A switch-based certificate management and authorization method, device and medium

Abstract

The application discloses a kind of certificate management and authorization method, equipment and medium based on switch, belong to communication technical field, for solving the authorization and the way of cutting off between existing SDN controller and managed and controlled device is relatively simple, only limit user to view system, cannot solve the essential demand of SDN authorization, still in the resource of SDN controller's technical problem of consumption.Method includes: the default type certificate is sent to the specified installation directory of SDN controller, obtains the SDN controller to be run;To the SDN controller to be run is accessed public network judgment;If the SDN controller to be run is allowed to access public network, then through the SDN controller to be run, the formal type certificate sent online is authorized verification, obtains first authorization data;If the SDN controller to be run is rejected to access public network, then through the SDN controller to be run, the authorization data uploaded offline is authorized verification, obtains second authorization data.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to a method, device, and medium for certificate management and authorization based on a switch. Background Technology

[0002] Software-defined networking (SDN) is a new network architecture whose core idea is to control or drive the entire network through software. The SDN controller, acting as the brain of the SDN system, is responsible for managing the entire network, overseeing multiple network devices. With the continuous development of the internet, SDN technology has been extensively implemented in data centers and campus networks.

[0003] On the other hand, as control software, SDN controllers require protection of their intellectual property and core technologies when used commercially. The software's usage period and scope are concerns for both the product and the user. Software licensing currently includes two methods: software licensing and hardware licensing. Hardware licensing combines hardware and software, exchanging data through hardware circuitry (commonly known as a dongle) installed on a parallel port or USB port and software functions. Without this hardware circuitry, the application cannot be accessed. Software licensing, on the other hand, manages usage permissions solely through the software program.

[0004] Currently, there are few SDN-based licensing products on the market, making it difficult to achieve finer-grained licensing of SDN-managed devices, including control over specific devices, types of devices, and their usage time. This invention effectively solves this problem. It can precisely manage licensed devices according to different customer needs, with customers paying based on the number of managed devices and the duration of management, achieving a win-win situation. Summary of the Invention

[0005] This application provides a switch-based certificate management and authorization method, device, and medium to solve the following technical problem: the existing authorization and termination methods between SDN controllers and managed devices are relatively simple, only restricting users from viewing the system, and cannot solve the essential needs of SDN authorization. The SDN controller is still interacting with switches, routers, etc., and is still consuming the resources of the SDN controller.

[0006] The embodiments of this application adopt the following technical solutions:

[0007] On one hand, this application provides a switch-based certificate management and authorization method, including: sending a default type certificate from a certificate management server to a designated installation directory of an SDN controller to obtain an SDN controller to be run; detecting and judging whether the SDN controller to be run can access the public network; if the SDN controller to be run allows access to the public network, then authorizing and verifying the formal type certificate sent online through the SDN controller to obtain first authorization data; if the SDN controller to be run denies access to the public network, then authorizing and verifying the unauthorized data uploaded offline through the SDN controller to obtain second authorization data; and controlling the operation of the SDN controller to be run based on the first authorization data and the second authorization data to realize the SDN controller's management of resources.

[0008] This application embodiment achieves resource configuration of the SDN controller by cooperating with a certificate management server to authorize and revoke network devices such as switches and routers. The core functionality is achieved through the SDN controller's authorization file. When an authorization expires, the invalidated switch, router, or other network device can be directly removed, freeing up SDN controller resources and improving resource utilization. Authorization can also be performed both online and offline. Furthermore, the certificate files are provided by the certificate management server; if a certificate file is lost in the SDN controller, it can be re-obtained through the certificate management service, preventing issues such as certificate file loss.

[0009] In one feasible implementation, before sending the default type certificate from the certificate management server to the designated installation directory of the SDN controller to obtain the SDN controller to be run, the method further includes: generating a private library file based on the preset authorization data in the certificate management server; wherein the preset authorization data contains usage time variables, validity time variables, and expiration time variables; encrypting the preset authorization data using the private library file to obtain a certificate file; and integrating the private library file, the certificate file, and the switch device information in the preset authorization data into an initialization file to obtain the default type certificate.

[0010] In one feasible implementation, the default type certificate in the certificate management server is sent to the designated installation directory of the SDN controller to obtain the SDN controller to be run. Specifically, this includes: starting the SDN controller to be run; obtaining the certificate file of the default type certificate in the certificate management server based on the startup information; sending the certificate file to the designated installation directory of the SDN controller; performing initialization processing and a certificate detection timed task on the certificate file to obtain the SDN controller to be run after initialization verification.

