Edge node access method, device, network, and computer-readable storage medium

Abstract

The present disclosure relates to an edge node access method, device, network, and computer-readable storage medium. The method includes: counting all service end nodes in the target area, establishing a connection link for every two nodes in the service end nodes; measuring the network status of each connection link, and determining the network quality score of each connection link; determining the network service provider point according to the network quality score of each connection link, and using the network service provider point as the cluster head of a network cluster, wherein a network cluster includes at least one service end node; and establishing a secure access service edge node network according to the network service provider point of each network cluster and the service end nodes in each network cluster. The present disclosure can help enterprises intelligently select appropriate network service provider points.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to an edge node access method, device and network, and a computer-readable storage medium. Background Art

[0002] SASE (Secure Access Service Edge) is an emerging concept that integrates comprehensive wide-area networking functions and comprehensive network security functions to provide dynamic and secure access services for digital enterprises. To ensure that all network and security functions are available everywhere and deliver the best possible experience to all edges, SASE adopts a distributed architecture. In this architecture, low-latency services are delivered to enterprises by using POP points (network service provider points or central offices) close to the enterprise, improving access performance between nodes. Applications with high performance and high quality requirements can use high-quality network interconnection without reducing security. Summary of the invention

[0003] The inventors found through research that in the SASE application environment of related technologies, since the POP points are generally deployed by the service provider before the enterprise purchases the SASE service, the client accesses by manually selecting or directly selecting the nearest POP point for access, and the current access methods on the market are all one-hop access. This unintelligent selection method may select a POP point that is not "close" enough to the service side, resulting in high latency, thus affecting the quality of network services and deviating from the original intention of SASE.

[0004] In view of at least one of the above technical problems, the present disclosure provides an edge node access method, device and network, and computer-readable storage medium, which can help enterprises intelligently select appropriate network service provision points.

[0005] According to one aspect of the present disclosure, there is provided an edge node access method, including:

[0006] Count all server nodes in the target area, and establish a connection link between every two server nodes;

[0007] Measuring the network status of each connection link and determining the network quality score of each connection link;

[0008] Determine a network service provider point according to the network quality score of each connection link, and use the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node;

[0009] A secure access service edge node network is established based on the network service provision points of each network cluster and the server nodes within each network cluster.

[0010] In some embodiments of the present disclosure, determining a network service provider point according to a network quality score of each connection link, and using the network service provider point as a cluster head of a network cluster includes:

[0011] randomly generating a first predetermined number of cluster heads;

[0012] Generate at most a second predetermined number of neighbor nodes for each cluster head, wherein the second predetermined number is an upper limit of neighbor nodes in the network cluster;

[0013] Regenerate cluster heads for each network cluster;

[0014] Determine whether the cluster head position has changed;

[0015] When the location of the cluster head does not change, the network service provider point of each network cluster and the server node within each network cluster are output.

[0016] In some embodiments of the present disclosure, determining a network service provider point according to a network quality score of each connection link and using the network service provider point as a cluster head of a network cluster further includes:

[0017] In case the position of the cluster head changes, the steps of generating at most a second predetermined number of neighbor nodes for each cluster head, regenerating a cluster head for each network cluster, and determining whether the position of the cluster head changes are re-executed.

[0018] In some embodiments of the present disclosure, generating at most a second predetermined number of neighbor nodes for each cluster head includes:

[0019] In the case of adding the server node to a network cluster, determining whether the capacity of the network cluster reaches a second predetermined number;

[0020] If the capacity of the network cluster does not reach the second predetermined number, adding the server node to the network cluster;

[0021] When the capacity of the network cluster reaches a second predetermined amount, comparing the network quality scores from the server node to the member nodes in the network cluster to the cluster head;

[0022] When the network quality score from the server node to the cluster head is the lowest, the server node is not added to the network cluster;

[0023] When the network quality score from a member node to the cluster head is the lowest, the member node with the lowest network quality score is removed, and then the server node is added to the network cluster.

[0024] In some embodiments of the present disclosure, the edge node access method further includes:

[0025] When the network quality scores of any two service-end nodes are greater than a predetermined score threshold, the two service-end nodes are neighbor nodes.

[0026] In some embodiments of the present disclosure, after generating at most a second predetermined number of neighbor nodes for each cluster head, the method further includes:

[0027] The network clusters and the server nodes are processed accordingly, and then the step of regenerating the cluster head for each network cluster is performed.

[0028] In some embodiments of the present disclosure, the corresponding processing of the network cluster and the server node includes:

[0029] In the case that the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set, the first cluster head is deleted from the cluster head set.

[0030] In some embodiments of the present disclosure, the corresponding processing of the network cluster and the server node includes:

[0031] Determine whether there is an outlier node, wherein the outlier node is a server node that does not belong to a neighbor node set of any cluster head;

[0032] If there is an outlier node, it will be used as the cluster head.

[0033] In some embodiments of the present disclosure, the corresponding processing of the network cluster and the server node includes:

[0034] If a service end node is a neighbor node of two cluster heads and a neighbor node of a second cluster head at the same time, comparing the first network quality score of the service end node and the first cluster head, and the second network quality score of the service end node and the second cluster head;

[0035] If the first network quality score is greater than the second network quality score, adding the server node to the network cluster corresponding to the first cluster head;

[0036] If the second network quality score is greater than the first network quality score, the server node is added to the network cluster corresponding to the second cluster head.

