Intrinsically secure optical network service mapping method and related equipment

Abstract

The present application provides a method, device, electronic device and storage medium for mapping intrinsically secure optical network services. The method includes: dividing the security level of the optical path by the number of bits, and after determining the security level required for the service, mapping services with different requirements to the corresponding paths. The device includes: a security level division module, a service security level determination module and a service mapping module. The electronic device includes: a memory, a processor and a computer program stored in the memory and executable on the processor to implement the intrinsically secure optical network service mapping method. The storage medium is a non-transitory computer-readable storage medium, and the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the intrinsically secure optical network service mapping method. The present application takes into account both network resources and user needs, and ensures that resources are used to the fullest, avoiding the arbitrary occupation and waste of network resources.

Description

Technical Field

[0001] The present application relates to the field of secure optical communication technology, and in particular to a method, device, electronic device and storage medium for mapping intrinsically secure optical network services. Background Art

[0002] In the field of secure optical communications, in an intrinsically secure optical network built based on intrinsically secure transmission technology, the key negotiation capabilities on each optical path are different. The services applied for by different users also have different requirements for key negotiation capabilities. Therefore, when mapping services, it is necessary to consider how to map services with different requirements to the corresponding optical paths while ensuring service security. Summary of the invention

[0003] In view of this, the purpose of this application is to propose an intrinsically secure optical network service mapping method, device, electronic device and storage medium to solve the problem of arbitrary occupation and waste of network resources due to failure to map services to corresponding optical paths as needed when optical paths carry multiple services.

[0004] Based on the above purpose, the present application provides a method for mapping endogenous secure optical network services, including:

[0005] Divide the security level of the optical path according to the number of bits;

[0006] Determine the level of security required for the business;

[0007] According to the user's demand for the service, the service is mapped to a corresponding path on the basis of satisfying the security level required by the service.

[0008] Optionally, dividing the security level of the optical path according to the number of bits includes:

[0009] Encoding each symbol in each wavelength signal with a bit number; wherein the wavelength signal is located in an endogenous secure optical transport network;

[0010] Establishing an optical path, obtaining the number of high-order bits for data transmission and the number of middle-order bits for key negotiation in the wavelength signal;

[0011] quantifying data transmission and key negotiation capabilities by using bandwidth and key resources respectively, and determining the sizes of the bandwidth and key resources;

[0012] The security level of the optical path is divided according to the size of the bandwidth and key resources.

[0013] Optionally, determining the security level required for the service includes:

[0014] Preconfigure an optical path topology G(V, E) with the security level; wherein the optical path topology G(V, E) is composed of a node V and an optical path E connecting each node, and each optical path contains a bandwidth D(i, j, t) and a key resource K(i, j, t), wherein i, j, t represents the tth optical path from the i-th node to the j-th node;

[0015] The security level required for the service is determined according to the user's setting of the Γ value; wherein the Γ value is the ratio of the key resource to the bandwidth on the t-th optical path from node i to node j, expressed as:

[0016]

[0017] Optionally, mapping the service to a corresponding path based on the user's demand for the service and on the basis of satisfying the security level required by the service includes:

[0018] Obtain the optical path topology G(V, E) and the service request C(s, d, b, τ); wherein the service request C(s, d, b, τ) represents a service request with a bandwidth of b and a security of τ from a source node s to a destination node d;

[0019] Get the k shortest paths from the source node s to the destination node d and save them to the set P K ; Wherein, the k shortest paths are obtained based on the K shortest path algorithm;

[0020] Traverse the set P K For each path p stored in the data source, an available light path is allocated to each hop on the path p;

[0021] Calculate H according to the optimization index and store all candidate paths in the set P v ; Wherein, the candidate path is a path in which each hop in a path is assigned a lightpath;

[0022] Judgment set P v Is it empty?

[0023] If the set P v is not empty, according to H, the set P v Arrange in ascending order, map the service to the first path, and allocate bandwidth and key resources to it; if the set P v If it is empty, the business mapping is blocked.

[0024] Optionally, allocating an available lightpath to each hop on the path p includes:

[0025] According to the demand of the service, the available optical path is allocated with a bandwidth not lower than the bandwidth required by the service and a security level not lower than the level required by the service.

[0026] Optionally, when there is more than one available optical path, the optical path with the lowest security level will be preferentially selected.

