A network security path calculation method, device and storage medium based on intent

Abstract

The present application discloses a network security path calculation method, device and storage medium based on intent. The method of the present application first obtains and decomposes intent, then calculates the network security path through subnet sharding and then merges the sharded paths to obtain a unique path, thereby realizing a network security path calculation method that is efficient, secure and perfectly adapted to user intent.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intent-based network security path calculation method, device and storage medium. Background Art

[0002] At present, the cross-domain routing security problem in multi-domain SDN networks cannot be properly solved. Many network security platforms are only used for the configuration of security devices and cannot provide network security path calculation. Most of the existing methods are to spread through broadcasting and then gradually obtain the path, or to access based on the original access path. This makes it impossible to effectively evaluate and optimize the cross-domain network path, and the security cannot be guaranteed. In addition, the same protection is used for different security requirements, which makes the path acquisition slow and unstable. Due to hardware limitations, the scale of a single SDN network will inevitably not be large. Even if there is an SDN controller, it will not be able to obtain the overall situation of the network in the traditional way of cross-domain routing. Building a centralized network controller is not only huge in consumption and computing pressure, but also feedback timeliness may not be guaranteed. There are certain systemic risks. Due to the single point failure of the controller and the threat of malicious attacks, the path information calculated by a controller cannot guarantee the security and reliability of cross-domain communication. Summary of the invention

[0003] The main purpose of this application is to provide an intent-based network security path calculation method, device and storage medium, aiming to provide an efficient, secure and perfectly adapted to user intent network security path calculation method.

[0004] To achieve the above-mentioned purpose, in a first aspect, a method for calculating a network security path based on intent is provided, which is applicable to a computing power network security platform, wherein the computing power network security platform includes a plurality of network nodes, the computing power network security platform is provided with a plurality of subnets, the network nodes belong to corresponding subnets, each subnet is configured with a subnet controller, the computing power network security platform is connected to a computing network brain, the computing network brain is configured with a master control module and an intent acquisition module, the intent acquisition module, the method comprises the following steps:

[0005] S100, the computing network brain obtains the user's intention information through the intention acquisition module, where the intention information includes a source node, a destination node, and a security level requirement;

[0006] S200, the computing network brain performs intent decomposition according to the intent information to generate a number of intent decomposition schemes, and generates a number of intent global paths according to the intent decomposition schemes; wherein the intent decomposition schemes include sharding subnet information, and the sharding subnet information includes a subnet identifier set corresponding to a subnet passed from a source node to a destination node and marginal node information; the specific steps of generating a number of intent global paths according to the intent decomposition schemes include:

[0007] S210, the computing network brain determines the corresponding subnet controller according to the shard subnet information in the intention disassembly scheme, and generates or updates each shard subnet topology corresponding to the intention disassembly scheme through the determined subnet controller; wherein the data stored in the shard subnet topology includes node data and link data, the link data includes the node information of the link and the link enablement identifier, the node data includes the node subnet identifier and the status identifier, and the status identifier includes one or more of the security event identifier, the equipment update identifier, and the fault identifier;

[0008] S220, marking security devices in each of the slice subnet topologies, and determining the link enablement status according to the status identifiers of the nodes at both ends of the link and the link enablement identifier;

[0009] S230, calculate the weight of the enabled link in the slice subnet topology; the weight calculation steps are as follows:

[0010] S231, obtaining link security scores of all links in the slicing subnet topology; the link security scores are calculated based on the security device labels involved in the links and the security event identifiers of the nodes at both ends of the links;

[0011] S232, determining the safety factor of the link according to the link safety score-safety factor mapping relationship corresponding to each safety level requirement; S233, obtaining the load factor of the link based on the load condition of the link, and calculating the link weight based on the load factor and safety factor of the link;

[0012] S240 calculates a minimum spanning tree according to each shard subnet topology corresponding to the intended disassembly solution and the marginal node information in the shard subnet information and in combination with the link weight to generate a number of corresponding shard subnet paths; the adjacent nodes of all links in the shard subnet path belong to the same subnet;

[0013] S250, the master control module of the computing network brain generates the intent global topology corresponding to the intent decomposition scheme based on each shard subnet topology corresponding to the intent decomposition scheme, determines the corresponding cross-subnet link based on the intent global topology and link weight, and synthesizes several intent global paths through the shard subnet paths and cross-subnet links;

[0014] S300: All intended global paths are selected by comparing path weights to determine a unique global path.

[0015] Preferably, after step S300, the method further includes:

[0016] S400, the computing network brain sends the unique global path to the relevant subnet controller. The subnet controller determines the starting node in the corresponding subnet and the subnet identifier of the next subsequent subnet based on the received unique global path, and retrieves the corresponding security policy based on the determined subnet identifier and sends it at the determined starting node.

