Network orchestration method, device, electronic device and computer readable storage medium

Abstract

The present disclosure provides a network orchestration method, device, electronic device and computer-readable storage medium, which relate to the field of network security technology. The method includes: obtaining a logical chain of intended content to be processed; determining a first security level of the logical chain, and determining a second security level of the user corresponding to the intended content to be processed; determining a first size relationship between the first security level and the second security level; generating a control instruction according to the logical chain when the first size relationship is that the second security level is not less than the first security level; and sending the control instruction to the network controller so that the network controller executes the control instruction. When the second security level is not less than the first security level, generating and sending the control instruction according to the logical chain to the network controller can reduce the possibility of causing confusion in the network system after the control instruction is executed, which is conducive to improving the stability of the network system and avoiding users from exceeding their authority to perform network orchestration.

Description

Background Art

[0002] In the field of network security technology, network orchestration refers to some operations performed on controllers in the network. The operations in network orchestration include setting up network devices, setting up services (applications) in the network, etc.

[0003] In the related art, the device that performs network orchestration generates a corresponding logical chain according to the intent content, and then obtains a specific control instruction according to the logical chain. After that, the control instruction is sent to the controller that the control instruction acts on. After receiving the control instruction, the controller executes the control instruction to complete the network orchestration.

[0004] However, the method of directly generating control instructions based on the logic chain makes it easy for the control instructions to affect the normal execution of high-authority security capabilities after being executed, thereby causing chaos in the network system.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The present disclosure provides a network orchestration method, device, electronic device and computer-readable storage medium, which at least to a certain extent overcome the problem in the related art that the normal execution of high-authority security capabilities is easily affected.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to one aspect of the present disclosure, there is provided a network orchestration method, including: obtaining a logical chain of intended content to be processed; determining a first security level of the logical chain, and determining a second security level of a user corresponding to the intended content to be processed; determining a first size relationship between the first security level and the second security level; generating a control instruction according to the logical chain when the first size relationship is that the second security level is not less than the first security level; and sending the control instruction to a network controller so that the network controller executes the control instruction.

[0009] In one embodiment of the present disclosure, determining the first security level of the logical chain includes: determining the security level of each asset object involved in the logical chain; and determining the first security level according to the security level of each asset object.

[0010] In one embodiment of the present disclosure, the asset objects involved in the logical chain include network devices; determining the security level of each asset object involved in the logical chain includes: obtaining a first parameter of the network device, the first parameter including one or more of the bandwidth of the network device, the number of subordinate network devices, and the number of times it is accessed within a first time period; determining the security level of the network device based on the first parameter.

[0011] In one embodiment of the present disclosure, the asset objects involved in the logical chain include security capabilities; determining the security level of each asset object involved in the logical chain includes: obtaining a second parameter of the security capability, the second parameter including one or more of the last update time of the security capability, the number of covered services, and the number of risk events occurring within a second time period; determining the security level of the security capability based on the second parameter.

[0012] In one embodiment of the present disclosure, determining the second security level of the user corresponding to the intended content to be processed includes: obtaining a third parameter of the user, the third parameter including one or more of the user's operating authority level, software and hardware environment parameters, the number of times the first behavior is performed within a third time period, and the number of times the second behavior is performed; the first behavior is a behavior in a normal behavior library corresponding to the user, and the second behavior is a behavior that does not belong to the normal behavior library; and determining the second security level based on the third parameter.

[0013] In one embodiment of the present disclosure, the sending of the control instruction to the network controller includes: performing conflict detection on the control instruction to obtain a detection result; and sending the control instruction to the network controller if the detection result is a pass.

[0014] In one embodiment of the present disclosure, it also includes: receiving system feedback information after the network controller executes the control instruction; performing execution analysis on the system feedback information to obtain the execution result of the control instruction; when the execution result is a failure, determining the third security level of the system feedback information according to the asset object involved in the system feedback information; determining a second size relationship between the second security level and the third security level; and generating intention feedback carrying the second size relationship.

[0015] According to another aspect of the present disclosure, a network orchestration device is provided, including: an acquisition module for acquiring a logical chain of intended content to be processed; a determination module for determining a first security level of the logical chain, and determining a second security level of a user corresponding to the intended content to be processed; the determination module is also used to determine a first size relationship between the first security level and the second security level; a generation module for generating a control instruction according to the logical chain when the first size relationship is that the second security level is not less than the first security level; and a sending module for sending the control instruction to a network controller so that the network controller executes the control instruction.