[0011] In one feasible implementation, the certificate file undergoes initialization processing and a certificate detection timer task to obtain an SDN controller awaiting initialization verification. Specifically, this includes: decrypting the certificate file using the public key library file in the SDN controller to obtain authorization time information; wherein the authorization time information includes: authorization effective time and authorization expiration time; determining the validity period of the authorization time information; and based on the validity period determination result, managing all switch devices and performing initial deployment on the switches; performing timer checks on the effective and expiration times of the pre-deployed switches, and repeatedly decrypting the certificate file for switches within their effective time until the switch reaches its expiration time; and obtaining the SDN controller awaiting initialization verification based on the validity period determination result and the certificate detection timer task.

[0012] In one feasible implementation, before detecting and judging the SDN controller's access to the public network, the method further includes: visually associating the SDN controller with the SDN controller via a web page to obtain a visual interface based on the SDN controller; displaying the device information and corresponding authorization status information of the switches connected to and managed by the SDN controller through the visual interface; wherein, the device information includes at least: an SN code; and the authorization status information includes: validity period judgment result, effective time and expiration time, and authorization time information.

[0013] In one feasible implementation, the SDN controller to be run obtains device information of the access switch through management protocols such as SNMP and Telemetry; determines the SN code in the device information as a unique identifier and records the unique identifier in the service database; based on the service database, obtains the authorization status of the corresponding switch; wherein, the authorization status includes: true status and false status.

[0014] In one feasible implementation, if the SDN controller to be run is allowed to access the public network, then the SDN controller to be run performs authorization verification on the formal type certificate sent online to obtain first authorization data. Specifically, this includes: when the SDN controller to be run is accessible to the public network, sending formal certificate request information to the certificate management server through a visual interface; wherein, the formal certificate request information includes: authorization data, certificate type, and formal type certificate; generating the formal type certificate file based on the formal certificate request information; and sending the formal type certificate file to the SDN controller to be run; through the SDN controller to be run, performing certificate replacement and authorization data detection on the formal type certificate file to obtain authorized device information related to switch authorization management; and updating the authorization status of the corresponding switch in the service database through the authorized device information to obtain first authorization data for online management of switch resource configuration.

[0015] In one feasible implementation, if the SDN controller to be run is denied access to the public network, the offline uploaded unauthorized data is verified through the SDN controller to obtain second authorized data. Specifically, this includes: when the SDN controller to be run is unable to access the public network and cannot be accessed by the public network, the unauthorized data related to the switch is sent to the certificate management server offline, and the corresponding official type certificate file is obtained; the official type certificate file is uploaded to the SDN controller to be run through a visual interface; the SDN controller to be run performs certificate replacement and authorization data detection on the official type certificate file to obtain authorized device information related to switch authorization management; and the authorization status of the corresponding switch in the business database is updated using the authorized device information to obtain second authorized data for offline management of the switch resource configuration.

[0016] Secondly, embodiments of this application also provide a switch-based certificate management and authorization device, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to execute a switch-based certificate management and authorization method as described in any of the above embodiments.

[0017] Thirdly, embodiments of this application also provide a non-volatile computer storage medium, characterized in that the storage medium is a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium stores at least one program, each program including instructions, and when the instructions are executed by a terminal, the terminal executes a switch-based certificate management and authorization method described in any of the above embodiments.

[0018] This application provides a certificate management and authorization method, device, and medium based on a switch. Compared with the prior art, the embodiments of this application have the following beneficial technical effects:

[0019] This application embodiment achieves resource configuration of the SDN controller by cooperating with a certificate management server to authorize and revoke network devices such as switches and routers. The core functionality is achieved through the SDN controller's authorization file. When an authorization expires, the invalidated switch, router, or other network device can be directly removed, freeing up SDN controller resources and improving resource utilization. Authorization can also be performed both online and offline. Furthermore, the certificate files are provided by the certificate management server; if a certificate file is lost in the SDN controller, it can be re-obtained through the certificate management service, preventing issues such as certificate file loss. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0021] Figure 1 A flowchart illustrating a certificate management and authorization method based on a switch, provided for embodiments of this application;

[0022] Figure 2 A schematic diagram of an SDN controller provided in an embodiment of this application;