[0017] Preferably, the security policy is configured with security restrictions, and the security restrictions include one or more of time restrictions, number restrictions, and destination node restrictions.

[0018] Preferably, the link security score is calculated based on a security device score and a security event score, wherein the security device score is calculated based on the security device status of nodes at both ends of the link, and the security event score is calculated based on the security event status of nodes at both ends of the link.

[0019] Preferably, the safety device labeling includes an embedded safety device identification and a side-mounted safety device identification, and the embedded safety device identification and the side-mounted safety device identification have preset different safety device scores.

[0020] In a second aspect, an embodiment of the present application further provides a computer device, comprising one or more processors;

[0021] a memory for storing one or more programs,

[0022] When the one or more programs are executed by the one or more processors, the one or more processors execute the method as described in the first aspect above.

[0023] In a third aspect, an embodiment of the present application further provides a storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect above.

[0024] The beneficial effects of the present invention are:

[0025] The network security path is calculated by subnet sharding, and then the shard paths are merged to obtain a unique path. The path calculation efficiency is high, the path calculation takes less time, and the shard path calculation is only performed through the subnet controller of the subnet, which is more secure.

[0026] The user's security intention is reflected in the calculation of the path weight. The same link security score can obtain different security factors under different security level requirements of the user, which in turn affects the link weight. This makes the weight calculation of each link different according to the different security level requirements of the user. In the path calculation, different network security paths can be obtained according to the different security level requirements of the user, which better meets user needs and makes the path calculation more intelligent.

[0027] The intent is decomposed through intent information to split the user's intent and calculate it to improve efficiency. The relevant sharded subnet topologies are then synthesized to form the global topology of the intent. Only the relevant subnet data is calculated and updated, avoiding useless consumption when calculating the overall topology and obtaining network security paths more efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of a flow chart of a method for calculating an intent-based network security path provided by an embodiment of the present invention;

[0029] Figure 2 A global topology abstract graph provided by an embodiment of the present invention;

[0030] Figure 3 A path diagram obtained after calculation provided by an embodiment of the present invention;

[0031] Figure 4 A schematic diagram of the structure of a device provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0032] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

[0033] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0034] like Figure 1 As shown, Figure 1 A flowchart of a network security path calculation method based on intent provided by one embodiment of the present invention. As one embodiment of the present application, a network security path calculation method based on intent is provided, which is applicable to a computing power network security platform, wherein the computing power network security platform includes multiple network nodes, and the computing power network security platform is provided with several subnets, wherein the network nodes belong to corresponding subnets, and each subnet is configured with a subnet controller, wherein the computing power network security platform is connected to the computing network brain, and the computing network brain is configured with a master control module and an intent acquisition module, wherein the intent acquisition module, the method includes the following steps:

[0035] S100, the computing network brain obtains the user's intention information through the intention acquisition module; the intention information includes the source node, the destination node and the security level requirement;

[0036] S200, the computing network brain performs intent decomposition according to the intent information to generate a number of intent decomposition schemes, and generates a number of intent global paths according to the intent decomposition schemes; wherein the intent decomposition schemes include sharding subnet information, and the sharding subnet information includes a subnet identifier set corresponding to a subnet passed from a source node to a destination node and marginal node information; the specific steps of generating a number of intent global paths according to the intent decomposition schemes include:

[0037] S210, the computing network brain determines the corresponding subnet controller according to the shard subnet information in the intention disassembly scheme, and generates or updates each shard subnet topology corresponding to the intention disassembly scheme through the determined subnet controller; wherein the data stored in the shard subnet topology includes node data and link data, the link data includes the node information of the link and the link enablement identifier, the node data includes the node subnet identifier and the status identifier, and the status identifier includes one or more of the security event identifier, the equipment update identifier, and the fault identifier;

[0038] S220, marking security devices in each of the slice subnet topologies, and determining the link enablement status according to the status identifiers of the nodes at both ends of the link and the link enablement identifier;

[0039] S230, performing weight calculation of the enabled link in the shard subnet topology; the link weight calculation steps are as follows:

[0040] S231, obtaining link security scores of all links in the slicing subnet topology; the link security scores are calculated based on the security device labels involved in the links and the security event identifiers of the nodes at both ends of the links;

[0041] S232, determining the safety factor of the link according to the link safety score-safety factor mapping relationship corresponding to each safety level requirement; S233, obtaining the load factor of the link based on the load condition of the link, and calculating the link weight based on the load factor and safety factor of the link;

