mapping a device identifier corresponding to the network device 404 with a link identifier corresponding to the network link to obtain a trusted path topology.

[0196] Exemplarily, the network orchestrator 400 determines a network link in a normal trusted state based on the link trusted state, determines a network device 404 in a normal trusted state based on the device trusted state, and then associates the link identifier corresponding to the network link in a normal trusted state with the device identifier corresponding to the network device 404 in a normal trusted state, thereby connecting all trusted paths to form a trusted path topology.

[0197] For example, when two network devices 404 are credible and the network link between the two network devices 404 is also credible, the path formed by the two network devices 404 and the network link between the two network devices 404 is considered to be a credible path.

[0198] In some embodiments, network orchestrator 400 may receive business requirement information of a business system, and screen a trusted path that meets the business requirement in a pre-established and stored trusted path topology according to the business requirement information.

[0199] Among them, the business system refers to the system used to process business processes, data and information. Business demand information includes the trusted slice information, source address information, target address information, routing information, network service quality information, latency information, etc. of the trusted path required by the business.

[0200] Trusted slice information refers to the logically independent, secure and reliable virtual network information provided to different tenants or applications through SDN architecture and network function virtualization technology on the physical infrastructure shared by multiple tenants.

[0201] Exemplarily, a trusted path that satisfies the source address, target address, and network service quality information of a certain business is screened in the trusted path topology.

[0202] For example, firstly, all trusted paths between the source address and the target address of the service are screened in the trusted path topology, and then a trusted path whose network service quality is higher than the network service quality required by the service is selected from all the trusted paths as the trusted path of the service.

[0203] In some embodiments, network orchestrator 400 may receive business requirement information of a business system, and establish a trusted path topology corresponding to the business requirement information based on the business requirement information.

[0204] For example: the network orchestrator 400 screens all network devices 404 and network links that may be involved between the source address and the target address of a certain service, obtains the device identifier of the network device 404 and the link identifier of the network link, queries the device trusted status of the corresponding network device 404 according to the device identifier, queries the link trusted status of the corresponding network link according to the link identifier, builds a trusted path topology based on the queried device trusted status and link trusted status, and then screens the trusted path that meets the service requirements from the trusted path topology based on the network service quality, latency information, etc.

[0205] In some embodiments, the network orchestrator 400 receives the link trust status and the device trust status in the following manner, but is not limited thereto:

[0206] Method 1: The network orchestrator 400 actively sends a link query request to the link management platform 401 to query the link trust status, and sends a device query request to the device verification network element 402 to query the device trust status.

[0207] In some embodiments, network orchestrator 400 queries the link trust status of all network links and the device trust status of all network devices 404 .

[0208] In other embodiments, network orchestrator 400 queries the link trust status of the specified network link and the device trust status of the specified network device 404 .

[0209] Exemplarily, the link query request includes a link identifier, and the link management platform 401 queries the link trust status of the specified network link based on the link identifier. The device query request includes a device identifier, and the link management platform 401 queries the device trust status of the specified device based on the device identifier.

[0210] The link management platform 401 can store the link trust status, for example, in the form of a link trust status table; upon receiving a link query status request, the link management platform 401 can report the link trust status of the corresponding network link according to the link identifier. The device verification network element 402 can store the device trust status, and upon receiving a device query status request, can report the device trust status of the corresponding network device 404 according to the device identifier.

[0211] Method 2: The network orchestrator 400 receives the link trust status actively reported by the link management platform 401 , and receives the link trust status actively reported by the device verification network element 402 .

[0212] Exemplarily, after receiving the link status information actively reported by the link monitoring device 403, the link management platform 401 actively reports the link trust status to the network orchestrator 400. After receiving the device status information actively reported by the network device 404, the device verification network element 402 actively reports the device trust status to the network orchestrator 400.

[0213] Exemplarily, link management platform 401 reports the link trust status to network orchestrator 400 at a certain time interval, and device verification network element 402 reports the device trust status to network orchestrator 400 at a certain time interval. For example: link management platform 401 reports the link trust status to network orchestrator 400 every hour, and device verification network element 402 reports the device trust status to network orchestrator 400 every hour.