[0016] In one embodiment of the present disclosure, the determination module is used to determine the security level of each asset object involved in the logical chain; and determine the first security level according to the security level of each asset object.

[0017] In one embodiment of the present disclosure, the asset objects involved in the logical chain include network devices; the determination module is used to obtain a first parameter of the network device, the first parameter including one or more of the bandwidth of the network device, the number of subordinate network devices, and the number of times it is accessed within a first time period; based on the first parameter, the security level of the network device is determined.

[0018] In one embodiment of the present disclosure, the asset objects involved in the logical chain include security capabilities; the determination module is used to obtain a second parameter of the security capability, the second parameter including one or more of the last update time of the security capability, the number of covered services, and the number of risk events occurring within a second time period; based on the second parameter, the security level of the security capability is determined.

[0019] In one embodiment of the present disclosure, the determination module is used to obtain a third parameter of the user, the third parameter including one or more of the user's operation authority level, software and hardware environment parameters, the number of times the first behavior is performed within a third time period, and the number of times the second behavior is performed; the first behavior is a behavior in a normal behavior library corresponding to the user, and the second behavior is a behavior that does not belong to the normal behavior library; the second security level is determined based on the third parameter.

[0020] In one embodiment of the present disclosure, the sending module is used to perform conflict detection on the control instruction to obtain a detection result; if the detection result is a pass, the control instruction is sent to the network controller.

[0021] In one embodiment of the present disclosure, the device also includes: a receiving module, used to receive system feedback information after the network controller executes the control instruction; an analysis module, used to perform execution analysis on the system feedback information to obtain the execution result of the control instruction; the determination module is also used to determine the third security level of the system feedback information according to the asset object involved in the system feedback information when the execution result is a failure; the determination module is also used to determine the second size relationship between the second security level and the third security level; the generation module is also used to generate intention feedback carrying the second size relationship.

[0022] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-mentioned network orchestration methods by executing the executable instructions.

[0023] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned network orchestration methods is implemented.

[0024] According to another aspect of the present disclosure, a computer program product is provided, wherein the computer program product includes a computer program or computer instructions, and the computer program or the computer instructions are loaded and executed by a processor so that a computer implements any of the above-mentioned network orchestration methods.

[0025] The technical solution provided by the embodiments of the present disclosure includes at least the following beneficial effects:

[0026] The technical solution provided by the embodiments of the present disclosure obtains the logical chain of the intended content to be processed, determines the first security level of the logical chain and the second security level of the user who issues the intended content to be processed, and generates and sends control instructions to the network controller according to the logical chain when the second security level is not less than the first security level. Among them, the second security level is not less than the first security level, indicating that the user has the authority to perform this network orchestration, and the orchestration result is not likely to affect the normal execution of high-authority security capabilities. When the second security level is not less than the first security level, generating and sending control instructions to the network controller according to the logical chain can reduce the possibility of causing chaos in the network system after the control instructions are executed, which is beneficial to improving the stability of the network system and preventing users from exceeding their authority to perform network orchestration.

[0027] Furthermore, when the second security level is not less than the first security level, a control instruction is generated according to the logical chain and sent to the network controller, so that network orchestration can be stopped when the user does not have permission, thereby avoiding the waste of computing resources caused by continuing network orchestration according to the logical chain.

[0028] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0030] Figure 1 A schematic diagram showing a network orchestration system in one embodiment of the present disclosure is shown;

[0031] Figure 2 A flowchart of a network orchestration method in one embodiment of the present disclosure is shown;

[0032] Figure 3 A flow chart of a method for sending a control instruction to a network controller in one embodiment of the present disclosure is shown;

[0033] Figure 4 A flow chart of a method for generating intention feedback in one embodiment of the present disclosure is shown;

[0034] Figure 5 A schematic diagram of a network orchestration device in one embodiment of the present disclosure is shown;

[0035] Figure 6 A schematic diagram of a network orchestration device in another embodiment of the present disclosure is shown;

[0036] Figure 7 A structural block diagram of an electronic device in one embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0037] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0038] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0039] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0040] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0041] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0042] Figure 1 A schematic diagram of a network orchestration system in an embodiment of the present disclosure is shown, and the system can apply the network orchestration method or network orchestration device in various embodiments of the present disclosure.