[0042] S240 calculates a minimum spanning tree according to each shard subnet topology corresponding to the intended disassembly solution and the marginal node information in the shard subnet information and in combination with the link weight to generate a number of corresponding shard subnet paths; the adjacent nodes of all links in the shard subnet path belong to the same subnet;

[0043] S250, the master control module of the computing network brain generates the intent global topology corresponding to the intent decomposition scheme based on each shard subnet topology corresponding to the intent decomposition scheme, determines the corresponding cross-subnet link based on the intent global topology and link weight, and synthesizes several intent global paths through the shard subnet paths and cross-subnet links;

[0044] S300: All intended global paths are selected by comparing path weights to determine a unique global path.

[0045] Furthermore, after step S300, the following steps are further included:

[0046] S400, the computing network brain sends the unique global path to the relevant subnet controller. The subnet controller determines the starting node in the corresponding subnet and the subnet identifier of the next subsequent subnet based on the received unique global path, and retrieves the corresponding security policy based on the determined subnet identifier and sends it at the determined starting node.

[0047] Furthermore, the security policy is configured with security restrictions, and the security restrictions include one or more of time restrictions, number restrictions, and destination node restrictions.

[0048] Furthermore, the link security score is calculated based on a security device score and a security event score. The security device score is calculated based on the security device status of the nodes at both ends of the link. The security event score is calculated based on the security event status of the nodes at both ends of the link.

[0049] Furthermore, the safety device labeling includes an embedded safety device identification and a side-mounted safety device identification, and the embedded safety device identification and the side-mounted safety device identification have preset different safety device scores.

[0050] Exemplarily, in this embodiment, the computing power network security platform includes 15 network nodes, namely nodes 1 to 15, and the computing power network security platform is provided with 3 subnets, namely subnet A, subnet B, and subnet C, respectively, with corresponding subnet controllers CA, subnet controller CB, and subnet controller CC, nodes 1 to 5 belong to subnet A, nodes 6 to 10 belong to subnet B, and nodes 11 to 15 belong to subnet C, wherein there is a data link between node 1 and node 7, there is a data link between node 3 and node 6, and there is a data link between node 8 and node 11;

[0051] First, the user fills in his / her intention through the user terminal or web page. For example, to securely access a device or port of node 15 from node 5, the security level requirement is a. The intention acquisition module of the computing network brain obtains the user's intention information, i.e., node 5-node 15, and the security level requirement is: a; assuming that the security registration requirements are divided into three levels from high to low: a, b, c;

[0052] The computing network brain first obtains the subnets where node 5 and node 15 are located, namely subnet A and subnet C. Since the nodes in subnet A and subnet C are not directly connected, they need to pass through subnet B, so the intended disassembly plan is subnet A, subnet B, and subnet C. The marginal nodes of subnet A are node 5, node 1, and node 3. The marginal nodes of subnet B are node 6, node 7, and node 8. The nodes of subnet C are node 11 and node 15. Then the computing network brain determines the subnet controller CA, subnet controller CB, and subnet controller CC according to the intended disassembly plan, and then forms the sharded subnet topology corresponding to subnet A, subnet B, and subnet C through subnet controller CA, subnet controller CB, and subnet controller CC respectively. The data stored in the sharded subnet topology includes node data and link data. The link data includes node information of the link and link enable identifier. The node data includes node subnet identifier and status identifier. The status identifier includes one or more of security event identifier, device update identifier, and fault identifier.

[0053] After obtaining the subnet topology, security equipment is marked. The security equipment of each node in the subnet is marked in the subnet topology by identification. Security equipment can be distinguished in form, such as embedded and side-mounted. The corresponding identification can include embedded security equipment identification and side-mounted security equipment identification. Security registration can also be configured for security equipment. Similarly, different identifications need to be set and then matched with different security event scores. Technical personnel in this field can configure it by themselves.