[0214] Method three: the network scheduler 400 can be directly connected to the network device 404 or the network link monitoring device 403 to receive the device trust status of the network device 404 and the link trust status of the network link.

[0215] In some embodiments, the network device 404 in which the network orchestrator 400 establishes a trusted path may belong to one network domain or multiple network domains.

[0216] When belonging to a network domain, the network devices 404 in the network domain are connected to the same SDN controller, the network orchestrator 400 is connected to the SDN controller, and a trusted path is established through the SDN controller.

[0217] When belonging to multiple network domains, each network domain is connected to an SDN controller, and the network orchestrator 400 is connected to each SDN controller respectively, and a trusted path within the corresponding network domain is established through each SDN controller connection.

[0218] Exemplarily, different network domains may have different SDN controllers, network devices 404, and link monitoring devices 403. For example, the network devices 404 of different network domains may be different IP devices, transmission devices, and the like.

[0219] Exemplarily, the trusted computing modules of network devices in different network domains may have different trusted status management methods, for example: the trusted computing module directly connects to the device verification network element to report device status information, or forwards the reported device status information through the network management function network element.

[0220] Exemplarily, different network domains may have different connection modes of network devices 404 and link monitoring devices 403. For example, network orchestrator 400 may be directly connected to network devices 404 and link monitoring devices 403, or may be connected to network devices 404 through device verification network element 402, and may be connected to link monitoring devices 403 through link management platform 401.

[0221] In summary, a trusted path establishment system proposed in an embodiment of the present application, when performing trusted path orchestration, the network orchestrator 400 constructs a trusted path topology with the link trusted status obtained from the link management platform 401 and the device trusted status obtained from the device verification network element 402, so that the security of the network device 404 and the network link is guaranteed at the same time, thereby improving the reliability of the trusted path in the trusted path topology and effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0222] The above embodiment describes in detail an exemplary trusted path establishment system of the present application. A trusted path topology constructed based on the above trusted path establishment system is as follows: Figure 5 shown.

[0223] Figure 5 An example diagram of a trusted path topology is provided for an exemplary embodiment.

[0224] Figure 5 The network structure includes 6 network devices and 8 network links. The network orchestrator receives the device trust status of all network devices and the link trust status of all network links, and determines whether the trust status of the network devices and the trust status of the network links are normal.

[0225] It is assumed that network device 51, network device 53, network device 54 and network device 56 are network devices in a normal trusted state, and network link 500, network link 501, network link 506 and network link 507 are network links in a normal trusted state. Then the path formed by connecting network device 51, network device 54, network device 56 and network link 500, network link 501 is a trusted path; the path formed by connecting network device 53, network device 54, network device 56 and network link 501, network link 507 is a trusted path; the path formed by connecting network device 53, network device 54, network device 51 and network link 500, network link 507 is a trusted path; the path formed by connecting network device 52, network device 56 and network link 506 is a trusted path; the path formed by connecting network device 51, network device 54 and network link 500 is a trusted path; the path formed by connecting network device 53, network device 54 and network link 507 is a trusted path; the path formed by connecting network device 54, network device 56 and network link 501 is a trusted path.

[0226] The network orchestrator receives business demand information from the business system. Assuming that the business demand information indicates that the source address of a business data transmission is network device 51 and the destination address is 56, then in the trusted path topology formed by the above-mentioned trusted path, the path formed by connecting network devices 51, 54, 56 and network links 500 and 501 is selected as the trusted path as the trusted path of the business.

[0227] To sum up, the trusted path topology constructed by the trusted path establishment system of the present application can intuitively display the connection relationship between network devices and network links, and can also intuitively display all trusted paths formed by the connection of network devices and network links. It can directly select the required trusted path in the trusted path topology according to business demand information, and the trusted path establishment is more efficient and convenient.

[0228] The above embodiment describes in detail the trusted path establishment system and the trusted path topology of the embodiment of the present application. Next, the trusted path establishment method in the embodiment of the present application will be described in detail.

