Application aware network implementation method based on controller

Abstract

The invention discloses an application awareness network implementation method based on a controller. The method comprises the steps that the controller provides a user group management function, a service group management function, a network application identifier management function, a network application identifier marking strategy configuration function, a service flow scheduling guarantee capability and a service visualization and diagnosis capability; the controller provides a user group parameter definition, a service group parameter definition and a network application identification parameter definition; and the controller opens interactive interfaces with the public network user side management and control system, the public network service side management and control system and the VPN management and control system, and provides a public network service network application identifier management process and a VPN service awareness network identifier management process. According to the method, network application identifiers are uniformly distributed and configured through a controller, and a tunnel drainage strategy based on the network application identifiers is managed, so that end-to-end access of a user to a server is controllable.

Description

Technical Field

[0001] The present invention relates to the field of network perception, and in particular to a method for implementing a controller-based application-aware network (an application-aware network is a network that supports APN6, and devices in the network are required to support APN6). Background Art

[0002] IPv6+ is an intelligent IP technology for 5G and cloud computing. Its core is based on the IPv6 technology architecture and is innovatively developed based on the emerging services of users. Behind any technological innovation, there is an invisible driving force - user needs, that is, the needs of user business development. To be more specific, it is the user's application system that drives the development of the network. The development of IPv6+ in three stages is the result of user business drive. IPv6+3.0 requires network-aware applications. The network-aware business applications carry the needs of network resources and can call corresponding resources immediately, so that many business applications can run smoothly. Internet applications have different requirements for network bandwidth, latency, jitter, packet loss rate, etc., and the decoupling of network and application makes it impossible for the network to effectively perceive the needs of applications, so it is difficult to provide corresponding service quality SLA guarantees for applications. An application-aware network based on IPv6, APN6, is proposed. By encapsulating the application demand information in data packets, the network can perceive the application and its needs, which is convenient for the network to schedule traffic and adjust resources. A secure access control solution is designed to solve the problem of forgery and tampering of application information in APN6 access scenarios, ensuring that APN6 only provides corresponding services to legitimate users.

[0003] The present invention is a practical application solution of APN6. Relying on the controller, in the provincial operator network, the application and the network are connected in series to realize the implementation of APN6 application-aware network based on IPv6 in the network.

[0004] As an innovative network technology, APN6 is an important bridge connecting networks and applications. Both networks and applications can recognize IPv6. APN6 uses the extended header of IPv6 messages to carry application information, allowing the network to identify applications and perceive the application's needs for the network, thereby providing accurate and differentiated network services for different application services. Among them, application information currently includes two categories:

[0005] APN ID: Network application identifier. This information must be carried in the IPv6 message of the APN6 network.

[0006] APN Parameters: Information about the application's requirements for network quality, such as bandwidth requirements, latency requirements, jitter requirements, and packet loss rate requirements.

[0007] To implement traffic diversion based on APN ID, you need to first divert service traffic to an SRv6 TE Policy group for forwarding. In this SRv6 TE Policy group, you need to establish a mapping relationship between the APN ID and the SRv6 TE Policy or SRv6 BE (Segment Routing version 6 Based). When traffic is forwarded in the SRv6 TE Policy group, the SRv6 TE Policy or SRv6 BE policy that matches the APN ID carried in the traffic packet is searched for, and the traffic is forwarded along the path of the matching SRv6 TE Policy or in SRv6 BE mode. Summary of the invention

[0008] In view of the above situation, the present invention provides a controller-based application-aware network implementation method, which is based on the controller, and uniformly allocates and configures network application identifiers through the controller, and manages the tunnel diversion strategy based on network application identifiers to achieve controllable end-to-end access from users to services. The present invention implements the APN6 scenario of both public network services and VPN services, exchanges network application identification information for the two services, and realizes the planning, registration, distribution and tunnel binding capabilities of network application identifiers (APN IDs).

[0009] To achieve the above object, the present invention adopts the following technical solutions:

[0010] In one embodiment of the present invention, a controller-based application-aware network implementation method is proposed, the method comprising:

[0011] The controller provides user group management, service group management, centralized allocation management of network application identifiers, tagging strategy configuration of network application identifiers, traffic scheduling and guarantee capabilities based on network application identifiers in public network and VPN business scenarios, business visualization, and business fault diagnosis capabilities based on flow detection data;

[0012] The controller provides user group parameter definition, service group parameter definition and network application identification parameter definition; the network application identification includes the user group identification and the service group identification;

[0013] The controller opens interactive interfaces with the public network user side control system, the public network service side control system and the VPN control system, which are used to interact with the control systems on the public network user side and the public network service side to plan network application identification, and interact with the VPN control system to identify network application identification and configure tunnel mapping strategies;

[0014] The controller provides the public network service network application identification management process and the VPN service awareness network identification management process.