[0027] Optionally, the optimization index includes a security deviation; the security deviation is the standard deviation between the security level of the request and the provided path, which indicates the degree to which the security provided by the path is higher than the security of the request, and is expressed as:

[0028]

[0029] Among them, Φ m It represents the security level of the m-th hop optical path in a path, τ is the security level of the service requirement, and M is the total number of hops in the path.

[0030] Based on the above purpose, the present application also provides an intrinsically secure optical network service mapping electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any one of the above items is implemented.

[0031] Based on the above purpose, the present application also provides an endogenous secure optical network service mapping device, including:

[0032] A security level division module is configured to divide the security level of the optical path according to the number of bits;

[0033] A service security level determination module, configured to determine a security level required for a service;

[0034] The service mapping module is configured to map the service to a reasonable path based on the user's demand for the service and on the basis of satisfying the security level required by the service.

[0035] Based on the above purpose, the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the methods described above.

[0036] From the above, it can be seen that the method, device, electronic device and storage medium provided by the present application for mapping endogenous secure optical network services use the number of bits to divide the security level of the optical path, first determine the security level required for the service, and then map the service to the corresponding optical path based on the security level required for the service according to the user's demand for the service. This technical solution meets the needs of users and avoids the arbitrary occupation and waste of network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A schematic diagram of a method for mapping endogenous secure optical network services provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a method for dividing optical path security levels according to the number of bits in the intrinsically secure optical network service mapping method provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of an intrinsically secure transmission model provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of a method for determining the security level required for a service in the method for mapping an intrinsically secure optical network service provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of an intrinsically secure optical transport network and optical path topology provided in an embodiment of the present application;

[0043] Figure 6 An algorithm flow chart for mapping a service to a corresponding path on demand based on the security level required by the service in the intrinsically secure optical network service mapping method provided in an embodiment of the present application;

[0044] Figure 7 Schematic diagram of the minimum hop number priority method and the optimal level priority method provided in the embodiment of the present application;

[0045] Figure 8 A schematic diagram of an electronic device for mapping endogenous secure optical network services provided in an embodiment of the present application;

[0046] Fig. 9 A schematic diagram of an intrinsically secure optical network service mapping device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0048] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0049] Fiber-optic communication systems have become a vital component of modern communication systems. With the rapid growth in access and usage, secure optical communications have become particularly important. Similar to other networks, the first line of defense to ensure communication security begins with encryption protocols. The security of encryption protocols mainly comes from computational complexity. However, with the increasing computing power of computers, communication security based on computational complexity also faces the risk of being cracked. Secondly, the high transmission rate in fiber-optic communication systems poses new challenges to communication security, because encryption protocols can no longer achieve real-time encryption at high rates.

[0050] The physical layer (also known as the optical layer) security mechanism of the optical communication system can solve the above problems very well. First, optical layer security can enhance the security of the high-level encryption protocol of the protocol stack and achieve the overall security of the system. Secondly, since optical signals do not generate electromagnetic radiation, the optical communication system is less likely to be affected by electromagnetic interference, and is inherently not susceptible to electromagnetic-based side channel eavesdropping. Therefore, in order to avoid threats to the security of optical networks, it is necessary to ensure the optical layer security of optical communication systems.

[0051] Quantum key distribution technology is a future-oriented optical layer security technology that aims to ensure the secure negotiation of keys. It can enhance the security of communications by increasing the key refresh frequency. In a communication system that uses quantum key distribution technology, the classical channel is used to transmit key-encrypted user data, and the quantum channel is used for key negotiation. Based on the basic principles of quantum mechanics, the two communication endpoints in the communication system can detect the existence of any third party that attempts to illegally obtain the key. Once discovered, the normal key negotiation process will be interrupted. Therefore, quantum key distribution technology can obviously greatly reduce the risk of decryption and eavesdropping and enhance the security of the system. However, the interruption of the negotiation process also destroys the communication process of the legitimate recipient, which affects the stability of the communication. In addition, quantum key distribution technology uses an additional external key negotiation system for key negotiation, which increases the complexity and cost of the system. To solve the above problems, the intrinsic security transmission technology embeds the key negotiation function inside the communication system to reduce the complexity of the system and improve the stability of the system.