[0037] In some embodiments of the present disclosure, the edge node access method further includes:

[0038] A network traffic probe is used to monitor whether the traffic of a network service provider point is greater than a predetermined traffic threshold;

[0039] When the traffic of the network service provider point is greater than the predetermined traffic threshold, the upper limit of the server node in the network cluster is reduced by a predetermined adjustment amount, and then the steps of determining the network service provider point according to the network quality score of each connection link, taking the network service provider point as the cluster head of a network cluster, and establishing a secure access service edge node network according to the network service provider point of each network cluster and the server node in each network cluster are repeated.

[0040] According to another aspect of the present disclosure, an edge node access device is provided, including:

[0041] A link establishment module is configured to count all server nodes in a target area and establish a connection link between every two server nodes;

[0042] A network quality determination module is configured to measure the network status of each connection link and determine a network quality score of each connection link;

[0043] The cluster head determination module is configured to determine a network service provider point according to the network quality score of each connection link, and use the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node;

[0044] The network establishment module is configured to establish a secure access service edge node network according to the network service provision point of each network cluster and the service end node in each network cluster.

[0045] In some embodiments of the present disclosure, the cluster head determination module is configured to randomly generate a first predetermined number of cluster heads; generate up to a second predetermined number of neighbor nodes for each cluster head, wherein the second predetermined number is an upper limit of the neighbor nodes in the network cluster; regenerate the cluster head for each network cluster; determine whether the position of the cluster head has changed; and if the position of the cluster head has not changed, output the network service provider point of each network cluster and the service end node within each network cluster.

[0046] In some embodiments of the present disclosure, the cluster head determination module is also configured to re-execute the operations of generating up to a second predetermined number of neighbor nodes for each cluster head, regenerating a cluster head for each network cluster, and determining whether the cluster head position has changed when the cluster head position changes.

[0047] In some embodiments of the present disclosure, the cluster head determination module, while generating at most a second predetermined number of neighbor nodes for each cluster head, is configured to, when adding a service end node to a network cluster, determine whether the capacity of the network cluster reaches the second predetermined number; when the capacity of the network cluster does not reach the second predetermined number, add the service end node to the network cluster; when the capacity of the network cluster reaches the second predetermined number, compare the network quality scores of the service end node with those of the member nodes in the network cluster to the cluster head; when the network quality score of the service end node to the cluster head is the lowest, do not add the service end node to the network cluster; when the network quality score of a member node to the cluster head is the lowest, remove the member node with the lowest network quality score and then add the service end node to the network cluster.

[0048] In some embodiments of the present disclosure, the edge node access device further includes:

[0049] The neighbor node determination module is configured to determine that, when the network quality scores of any two server nodes are greater than a predetermined score threshold, the two server nodes are neighbor nodes to each other.

[0050] In some embodiments of the present disclosure, the cluster head determination module is further configured to, after generating at most a second predetermined number of neighbor nodes for each cluster head, perform corresponding processing on the network cluster and the service end node, and then perform the operation of regenerating the cluster head for each network cluster.

[0051] In some embodiments of the present disclosure, the cluster head determination module, when performing corresponding processing on the network cluster and the service end node, is configured to delete the first cluster head from the cluster head set if the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set.

[0052] In some embodiments of the present disclosure, the cluster head determination module, when performing corresponding processing on the network cluster and the service node, is configured to determine whether there is an outlier node, wherein the outlier node is a service node that does not belong to the set of neighbor nodes of any cluster head; if there is an outlier node, the outlier node is used as the cluster head.

[0053] In some embodiments of the present disclosure, the cluster head determination module, when performing corresponding processing on the network cluster and the service node, is configured to compare the first network quality scores of the service node and the first cluster head, and the second network quality scores of the service node and the second cluster head if a service node is simultaneously a neighbor node of two cluster heads and a neighbor node of the second cluster head; if the first network quality score is greater than the second network quality score, add the service node to the network cluster corresponding to the first cluster head; if the second network quality score is greater than the first network quality score, add the service node to the network cluster corresponding to the second cluster head.

[0054] In some embodiments of the present disclosure, the edge node access device further includes:

[0055] A flow monitoring module is configured to use a network flow probe to monitor whether the flow of a network service provider point is greater than a predetermined flow threshold;

[0056] The upper limit adjustment module is configured to reduce the upper limit of the service end node in the network cluster by a predetermined adjustment amount when the traffic of the network service provider point is greater than the predetermined traffic threshold, and then instruct the cluster head determination module to repeatedly perform the operations of determining the network service provider point according to the network quality score of each connection link, taking the network service provider point as the cluster head of a network cluster, and establishing a secure access service edge node network according to the network service provider point of each network cluster and the service end node in each network cluster.

[0057] According to another aspect of the present disclosure, an edge node access device is provided, including:

[0058] a memory configured to store instructions;

[0059] The processor is configured to execute the instruction so that the edge node access device performs operations to implement the edge node access method described in any of the above embodiments.