[0015] Furthermore, the controller provides a marking policy configuration function for the network application identifier. According to the service group and user group definition of the network application identifier, combined with VPN and IP routing information, it automatically searches for user access devices and application access devices, configures service flow identification and marking policies in the form of IP five-tuples on user access devices and application access devices, and adds a network application identifier tag to the IPv6 packet header of a specific service flow.

[0016] Furthermore, the controller provides traffic scheduling and guarantee capabilities based on network application identifiers in public network and VPN business scenarios. According to the definition of network application identifiers, it automatically searches for user access devices and application access devices in combination with VPN and IP routing information. On user access devices and application access devices, it supports configuring a mapping strategy from network application identifiers to SRv6 Policy colors, and introduces public network or VPN business flows carrying specific network application identifiers into the SRv6 tunnel.

[0017] Furthermore, user groups and service groups are combined into applications, and the access of a user group to a service group is defined as an application;

[0018] User groups, service groups and applications are centrally managed by the controller. The public network user-side management and control system and the public network service-side management and control system register and query user groups, service groups and application information through the API interface provided by the controller. User group identifiers, service group identifiers and network application identifiers are globally and uniformly allocated by the controller. The network application identifier will be carried in the IPv6 message for network devices to identify the application. Network devices can perform traffic diversion and path assurance processing based on the network application identifier of the IPv6 message. The controller provides an API interface to provide path assurance for the application.

[0019] Furthermore, the controller opens the "public network user group registration" interface, the "public network user group query" interface, the "public network service network application identity allocation" interface and the "network application identity mapping policy creation" interface for the public network user side management and control system to call; the controller opens the "public network service group registration" interface and the "public network service group query" interface for the public network service side management and control system to call; the controller opens the "VPN service network application identity allocation" interface and the "network application identity mapping policy creation" interface for the VPN management and control system to call; the public network service side management and control system opens the "network application identity marking policy addition" interface for the controller to call.

[0020] Furthermore, the public network service network application identification management process is as follows:

[0021] The public network service-side control system calls the controller's "public network service group registration" interface to register the service group;

[0022] The public network user-side control system calls the controller's "public network user group registration" interface to register the user group;

[0023] The public network user-side control system receives the user application access protection demand, calls the controller's "Public Network Service Group Query" interface to query the service ID and service address port list, and then calls the controller's "Public Network Service Network Application ID Allocation" interface, enters the user group and service group ID information, and obtains the public network service network application ID;

[0024] The public network user-side control system instructs the user side to add a public network service network application identification mark to the IPv6 message header;

[0025] After the controller allocates the public network service network application identifier, it calls the "network application identifier tagging strategy addition" interface of the public network service side control system that has registered the service group, initiates a return service tagging request, and brings in the service group identifier, user address range and public network service network application identifier ID. The public network service side control system instructs the service side to add the public network service network application identifier tag to the IPv6 message header;

[0026] The public network user-side control system calls the controller's "Network Application Identity Mapping Policy Creation" interface, configures the network application identity mapping policy on the PE device interconnected with the user access device, maps the network application identity to the color corresponding to the security level, and supports the simultaneous configuration of the network application identity marking policy based on the IP quintuple. The backbone network automatically directs traffic to the SRv6 tunnel corresponding to the color; the controller automatically configures the network application identity mapping policy on the PE device interconnected with the service access device, maps the public network service network application identity to the color corresponding to the security level, and supports the simultaneous configuration of the network application identity marking policy based on the IP quintuple. The backbone network automatically directs traffic to the SRv6 tunnel corresponding to the color to achieve backhaul protection.

[0027] Furthermore, the VPN service-aware network identification management process is as follows:

[0028] When the VPN management and control system receives the user's application access protection requirements, it calls the controller's "VPN business network application identification allocation" interface, enters the VPN name, user group and service group information, and obtains the VPN business network application identification;

[0029] The VPN management and control system instructs the user side and the service side to add a VPN service network application identification mark to the service flow message header;

[0030] The VPN management and control system calls the controller's "Network Application Identifier Mapping Policy Creation" interface to configure the network application identifier mapping policy on the NPE device interconnected with the user access device and the CPE device interconnected with the resource pool where the service is located, and maps the VPN service network application identifier ID to the color corresponding to the security level. It supports the configuration of the network application identifier marking policy based on the IP quintuple at the same time. The backbone network identifies the application and directs the traffic to the SRv6 tunnel corresponding to the color.