[0023] Figure 3 A schematic diagram of a certificate management service provided in an embodiment of this application;

[0024] Figure 4 A flowchart illustrating the overall association method of a switch-based certificate management and authorization method provided in this application embodiment;

[0025] Figure 5 This is a schematic diagram of a switch-based certificate management and authorization device provided in an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0027] This application provides a certificate management and authorization method based on a switch, such as... Figure 1 As shown, the certificate management and authorization method based on the switch specifically includes steps S101-S104:

[0028] It should be noted that, Figure 2 A schematic diagram of an SDN controller provided in an embodiment of this application is shown below. Figure 2 As shown, the SDN controller is responsible for managing the entire network, and manages multiple switches. The certificate management server is used to generate certificate files. The SDN controller requires certificate files and public key store files to operate, and it also records the SN codes of all switches as unique identifiers in the service database.

[0029] Figure 3 This application provides a schematic diagram of a certificate management service, as shown in the embodiment. Figure 3 As shown, the certificate management server operates as follows: A private key store / public key store is generated using the DSA algorithm (RSA or other algorithms can be used). The private key store file is kept confidential and stored in the certificate management service. The public key store file is publicly accessible and placed in the SDN controller. The authorization data to be encrypted, including device information and usage duration, is encrypted using the private key store to generate a certificate file. The certificate file is decrypted using the public key store to obtain the encrypted authorization data, which contains the device information and usage duration. The specific authorization data to be encrypted can be adjusted; in this embodiment, the authorization data to be encrypted is shown in the figure below. The effective time and expiration time refer to the validity period of the entire authorization data. The effective time and expiration time in the authorized device information refer to the effective and expiration times of the switch corresponding to the specific SN code.

[0030] S101. Send the default type certificate from the certificate management server to the specified installation directory of the SDN controller to obtain the SDN controller to be run.

[0031] Specifically, a private repository file is first generated based on the preset authorization data in the certificate management server. This preset authorization data includes usage time, validity period, and expiration time variables. The private repository file is then used to encrypt the preset authorization data, resulting in the certificate file.

[0032] Furthermore, the private database file, certificate file, and switch device information in the preset authorization data are integrated into an initialization file to obtain a default type certificate.

[0033] In one embodiment, Figure 4 A flowchart illustrating the overall association method of a switch-based certificate management and authorization method is provided for embodiments of this application, as shown below. Figure 4 As shown, the certificate management server generates a default type certificate, whose authorization data includes a 30-day usage period limit and information on unauthorized switches. The usage period is: effective date is the creation date, and expiration date is the creation date + 30 days (adjustable). This can be considered as a trial period.

[0034] Next, start the SDN controller to be run. Based on the startup information, obtain the certificate file of the default type certificate from the certificate management server.

[0035] Furthermore, the certificate file is sent to the designated installation directory of the SDN controller. The certificate file undergoes initialization processing and a scheduled certificate verification task, resulting in the initialized and verified certificate file sent to the SDN controller to be run. Specifically, this includes:

[0036] First, the certificate file is decrypted using the public key store file in the SDN controller to obtain the authorization time information. This authorization time information includes the authorization effective date and the authorization expiration date. The validity period of the authorization time information is then determined. Based on the validity period determination result, all switch devices are managed and initial deployments are performed on the switches.

[0037] Furthermore, the switches after initial deployment are periodically checked for effective and ineffective times, and the switches within the effective time period are cyclically decrypted for certificate files until the switches reach their ineffective time period.

[0038] Furthermore, based on the validity period judgment result and the certificate detection timer task, the SDN controller to be run after initialization verification is obtained.

[0039] In one embodiment, such as Figure 4As shown, during the initial deployment of the SDN controller, the certificate file of the default certificate type from the certificate management server needs to be placed in the designated installation directory of the SDN controller for it to start and run normally. If the SDN controller lacks the certificate file, it will fail to start. During startup, the SDN controller performs initialization operations, decrypts the certificate file, and obtains the authorization time information (only the effective and expiration times of the entire authorization data) after decryption. It then checks whether the current time is within the validity period; if it has expired, the SDN controller stops running.

[0040] In one embodiment, such as Figure 4 As shown, after completing the initialization described above, the SDN controller starts a scheduled certificate check task. It is set to check certificates once a day, decrypting the certificate files to obtain authorization data. Since the initial installation and deployment used a default certificate type, the authorization time information only includes the effective and expiration times, without information on authorized switch devices. Therefore, the SDN controller does not verify the switch device information and can manage all network devices connected to the SDN controller.