[0043] like Figure 1 As shown, the network orchestration system may include: a client 11 and a network controller 12.

[0044] The client 11 can obtain the intent content carrying the user's intent, and can also generate a logical chain according to the intent content. The client 11 can also calculate and determine the security level of the logical chain, and calculate and determine the security level of the user. The client 11 can also compare the size relationship between the user's security level and the security level of the logical chain, and generate a control instruction for the logical chain when the user's security level is not less than the security level of the logical chain.

[0045] In one embodiment, the client 11 may send the generated control instruction directly to the network controller 12. In another embodiment, the client 11 may also perform conflict detection on the control instruction, and send the control instruction to the network controller 12 if the detection passes.

[0046] After receiving the control instruction, the network controller 12 can execute the control instruction. After the network controller 12 executes the control instruction, the network device where the network controller 12 is located generates system feedback information after the network controller 12 executes the control instruction, and sends the system feedback information to the client 11. The client 11 can analyze the system feedback information to determine whether the network controller 12 successfully executes the control instruction.

[0047] In one embodiment, the client 11 can also analyze the security level of the system feedback information and the relationship between the security level and the user's security level when determining that the network controller 12 fails to execute the control instruction, which can help the user determine, based on the relationship, whether the reason for the failure of the network controller 12 to execute the control instruction is because the user does not have the scheduling authority.

[0048] The client 11 and the network controller 12 are connected to each other through a network, which may be a wired network or a wireless network.

[0049] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0050] The client 11 may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, augmented reality devices, virtual reality devices, etc.

[0051] The client 11 can also be a server that provides various services. Optionally, the server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0052] The network controller 12 may be any controller in the network that has the above functions, for example, the network controller 12 may be a gateway. For another example, the network controller 12 may be a controller for configuring a firewall of the network.

[0053] Those skilled in the art will know that Figure 1 The number of the clients 11 in the figure is only for illustration, and any number of clients may be provided according to actual needs, which is not limited in the embodiments of the present disclosure.

[0054] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0055] The present disclosure provides a network orchestration method, which can be executed by any electronic device with computing and processing capabilities. For example, the electronic device is a client.

[0056] Figure 2 A flowchart of a network orchestration method in one disclosed embodiment of the present invention is shown as follows: Figure 2 As shown, the network orchestration method provided in the embodiment of the present disclosure includes the following S201 to S205.

[0057] S201, the client obtains the logical chain of intent content to be processed.

[0058] Among them, the intent content to be processed is the content that carries the user's intent, and the specific format of the intent content to be processed is not limited by the embodiments of the present disclosure. For example, the format of the intent content to be processed is a text format, that is, the intent content to be processed can be a text that carries the user's intent. Alternatively, the format of the intent content to be processed is a voice format, that is, the intent content to be processed can be a voice that carries the user's intent. Alternatively, the format of the intent content to be processed is a picture format, that is, the intent content to be processed can be a picture that carries the user's intent.

[0059] The logical chain is used to represent the objects, operations and corresponding relationships involved in the intent content to be processed, and the content included in the logical chain belongs to the content that can be directly recognized by the client. For example, the intent content to be processed is: receive the access request from server A at 14:00. Then the strategy involved in the logical chain is: receive; object: IP (Internet Protocol) address of server A; conversation type: access request; policy effective time: the timestamp corresponding to 14:00.

[0060] In one embodiment, the client obtains the logical chain of the intent content to be processed, which may include: obtaining the intent content to be processed; generating a standard text according to the intent content to be processed; generating a logical chain according to the standard text. Among them, the standard text is used to represent the objects, operations and corresponding relationships involved in the intent content to be processed, and the content included in the standard text does not belong to the content that the client can directly recognize. For example, the intent content to be processed is: Receive the access request of server A at 14:00. Then the policy involved in the standard text is: receive; object: server A; conversation type: access request; policy effective time: 14:00. The difference between the standard text and the logical chain is that the standard text does not belong to the content that the client can directly recognize, and the logical chain belongs to the content that the client can directly recognize.