[0031] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned controller-based application-aware network implementation method is implemented.

[0032] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing the controller-based application-aware network implementation method.

[0033] Beneficial effects:

[0034] 1. The present invention proposes a practical APN6 scenario support solution that can be implemented at the operator group level and provincial level.

[0035] 2. The present invention supports both public network service network applications and VPN network service applications, and supports the security of applications in public networks and private networks.

[0036] 3. The present invention defines network application identification and distinguishes security levels in the definition.

[0037] 4. The present invention realizes the management of network application identification and realizes closed-loop management of the entire life cycle of the application.

[0038] 5. The present invention provides a traffic scheduling guarantee capability based on network application identification for public network and VPN business scenarios, and presents the user, service and business flow path information corresponding to the network application identification in a graphical manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a diagram of the controller-based application-aware network implementation architecture of the present invention;

[0040] Figure 2 It is a flow chart of public network service network application identification management of the present invention;

[0041] Figure 3 It is a flow chart of VPN service network application identification management of the present invention;

[0042] Figure 4 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0043] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0044] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0045] According to an embodiment of the present invention, a controller-based application-aware network implementation method is proposed, such as Figure 1 As shown, in the network application-aware service, that is, the service application scenario using APN6, the network can identify the service application and can direct the traffic of the service application into a specific network tunnel for protection. The controller uniformly allocates and configures the network application identifier, and manages the tunnel diversion strategy based on the network application identifier to achieve controllable end-to-end access from users to services. To this end, the controller needs to interact with the management and control systems on the user side and the service side to plan the network application identifier, and interact with the bearer network PE device to identify the network application identifier and configure the tunnel mapping strategy. At the same time, the controller should provide a service visualization view, graphically present the user, service and service flow path information corresponding to the network application, and provide service fault diagnosis capabilities based on flow detection.

[0046] Figure 1 Among them, APN-Controller: a controller that supports APN6 services, that is, an IP network controller, which is generally a super controller (third-party controller) and supports heterogeneous devices from different manufacturers; APN6 Domain: a network domain that supports APN6 services, and all devices in the domain support APN6; APN-Edge: an edge device that supports APN6, generally used for service access; APN-Head: a head node that supports APN6 SRv6 TE tunnels; APN-Midpoint: an intermediate node that supports APN6 SRv6 TE tunnels. APN-Midpoint provides forwarding services for application messages, and supports providing value-added services such as iFIT and SRv6 SFC based on the application information carried in the messages. APN-Endpoint: an end node that supports APN6 SRv6 TE tunnels.

[0047] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0048] The present invention proposes a controller-based application-aware network implementation method, the method comprising:

[0049] 1. The controller provides user group management, service group management, centralized allocation management of network application identifiers, tagging strategy configuration of network application identifiers, traffic scheduling and guarantee capabilities based on network application identifiers in public network and VPN business scenarios, business visualization, and business fault diagnosis capabilities based on flow detection data;

[0050] 2. The controller provides user group parameter definition, service group parameter definition and network application identification parameter definition; the network application identification includes the user group identification and the service group identification;

[0051] 3. The controller opens the interactive interface with the public network user side control system, the public network service side control system and the VPN control system, which is used to interact with the control systems of the public network user side and the public network service side to plan the network application identification, and interact with the VPN control system to identify the network application identification and configure the tunnel mapping strategy;

[0052] 4. The controller provides the public network service network application identification management process and the VPN service awareness network identification management process.

[0053] In order to explain the above-mentioned controller-based application-aware network implementation method more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0054] The detailed implementation is as follows:

[0055] 1. Network application awareness management function

[0056] (1) User Group Management

[0057] The controller should provide user group management functions and support the definition of user groups based on attributes such as access type, user level, user name, province, VPN and IP prefix list.

[0058] Supports adding, modifying, querying, and deleting user groups through the interface and northbound interface.

[0059] (2) Service Group Management

[0060] The controller should provide service group management functions and support the definition of service groups by attributes such as service type, service provider name, service name, province, resource pool code, VPN, IP prefix list, port list, etc.

[0061] Supports adding, modifying, querying, and deleting service groups through the interface and northbound interface.