[0229] Figure 6 A flow chart of a trusted path establishment method provided by an exemplary embodiment, the method can be executed by a network orchestrator. The method includes:

[0230] Step S601: The network orchestrator obtains the link trust status corresponding to the network link.

[0231] The link trust status is used to describe the reliability of the network link.

[0232] Exemplarily, the link credibility status is obtained after the link management platform performs a link credibility analysis on the link status information.

[0233] Link reliability analysis refers to evaluating the reliability of network links based on link status information.

[0234] Exemplarily, the reliability of the network link is evaluated based on the bit error rate, the packet loss rate and the bandwidth utilization rate. The lower the bit error rate and the packet loss rate, the higher the bandwidth utilization rate, and the higher the reliability of the network link.

[0235] In some embodiments, the method of obtaining the link trust status includes at least one of the following methods, but is not limited thereto, and the embodiments of the present application do not specifically limit this:

[0236] Method 1: The network orchestrator actively sends a link query request to the link management platform to query the link trust status.

[0237] In some embodiments, the network orchestrator queries the link trust status of all network links.

[0238] In other embodiments, the network orchestrator queries the link trust status of a specified network link.

[0239] Exemplarily, the link query request includes a link identifier, and the link management platform queries the link trust status of the specified link based on the link identifier.

[0240] Among them, the link management platform can store the link trust status, and when receiving a link query status request, it can report the link trust status of the corresponding network link according to the link identifier.

[0241] Method 2: The network orchestrator receives the link trust status actively reported by the link management platform.

[0242] Exemplarily, after receiving the link status information actively reported by the link monitoring device, the link management platform actively reports the link trust status to the network orchestrator.

[0243] Exemplarily, the link management platform reports the link trust status to the network orchestrator at a certain time interval. For example, the link management platform reports the link trust status to the network orchestrator every hour.

[0244] Method three: The device verification network element can be directly connected to the network link monitoring device to receive the link trust status of the network link.

[0245] Step S602: The network orchestrator obtains the device trust status corresponding to the network device.

[0246] Among them, the device trusted status is used to describe the reliability of network devices.

[0247] Exemplarily, the device trust status is obtained after the device verification network element performs device trustworthiness analysis on the device status information.

[0248] Device credibility analysis refers to evaluating the reliability of network devices based on device status information. For example, when the integrity of a network device is maliciously tampered with or destroyed, the device credibility status changes to abnormal device status.

[0249] In some embodiments, the method of obtaining the trusted status of the device includes at least one of the following methods, but is not limited thereto, and the embodiments of the present application do not specifically limit this:

[0250] Method 1: The network orchestrator actively sends a device query request to the device verification network element to query the device's trusted status.

[0251] In some embodiments, the network orchestrator queries all network devices for device trust status.

[0252] In other embodiments, the network orchestrator queries the device trust status of a specified network device.

[0253] Exemplarily, the device query request includes a device identification, and the link management platform queries the device trust status of the specified device based on the device identification.

[0254] Among them, the device verification network element can store the device trust status, and when receiving a device query status request, it can report the device trust status of the corresponding network device according to the device identification.

[0255] Method 2: The network orchestrator receives the link trust status proactively reported by the device to verify the network element.

[0256] Exemplarily, after receiving the device status information actively reported by the network device, the device verification network element actively reports the trusted status of the device to the network orchestrator.

[0257] Exemplarily, the device verification network element reports the device trust status to the network orchestrator at a certain time interval. For example, the device verification network element reports the device trust status to the network orchestrator every hour.

[0258] Method three: The device verification network element can directly connect to the network device and receive the device trust status of the network device.

[0259] Step S603: The network orchestrator obtains a trusted path topology based on the trusted state of the link and the trusted state of the device.

[0260] Among them, the trusted path topology refers to the network structure composed of trusted paths to ensure the reliability and security of data transmission in network communications.

[0261] The trusted path topology includes at least one trusted path.