[0041] In one embodiment, such as Figure 4 As shown, the certificate detection scheduled task retrieves authorization time information. If it detects that the current time is not within the validity period, the SDN controller will set the authorization status of all devices in the business database to false. At this time, the SDN controller stops managing the devices and no longer retrieves device status or issues configurations to the devices.

[0042] S102. Detect and determine whether the SDN controller to be run can access the public network. If the SDN controller to be run is allowed to access the public network, then the official type certificate sent online is used for authorization verification through the SDN controller to obtain the first authorization data.

[0043] Specifically, the process begins with visually associating the SDN controller to be run via a web page, resulting in a visual interface based on the SDN controller. This visual interface then displays the device information and corresponding authorization status information of the switches connected to and managed by the SDN controller.

[0044] The device information includes at least the serial number (SN). The authorization status information includes: the validity period determination result, the effective date and expiration date, and the authorization time information.

[0045] Furthermore, the SDN controller to be run obtains device information from the access switches via management protocols such as SNMP and Telemetry. It identifies the SN code in the device information as a unique identifier and records it in the service database. Based on the service database, it retrieves the authorization status of the corresponding switch. The authorization status includes both a true and a false state.

[0046] In one embodiment, the SDN controller obtains information about the accessing switch devices through management protocols such as SNMP and telemetry. The SDN controller also records the SN (Switch Serial Number) of all switches as a unique identifier in the service database and sets its authorization status to true. When the authorization status is true, the SDN controller can manage the devices normally, including updating device status and issuing configurations. Switches with an authorization status of false will not have their device status obtained or configurations issued.

[0047] Furthermore, when the SDN controller to be run is publicly accessible, it sends a formal certificate request to the certificate management server through a visual interface. This formal certificate request includes authorization data, certificate type, and a formal certificate type. Based on the formal certificate request, a formal certificate type file is generated and sent to the SDN controller to be run.

[0048] Furthermore, by using the SDN controller to be run, the old and new certificates in the formal type certificate file are replaced and the authorization data is checked to obtain the authorized device information related to the switch's authorization management.

[0049] Furthermore, by using the authorized device information, the authorization status of the corresponding switch in the business database is updated to obtain the first authorization data for online management of the switch resource configuration.

[0050] As a feasible implementation method, the SDN controller web page provides a visual interface that displays device information connected to the SDN controller, including the SN code, and also shows its authorization status.

[0051] In one embodiment, such as Figure 4 As shown, when the SDN controller is accessible and publicly available, it can apply for certificate files online via a visual interface to authorize the switch. The authorization process is as follows: The SDN controller sends a formal certificate request to the certificate management service, the request containing authorization data and the certificate type. After receiving the request, the certificate management service, through the certificate administrator's review and approval, generates a formal certificate containing... Figure 3 The certificate management service then pushes the certificate file to the SDN controller, which replaces the old certificate file and verifies the certificate to obtain the authorization data. Based on the authorized device information, the corresponding switch's authorization status in the service database is set to true. Simultaneously, the SDN controller is notified to update the status of switches with an authorization status of true and to distribute configurations. Switches with an authorization status of false will still not have their device status retrieved or configurations distributed.

[0052] S103. If the SDN controller to be run denies access to the public network, the offline uploaded data to be authorized is authorized and verified through the SDN controller to obtain the second authorized data.

[0053] Specifically, when the SDN controller to be run is inaccessible from the public network, it sends unauthorized data about the switch to the certificate management server offline and obtains the corresponding official certificate file. The official certificate file is then uploaded to the SDN controller through a visual interface.

[0054] Furthermore, by using the SDN controller to be run, the old and new certificates in the formal type certificate file are replaced and the authorization data is checked to obtain the authorized device information related to the switch's authorization management.

[0055] Furthermore, by using the authorized device information, the authorization status of the corresponding switch in the business database is updated to obtain the second authorization data used for offline management of switch resource configuration.

[0056] In one implementation, such as Figure 4 As shown, when the SDN controller cannot access the public network or is accessed by the public network, it sends authorization data (in the format shown) to the certificate administrator offline. Figure 3 As shown, obtain the corresponding official certificate file. Upload the certificate file through the SDN controller web page. After successful upload, the SDN controller replaces the old certificate file and checks the certificate to obtain authorization data. Based on the authorized device information, set the authorization status of the corresponding switch in the service database to true. Simultaneously, notify the SDN controller to update the status of switches with an authorization status of true and distribute configurations. Switches with an authorization status of false will still not have their device status obtained or configurations distributed to them.