[0062] (3) Network application identification management

[0063] The controller provides centralized management of network application IDs:

[0064] Supports network application identifiers with lengths of 32bit, 64bit, and 128bit;

[0065] Support application identification number segment management, which can set the number segment according to the identification prefix and ensure that there is no conflict in the identification range of different number segments;

[0066] Supports statistical query of the capacity and usage rate of application identification number segments, and generates alarms when the usage rate exceeds the threshold;

[0067] Supports the allocation function of application IDs, and can define and allocate network application IDs according to service groups + user groups;

[0068] Supports setting application ID allocation rules. You can set segment mapping rules according to service group attributes and user group attribute conditions, and allocate application IDs within the segment set by the rules.

[0069] Support adding, modifying, querying and deleting network application identifiers through the interface and northbound interface;

[0070] It supports the recycling and reallocation of network application identifiers. Deleted application identifiers can be allocated and reused after a certain time interval.

[0071] (4) Network application identification tagging policy configuration

[0072] The controller provides a marking policy configuration function for network application identifiers. Based on the service group and user group definitions of the network application identifier, combined with VPN and IP routing information (obtained from the public network user-side management and control system or the VPN management and control system), it automatically searches for user access devices and application access devices, configures service flow identification and marking policies in the form of IP five-tuples on user access devices and application access devices, and adds a network application identifier tag to the IPv6 packet header of the identified specific service flow.

[0073] Supports adding, modifying, querying, and deleting network application identification and marking policies through the interface and northbound interface.

[0074] (5) Service Traffic Scheduling

[0075] The controller provides traffic scheduling and assurance capabilities based on network application identifiers in public network and VPN service scenarios. According to the definition of network application identifiers, it automatically searches for user access devices and application access devices in combination with VPN and IP routing information. On user access devices and application access devices, it supports configuring a mapping strategy from network application identifiers to SRv6 Policy colors, and introduces public network or VPN service flows carrying specific network application identifiers into SRv6 tunnels.

[0076] Supports adding, modifying, querying, and deleting operations of the mapping policy between network application identifiers and SRv6 Policy colors through the interface and northbound interface.

[0077] (6) Business visualization and diagnosis

[0078] The controller provides a business visualization view, presenting the user, service and business flow path information corresponding to the network application identifier in a graphical manner.

[0079] It supports viewing the service topology, and can display the access nodes and traffic policy information of service users and applications in the form of topology. It supports displaying the service flow bearer path information between service nodes on the service topology, and can associate and present the traffic and performance status indicators of each hop link in the path.

[0080] It supports the configuration of on-line detection services based on network application identification, collects and analyzes on-line detection results, presents the service flow path and quality, and provides service fault diagnosis capabilities based on on-line detection data.

[0081] 2. Network application identification definition

[0082] An application is composed of user groups and service groups. The access of a user group to a service group is defined as an application.

[0083] User groups, service groups and applications are centrally managed by the controller. The public network user-side management and control system and the public network service-side management and control system register and query user groups, service groups and application information through the API interface provided by the controller. User group identifiers, service group identifiers and network application identifiers are globally and uniformly allocated by the controller. The network application identifier will be carried in the network IPv6 message for network devices to identify the application. Network devices can perform traffic diversion and path assurance processing based on the network application identifier of the IPv6 message. The controller provides an API interface to provide path assurance for the application.

[0084] (1) User group parameters are defined in Table 1:

[0085] Table 1

[0086]

[0087]

[0088] (2) The service group parameters are defined in Table 2:

[0089] Table 2

[0090]

[0091] (3) The network application identification parameters are defined in Table 3:

[0092] Table 3

[0093] Logo type Value range User group ID String 1 to 36 characters Service group ID String 1 to 36 characters

[0094] 3. Network application identification management interface requirements

[0095] In order to exchange network application identification information and realize the planning, registration, distribution and tunnel binding of network application identification, the controller needs to open interfaces with the public network user side management and control system, the public network service side management and control system and the VPN management system, as shown in Table 4 below, to realize functions such as resource registration, resource query and policy issuance. The interfaces between the systems interact in REST mode.

[0096] Table 4

[0097]

[0098]

[0099] The interfaces between systems define the interaction content through OpenAPI.