[0054] After marking the security devices, the link weights are calculated for the links of each shard subnet topology. An innovation of this application is to link the link weights with the security status and the intended security level requirements. The same link will have different weights under different security level requirements. Therefore, each security level requirement will have a corresponding link security score-safety factor mapping relationship. For example, when the security level is a, the link security score interval of 1-5 points corresponds to a safety factor of 0.7, the link security score interval of 6-10 points corresponds to a safety factor of 0.8, and the link security score interval of 11-15 points corresponds to a safety factor of 0.9; and when the security level is c, the link security score interval of 1-5 points corresponds to a safety factor of 0.9, and the link security score interval of 11-15 points corresponds to a safety factor of 0.9. The safety factor of the road safety score of 6-10 points corresponds to a safety factor of 0.8, and the safety factor of the link safety score of 11-15 points corresponds to a safety factor of 0.7. The link safety score is calculated based on the safety device score and the safety event score. For example, the safety score of each side-mounted safety device link is +2, and the safety score of each embedded safety device link is +3. If there is no safety event at both ends of the link, the safety event score defaults to +10 points and -3 points for each event. Similar scoring methods can be set by technicians in this field. Similarly, this application only lists the safety factor and load factor, and there can also be factors related to weight calculation such as transmission quality factor, which can be configured according to actual conditions. However, the focus of this application is to associate the weight of the link with the link security, and for different security level requirements, even the same link may have different weights. The evaluation of the weight is affected by the security level requirements in the user's intention. In fact, the user's intention for the security level is integrated into the setting of the link weight. The link weight is revised by the safety factor, so that different user intentions will have different link weights for the same link situation, so that the final network topology changes according to the user's intention.

[0055] After calculating the weights of the links in all the sharded subnet topologies, the minimum spanning tree algorithm is used to determine the sharded subnet paths in each subnet. Continuing to use the above subnet A, subnet B, and subnet C as an example, assuming that the global topology abstract diagram of subnet A, subnet B, and subnet C is as follows: Figure 2As shown in the figure, the shard paths of subnet A are 5-1 and 5-3. This is because there are two different cross-subnet links, 1-7 and 3-6, between subnet A and subnet B. The subnet controller does not have a global perspective and cannot confirm the weights of subsequent links, so all of them are retained. Therefore, the shard paths of subnet B are 6-7-8 and 7-8, and the shard paths of subnet C are 11-15. The final corresponding combined intended global paths are 5-1-7-8-11-15 and 5-3-6-7-8-11-15. Then the path weights of all intended global paths are calculated to finally obtain a unique global path. For example, the path weight of path 5-1-7-8-11-15 is 21 and the path weight of path 5-3-6-7-8-11-15 is 35. Then path 5-1-7-8-11-15 is the final unique global path. Figure 3 shown.

[0056] After obtaining the unique global path, the computing network brain sends the unique global path to the relevant subnet controller. The subnet controller determines the starting node in the corresponding subnet according to the received unique global path, as well as the subnet identifier of the next subsequent subnet. According to the determined subnet identifier, the corresponding security policy is retrieved and sent at the determined starting node. The fragmented sending of security policies can better protect the security of the overall network environment, so that another subnet that has not obtained the security approval of a certain subnet cannot obtain the security policy of the subnet. For example, the security of subnet A cannot be recognized by subnet C, so that users of subnet A cannot directly access devices and interfaces in subnet C. The use of the security policy sending method of the present application can effectively prevent users in subnet A from obtaining the security policy of subnet C, thereby forming a better protection. A further security policy can be configured with security restrictions, which include one or more of time limits, number limits, and destination node limits, to further improve security.

[0057] The effective effects of this application are:

[0058] 1. Calculate the network security path through subnet sharding, and then merge the shard paths to get a unique path. The path calculation efficiency is high, the path calculation takes less time, and the shard path calculation is only performed through the subnet controller of the subnet, which is more secure.

[0059] 2. The user's security intention is reflected in the calculation of the path weight. The same link security score can obtain different security factors under different security level requirements of users, which in turn affects the link weight. This makes the weight calculation of each link different according to the different security level requirements of users. In the path calculation, different network security paths can be obtained according to different security level requirements of users, which better meets user needs and makes the path calculation more intelligent.

[0060] 3. Decompose the user's intention through intent information to split the calculation to improve efficiency, and then synthesize the relevant sharded subnet topologies to form the global topology of the intention. Only the relevant subnet data is calculated and updated, avoiding useless consumption when calculating the overall topology, and obtaining network security paths more efficiently.

[0061] Figure 4 A schematic diagram of the structure of a device provided by an embodiment of the present invention. Figure 2 As shown, as another aspect, the present application also provides a computer device 100, including one or more central processing units (CPU) 101, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 102 or the program loaded from the storage part 108 to the random access memory (RAM) 103. In the RAM 103, various programs and data required for the operation of the device 100 are also stored. The CPU 101, the ROM 102, and the RAM 103 are connected to each other through a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0062] The following components are connected to the I / O interface 105: an input section 106 including a keyboard, a mouse, etc.; an output section 107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 108 including a hard disk, etc.; and a communication section 109 including a network interface card such as a LAN card, a modem, etc. The communication section 109 performs communication processing via a network such as the Internet. A driver 110 is also connected to the I / O interface 105 as needed. A removable medium 111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the driver 110 as needed, so that a computer program read therefrom is installed into the storage section 108 as needed.