[0052] Intrinsic secure transmission technology is a secure optical communication method that does not rely on an additional external key negotiation system, and completely uses the communication system itself to provide endogenous protection for information transmission. During the intrinsic secure transmission process, since the eavesdropper cannot know the sending status of the sender, it is difficult to decipher the key and data information. Therefore, this technology increases the difficulty of eavesdropping and improves the ability to resist information interception. The intrinsic secure optical network deployed with intrinsic secure transmission technology can provide both data transmission capabilities and key negotiation capabilities when carrying user services. However, since the key negotiation capabilities on each optical path in the intrinsic secure optical network are different, the requirements for key negotiation capabilities for the services requested by different users are also different. Therefore, how to map the services to the corresponding optical paths on demand is an urgent problem to be solved.

[0053] In response to the above problems, the embodiments of the present application provide an intrinsically secure optical network service mapping solution, which uses the number of bits to divide the security level of the optical path, and after determining the security level required by the service, maps services with different requirements to the corresponding paths. The solution takes into account both network resources and user needs, ensures that resources are used to their full potential, and avoids arbitrary occupation and waste of network resources.

[0054] Figure 1 A schematic diagram of an endogenous secure optical network service mapping method provided in an embodiment of the present application includes:

[0055] S101: Divide the security level of the optical path according to the number of bits.

[0056] The method of dividing the optical path security level by the number of bits can control the strength of the encryption strategy and improve the rationality and effectiveness of business encryption. Figure 2 As shown, this method is applied to Figure 3The inherently secure transmission model shown includes:

[0057] S201: Encode each symbol in each wavelength signal using a bit number.

[0058] In an endogenously secure optical network, wavelength division multiplexing technology allows multiple wavelength signals to transmit data in the same optical fiber. Wavelength division multiplexing technology is a technology that combines two or more optical carrier signals of different wavelengths (carrying various information) at the transmitting end through a multiplexer and couples them to the same optical fiber of the optical line for transmission; at the receiving end, the optical carriers of various wavelengths are separated by a demultiplexer, and then further processed by the optical receiver to restore the original signal.

[0059] In this embodiment, each symbol in a wavelength signal is encoded by a number of bits, such as Figure 3 As shown in bit1-8, bit1-2 is the lowest bit number and is safely immersed in noise. The higher the bit number, the less affected by noise. Therefore, the high bit number has a higher signal-to-noise ratio and a lower bit error rate, and the low bit number has a lower signal-to-noise ratio and a higher bit error rate.

[0060] S202: Establishing an optical path, obtaining the number of high-order bits used for data transmission and the number of middle-order bits used for key negotiation in the wavelength signal.

[0061] Once an optical path is established, the number of bits used for each function in its wavelength signal is determined. Figure 3 As shown in the figure, bit6-8 is the high bit number, which can be used to transmit user data with high quality, and bit3-5 is the middle bit number, which can be used to transmit the measurement sequence used for key negotiation. Therefore, the transmission data and key negotiation capabilities within a channel are determined.

[0062] S203: Use bandwidth and key resources to quantify data transmission and key negotiation capabilities respectively, and determine the sizes of the bandwidth and key resources.

[0063] In this embodiment, if Figure 3 As shown in FIG. 1 , the capabilities of transmitting data and key negotiation are quantified by bandwidth and key resources, respectively, in bits per second.

[0064] S204: Divide the security level of the optical path according to the size of the bandwidth and the key resource.

[0065] The more key resources there are, the faster the transmission speed of the measurement sequence is, the faster and more keys are generated, and the higher the data transmission security is. That is, each wavelength signal contains limited bandwidth and key resources, and the more key resources there are, the higher the security is.

[0066] S102: Determine the security level required for the business.

[0067] In an inherently secure optical network, diverse services have different security requirements. For example, financial services require high security to ensure user privacy, while entertainment and audio-visual services focus more on real-time performance and require lower or even no security. Therefore, before allocating services to the corresponding paths on demand, it is necessary to determine the security level required by the services.

[0068] Specifically as an optional method, such as Figure 4 As shown, including:

[0069] S401: Preconfigure an optical path topology structure with the security level.

[0070] In this embodiment, if Figure 5 As shown, the left figure is an endogenously secure optical transport network, which after pre-configuration forms an optical path topology G(V, E) with a security level as shown in the right figure. The topology consists of nodes V and optical paths E connecting each node.