[0100] 4. Network application identification management business process

[0101] (1) Public network service network application identification management process

[0102] like Figure 2 As shown, the public network service side management and control system calls the controller's "public network service group registration" interface to register the service group;

[0103] The public network user-side control system calls the controller's "public network user group registration" interface to register the user group;

[0104] The public network user-side control system receives the user application access protection demand, calls the controller's "Public Network Service Group Query" interface to query the service ID and service address port list, and then calls the controller's "Public Network Service Network Application ID Allocation" interface, enters the user group and service group ID information, and obtains the public network service network application ID;

[0105] The public network user-side control system instructs the user-side to add a public network service network application identification mark to the IPv6 message header (optional);

[0106] After the controller allocates the public network service network application identifier, it calls the "network application identifier tagging strategy addition" interface of the public network service side control system that has registered the service group, initiates a return service tagging request, and brings in the service group identifier, user address range and public network service network application identifier ID. The public network service side control system instructs the service side to add the public network service network application identifier tag to the IPv6 message header (optional);

[0107] The public network user-side control system calls the controller's "Network Application Identity Mapping Policy Creation" interface, configures the network application identity mapping policy on the PE device interconnected with the user access device, maps the network application identity to the color corresponding to the security level, and supports the simultaneous configuration of the network application identity marking policy based on the IP quintuple (optional). The backbone network automatically steers traffic to the SRv6 tunnel corresponding to the color; the controller automatically configures the network application identity mapping policy on the PE device interconnected with the service access device, maps the public network service network application identity to the color corresponding to the security level, and supports the simultaneous configuration of the network application identity marking policy based on the IP quintuple (optional). The backbone network automatically steers traffic to the SRv6 tunnel corresponding to the color to achieve backhaul security.

[0108] (2) VPN Service Awareness Network Identity Management Process

[0109] like Figure 3 As shown, the VPN control system receives the user's application access protection requirements, calls the controller's "VPN business network application identifier allocation" interface, enters the VPN name, user group and service group information, and obtains the VPN business network application identifier;

[0110] The VPN management and control system instructs the user side and the service side to add a VPN service network application identification mark to the service flow message header (optional);

[0111] The VPN management and control system calls the controller's "Network Application Identifier Mapping Policy Creation" interface to configure the network application identifier mapping policy on the NPE device interconnected with the user access device and the CPE device interconnected with the resource pool where the service is located, and maps the VPN service network application identifier ID to the color corresponding to the security level. It supports the configuration of a network application identifier marking policy based on the IP quintuple (optional). The backbone network identifies the application and directs traffic to the SRv6 tunnel corresponding to the color.

[0112] Based on the above invention concept, Figure 4As shown, the present invention also proposes a computer device 100, including a memory 110, a processor 120, and a computer program 130 stored in the memory 110 and executable on the processor 120, and the processor 120 implements the aforementioned controller-based application-aware network implementation method when executing the computer program 130.

[0113] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned controller-based application-aware network implementation method.

[0114] The controller-based application-aware network implementation method proposed in the present invention has the following highlights:

[0115] 1. A practical APN6 scenario solution that can be implemented at the operator group level and provincial level.

[0116] 2. The solution supports both public network business applications and VPN network business applications, and supports the security of applications in public and private networks.

[0117] 3. The solution defines network application identification and distinguishes the security levels in the definition.

[0118] 4. The solution implements the management of network application identities and realizes closed-loop management of the entire life cycle of applications.

[0119] 5. The solution provides traffic scheduling and guarantee capabilities based on network application identifiers for public network and VPN business scenarios, and graphically presents the user, service and business flow path information corresponding to the network application identifier.

[0120] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0121] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A controller-based application-aware network implementation method, characterized in that: The method includes: The controller provides user group management, service group management, centralized allocation management of network application identifiers, tagging strategy configuration of network application identifiers, traffic scheduling and guarantee capabilities based on network application identifiers in public network and VPN business scenarios, business visualization, and business fault diagnosis capabilities based on flow detection data; The controller provides user group parameter definition, service group parameter definition and network application identification parameter definition; the network application identification includes the user group identification and the service group identification; The controller opens interactive interfaces with the public network user side control system, the public network service side control system and the VPN control system, which are used to interact with the control systems on the public network user side and the public network service side to plan network application identification, and interact with the VPN control system to identify network application identification and configure tunnel mapping strategies; The controller provides the public network service network application identification management process and the VPN service awareness network identification management process.

2. The controller-based application-aware network implementation method according to claim 1, characterized in that: The controller provides a marking policy configuration function for the network application identifier. According to the service group and user group definition of the network application identifier, the controller automatically searches for user access devices and application access devices in combination with VPN and IP routing information. On the user access devices and application access devices, the controller configures the service flow identification and marking policy in the form of IP five-tuples, and adds a network application identifier tag to the IPv6 message header of a specific service flow.