[0057] S104. Based on the first authorized data and the second authorized data, perform operation control on the SDN controller to be run, so as to realize the SDN controller's management of resources.

[0058] Specifically, the SDN controller relies on certificate files to authorize and revoke the authorization of switches. When adding or deauthorizing devices, it needs to complete the formal certificate update using the online first authorization data and offline second authorization data methods mentioned above. When the SDN controller connects a new switch, it decrypts the authorization file and compares whether the newly connected switch is in the authorized device information. If it is not authorized, the switch's SN code is used as a unique identifier and recorded in the service database, while its authorization status is set to false. The certificate needs to be updated online or offline to allow the SDN controller to manage the newly connected switch. When an authorized switch is revoked or an unauthorized switch is reauthorized, the SDN controller resets the authorization status of the switch in the service database according to the authorization data in the certificate file, and obtains the device status and issues configurations for authorized switches.

[0059] In one embodiment, a certificate inspection scheduled task can check the certificate authorization time information once a day, decrypting the certificate file to obtain the authorization time information. When all switch authorization device information in the certificate file has expired, the SDN controller will automatically stop running to release resources. Restarting the SDN controller requires either offline uploading to update the official certificate file or obtaining a new default certificate from the certificate administrator. Once the SDN controller is running normally, it updates the official certificate file by verifying the authorization using the officially sent certificate online and obtaining the first authorization data, thus enabling the SDN controller to manage resources.

[0060] As a feasible implementation method, the certificate file is provided by the certificate management server. If a special situation occurs and the certificate file in the SDN controller is lost, it can be retrieved again through the certificate management server to enable the SDN controller to manage resources.

[0061] In addition, embodiments of this application also provide a certificate management and authorization method device based on a switch, such as... Figure 5 As shown, the certificate management and authorization method based on the switch in device 500 specifically includes:

[0062] At least one processor 501. And a memory 502 communicatively connected to the at least one processor 501. The memory 502 stores instructions executable by the at least one processor 501, enabling the at least one processor 501 to execute:

[0063] Send the default type certificate from the certificate management server to the specified installation directory of the SDN controller to obtain the SDN controller to be run;

[0064] The system detects and determines whether the SDN controller to be run is accessing the public network.

[0065] If the SDN controller to be run is allowed to access the public network, then the official type certificate sent online will be authorized and verified through the SDN controller to obtain the first authorization data;

[0066] If the SDN controller to be run denies access to the public network, then the offline uploaded data to be authorized is authorized and verified through the SDN controller to obtain the second authorized data;

[0067] Based on the first and second authorized data, the SDN controller to be run is controlled to achieve resource management by the SDN controller.

[0068] This application provides a switch-based certificate management and authorization method, device, and medium. By cooperating with a certificate management server and an SDN controller, it authorizes and revokes network devices such as switches and routers, thereby configuring the SDN controller's resources. The core functionality is achieved through the SDN controller's authorization file. When an authorization expires, the invalidated switch, router, or other network device can be directly removed, freeing up SDN controller resources and improving resource utilization. Authorization can be performed both online and offline. Furthermore, the certificate files are provided by the certificate management server; if a certificate file is lost in the SDN controller, it can be retrieved through the certificate management service, preventing issues such as certificate file loss.

[0069] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for devices and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0070] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0071] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0073] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0074] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0075] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0076] The above description is merely an embodiment of this application and is not intended to limit this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of this application should be included within the scope of the claims of this application.

Claims

1. A certificate management and authorization method based on a switch, characterized in that, The method includes: A private repository file is generated based on the preset authorization data in the certificate management server; wherein, the preset authorization data contains usage time variables, validity time variables, and expiration time variables; The preset authorization data is encrypted using the private database file to obtain a certificate file; The private database file, the certificate file, and the switch device information in the preset authorization data are integrated into an initialization file to obtain a default type certificate. Send the default type certificate from the certificate management server to the specified installation directory of the SDN controller to obtain the SDN controller to be run; The SDN controller to be run is subjected to detection and judgment regarding its access to the public network; If the SDN controller to be run is allowed to access the public network, then the formal type certificate sent online will be authorized and verified through the SDN controller to obtain the first authorization data; If the SDN controller to be run denies access to the public network, then the offline uploaded data to be authorized is authorized and verified through the SDN controller to obtain the second authorized data; Based on the first and second authorized data, the operation control of the SDN controller to be run is performed to realize the SDN controller's management of resources.