[0061] The intended content to be processed can be input to the client by the user through an input device configured by the client. For example, if the intended content to be processed is text, the user can input the intended content to be processed to the client through a text input device (e.g., a keyboard) configured by the client. Alternatively, the user can input the intended content to be processed to other devices through input devices configured by other devices, and then the client downloads the intended content to be processed from the other devices, thereby completing the acquisition of the intended content to be processed.

[0062] In one embodiment, generating a standard text according to the intention content to be processed may include: performing semantic recognition and analysis on the intention content to be processed to obtain an analysis result; and generating the standard text according to the analysis result.

[0063] S202, the client determines a first security level of the logical chain, and determines a second security level of the user corresponding to the intended content to be processed.

[0064] The user corresponding to the intent content to be processed is the user account used when inputting the intent content to be processed into the client.

[0065] In one embodiment, the client determines the first security level of the logical chain, which may include: determining the security level of each asset object involved in the logical chain; determining the first security level according to the security level of each asset object. Among them, the asset objects may include: services (applications), network devices and security capabilities. The asset objects involved in a logical chain may include: one or more of network devices, security capabilities, and services. It should be noted that the network device involved in the logical chain may be one or more, and the network device may include the network device directly included in the logical chain, or it may be a network device related to the logical chain. For example, the network device included in the logical chain is device A, and the operation of device A requires the authorization of device B, and device B is a network device related to the logical chain.

[0066] Services refer to applications that can be used and provided in a network system. For example, financial applications in a network system. Security capabilities refer to the ability to reduce the risk of network systems being damaged by malicious attacks and information leakage.

[0067] In one embodiment, the asset objects involved in the logical chain include network devices, and the client determines the security level of each asset object involved in the logical chain, which may include: obtaining a first parameter of the network device, the first parameter including one or more of the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been accessed within a first time period; and determining the security level of the network device based on the first parameter. The embodiment of the present disclosure does not limit how the client obtains the first parameter. For example, information representing the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been accessed within the first time period can be directly stored in the memory of the network device, and the client can obtain information representing the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been accessed within the first time period from the memory of the network device.

[0068] The first duration is a set duration, and the specific value of the first duration is not limited in the embodiment of the present disclosure. The number of accesses within the first duration refers to the number of times the network device is accessed within the first duration before the client executes the operation of obtaining the number of accesses.

[0069] In one embodiment, the first parameter includes the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been visited within a first time period. Determining the security level of the network device based on the first parameter may include: adding the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been visited within the first time period according to corresponding weights to obtain the security level of the network device. Among them, the weights of the bandwidth of the network device, the number of subordinate network devices, and the number of times it has been visited within the first time period may be pre-set weight values. The embodiments of the present disclosure do not limit the values ​​of the pre-set weight values. For example, the preset weight of the bandwidth of the network device is 0.1, the preset weight of the number of subordinate network devices is 0.2, and the preset weight of the number of times it has been visited within the first time period is 0.02.

[0070] In one embodiment, the security level of the network device is positively correlated with the bandwidth of the network device, the number of subordinate network devices, and the number of times the network device is accessed within the first period of time.

[0071] In one embodiment, the asset objects involved in the logical chain include security capabilities, and the client determines the security level of each asset object involved in the logical chain, which may include: obtaining a second parameter of the security capability, the second parameter including one or more of the last update time of the security capability, the number of covered services, and the number of risk events occurring within a second period; and determining the security level of the security capability based on the second parameter. The number of services covered by the security capability refers to the number of services restricted by the security capability.

[0072] The disclosed embodiment does not limit how to obtain the last update time of the security capability, the number of covered services, and the number of risk events that occurred within the second time period. In one embodiment, the last update time of the security capability, the number of covered services, and the number of risk events that occurred within the second time period are all recorded in a device that supports the maintenance of the security capability, and the last update time of the security capability, the number of covered services, and the number of risk events that occurred within the second time period can be obtained from the device.

[0073] In one embodiment, the specific implementation method of determining the security level of the security capability according to the second parameter is the same as the implementation method of determining the security level of the network device according to the first parameter, and will not be repeated here.