[0071] It should be noted that an optical path is a path established using the same wavelength in one or more adjacent optical fibers. Nodes 1, 2, 3, and 6 in the intrinsically safe optical transmission network have a common wavelength λ1, and a path such as Figure 5 The right figure shows the light path from node 1 to node 6. In addition, there may be multiple light paths between any two adjacent nodes, such as Figure 5 There are two optical paths between node 5 and node 6, so E(i, j, t) is used to represent the t-th optical path from the i-th node to the j-th node. Each optical path contains bandwidth D(i, j, t) and key resources K(i, j, t). The size of bandwidth and key resources is determined as the optical path is established.

[0072] S402: Determine the security level required for the service according to the user's setting of the Γ value.

[0073] The bandwidth and key resources coexist on the optical path of the intrinsically secure optical network, but the bandwidth and key resources contained in different optical paths are not the same. n Indicates the security level. The larger n is, the lower the service security requirement is. Γ(i, j, t) is used to represent the ratio of key resources to bandwidth on the tth optical path from node i to node j. The formula is: The security level required for the business is determined based on the user's setting of the Γ value.

[0074] In this embodiment, if Figure 5As shown, there are three security levels in the optical path topology G(V, E), and τ1>τ2>τ3. When the user of node 1 requests a service connection with a security level of τ2 to node 6, the one-hop path between node 1 and node 6, or the multi-hop path via node 5 can be considered in the path selection. Among them, there are multiple optical paths from node 5 to node 6 in the multi-hop path, and the optical path with a security level of τ3 does not meet the service requirements, so this optical path is not considered; on the contrary, the optical path with a security level of τ1 can be used as a candidate path.

[0075] S103: According to the user's demand for the service, the service is mapped to a corresponding path on the basis of satisfying the security level required by the service.

[0076] The security-aware service mapping algorithm proposed in this application is used for the path mapping decision of S103. When a user applies for a service connection, the network controller needs to calculate a path that meets its security and bandwidth requirements for the service and allocate the corresponding amount of resources. Specifically, as an optional method, Figure 6 As shown, it is a flow chart of the security-aware business mapping algorithm for mapping path decision according to an embodiment of the present application, which mainly includes the following steps:

[0077] S601: Obtain an optical path topology diagram G (V, E).

[0078] S602: Obtain a service request C(s, d, b, τ).

[0079] In this embodiment, C(s, d, b, τ) is used to represent a service request from a source node s to a destination node d with a bandwidth of b and a security of τ.

[0080] S603: Calculate k shortest paths and output the set P K .

[0081] In this embodiment, based on the K shortest path algorithm, k shortest paths from the source node s to the destination node d are obtained and saved in the set P K .

[0082] In this embodiment, it is necessary to traverse the set P K For each path p saved in the system, an available lightpath is allocated to each hop on the path p. It should be noted that the lightpath is subject to bandwidth and security level constraints. The available bandwidth in a lightpath is not less than the bandwidth required by the business and the security level is not less than the level required by the business. Only when each hop in a path is allocated a lightpath can the path be used as a candidate path. Among them, there may be more than one available lightpath, and the lightpath with the lowest level will be preferred. Finally, H is calculated based on the optimization index, and all candidate paths are stored in the set P. v .like Figure 6 As shown, including:

[0083] S604: Determine the set P K Whether it is empty.

[0084] S605: Select P K The first path p in it.

[0085] It should be noted that if S604 determines that the set P K If it is not empty (S604 is “No”), execute this step.

[0086] S606: i=1.

[0087] S607: Determine whether i is not greater than the hop count of p.

[0088] S608: Select the i-th hop endpoint (s′, d′).

[0089] It should be noted that if S607 determines that i is not greater than the number of hops p (S607 is "yes"), this step is executed.

[0090] S609: Output a set L of all optical paths between (s′, d′) that meet the bandwidth b and level τ requirements M .

[0091] S610: Determine L M Whether it is empty.

[0092] S611: According to the level of L M Sort in ascending order.

[0093] It should be noted that if S610 determines that L M If it is not empty (S610 is “No”), execute this step.

[0094] S612: Select the first light path and store it in p.

[0095] S613: i+=1.

[0096] It should be noted that after i is updated to i+1, S607 is executed again.

[0097] S614: From P K Delete path p.

[0098] It should be noted that if S610 determines that L M If it is empty (S610 is "yes"), execute this step. K After deleting the path p, S604 is executed again.

[0099] S631: Calculate the optimization index H.

[0100] It should be noted that if S607 determines that i is greater than the number of hops p (S607 is "No"), this step is executed.