[0060] According to another aspect of the present disclosure, a secure access service edge node network is provided, comprising an edge node access device as described in any of the above embodiments.

[0061] According to another aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the edge node access method described in any of the above embodiments is implemented.

[0062] The present disclosure can help enterprises intelligently select appropriate network service provision points. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0064] Figure 1 Schematic diagram of some embodiments of the edge node access method disclosed in the present invention.

[0065] Figure 2 The embodiment is a schematic diagram of the quality score matrix in some embodiments of the present disclosure.

[0066] Figure 3 A schematic diagram of the SASE architecture in some embodiments of the present disclosure.

[0067] Figure 4 Schematic diagrams of other embodiments of the edge node access method disclosed in the present invention.

[0068] Figure 5 Schematic diagram of some embodiments of the POP point determination method disclosed in the present invention.

[0069] Figure 6 Schematic diagram of some embodiments of the edge node access device disclosed in the present invention.

[0070] Figure 7 Schematic diagram of the structure of other embodiments of the edge node access device disclosed in the present invention. DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0072] Unless specifically stated otherwise, the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure.

[0073] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0074] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0075] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0076] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0077] Figure 1 The following is a schematic diagram of some embodiments of the edge node access method disclosed in the present invention. Preferably, this embodiment can be performed by the edge node access method device disclosed in the present invention or the secure access service edge node network disclosed in the present invention. The method includes at least one step from step 11 to step 14, wherein:

[0078] Step 11: Count all server nodes in the target area, and establish a connection link between every two nodes in the server nodes.

[0079] In some embodiments of the present disclosure, the service-end node may be an enterprise-side access node.

[0080] In some embodiments of the present disclosure, the server node may include a corporate headquarters, a branch office, a data center, a remote office, and other servers.

[0081] In some embodiments of the present disclosure, establishing a connection link between every two of the server nodes includes: establishing connection links between all server nodes in pairs.

[0082] Step 12: measuring the network status of each connection link and determining the network quality score of each connection link.

[0083] In some embodiments of the present disclosure, network conditions may include indicators such as bandwidth, latency, and jitter.

[0084] In some embodiments of the present disclosure, step 12 may include: measuring the network status of each connection link, including bandwidth, delay, jitter and other indicators, and customizing the weights of these indicators to score each link; after the scoring in the previous step, a score matrix PL can be obtained, and PL(i,j) represents the network quality score from node i to node j. In the present disclosure, PL(i,j)=PL(j,i), and PL(i,i) is meaningless.

[0085] Figure 2The embodiment is a schematic diagram of a mass fraction matrix in some embodiments of the present disclosure. As Figure 2 The shown fraction matrix is a mass fraction matrix composed of the network quality fractions between every two of the five nodes a, b, c, d, and e.

[0086] In some embodiments of the present disclosure, the edge node access method may further include: when the network quality fraction between any two server nodes is greater than a predetermined fraction threshold PMAX, these two server nodes are neighbor nodes to each other, where the predetermined fraction threshold PMAX is a quality fraction threshold set according to the actual situation.

[0087] In some embodiments of the present disclosure, the edge node access method may further include: if PL(i,j)>PMAX, then node i and node j are "neighbors" (neighbor nodes) to each other; if PL(i,j)<PMAX, it indicates that the network quality between node i and node j is relatively low, and the two nodes are regarded as unreachable from each other.

[0088] Step 13: Determine a network service providing point according to the network quality fraction of each connection link, and use the network service providing point as the cluster head of a network cluster, where at least one server node is included in one network cluster.

[0089] Step 14: Establish a secure access service edge node network as shown in Figure 3 according to the network service providing point (POP point) of each network cluster and the server nodes in each network cluster. Figure 3 This is a schematic diagram of the SASE architecture in some embodiments of the present disclosure. As Figure 3 The shown SASE architecture includes 4 POP points, and the POP points provide services for server sides such as enterprise headquarters, branches, data centers, and remote offices of enterprises.

[0090] Figure 4 This is a schematic diagram of another embodiment of the edge node access method of the present disclosure. Preferably, this embodiment can be executed by the edge node access method device of the present disclosure or the secure access service edge node network of the present disclosure. Figure 4 Steps 41 - 44 of the embodiment are respectively the same as or similar to Figure 1 Steps 11 - 14 of the embodiment. Figure 4 The method of the embodiment may include at least one of steps 41 - 46, where:

[0091] Step 41: Count all server nodes in the target area, and establish connection links between every two of the server nodes.

[0092] Step 42: Measure the network condition of each connection link, determine the network quality fraction of each connection link, and establish a mass fraction matrix.

[0093] Step 43, determining a network service provider point according to the network quality score of each connection link, and using the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node.

[0094] In some embodiments of the present disclosure, step 43 may include: using the improved algorithm of the present disclosure for the K-means algorithm to obtain the location of the POP point and obtain the path from each server node to the POP point in the network cluster.

[0095] Step 44, based on the network service provider point (POP point) of each network cluster and the server node in each network cluster, establish Figure 3 The secure access service edge node network shown.