[0063] In particular, according to the embodiments disclosed in the present application, the method described in the above embodiment 1 can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method described in any of the above embodiments. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 109, and / or installed from the removable medium 111.

[0064] As another aspect, the present application further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the apparatus of the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the method described in the present application.

[0065] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a dedicated hardware-based system that performs a specified function or operation, or can be realized by a combination of dedicated hardware and computer instructions.

[0066] The units or modules involved in the embodiments described in the present application may be implemented by software or by hardware. The units or modules described may also be arranged in a processor. For example, each of the units may be a software program arranged in a computer or a mobile smart device, or may be a separately configured hardware device. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0067] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the present application. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) to form a technical solution.

Claims

1. A network security path calculation method based on intent, characterized in that: Applicable to a computing power network security platform, the computing power network security platform includes multiple network nodes, the computing power network security platform is provided with several subnets, the network nodes belong to corresponding subnets, each subnet is configured with a subnet controller, the computing power network security platform is connected to the computing network brain, the computing network brain is configured with a master control module and an intention acquisition module, the method includes the following steps: S100, the computing network brain obtains the user's intention information through the intention acquisition module, where the intention information includes a source node, a destination node, and a security level requirement; S200, the computing network brain performs intent decomposition according to the intent information to generate a number of intent decomposition schemes, and generates a number of intent global paths according to the intent decomposition schemes; wherein the intent decomposition schemes include sharding subnet information, and the sharding subnet information includes a subnet identifier set corresponding to a subnet passed from a source node to a destination node and marginal node information; the specific steps of generating a number of intent global paths according to the intent decomposition schemes include: S210, the computing network brain determines the corresponding subnet controller according to the shard subnet information in the intention disassembly scheme, and generates or updates each shard subnet topology corresponding to the intention disassembly scheme through the determined subnet controller; wherein the data stored in the shard subnet topology includes node data and link data, the link data includes the node information of the link and the link enablement identifier, the node data includes the node subnet identifier and the status identifier, and the status identifier includes one or more of the security event identifier, the equipment update identifier, and the fault identifier; S220, marking security devices in each of the slice subnet topologies, and determining the link enablement status according to the status identifiers of the nodes at both ends of the link and the link enablement identifier; S230, performing weight calculation of the enabled link in the shard subnet topology; the link weight calculation steps are as follows: S231, obtaining link security scores of all links in the slicing subnet topology; the link security scores are calculated based on the security device labels involved in the links and the security event identifiers of the nodes at both ends of the links; S232, determining the safety factor of the link according to the link safety score-safety factor mapping relationship corresponding to each safety level requirement; S233, obtaining a load factor of the link based on the load condition of the link, and calculating a link weight based on the load factor and safety factor of the link; S240 calculates a minimum spanning tree according to each shard subnet topology corresponding to the intended disassembly solution and the marginal node information in the shard subnet information and in combination with the link weight to generate a number of corresponding shard subnet paths; the adjacent nodes of all links in the shard subnet path belong to the same subnet; S250, the master control module of the computing network brain generates the intent global topology corresponding to the intent decomposition scheme based on each shard subnet topology corresponding to the intent decomposition scheme, determines the corresponding cross-subnet link based on the intent global topology and link weight, and synthesizes several intent global paths through the shard subnet paths and cross-subnet links; S300: All intended global paths are selected by comparing path weights to determine a unique global path.

2. The method for calculating an intent-based network security path according to claim 1, characterized in that: After step S300, the following steps are also included: S400, the computing network brain sends the unique global path to the relevant subnet controller. The subnet controller determines the starting node in the corresponding subnet and the subnet identifier of the next subsequent subnet based on the received unique global path, and retrieves the corresponding security policy based on the determined subnet identifier and sends it at the determined starting node.

3. The method for calculating an intent-based network security path according to claim 2, characterized in that: The security policy is configured with security restrictions, and the security restrictions include one or more of time restrictions, number restrictions, and destination node restrictions.

4. The method for calculating an intent-based network security path according to claim 1, characterized in that: The link security score is calculated based on a security device score and a security event score. The security device score is calculated based on the security device status of nodes at both ends of the link. The security event score is calculated based on the security event status of nodes at both ends of the link.

5. The method for calculating an intent-based network security path according to claim 1, characterized in that: The safety device labeling includes an embedded safety device identification and a side-mounted safety device identification, and the embedded safety device identification and the side-mounted safety device identification have different preset safety device scores.

6. A computer device, characterized in that: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1 to 5.

7. A storage medium storing a computer program, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images