[0262] Specifically, based on the link trust state and the device trust state, a mapping relationship between network devices and network links is established to obtain a trusted path topology.

[0263] The mapping relationship between network devices and network links refers to the connection and correspondence between network devices (such as routers, switches, servers, etc.) and network links (such as optical fibers, copper wires, wireless networks, etc.) in a network environment.

[0264] Exemplarily, a device identifier corresponding to a network device and a link identifier corresponding to a network link are associated and mapped to obtain a trusted path topology.

[0265] Exemplarily, the network orchestrator determines a network link in a normal trusted state based on the link trusted state, determines a network device in a normal trusted state based on the device trusted state, and then associates the link identifier corresponding to the network link in a normal trusted state with the device identifier corresponding to the network device in a normal trusted state, thereby connecting all trusted paths to form a trusted path topology.

[0266] In summary, in the above-mentioned trusted path establishment method based on the execution of the network orchestrator, the network orchestrator obtains the link trusted state and the device trusted state to build the trusted path topology, so that the security of the network devices and network links is guaranteed at the same time, and the reliability of the trusted path in the trusted path topology is improved, and the security risks of the network system being maliciously tampered with and the data being stolen are effectively avoided.

[0267] Figure 7 A flow chart of a trusted path establishment method provided by an exemplary embodiment, which can be executed by a link management platform. The method includes:

[0268] Step S701: The link management platform obtains the link trust status corresponding to the network link.

[0269] The link trust state is used to describe the reliability of the network link and to build the trusted path topology.

[0270] Trusted path topology refers to a network structure composed of trusted paths to ensure the reliability and security of data transmission in network communications.

[0271] The trusted path topology includes at least one trusted path.

[0272] Specifically, link status information corresponding to a network link is received, and link credibility analysis is performed on the link status information to obtain a link credibility status.

[0273] In some embodiments, the link management platform receives the link status information in at least one of the following ways, but is not limited thereto. The embodiments of the present application do not specifically limit this:

[0274] Method 1: The link management platform sends a link status query request to the link monitoring device; and receives link status information reported by the link monitoring device based on the link status query request.

[0275] Exemplarily, the link management platform sends a link status query request to all link monitoring devices, and receives link status information reported by all link monitoring devices.

[0276] In some embodiments, the link management platform sends a link status query request to a designated link monitoring device according to the link identifier, and receives link status information reported by the designated link monitoring device.

[0277] The link identifier refers to an identifier used to identify different links in communication, and the link monitoring device can report the link status information corresponding to the network link according to the link identifier.

[0278] For example, in a multi-protocol label switching network, the link identifier may be a multi-protocol label switching (MPLS) label.

[0279] Method 2: The link management platform receives the link status information actively reported by the link monitoring device after the link status reporting condition is triggered.

[0280] The link status reporting condition includes at least one of a change in the network link status and periodic reporting of link status information.

[0281] The change in the network link status refers to a change in link status information, or a change in the link credibility status obtained after link credibility analysis.

[0282] Exemplarily, the link monitoring device analyzes whether the link status information has changed, for example, if the bit error rate of the network link changes from above the standard range to below the standard range, the link monitoring device reports the changed bit error rate of the network link to the link management platform.

[0283] Exemplarily, when the link monitoring device performs link credibility analysis based on the link status information, it analyzes whether the link credibility status has changed. For example, if the link credibility status changes from the normal link status to the abnormal link status, the link monitoring device reports the changed link credibility status to the link management platform.

[0284] Periodically reporting link status information refers to automatically or manually reporting link status information according to a predetermined time period.

[0285] Exemplarily, the link monitoring device actively reports the link status information at a certain time interval, for example, the link monitoring device reports the link status information once every hour.

[0286] Step S702: The link management platform sends the link trust status to the network orchestrator.

[0287] In some embodiments, after receiving the actively reported link status information, the link management platform sends the link trust status obtained based on the actively reported link status information to the network orchestrator.

[0288] In other embodiments, the link management platform sends the link trust status to the network orchestrator based on the link query request sent by the network orchestrator.