[0096] Step 45: Use a network traffic probe to monitor whether the traffic of the network service provider point is greater than a predetermined traffic threshold.

[0097] Step 46, when the traffic of the network service provider point is greater than the predetermined traffic threshold, the upper limit of the server nodes in the network cluster is reduced by a predetermined adjustment amount, and then steps 43 to 45 are repeatedly executed.

[0098] The above embodiments of the present disclosure introduce network traffic probes to assist in load balancing, and can intelligently deploy POP points on demand according to the actual needs of the enterprise, which reduces the traffic burden of the POP points and reduces the possibility of network congestion compared to the traditional mode of related technologies. The above embodiments of the present disclosure provide better network service quality than the traditional mode of related technologies, while reducing the cost of network services. Moreover, the more nodes on the user side are, the more dispersed they are, and the more significant the advantages of the above embodiments of the present disclosure are.

[0099] Figure 5 The diagram is a schematic diagram of some embodiments of the POP point determination method disclosed in the present invention. Preferably, the present embodiment can be executed by the edge node access method device disclosed in the present invention or the secure access service edge node network disclosed in the present invention. Figure 5 The method of the embodiment (eg Figure 1 Step 13 of the embodiment and Figure 4 Step 43) of the embodiment may include at least one of steps 51 to 56, wherein:

[0100] Step 51: randomly generate a first predetermined number k of cluster heads.

[0101] In some embodiments of the present disclosure, step 51 may include: inputting a predetermined upper limit M of nodes in the cluster, randomly generating k initial points as cluster heads, and setting the cluster head set to K. k,k′∈K.

[0102] Step 52: Generate at most a second predetermined number M of neighbor nodes for each cluster head, wherein the second predetermined number M is an upper limit of neighbor nodes in the network cluster.

[0103] In some embodiments of the present disclosure, step 52 may include: for each cluster head k, generating its one-hop neighbor set N k , accommodating only the M nodes closest to it.

[0104] In some embodiments of the present disclosure, step 52 may include: when adding a service end node to a network cluster, determining whether the capacity of the network cluster reaches a second predetermined number; when the capacity of the network cluster does not reach the second predetermined number, adding the service end node to the network cluster; when the capacity of the network cluster reaches the second predetermined number, comparing the network quality scores of the service end node with those of the member nodes in the network cluster to the cluster head; when the network quality score from the service end node to the cluster head is the lowest, not adding the service end node to the network cluster; when the network quality score from a member node to the cluster head is the lowest, removing the member node with the lowest network quality score, and then adding the service end node to the network cluster.

[0105] In some embodiments of the present disclosure, step 52 may include: when a node is to be added to a cluster, first determine whether the capacity of the cluster has reached an upper limit. If not, directly add the node to the cluster. If it has reached the upper limit, compare the network quality scores of the node and the member nodes in the cluster to the cluster head, remove the one with the lowest score, and then add the node to the cluster. If the node has the lowest score, do not add it to the cluster, and consider joining other clusters or forming its own cluster.

[0106] Step 53: Perform corresponding processing on the network cluster and the server node.

[0107] In some embodiments of the present disclosure, step 53 may include at least one of steps 531 to 533, wherein:

[0108] Step 531: when the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set, delete the first cluster head from the cluster head set.

[0109] In some embodiments of the present disclosure, step 531 may include: Then k′ is removed from the cluster head set.

[0110] In some embodiments of the present disclosure, before step 531, it is possible that the cluster head i is a "neighbor" of the cluster head j. At this time, the "neighbors" of the cluster head i may be a subset of the "neighbors" of the cluster head j. If the cluster head i is not removed from the cluster head set, then subsequent operations on i will be meaningless. Therefore, step 531 is introduced here to avoid this phenomenon.

[0111] Step 532, determine whether there are outlier nodes, where the outlier nodes are server nodes that do not belong to the neighbor node set of any cluster head; if there are outlier nodes, then use the outlier node as the cluster head.

[0112] In some embodiments of the present disclosure, step 532 may include: such as For Then K = K ∪ {n}, and generate N n .

[0113] In some embodiments of the present disclosure, in the K-means (K-means clustering algorithm) algorithm, outlier points have a great impact on the efficiency of the algorithm. The present disclosure uses step 532 to use the outlier points themselves as the cluster heads to eliminate the influence of the outlier points.

[0114] Step 533, if a server node is a neighbor node of two cluster heads at the same time, a neighbor node of the second cluster head, then compare the first network quality score of the server node and the first cluster head, and the second network quality score of the server node and the second cluster head; if the first network quality score is greater than the second network quality score, then add the server node to the network cluster corresponding to the first cluster head; if the second network quality score is greater than the first network quality score, then add the server node to the network cluster corresponding to the second cluster head.

[0115] In some embodiments of the present disclosure, step 533 may include: such as node n ∈ N k ∩N k′ , then determine the size of PL(n, k′) and PL(n, k). If PL(n, k′) < PL(n, k), then N k′ = N k′ - n.

[0116] In some embodiments of the present disclosure, step 533 is used to handle the situation where a node becomes a "neighbor" of multiple cluster heads at the same time, and add the node to the cluster with a higher network quality score.