[0074] In some embodiments, the security level of the security capability is positively correlated with the last update time and the number of covered services, and negatively correlated with the number of risk events that occur within the second time period. The second time period is a set time period, and the embodiment of the present disclosure does not limit the specific value of the second time period. The number of risk events that occur within the second time period refers to the number of risk events that occur in the security capability within the second time period before the client executes the operation of obtaining the number of risk events.

[0075] In one embodiment, the asset objects involved in the logical chain include services, the security level of the service is a set value, and the client determines the security level of each asset object involved in the logical chain, which may include: directly obtaining the security level of the service.

[0076] Taking the asset objects involved in the logical chain including services, network devices, and security capabilities as an example, the security level of each asset object and determining the first security level may include: adding the security levels of the services, network devices, and security capabilities according to the corresponding weights to obtain the first security level of the logical chain. The embodiments of the present disclosure do not limit the weights of the services, network devices, and security capabilities.

[0077] In one embodiment, determining the second security level of the user corresponding to the intended content to be processed may include: obtaining a third parameter of the user, the third parameter including one or more of the user's operating authority level, software and hardware environment parameters, the number of times the first behavior is performed within a third time period, and the number of times the second behavior is performed; the first behavior is a behavior in a normal behavior library corresponding to the user, and the second behavior is a behavior that does not belong to the normal behavior library; and determining the second security level based on the third parameter.

[0078] Among them, the user's operation authority level is a preset value, and the preset value can be directly obtained from the memory storing the preset value. The software and hardware environment parameters are used to represent the software and hardware environment of the client. According to the user's operation authority level and / or position, a normal behavior library that conforms to the operation authority level and / or position is preset. The first behavior belongs to the normal behavior library, and the second behavior does not belong to the normal behavior library. The third duration is a set value. The specific duration of the third duration is not limited in the embodiment of the present disclosure. For example, the third duration is 1 month.

[0079] In one embodiment, the specific implementation method of determining the second security level according to the third parameter is the same as the implementation method of determining the security level of the network device according to the first parameter, and will not be repeated here.

[0080] In one embodiment, the second security level is positively correlated with the operation authority level and the number of first behaviors, and negatively correlated with the number of second behaviors. When the software and hardware environment parameters are not less than the set parameter threshold, the second security level is independent of the software and hardware environment parameters. When the software and hardware environment parameters are less than the set parameter threshold, the second security level is positively correlated with the software and hardware environment parameters.

[0081] S203: The client determines a first size relationship between the first security level and the second security level.

[0082] The first size relationship may be that the first security level is greater than the second security level, or that the first security level is less than the second security level, or that the first security level is equal to the second security level.

[0083] S204: When the first size relationship is such that the second security level is not less than the first security level, the client generates a control instruction according to the logic chain.

[0084] For example, if the content of the pending intent is to reject the access request from server A, the logical chain generated based on the pending intent content can be server A: IP address, session type: access request, policy: reject. The control instructions generated based on the logical chain include request type: access request, policy: reject, IP address: IP address of server A, execution location: local gateway, execution time: xx year xx month xx day xx:xx. Among them, the execution location is the network controller.

[0085] S205: The client sends a control instruction to the network controller so that the network controller executes the control instruction.

[0086] The technical solution provided by the embodiment of the present disclosure obtains the logical chain of the intended content to be processed, determines the first security level of the logical chain and the second security level of the user who issued the intended content to be processed, and generates and sends control instructions to the network controller according to the logical chain when the second security level is not less than the first security level. Among them, the second security level is not less than the first security level, which means that the user has the authority to perform this network orchestration, and the orchestration result is not likely to affect the normal execution of high-authority security capabilities. When the second security level is not less than the first security level, the control instruction is generated and sent to the network controller according to the logical chain, which can reduce the possibility of causing chaos in the network system after the control instruction is executed, which is conducive to improving the stability of the network system and preventing users from exceeding their authority to perform network orchestration.

[0087] Furthermore, when the second security level is not less than the first security level, a control instruction is generated according to the logical chain and sent to the network controller, so that network orchestration can be stopped when the user does not have permission, thereby avoiding the waste of computing resources caused by continuing network orchestration according to the logical chain.

[0088] In another embodiment, before sending the control instruction to the network controller, it is necessary to perform a conflict detection on the control instruction, and if the detection passes, the control instruction is sent to the network controller. Figure 3 As shown, the process of sending a control instruction to a network controller may include S301 to S302.