[0289] Exemplarily, the link query request includes a link identifier, and the link management platform queries the link trust status of the specified network link based on the link identifier.

[0290] Among them, the link management platform can store the link trust status, and when receiving a link query status request, it can send the link trust status of the corresponding network link to the network orchestrator according to the link identifier.

[0291] For example, Figure 8 A schematic diagram of the structure of a link management platform provided in an embodiment of the present application. Figure 8 The system includes six network devices 802, a link management platform 801, and six link monitoring devices 800. The link monitoring device 800 is arranged on the network link between the network devices 802, and the link monitoring device 800 is used to obtain the link status information of the network link and report it to the link management platform 801. Each network monitoring device 800 can directly perform link credibility analysis based on the link status information, obtain the link credibility status and report it to the link management platform 801, or the link management platform 801 can perform link credibility analysis based on the link status information to obtain the link credibility status. The number and connection positions of the link management platform 801 and the link monitoring device 800 are not limited to Figure 8 As shown in , the embodiments of the present application are not limited to this.

[0292] To summarize, in the above-mentioned trusted path method executed based on the link management platform, the link management platform sends the acquired link trusted status to the network orchestrator, so that the network orchestrator can build a trusted path topology based on the link trusted status to ensure the security of the network link, thereby improving the reliability of the trusted path in the trusted path topology and effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0293] Fig. 9A flow chart of a trusted path establishment method provided in an embodiment of the present application, which can be executed by a device verification network element. The method includes:

[0294] Step S901: The device verification network element obtains the device trust status corresponding to the network device.

[0295] Among them, the device trusted status is used to describe the reliability of network devices and is also used to build a trusted path topology.

[0296] Trusted path topology refers to a network structure composed of trusted paths to ensure the reliability and security of data transmission in network communications.

[0297] The trusted path topology includes at least one trusted path.

[0298] Specifically, the device status information corresponding to the network device is received, and the device credibility analysis is performed on the device status information to obtain the device credibility status.

[0299] In some embodiments, the manner of receiving the device status information corresponding to the network device includes at least one of the following manners, but is not limited thereto, and the embodiments of the present application do not specifically limit this:

[0300] Method 1: The device verification network element sends a device status query request to the network device, and receives the device status information reported by the network device based on the device status query request.

[0301] Exemplarily, the device verification network element sends a network status query request to all network devices, and receives device status information reported by all network devices.

[0302] In some embodiments, the device verification network element sends a device status query request to a designated network device according to the device identification, and receives device status information reported by the designated network device.

[0303] Among them, the device identification refers to an identifier used to identify different devices in communication, and the device verification network element can report the device status information corresponding to the network device according to the device identification.

[0304] For example, the device identifier may be a serial number, a physical address (Media Access Control Address, MAC address), a universal unique identification code, etc. of the device.

[0305] Method 2: The device verification network element receives the device status information actively reported by the network device after the device status reporting condition is triggered.

[0306] The device status reporting condition includes at least one of a change in network device status and periodic reporting of device status information.

[0307] A change in the state of a network device refers to a change in the state information of the device, or a change in the trust state of the device obtained after a device trustworthiness analysis.

[0308] Exemplarily, the network device analyzes whether the device status information has changed. For example, when the trust measurement information of the network device has changed, the changed trust measurement information is reported to the device verification network element.

[0309] Exemplarily, when the network device performs device credibility analysis based on device status information, it analyzes whether the device credibility status has changed. For example, if the device credibility status changes from a normal device status to an abnormal device status, the network device reports the changed device credibility status to the device verification network element.

[0310] Periodic reporting of device status information refers to automatic or manual reporting of device status information at a predetermined time period.

[0311] Exemplarily, the network device actively reports the device status information at a certain time interval, for example, the network device reports the device status information once every hour.

[0312] Step S902: The device verification network element sends the device trusted status to the network orchestrator.

[0313] In some embodiments, after receiving the actively reported device status information, the device verification network element sends the device trusted status obtained based on the actively reported device status information to the network orchestrator.