[0117] Step 54, regenerate the cluster heads for each network cluster.

[0118] In some embodiments of the present disclosure, step 54 may include for Calculate N according to formula (1)k The new cluster head k, wherein, in formula (1), for any network cluster, first calculate the minimum value of the network quality score from each node i except the cluster head to other nodes in the cluster, then take the minimum value from the multiple minimum values, and take the node i with the minimum value as the new cluster head k.

[0119]

[0120] In some embodiments of the present disclosure, when recalculating the cluster head to optimize the cluster head set in step 54, in order to minimize the impact of links with lower network quality on the entire system, a maximum and minimum decision method is adopted, which can save the time of calculating the cluster head and still achieve a result close to the cluster head.

[0121] Step 55, determine whether the cluster head position has changed. If the cluster head position has not changed, execute step 56; otherwise, if the cluster head position has changed, re-execute steps 52 to 54 until the cluster head set K no longer changes.

[0122] Step 56: output the network service provider point of each network cluster and the server node in each network cluster.

[0123] The location of the centroid set K obtained in the above embodiment of the present disclosure can be used as the optimal deployment location of the POP point in the SASE system, and the most ideal network service quality can be obtained in this case.

[0124] The above-mentioned embodiments of the present disclosure propose an improved algorithm based on K-means, which can help enterprises intelligently select suitable POP points, add network traffic probes to monitor the POP points, and intelligently optimize the system topology according to the feedback of the probes, thereby improving the flexibility and availability of the SASE system.

[0125] In order to solve some problems that may exist in the K-means algorithm when applied to the SASE scenario, the above-mentioned embodiments of the present disclosure propose an improved method for the algorithm, eliminate the influence of outliers and overlapping points, reduce the number of iterations, and improve the efficiency of the algorithm.

[0126] In the SASE application environment of related technologies, POP points are often deployed in provincial administrative regions or certain large cities. Service providers often select POP points for users based on the geographical location of the IP address. However, from the user's perspective, the company's servers or clients are not necessarily close to these determined POP points. This unintelligent selection method results in excessively long distances between servers, which may affect the stability of network quality.

[0127] The method proposed in the above embodiment of the present disclosure can intelligently limit the number of users accessing each POP point, and at the same time use the improved K-means algorithm to intelligently select POP points, thereby reducing the cost of network services and improving the stability of network service quality.

[0128] The above-mentioned embodiments of the present disclosure describe a SASE edge node access algorithm that supports load balancing.

[0129] The above embodiments of the present disclosure are based on the K-means algorithm, and the algorithm details are improved to adapt to the actual needs of the SASE network.

[0130] Before using the algorithm, the above-mentioned embodiment of the present disclosure collects and counts all servers of the customer enterprise that may be connected to SASE, establishes network links between these servers, and scores each link based on the service quality of the link (including bandwidth, latency, jitter and other factors) to form a score matrix.

[0131] The above-mentioned embodiment of the present disclosure uses the score matrix as input, and the improved algorithm of this patent will generate an ideal SASE network. The algorithm will output the locations of several servers, which are the optimal deployment locations of the POP points in the SASE network. In addition, the algorithm will assign each server in the region to its own POP point and assign each server a path to reach the POP point. At the same time, considering the load balancing problem, when the traffic of the POP point is about to be overloaded, the system will re-evaluate the entire network and recalculate the new topology.

[0132] If the POP points are deployed and the SASE network is constructed according to the results of the algorithm of the above-mentioned embodiment of the present invention, the best network service quality will be obtained under ideal circumstances.

[0133] Figure 6 The edge node access device of the present disclosure may include a link establishment module 61, a network quality determination module 62, a cluster head determination module 63 and a network establishment module 64, wherein:

[0134] The link establishing module 61 is configured to count all the server nodes in the target area and establish a connection link between every two nodes among the server nodes.

[0135] The network quality determination module 62 is configured to measure the network status of each connection link and determine the network quality score of each connection link.

[0136] In some embodiments of the present disclosure, the cluster head determination module 63 can be configured to randomly generate a first predetermined number of cluster heads; generate up to a second predetermined number of neighbor nodes for each cluster head, wherein the second predetermined number is an upper limit of the neighbor nodes in the network cluster; regenerate a cluster head for each network cluster; determine whether the position of the cluster head has changed; and if the position of the cluster head has not changed, output the network service provider point of each network cluster and the service end node within each network cluster.

[0137] In some embodiments of the present disclosure, the cluster head determination module 63 can also be configured to re-execute the operations of generating up to a second predetermined number of neighbor nodes for each cluster head, regenerating a cluster head for each network cluster, and determining whether the cluster head position has changed when the cluster head position changes.

[0138] In some embodiments of the present disclosure, the cluster head determination module 63, when generating at most a second predetermined number of neighbor nodes for each cluster head, can be configured to, when adding a service end node to a network cluster, determine whether the capacity of the network cluster reaches the second predetermined number; when the capacity of the network cluster does not reach the second predetermined number, add the service end node to the network cluster; when the capacity of the network cluster reaches the second predetermined number, compare the network quality scores of the service end node with those of the member nodes in the network cluster to the cluster head; when the network quality score of the service end node to the cluster head is the lowest, do not add the service end node to the network cluster; when the network quality score of a member node to the cluster head is the lowest, remove the member node with the lowest network quality score and then add the service end node to the network cluster.