[0101] S632: Store (p, H) into set P v .

[0102] It should be noted that (p, H) is stored in the set P v Then, execute S614 again.

[0103] S621: Determine the set P v Whether it is empty.

[0104] It should be noted that if S604 determines that the set P K is empty (S604 is "Yes"), execute this step.

[0105] S622: Based on H to P v Sort in ascending order.

[0106] It should be noted that if S621 determines that the set P v is not empty (S621 is "No"), execute this step; if S621 determines that the set P v If it is empty (S621 is "yes"), the service is blocked.

[0107] S623: Select the first path p.

[0108] S624: Map the service to p, and allocate service bandwidth and key resources.

[0109] Figure 7 Schematic diagram of the minimum hop priority method and the optimal level priority method provided in the embodiments of the present application.

[0110] The hop count indicates the number of optical paths in a path. It further indicates the number of optical-electrical-optical conversions during the transmission process. Services that are sensitive to latency may use this indicator. The security deviation indicates the standard deviation between the requested security level and the provided path. It indicates the degree to which the security provided by the path is higher than the requested security. It can be used to avoid wasting bandwidth at a high security level. The calculation formula is:

[0111]

[0112] Among them, Φ m It represents the security level of the m-th hop optical path in a path, τ is the security level of the service requirement, and M is the total number of hops in the path.

[0113] In this embodiment, if Figure 7As shown, the optical path topology shown in the left figure is used as the implementation object. The topology consists of four optical paths, and the level of each optical path is taken from {τ1, τ2, τ3}. The user applies for a service from node 1 to node 6, and the required security level is τ2. After the K shortest path algorithm, two shortest paths can be calculated for it, namely path (1, 6) and path (1, 5, 6). Assuming that the optical path has sufficient bandwidth, optical path ① can be selected for path (1, 6), and optical paths ② and ④ can be selected for path (1, 5, 6). Among them, because the security level of optical path ③ is lower than the security level τ2 required by the service, it is not considered. Because the number of hops of path (1, 6) is 1 and the number of hops of path (1, 5, 6) is 2, according to the principle of minimum hops, path (1, 6) is finally selected to carry the user's service.

[0114] In this embodiment, if Figure 7 As shown, the optical path topology shown in the left figure is used as the implementation object. The topology consists of four optical paths, and the level of each optical path is taken from {τ1, τ2, τ3}. The user applies for a service from node 1 to node 6, and the required security level is τ2. After the K shortest path algorithm, two shortest paths can be calculated for it, namely path (1, 6) and path (1, 5, 6). According to the calculation method of the security deviation, the security deviation of the path (1, 6) is calculated as:

[0115]

[0116] The safety deviation of path (1, 5, 6) is:

[0117]

[0118] It can be concluded that the safety deviation value of the path (1, 5, 6) is smaller, indicating that the path is closer to the service demand, so the path (1, 5, 6) is finally selected to carry the service.

[0119] The embodiment of the present application provides an intrinsically secure optical network service mapping method. The method takes into account both network resources and user needs, and aims to select a globally optimal or locally optimal mapping path for the service. In addition, the method can perform service mapping according to different optimization indicators, including a minimum hop priority mapping method based on the number of hops and an optimal level priority mapping method based on security deviation. The former can minimize the number of hops for service establishment, indirectly reducing the transmission delay; the latter can allocate the path that best meets the service needs to the service, ensuring that resources are used to the fullest extent possible and avoiding the arbitrary occupation and waste of bandwidth and key resources between levels.

[0120] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0121] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0122] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the intrinsically secure optical network service mapping method described in any of the above embodiments is implemented.

[0123] Figure 8 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0124] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0125] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0126] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0127] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0128] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0129] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0130] The electronic device of the above embodiment is used to implement the corresponding intrinsic security optical network service mapping method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0131] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an intrinsically secure optical network service mapping device.

[0132] refer to Fig. 9 , the intrinsically secure optical network service mapping device comprises:

[0133] The security level classification module 1 is configured to classify the security level of the optical path according to the number of bits;

[0134] A service security level determination module 2, configured to determine the security level required for the service;

[0135] The service mapping module 3 is configured to map the service to a reasonable path based on the user's demand for the service and on the basis of satisfying the security level required by the service.

[0136] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0137] The device of the above embodiment is used to implement the corresponding intrinsic security optical network service mapping method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0138] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the intrinsically secure optical network service mapping method described in any of the above embodiments.