[0314] In other embodiments, the device verification network element sends the device trusted status to the network orchestrator based on the device query request sent by the network orchestrator.

[0315] Exemplarily, the device query request includes a device identifier, and the device verification network element queries the device trustworthy status of the specified network device based on the device identifier.

[0316] Among them, the device verification network element can store the device trust status, and when receiving a device query status request, it can send the device trust status of the corresponding network device to the network orchestrator according to the device identifier.

[0317] To summarize, in the above-mentioned trusted path establishment method based on the execution of the device verification network element, the device verification network element sends the acquired device trusted status to the network orchestrator, so that the network orchestrator can build a trusted path topology based on the device trusted status to ensure the security of network devices, thereby improving the reliability of the trusted path in the trusted path topology and effectively avoiding the security risks of malicious tampering of the network system and data theft.

[0318] The above describes the method for establishing a trusted path from the network orchestrator side, the link management platform side, and the device verification network element side. Next, the method for establishing a trusted path will be described from the overall system side.

[0319] For example, Fig.10 The flowchart of the trusted path establishment method is shown in FIG.

[0320] Step S1001: The network orchestrator receives business demand information sent by the business system.

[0321] Business demand information includes trusted slice information, source address information, destination address information, routing information, network service quality information, latency information, etc. of the trusted path required by the business.

[0322] Step S1002: The network orchestrator generates an orchestration strategy based on business requirements and trusted path topology.

[0323] Trusted path topology refers to a network structure composed of trusted paths to ensure the reliability and security of data transmission in network communications.

[0324] The orchestration strategy includes the selection of the trusted path and the configuration of the network devices and network links in the trusted path.

[0325] Step S1003: The network orchestrator sends the orchestration policy to the SDN controller.

[0326] In the SDN architecture, it is difficult for one SDN controller to control all forwarding capabilities of the network layer, so the network orchestrator is connected to all SDN controllers.

[0327] Step S1004: The SDN controller configures the connection relationship between network devices based on the orchestration strategy and establishes a trusted path.

[0328] For example, Fig.10 The trusted path establishment method shown can be achieved by Fig.11 The system includes a network orchestrator 1100, a link management platform 1101 connected to the network orchestrator 1100, a device verification network element 1102, a service system 1103 and an SDN controller 1104, a link monitoring device 1105 connected to the link management platform 1101, and a network device 1106 connected to the device verification network element 1102. The network orchestrator 1100 generates a trusted path topology based on the device trusted state sent by the device verification network element 1102 and the link trusted state sent by the link management platform 1101, then receives the service requirement information sent by the service system 1103, selects a trusted path that meets the service requirement in the trusted path topology, and then establishes the trusted path through the SDN controller 1104.

[0329] Optional, Fig.11 The SDN controller 1104 may also be an element management system (EMS / ) or a network management system (NMS).

[0330] Among them, the EMS system and the NMS system can realize the functions of device management, performance management, fault management and security management of the network device 1106. When the EMS system and the NMS system have the function of collecting and evaluating the trustworthy measurement information of the network device 1106, the device verification network element 1102 can also obtain the device status information and device trustworthy status of the network device 1106 from the EMS system and the NMS system.

[0331] In summary, the network orchestrator selects the trusted path that meets the business requirements in the trusted path topology based on the business demand information, and the SDN controller establishes the trusted path for the business. The establishment of the trusted path is efficient and convenient, ensuring the security and reliability of the data transmission of the business.

[0332] The above mainly introduces the solution provided by the present application. Accordingly, the present application also provides the following trusted path establishment device, which is used to implement the above method embodiment.

[0333] like Fig.12 The structure diagram of the trusted path establishment device shown in FIG. 1 is a schematic diagram of the structure of the trusted path establishment device, and the trusted path establishment device may include an acquisition module 1201 and a construction module 1202. Among them, the acquisition module 1201 is used to execute Figure 6 The operations of steps S601 and S602 in the illustrated method; the construction module 1202 is used to execute Figure 6 The operation of step S603 in .