[0139] The cluster head determination module 63 is configured to determine a network service provider point according to the network quality score of each connection link, and use the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node.

[0140] In some embodiments of the present disclosure, the cluster head determination module 63 may also be configured to, after generating at most a second predetermined number of neighbor nodes for each cluster head, perform corresponding processing on the network cluster and the service end node, and then perform the operation of regenerating the cluster head for each network cluster.

[0141] In some embodiments of the present disclosure, the cluster head determination module 63, when performing corresponding processing on the network cluster and the service end node, can be configured to delete the first cluster head from the cluster head set if the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set.

[0142] In some embodiments of the present disclosure, the cluster head determination module 63, when performing corresponding processing on the network cluster and the service node, can be configured to determine whether there is an outlier node, wherein the outlier node is a service node that does not belong to the set of neighbor nodes of any cluster head; if there is an outlier node, the outlier node is used as the cluster head.

[0143] In some embodiments of the present disclosure, the cluster head determination module 63, when performing corresponding processing on the network cluster and the service node, can be configured to compare the first network quality scores of the service node and the first cluster head, and the second network quality scores of the service node and the second cluster head if a service node is simultaneously a neighbor node of two cluster heads and a neighbor node of the second cluster head; if the first network quality score is greater than the second network quality score, add the service node to the network cluster corresponding to the first cluster head; if the second network quality score is greater than the first network quality score, add the service node to the network cluster corresponding to the second cluster head.

[0144] The network establishing module 64 is configured to establish a secure access service edge node network according to the network service provision point of each network cluster and the service end node in each network cluster.

[0145] In some embodiments of the present disclosure, Figure 2 As shown, the edge node access device may further include a neighbor node determination module 65, wherein:

[0146] The neighbor node determination module 65 is configured to determine that, when the network quality scores of any two service end nodes are greater than a predetermined score threshold, the two service end nodes are neighbor nodes to each other.

[0147] In some embodiments of the present disclosure, Figure 2 As shown, the edge node access device may further include a flow monitoring module 66 and an upper limit adjustment module 67, wherein:

[0148] The traffic monitoring module 66 is configured to use a network traffic probe to monitor whether the traffic of the network service provider point is greater than a predetermined traffic threshold.

[0149] The upper limit adjustment module 67 is configured to reduce the upper limit of the service end node in the network cluster by a predetermined adjustment amount when the traffic of the network service provider point is greater than the predetermined traffic threshold, and then instruct the cluster head determination module 63 to repeatedly perform the operations of determining the network service provider point according to the network quality score of each connection link, taking the network service provider point as the cluster head of a network cluster, and establishing a secure access service edge node network according to the network service provider point of each network cluster and the service end node in each network cluster.

[0150] The above-mentioned embodiments of the present disclosure innovatively introduce a clustering algorithm, which can more intelligently select the deployment location of access points for users. At the same time, the introduction of load balancing can effectively enhance the data processing capabilities of the network and improve the flexibility and availability of SASE.

[0151] Figure 7 FIG. 1 is a schematic diagram of the structure of some other embodiments of the edge node access device disclosed in the present invention. Figure 7 As shown, the edge node access device disclosed herein may include a memory 71 and a processor 72 .

[0152] The memory 71 is used to store instructions. The processor 72 is coupled to the memory 71. The processor 72 is configured to execute and implement any of the above embodiments (for example, Figure 1 or Figure 4 Embodiment) The edge node access method described in the embodiment.

[0153] like Figure 7 As shown, the edge node access device also includes a communication interface 73 for information exchange with other devices. At the same time, the edge node access device also includes a bus 74, through which the processor 72, the communication interface 73, and the memory 71 communicate with each other.

[0154] The memory 71 may include a high-speed RAM memory, and may also include a non-volatile memory (Non-volatile Memory), such as at least one disk memory. The memory 71 may also be a memory array. The memory 71 may also be divided into blocks, and the blocks may be combined into virtual volumes according to certain rules.

[0155] In addition, the processor 72 may be a central processing unit CPU, or may be a fourth integrated circuit ASIC, or may be configured to implement one or more integrated circuits of the embodiments of the present disclosure.

[0156] In terms of edge node access selection, the above embodiments of the present disclosure introduce the K-means algorithm and make improvements based on actual scenarios, providing users with a more intelligent selection method.

[0157] In the current SASE application scenarios, the relevant technologies generally use the POP points pre-provided by the service provider to access the nearest network. The method of the above embodiment of the present disclosure introduces a network traffic probe to assist in load balancing, and can intelligently deploy POP points on demand according to the actual needs of the enterprise. Compared with the traditional mode, it reduces the traffic burden of the POP points and reduces the possibility of network congestion. The above embodiment of the present disclosure can provide better network service quality than the traditional mode, while reducing the cost of network services. Moreover, the more nodes on the user side are, the more dispersed they are, and the more significant the advantages of the above embodiment of the present disclosure are.