[0139] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0140] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the intrinsic security optical network service mapping method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0141] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0142] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0143] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0144] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for mapping endogenous secure optical network services, comprising: Divide the security level of the optical path according to the number of bits; Determine a security level required for the service, wherein the security level required for the service is determined based on bandwidth and key resources contained in each optical path in an optical path topology with the security level; According to the user's demand for the service, the service is mapped to a corresponding path on the basis of meeting the security level required by the service; The method of dividing the security level of the optical path according to the number of bits includes: Encoding each symbol in each wavelength signal with a number of bits; wherein the wavelength signal is located in an endogenous secure optical transport network; Establishing an optical path, obtaining the number of high-order bits for data transmission and the number of middle-order bits for key negotiation in the wavelength signal; quantifying data transmission and key negotiation capabilities by using bandwidth and key resources respectively, and determining the sizes of the bandwidth and key resources; According to the size of the bandwidth and key resources, the security level of the optical path is divided; The mapping of the service to the corresponding path based on the user's demand for the service and on the basis of satisfying the security level required by the service includes: obtaining the optical path topology and business requests ; Wherein, the optical path topology By Node And the optical path connecting each node The business request From the source node To the destination node The bandwidth is And the safety is The optical path topology is configured to receive the service request of the optical path, and each optical path in the optical path topology is subject to the constraints of the bandwidth and the security level.

2. The method according to claim 1, wherein: Determining the security level required for the business includes: Pre-configured with the specified light path topology with the specified security level ; wherein each of the optical paths contains a bandwidth and key resources ,in, Indicates that from Nodes to The node light path; According to the user The setting of the value determines the security level required for the business; wherein the The value is from the node To Node No. The ratio of key resources to bandwidth on an optical path is expressed as: 。 3. The method according to claim 2, wherein: The mapping of the service to a corresponding path based on the user's demand for the service and on the basis of satisfying the security level required by the service includes: Get from the source node To the destination node of Shortest paths and save them to a collection ; wherein said The shortest path is based on The shortest path algorithm is used to obtain the Iterate over the collection Each path saved in , for the path Allocate available lightpaths to each hop; Calculated according to the optimization index , and store all candidate paths in a collection ; Wherein, the candidate path is a path in which each hop in a path is assigned a lightpath; Judgment Set Whether it is empty; If the set Not empty, according to the The collection Arrange in ascending order, map the service to the first path, and allocate bandwidth and key resources to it; if the set If it is empty, the business mapping is blocked.

4. The method according to claim 3, wherein: The path Each hop is allocated available lightpaths, including: According to the demand of the service, the available optical path is allocated with a bandwidth not lower than the bandwidth required by the service and a security level not lower than the level required by the service.

5. The method according to claim 3 or 4, wherein: When there is more than one available optical path, the optical path with the lowest safety level will be selected first.

6. The method according to claim 3, wherein: The optimization index includes a security deviation; the security deviation is the standard deviation between the security level of the request and the provided path, which indicates the degree to which the security provided by the path is higher than the security of the request, and is expressed as: in, Indicates the first Safety level of the jump light path, The security level required by the business. is the total number of hops in the path.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the program.

8. An endogenous secure optical network service mapping device, comprising: A security level division module is configured to divide the security level of the optical path according to the number of bits; A service security level determination module is configured to determine a security level required for a service, wherein the security level required for the service is determined based on bandwidth and key resources contained in each optical path in an optical path topology with the security level; A service mapping module is configured to map the service to a reasonable path based on the user's demand for the service and on the basis of satisfying the security level required by the service; The security level division module is further configured to encode each symbol in each wavelength signal with a bit number; wherein the wavelength signal is located in an endogenous secure optical transmission network; establish an optical path to obtain the number of high-order bits for data transmission and the number of middle-order bits for key negotiation in the wavelength signal; quantify the data transmission and key negotiation capabilities respectively with bandwidth and key resources, and determine the size of the bandwidth and key resources; and divide the security level of the optical path according to the size of the bandwidth and key resources; The service mapping module is also configured to obtain the optical path topology and business requests ; Wherein, the optical path topology By Node And the optical path connecting each node The business request From the source node To the destination node The bandwidth is And the safety is The optical path topology is configured to receive the service request of the optical path, and each optical path in the optical path topology is subject to the constraints of the bandwidth and the security level.

9. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 6.

Images