[0334] like Fig.13 The structure diagram of the trusted path establishment device shown in FIG. 1 is a schematic diagram of the structure of the trusted path establishment device, which may include an acquisition module 1300 and a sending module 1310. The acquisition module 1300 is used to execute Figure 7 In the operation of step S701 of the illustrated method, the sending module 1310 is used to execute Figure 7 The operation of step S702 in the illustrated method.

[0335] In some embodiments, in order to implement the above functions, the trusted path establishment device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0336] The embodiment of the present application can divide the functional modules of the trusted path establishment device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0337] like Fig.14 As shown, the computer device provided in the embodiment of the present application may include a processor 1401, a bus 1402, a communication interface 1403, and a memory 1404. The processor 1401, the memory 1404, and the communication interface 1403 communicate with each other through the bus 1402. It should be understood that the present application does not limit the number of processors and memories in the network device.

[0338] The bus 1402 may be a PCI bus or an extended industry standard architecture (EISA) bus, or a USB bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.14 The bus 1402 may include a path for transmitting information between various components of a computer device (eg, memory 1404, processor 1401, communication interface 1403).

[0339] The processor 1401 may include any one or more processors such as a CPU, a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0340] The memory 1404 may include a volatile memory, such as a random access memory (RAM). The processor 1401 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0341] The communication interface 1403 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the network device and other devices or a communication network.

[0342] The memory 1404 stores executable program codes, and the processor 1401 executes the executable program codes to respectively implement the functions of the aforementioned method embodiments. That is, the memory 1404 stores instructions for executing the aforementioned trusted path establishment method.

[0343] On the other hand, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor to implement the trusted path establishment method provided by the above method embodiments.

[0344] On the other hand, a computer program product is provided. The computer program product includes a computer program or instructions. When the computer program or instructions are executed by a processor, the trusted path establishment method as described above is implemented.

[0345] On the other hand, a chip system is provided, comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to the at least one processor, and when the at least one processor executes the instructions, the at least one processor executes to implement the trusted path establishment method as described above.

[0346] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the module is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, module and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0347] Since the trusted path establishment module, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present invention will not be repeated here.

[0348] The method steps in this embodiment can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a network device. Of course, the processor and the storage medium can also exist in a network device as discrete components.

[0349] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When a computer program or instruction is loaded and executed on a computer, the process or function of the embodiment of the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable module. The computer program or instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instruction can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium can be a magnetic medium, for example, a floppy disk, a hard disk, a tape; it can also be an optical medium, for example, a digital video disc (digital video disc, DVD); it can also be a semiconductor medium, for example, a solid state drive (solid statedrive, SSD). The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A trusted path establishment system, characterized in that: The system includes a network orchestrator, a device verification network element connected to the network orchestrator, and a link management platform; The link management platform is used to obtain a link trust state corresponding to a network link, and send the link trust state to the network orchestrator, where the link trust state is used to describe the reliability of the network link; The device verification network element is used to obtain a device trust status corresponding to a network device and send the device trust status to the network orchestrator, where the device trust status is used to describe the reliability of the network device; The network orchestrator is configured to receive the link trust state and the device trust state; Based on the link trusted state and the device trusted state, a trusted path topology is obtained, wherein the trusted path topology includes at least one trusted path.

2. The system according to claim 1, characterized in that The link management platform is also used to receive link status information corresponding to the network link; perform link credibility analysis on the link status information to obtain the link credibility status, and the link credibility analysis refers to evaluating the reliability of the network link based on the link status information.

3. The system according to claim 2, characterized in that The link management platform is further configured to send a link status query request to a link monitoring device; and receive the link status information reported by the link monitoring device based on the link status query request; Alternatively, the link management platform is further configured to receive the link status information actively reported by the link monitoring device after a link status reporting condition is triggered.

4. The system according to claim 3, characterized in that The link status reporting condition includes at least one of a change in network link status and periodic reporting of link status information.

5. The system according to any one of claims 1 to 4, characterized in that: The device verification network element is also used to receive device status information corresponding to the network device; perform device credibility analysis on the device status information to obtain the device credibility status, and the device credibility analysis refers to evaluating the reliability of the network device based on the device status information.