[0158] According to another aspect of the present disclosure, a secure access service edge node network (such as Figure 3 The SASE architecture network shown in FIG. 1 includes any of the above embodiments (e.g. Figure 6 or Figure 7 The edge node access device described in embodiment).

[0159] The above embodiments of the present disclosure can be applied to SASE services. The above embodiments of the present disclosure can investigate the commonly used environments of the target enterprise, take into account the environments such as the corporate headquarters, branches, and data centers, customize the deployment of POP points for users, and improve the quality of network services.

[0160] According to another aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, any of the above embodiments (for example Figure 1 or Figure 4 Embodiment) The edge node access method described in the embodiment.

[0161] In some embodiments of the present disclosure, the computer-readable storage medium may be a non-transitory computer-readable storage medium.

[0162] Compared with the SASE services of related technology vendors, the above embodiments of the present disclosure have the following advantages while maintaining security:

[0163] 1. The above embodiments of the present disclosure use a clustering algorithm to bring about a smarter deployment method.

[0164] 2. The above embodiments of the present disclosure deploy POP points based on service quality to bring higher network service quality.

[0165] 3. The above embodiments of the present disclosure reduce the POP point load and bring lower network maintenance costs.

[0166] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a fourth computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0168] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0169] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0170] The edge node access device, link establishment module, network quality determination module, cluster head determination module, network establishment module, neighbor node determination module, traffic monitoring module and upper limit adjustment module described above can be implemented as a general-purpose processor, a programmable logic controller (PLC), a digital signal processor (DSP), a fourth integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component or any appropriate combination thereof for performing the functions described in this application.

[0171] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0172] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by instructing the relevant hardware through a program, and the program may be stored in a non-transitory computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0173] The description of the present disclosure is given for the purpose of illustration and description, and is not intended to be exhaustive or to limit the present disclosure to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present disclosure, and to enable those of ordinary skill in the art to understand the present disclosure and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. An edge node access method, comprising: Count all server nodes in the target area, and establish a connection link between every two server nodes; Measuring the network status of each connection link and determining the network quality score of each connection link; Determine a network service provider point according to the network quality score of each connection link, and use the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node; Establishing a secure access service edge node network based on the network service provision points of each network cluster and the server nodes within each network cluster; The step of determining a network service provider point according to the network quality score of each connection link and using the network service provider point as a cluster head of a network cluster includes: randomly generating a first predetermined number of cluster heads; Generate at most a second predetermined number of neighbor nodes for each cluster head, wherein the second predetermined number is an upper limit of neighbor nodes in the network cluster; Regenerate cluster heads for each network cluster; Determine whether the cluster head position has changed; When the location of the cluster head does not change, the network service provider point of each network cluster and the server node within each network cluster are output.

2. The edge node access method according to claim 1, wherein: The step of determining a network service provider point according to the network quality score of each connection link and using the network service provider point as a cluster head of a network cluster further includes: In case the position of the cluster head changes, the steps of generating at most a second predetermined number of neighbor nodes for each cluster head, regenerating a cluster head for each network cluster, and determining whether the position of the cluster head changes are re-executed.

3. The edge node access method according to claim 1 or 2, wherein: Generating at most a second predetermined number of neighbor nodes for each cluster head comprises: In the case of adding the server node to a network cluster, determining whether the capacity of the network cluster reaches a second predetermined number; If the capacity of the network cluster does not reach a second predetermined number, adding the server node to the network cluster; When the capacity of the network cluster reaches a second predetermined amount, comparing the network quality scores from the server node to the member nodes in the network cluster to the cluster head; When the network quality score from the server node to the cluster head is the lowest, the server node is not added to the network cluster; When the network quality score from a member node to the cluster head is the lowest, the member node with the lowest network quality score is removed, and then the server node is added to the network cluster.

4. The edge node access method according to claim 1 or 2, further comprising: When the network quality scores of any two service-end nodes are greater than a predetermined score threshold, the two service-end nodes are neighbor nodes.

5. The edge node access method according to claim 1 or 2, wherein: After generating at most a second predetermined number of neighbor nodes for each cluster head, the method further comprises: The network clusters and the server nodes are processed accordingly, and then the step of regenerating the cluster head for each network cluster is performed.

6. The edge node access method according to claim 5, wherein: The corresponding processing of the network cluster and the server node includes: In the case that the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set, the first cluster head is deleted from the cluster head set.

7. The edge node access method according to claim 5, wherein: The corresponding processing of the network cluster and the server node includes: Determine whether there is an outlier node, wherein the outlier node is a server node that does not belong to a neighbor node set of any cluster head; If there is an outlier node, it will be used as the cluster head.

8. The edge node access method according to claim 5, wherein: The corresponding processing of the network cluster and the server node includes: If a service end node is a neighbor node of two cluster heads and a neighbor node of a second cluster head at the same time, comparing the first network quality score of the service end node and the first cluster head, and the second network quality score of the service end node and the second cluster head; If the first network quality score is greater than the second network quality score, adding the server node to the network cluster corresponding to the first cluster head; If the second network quality score is greater than the first network quality score, the server node is added to the network cluster corresponding to the second cluster head.