2. The certificate management and authorization method based on a switch according to claim 1, characterized in that, Send the default type certificate from the certificate management server to the specified installation directory of the SDN controller to obtain the SDN controller to run. Specifically, this includes: Start the SDN controller to be run; Based on the startup information, obtain the certificate file of the default type certificate in the book management server; Send the certificate file to the specified installation directory of the SDN controller; The certificate file is initialized and a certificate detection timer task is performed to obtain the SDN controller to be run after initialization and verification.

3. The certificate management and authorization method based on a switch according to claim 2, characterized in that, The certificate file is initialized and a certificate detection timer task is performed to obtain the SDN controller to be run after initialization and verification. Specifically, this includes: The certificate file is decrypted using the public key library file in the SDN controller to obtain the authorization time information; wherein, the authorization time information includes: the authorization effective time and the authorization expiration time; The validity period of the authorized time information is determined; and based on the validity period determination result, all switch devices are managed and the switches are initially deployed. After initial deployment, the switches are periodically monitored for their effective and ineffective times. Switches within the effective time period are repeatedly decrypted from the certificate file until the switch reaches its ineffective time period. Based on the validity period determination result and the certificate detection timer task, the SDN controller to be run is obtained after initial verification.

4. The certificate management and authorization method based on a switch according to claim 1, characterized in that, Before detecting and determining whether the SDN controller to be run is accessing the public network, the method further includes: The SDN controller to be run can be visualized and associated through a web page, resulting in a visual interface based on the SDN controller. The visualization interface displays the device information and corresponding authorization status information of the switches connected to and managed by the SDN controller to be run; The device information includes at least: an SN code; the authorization status information includes: validity period determination result, effective time and expiration time, and authorization time information.

5. The certificate management and authorization method based on a switch according to claim 1, characterized in that, The SDN controller to be run obtains device information from the access switch through management protocols such as SNMP and Telemetry. The SN code in the device information is determined as a unique identification code, and the unique identification code is recorded in the business database; Based on the business database, the authorization status of the corresponding switch is obtained; wherein, the authorization status includes: true status and false status.

6. The certificate management and authorization method based on a switch according to claim 1, characterized in that, If the SDN controller to be run is authorized to access the public network, then the formal type certificate sent online will be authorized and verified through the SDN controller to obtain the first authorization data, which specifically includes: When the SDN controller to be run is on a publicly accessible network and can be accessed by the public network, it sends a formal certificate request to the certificate management server through a visual interface; wherein, the formal certificate request includes: authorization data, certificate type, and formal type certificate; Based on the formal certificate request information, the formal type certificate file is generated; and the formal type certificate file is sent to the SDN controller to be run. The SDN controller to be run performs certificate replacement and authorization data detection on the formal type certificate file to obtain authorized device information related to switch authorization management. Using the authorized device information, the authorization status of the corresponding switch in the business database is updated to obtain the first authorization data for online management of the switch resource configuration.

7. The certificate management and authorization method based on a switch according to claim 1, characterized in that, If the SDN controller to be run denies access to the public network, then the offline uploaded data to be authorized is verified through the SDN controller to obtain the second authorized data, which specifically includes: When the SDN controller to be run is unable to access the public network and cannot be accessed by the public network, it sends the unauthorized data of the switch to the certificate management server in an offline manner and obtains the corresponding formal type certificate file. The formal type certificate file is uploaded to the SDN controller to be run through a visual interface; The SDN controller to be run performs certificate replacement and authorization data detection on the formal type certificate file to obtain authorized device information related to switch authorization management. Using the authorized device information, the authorization status of the corresponding switch in the business database is updated to obtain second authorization data for offline management of the switch resource configuration.

8. A certificate management and authorization device based on a switch, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to perform a switch-based certificate management and authorization method according to any one of claims 1-7.

9. A non-volatile computer storage medium, characterized in that, The storage medium is a non-volatile computer-readable storage medium that stores at least one program, each program including instructions that, when executed by a terminal, cause the terminal to perform a switch-based certificate management and authorization method according to any one of claims 1-7.

Images