6. The system according to claim 5, characterized in that The device verification network element is further used to send a device status query request to the network device; receive the device status information reported by the network device based on the device status query request; Alternatively, the device verification network element is further used to receive the device status information actively reported by the network device after a device status reporting condition is triggered.

7. The system according to claim 6, characterized in that The device status reporting condition includes at least one of a change in network device status and periodic reporting of device status information.

8. The system according to any one of claims 1 to 7, characterized in that: The network orchestrator is further configured to establish a mapping relationship between the network device and the network link based on the link trust state and the device trust state to obtain the trusted path topology.

9. The system according to claim 8, characterized in that The network orchestrator is further used to associate and map the device identifier corresponding to the network device and the link identifier corresponding to the network link to obtain the trusted path topology.

10. A trusted path establishment method, characterized in that: Applied to a network orchestrator, the method comprises: Obtaining a link trust state corresponding to a network link and a device trust state corresponding to a network device; the link trust state is used to describe the reliability of the network link, and the device trust state is used to describe the reliability of the network device; Based on the link trusted state and the device trusted state, a trusted path topology is obtained, wherein the trusted path topology includes at least one trusted path.

11. The method according to claim 10, characterized in that The link credibility status is obtained after the link management platform performs a link credibility analysis on the link status information.

12. The method according to claim 10, characterized in that The device trustworthy status is obtained after the device verification network element performs device trustworthiness analysis on the device status information.

13. The method according to any one of claims 10 to 12, characterized in that: The obtaining a trusted path topology based on the link trusted state and the device trusted state includes: Based on the link trust state and the device trust state, a mapping relationship between the network device and the network link is established to obtain the trusted path topology.

14. The method according to claim 13, characterized in that The establishing a mapping relationship between the network device and the network link to obtain the trusted path topology includes: The device identifier corresponding to the network device and the link identifier corresponding to the network link are associated and mapped to obtain the trusted path topology.

15. A trusted path establishment method, characterized in that: Applied to a link management platform, the method comprises: Obtain the link trust status corresponding to the network link; The link trusted state is sent to a network orchestrator, where the link trusted state is used to describe the reliability of the network link, and the link trusted state is used to construct a trusted path topology, where the trusted path topology includes at least one trusted path.

16. The method according to claim 15, characterized in that The obtaining of the link trust status corresponding to the network link includes: Receiving link status information corresponding to the network link; A link credibility analysis is performed on the link status information to obtain the link credibility status, wherein the link credibility analysis refers to evaluating the reliability of the network link based on the link status information.

17. The method according to claim 16, characterized in that The receiving link status information corresponding to the network link includes: Sending a link status query request to a link monitoring device; receiving the link status information reported by the link monitoring device based on the link status query request; Or, receiving the link status information actively reported by the link monitoring device after a link status reporting condition is triggered.

18. The method according to claim 17, characterized in that The link status reporting condition includes at least one of a change in the network link status and periodic reporting.

19. A trusted path establishment device, characterized in that: The device includes: An acquisition module, used to acquire a link trust state corresponding to a network link and a device trust state corresponding to a network device; wherein the link trust state is used to describe the reliability of the network link, and the device trust state is used to describe the reliability of the network device; A construction module is used to obtain a trusted path topology based on the link trusted state and the device trusted state, wherein the trusted path topology includes at least one trusted path.

20. A trusted path establishment device, characterized in that: The device includes: An acquisition module, used to acquire a link trust state corresponding to a network link, wherein the link trust state is used to describe the reliability of the network link; A sending module is used to send the link trusted state to the network orchestrator.

21. A computer device, characterized in that: The computer comprises: a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to implement the trusted path establishment method according to any one of claims 10 to 18.

22. A computer-readable storage medium, characterized in that: At least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by the processor to implement the trusted path establishment method according to any one of claims 10 to 18.

23. A computer program product, characterized in that The computer program product includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the trusted path establishment method according to any one of claims 10 to 18 is implemented.

Images