9. The edge node access method according to claim 1 or 2, further comprising: A network traffic probe is used to monitor whether the traffic of a network service provider point is greater than a predetermined traffic threshold; When the traffic of the network service provider point is greater than the predetermined traffic threshold, the upper limit of the server node in the network cluster is reduced by a predetermined adjustment amount, and then the steps of determining the network service provider point according to the network quality score of each connection link, taking the network service provider point as the cluster head of a network cluster, and establishing a secure access service edge node network according to the network service provider point of each network cluster and the server node in each network cluster are repeated.

10. An edge node access device, comprising: A link establishment module is configured to count all server nodes in a target area and establish a connection link between every two server nodes; A network quality determination module is configured to measure the network status of each connection link and determine a network quality score of each connection link; The cluster head determination module is configured to determine a network service provider point according to the network quality score of each connection link, and use the network service provider point as a cluster head of a network cluster, wherein a network cluster includes at least one server node; a network establishment module configured to establish a secure access service edge node network based on a network service provision point of each network cluster and a server node within each network cluster; Among them, the cluster head determination module is configured to randomly generate a first predetermined number of cluster heads; generate at most a second predetermined number of neighbor nodes for each cluster head, wherein the second predetermined number is the upper limit of the neighbor nodes in the network cluster; regenerate the cluster head for each network cluster; determine whether the position of the cluster head has changed; and if the position of the cluster head has not changed, output the network service provider point of each network cluster and the service end node in each network cluster.

11. The edge node access device according to claim 10, wherein: The cluster head determination module is also configured to re-execute the operations of generating at most a second predetermined number of neighbor nodes for each cluster head, regenerating a cluster head for each network cluster, and determining whether the cluster head position has changed when the cluster head position changes.

12. The edge node access device according to claim 10 or 11, wherein: The cluster head determination module, in the case of generating at most a second predetermined number of neighbor nodes for each cluster head, is configured to, when adding a service end node to a network cluster, determine whether the capacity of the network cluster reaches the second predetermined number; when the capacity of the network cluster does not reach the second predetermined number, add the service end node to the network cluster; when the capacity of the network cluster reaches the second predetermined number, compare the network quality scores of the service end node and the member nodes in the network cluster to the cluster head; when the network quality score of the service end node to the cluster head is the lowest, do not add the service end node to the network cluster; when the network quality score of a member node to the cluster head is the lowest, remove the member node with the lowest network quality score and then add the service end node to the network cluster.

13. The edge node access device according to claim 10 or 11, further comprising: The neighbor node determination module is configured to determine that, when the network quality scores of any two server nodes are greater than a predetermined score threshold, the two server nodes are neighbor nodes to each other.

14. The edge node access device according to claim 10 or 11, wherein: The cluster head determination module is further configured to, after generating at most a second predetermined number of neighbor nodes for each cluster head, perform corresponding processing on the network cluster and the server node, and then execute the operation of regenerating the cluster head for each network cluster.

15. The edge node access device according to claim 14, wherein: The cluster head determination module, when processing the network cluster and the service end node accordingly, is configured to delete the first cluster head from the cluster head set if the first cluster head is a neighbor node of the second cluster head and the first cluster head neighbor node set is a subset of the second cluster head neighbor node set.

16. The edge node access device according to claim 14, wherein: The cluster head determination module is configured to determine whether there is an outlier node when the network cluster and the server node are processed accordingly, wherein the outlier node is a server node that does not belong to the neighbor node set of any cluster head; if there is an outlier node, the outlier node is used as the cluster head.

17. The edge node access device according to claim 14, wherein: The cluster head determination module, when performing corresponding processing on the network cluster and the service end node, is configured to compare the first network quality score of the service end node and the first cluster head, and the second network quality score of the service end node and the second cluster head if a service end node is simultaneously a neighbor node of two cluster heads and a neighbor node of the second cluster head; if the first network quality score is greater than the second network quality score, add the service end node to the network cluster corresponding to the first cluster head; if the second network quality score is greater than the first network quality score, add the service end node to the network cluster corresponding to the second cluster head.

18. The edge node access device according to claim 10 or 11, further comprising: A flow monitoring module is configured to use a network flow probe to monitor whether the flow of a network service provider point is greater than a predetermined flow threshold; The upper limit adjustment module is configured to reduce the upper limit of the service end node in the network cluster by a predetermined adjustment amount when the traffic of the network service provider point is greater than the predetermined traffic threshold, and then instruct the cluster head determination module to repeatedly perform the operations of determining the network service provider point according to the network quality score of each connection link, taking the network service provider point as the cluster head of a network cluster, and establishing a secure access service edge node network according to the network service provider point of each network cluster and the service end node in each network cluster.

19. An edge node access device, comprising: a memory configured to store instructions; The processor is configured to execute the instruction so that the edge node access device performs the operation of implementing the edge node access method according to any one of claims 1 to 9.

20. A secure access service edge node network, comprising the edge node access device according to any one of claims 10-19.

21. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the edge node access method according to any one of claims 1 to 9 is implemented.

Images