[0089] S301, the client performs conflict detection on the control instruction and obtains the detection result.

[0090] In some embodiments, other control instructions that conflict with the control instruction may include: historical control instructions that are mutually exclusive with the control instruction and are in effect, historical control instructions that include the control instruction and are in effect, and historical control instructions that are identical to the control instruction and are in effect.

[0091] In one embodiment, the client performs conflict detection on the control instruction and obtains a detection result, which may include: determining other control instructions that conflict with the control instruction, where the other control instructions are instructions that were in effect before the control instruction was generated; determining a third security level of the user corresponding to the other control instructions; determining a second size relationship between the second security level and the third security level; and obtaining a detection result indicating a pass when the second size relationship is that the second security level is greater than the third security level.

[0092] In another embodiment, when the second size relationship is that the second security level is less than the third security level, the client determines that the parameters acted on by the control instruction are the same parameters among the parameters acted on by other control instructions; when the number of identical parameters is less than the quantity threshold and / or the ratio of the number of identical parameters to the number of parameters acted on by other control instructions is less than the ratio threshold, a detection result indicating a pass is obtained. Among them, the parameters acted on by the control instruction refer to the parameters that need to be modified during the execution of the control instruction by the network controller, and the parameters acted on by other control instructions refer to the parameters that need to be modified during the execution of the other control instructions by the network controller. Both the quantity threshold and the ratio threshold are set values, and the embodiments of the present disclosure do not limit the specific values ​​of the quantity threshold and the ratio threshold. For example, the quantity threshold is 3. The ratio threshold is 0.3.

[0093] In another embodiment, when the second security level is equal to the third security level, the effective time of other control instructions is determined; when the time difference between the effective time and the execution time of the control instruction is not less than the time threshold, a test result indicating a pass is obtained. In another embodiment, when the time difference between the effective time and the execution time of the control instruction is less than the time threshold, the client determines that the parameters acted on by the control instruction are the same parameters as the parameters acted on by other control instructions; when the number of identical parameters is less than the number threshold and / or the ratio of the number of identical parameters to the number of parameters acted on by other control instructions is less than the ratio threshold, a test result indicating a pass is obtained. Wherein, the time threshold is a set value, and the embodiment of the present disclosure does not limit the specific value of the time threshold. For example, the time threshold is 1 week.

[0094] S302: When the detection result is passed, the client sends a control instruction to the network controller.

[0095] The technical solution provided by the embodiment of the present disclosure performs conflict detection on the control instruction after the control instruction is generated, and sends the control instruction to the network controller if the detection passes. In this way, it is possible to avoid conflicts between the control instruction and other control instructions that are in effect, thereby avoiding confusion in the network system caused by conflicts between control instructions, which is conducive to improving the stability of the network system.

[0096] In another embodiment, the information that the client can obtain has a certain lag. When it is determined that the user's security level is greater than the security level of the logical chain and the control instruction passes the conflict detection, there is still a possibility that the control instruction execution fails. Therefore, it is necessary to collect feedback information after the control instruction is executed to determine whether the control instruction is executed successfully, and in the case of execution failure, determine whether the reason for the failure is a permission mismatch, and in the case of failure, generate intent feedback in a timely manner so that the user can adjust the intention of orchestrating the network according to the intent feedback. Figure 4 As shown, the process of generating intention feedback may include the following S401 to S405.

[0097] S401, the client receives system feedback information after the network controller executes the control instruction.

[0098] In one embodiment, the network controller has the ability to generate system feedback information, and the system feedback information can be generated by the network controller after executing the control instruction, and the system feedback information is sent to the client. In another embodiment, the network controller does not have the ability to generate system feedback information, and the system feedback information can be generated by the network device where the network controller is located after the network controller executes the control instruction, and the network device sends the system feedback information to the client.

[0099] S402: The client performs execution analysis on the system feedback information to obtain the execution result of the control instruction.

[0100] The execution result of the control instruction can be either successful or failed.

[0101] S403: When the execution result is a failure, the client determines the third security level of the system feedback information according to the asset object involved in the system feedback information.

[0102] In one embodiment, the implementation method of the third security level of the system feedback information is determined according to the asset object involved in the system feedback information. Figure 2 The implementation method of determining the safety level of the logical chain in S202 of the corresponding embodiment is the same and will not be repeated here.