3. The controller-based application-aware network implementation method according to claim 1, characterized in that: The controller provides traffic scheduling and guarantee capabilities based on network application identifiers in public network and VPN business scenarios. According to the definition of network application identifiers, it automatically searches for user access devices and application access devices in combination with VPN and IP routing information. On user access devices and application access devices, it supports configuring a mapping strategy from network application identifiers to SRv6 Policy colors, and introduces public network or VPN business flows carrying specific network application identifiers into SRv6 tunnels.

4. The controller-based application-aware network implementation method according to claim 1, characterized in that: The user group and service group are combined into an application, and the access of one user group to one service group is defined as an application; User groups, service groups and applications are centrally managed by the controller. The public network user-side management and control system and the public network service-side management and control system register and query user groups, service groups and application information through the API interface provided by the controller. User group identifiers, service group identifiers and network application identifiers are globally and uniformly allocated by the controller. The network application identifier will be carried in the IPv6 message for network devices to identify the application. Network devices can perform traffic diversion and path assurance processing based on the network application identifier of the IPv6 message. The controller provides an API interface to provide path assurance for the application.

5. The controller-based application-aware network implementation method according to claim 1, characterized in that: The controller opens the "public network user group registration" interface, the "public network user group query" interface, the "public network service network application identity allocation" interface and the "network application identity mapping policy creation" interface for the public network user side control system to call; The controller opens the "Public Network Service Group Registration" interface and the "Public Network Service Group Query" interface for the public network service side management and control system to call; the controller opens the "VPN Service Network Application Identity Allocation" interface and the "Network Application Identity Mapping Policy Creation" interface for the VPN management and control system to call; the public network service side management and control system opens the "Network Application Identity Marking Policy Addition" interface for the controller to call.

6. The controller-based application-aware network implementation method according to claim 1, characterized in that: The public network service network application identification management process is as follows: The public network service side control system calls the controller's "public network service group registration" interface to register the service group; The public network user-side control system calls the controller's "public network user group registration" interface to register the user group; The public network user-side control system receives the user application access protection demand, calls the controller's "public network service group query" interface to query the service ID and service address port list, and then calls the controller's "public network business network application ID allocation" interface, enters the user group and service group ID information, and obtains the public network business network application ID; The public network user-side control system instructs the user side to add a public network service network application identification mark to the IPv6 message header; After the controller allocates the public network service network application identifier, it calls the "network application identifier tagging strategy addition" interface of the public network service side control system that has registered the service group, initiates a return service tagging request, and brings in the service group identifier, user address range, and public network service network application identifier ID. The public network service side control system instructs the service side to add the public network service network application identifier tag to the IPv6 message header; The public network user-side control system calls the controller's "Network Application Identifier Mapping Policy Creation" interface to configure the network application identifier mapping policy on the PE device interconnected with the user access device, maps the network application identifier to the color corresponding to the security level, and supports the simultaneous configuration of the network application identifier marking policy based on the IP quintuple. The backbone network automatically directs traffic to the SRv6 tunnel corresponding to the color; the controller automatically configures the network application identifier mapping policy on the PE device interconnected with the service access device, maps the public network service network application identifier to the color corresponding to the security level, and supports the simultaneous configuration of the network application identifier marking policy based on the IP quintuple. The backbone network automatically directs traffic to the SRv6 tunnel corresponding to the color to achieve backhaul security.

7. The controller-based application-aware network implementation method according to claim 1, characterized in that: The VPN service-aware network identification management process is as follows: When the VPN management system receives the user's application access protection requirements, it calls the controller's "VPN business network application identifier allocation" interface, enters the VPN name, user group and service group information, and obtains the VPN business network application identifier; The VPN management and control system instructs the user side and the service side to add a VPN service network application identification mark to the service flow message header; The VPN management and control system calls the controller's "Network Application Identifier Mapping Policy Creation" interface to configure the network application identifier mapping policy on the NPE device interconnected with the user access device and the CPE device interconnected with the resource pool where the service is located, and maps the VPN service network application identifier ID to the color corresponding to the security level. It supports the configuration of the network application identifier marking policy based on the IP quintuple at the same time. The backbone network identifies the application and directs the traffic to the SRv6 tunnel corresponding to the color.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 7.

Images