[0103] S404: The client determines a second size relationship between the second security level and the third security level.

[0104] S405: The client generates an intention feedback carrying a second size relationship.

[0105] In one embodiment, after the client generates the intention feedback carrying the second size relationship, the intention feedback is displayed on a display device, so that the user can obtain the intention feedback through the content displayed on the display device.

[0106] The technical solution provided by the embodiment of the present disclosure collects system feedback information after the network controller executes the control instruction, and then determines the execution result of the control instruction based on the system feedback information. In the case where the execution result is a failure, the second size relationship between the third security level of the system feedback information and the second security level of the user is compared, and an intention feedback carrying the second size relationship is generated, so that the user can adjust the network orchestration intention according to the second size relationship. By generating and displaying the intention feedback carrying the second size relationship to the user, it is beneficial for the user to adjust the intention of orchestrating the network in a timely manner, and then obtain the intention that can be successfully orchestrated, thereby improving the efficiency of network orchestration.

[0107] Based on the same inventive concept, the present disclosure also provides a network orchestration device in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0108] Figure 5 A schematic diagram of a network orchestration device in one embodiment of the present disclosure is shown. Figure 5 As shown, the device includes: an acquisition module 501, used to acquire a logical chain of intended content to be processed; a determination module 502, used to determine a first security level of the logical chain, and to determine a second security level of a user corresponding to the intended content to be processed; the determination module 502 is also used to determine a first size relationship between the first security level and the second security level; a generation module 503, used to generate a control instruction according to the logical chain when the first size relationship is that the second security level is not less than the first security level; a sending module 504, used to send a control instruction to a network controller so that the network controller executes the control instruction.

[0109] In one embodiment of the present disclosure, the determination module 502 is used to determine the security level of each asset object involved in the logical chain; and determine the first security level according to the security level of each asset object.

[0110] In one embodiment of the present disclosure, the asset objects involved in the logical chain include network devices; a determination module 502 is used to obtain a first parameter of the network device, the first parameter including one or more of the bandwidth of the network device, the number of subordinate network devices, and the number of times it is accessed within a first time period; based on the first parameter, a security level of the network device is determined.

[0111] In one embodiment of the present disclosure, the asset objects involved in the logical chain include security capabilities; a determination module 502 is used to obtain a second parameter of the security capability, the second parameter including one or more of the last update time of the security capability, the number of covered services, and the number of risk events occurring within a second period of time; based on the second parameter, the security level of the security capability is determined.

[0112] In one embodiment of the present disclosure, a determination module 502 is used to obtain a third parameter of the user, where the third parameter includes one or more of the user's operating authority level, software and hardware environment parameters, the number of times the first behavior is performed within a third time period, and the number of times the second behavior is performed; the first behavior is a behavior in a normal behavior library corresponding to the user, and the second behavior is a behavior that does not belong to the normal behavior library; and the second security level is determined based on the third parameter.

[0113] In one embodiment of the present disclosure, the sending module 504 is used to perform conflict detection on the control instruction to obtain a detection result; when the detection result is a pass, the control instruction is sent to the network controller.

[0114] In one embodiment of the present disclosure, Figure 6 As shown, the device also includes: a receiving module 505, which is used to receive system feedback information after the network controller executes the control instruction; an analysis module 506, which is used to perform execution analysis on the system feedback information to obtain the execution result of the control instruction; a determination module, which is also used to determine the third security level of the system feedback information according to the asset object involved in the system feedback information when the execution result is a failure; the determination module is also used to determine the second size relationship between the second security level and the third security level; the generation module is also used to generate intention feedback carrying the second size relationship.

[0115] The technical solution provided by the embodiment of the present disclosure obtains the logical chain of the intended content to be processed, determines the first security level of the logical chain and the second security level of the user who issued the intended content to be processed, and generates and sends control instructions to the network controller according to the logical chain when the second security level is not less than the first security level. Among them, the second security level is not less than the first security level, which means that the user has the authority to perform this network orchestration, and the orchestration result is not likely to affect the normal execution of high-authority security capabilities. When the second security level is not less than the first security level, the control instruction is generated and sent to the network controller according to the logical chain, which can reduce the possibility of causing chaos in the network system after the control instruction is executed, which is conducive to improving the stability of the network system and preventing users from exceeding their authority to perform network orchestration.

[0116] Furthermore, when the second security level is not less than the first security level, a control instruction is generated according to the logical chain and sent to the network controller, so that network orchestration can be stopped when the user does not have permission, thereby avoiding the waste of computing resources caused by continuing network orchestration according to the logical chain.

[0117] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0118] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0119] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0120] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Specific Implementation Methods” section of this specification.

[0121] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0122] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0123] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0124] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 700, and / or any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 760. Figure 7 As shown, the network adapter 760 communicates with other modules of the electronic device 700 via the bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0125] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0126] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above-mentioned method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Specific Implementation Methods” section of this specification.

[0127] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0129] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0130] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0131] In an exemplary embodiment of the present disclosure, a computer program product is also provided, which includes a computer program or computer instructions, and the computer program or computer instructions are loaded and executed by a processor to enable a computer to implement the steps of various exemplary embodiments of the present disclosure described in the above "Specific Implementation" section of this specification.

[0132] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0133] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0134] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0135] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope of the present disclosure is indicated by the appended claims.

Claims

1. A network orchestration method, characterized in that: include: Get the logical chain of intent content to be processed; Determining a first security level of the logic chain, and determining a second security level of a user corresponding to the intended content to be processed; Determine a first magnitude relationship between the first security level and the second security level; generating a control instruction according to the logic chain in the case where the first size relationship is that the second security level is not less than the first security level; Sending a control instruction to a network controller so that the network controller executes the control instruction; Wherein, determining the first security level of the logical chain includes: Determining a security level of each asset object involved in the logical chain, wherein the asset object includes at least one of a service, a network device, and a security capability; The first security level is determined according to the security level of each asset object.

2. The method according to claim 1, characterized in that The asset objects involved in the logical chain include network equipment; Determining the security level of each asset object involved in the logical chain includes: Acquire a first parameter of the network device, the first parameter including one or more of a bandwidth of the network device, a number of subordinate network devices, and a number of times the network device is accessed within a first time period; A security level of the network device is determined according to the first parameter.

3. The method according to claim 1, characterized in that The asset objects involved in the logic chain include security capabilities; Determining the security level of each asset object involved in the logical chain includes: Acquire a second parameter of the security capability, where the second parameter includes one or more of a last update time of the security capability, a number of covered services, and a number of risk events occurring within a second period of time; A security level of the security capability is determined according to the second parameter.

4. The method according to claim 1, characterized in that: The determining the second security level of the user corresponding to the intended content to be processed includes: Acquire a third parameter of the user, the third parameter including one or more of the user's operation authority level, software and hardware environment parameters, the number of times the user performs a first behavior and the number of times the user performs a second behavior within a third time period; the first behavior is a behavior in a normal behavior library corresponding to the user, and the second behavior is not a behavior in the normal behavior library; The second security level is determined according to the third parameter.

5. The method according to claim 1, characterized in that The sending of a control instruction to the network controller includes: Performing conflict detection on the control instructions to obtain a detection result; When the detection result is passed, a control instruction is sent to the network controller.

6. The method according to claim 1, characterized in that Also includes: Receiving system feedback information after the network controller executes the control instruction; Performing execution analysis on the system feedback information to obtain the execution result of the control instruction; In the case where the execution result is a failure, determining a third security level of the system feedback information according to the asset object involved in the system feedback information; Determining a second magnitude relationship between the second security level and the third security level; Generate intent feedback carrying the second size relationship.

7. A network arrangement device, characterized in that: include: The acquisition module is used to obtain the logical chain of the intent content to be processed; A determination module, used to determine a first security level of the logic chain, and to determine a second security level of the user corresponding to the intended content to be processed; The determination module is further used to determine a first magnitude relationship between the first security level and the second security level; a generating module, configured to generate a control instruction according to the logic chain if the first size relationship is that the second security level is not less than the first security level; A sending module, used for sending a control instruction to the network controller so that the network controller executes the control instruction; The determination module is further used to determine the security level of each asset object involved in the logical chain, where the asset objects include at least one of services, network equipment, and security capabilities; and determine the first security level based on the security level of each asset object.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the network orchestration method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network orchestration method according to any one of claims 1 to 6 is implemented.

Images