Methods and devices for handling inherent security in Neutron network components

Abstract

This invention provides an intrinsic security processing method and apparatus for Neutron network components. The method includes: acquiring a network creation request; sending the network creation request to multiple heterogeneous execution entities and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous execution entity; when it is determined that the multiple first network state information originates from the same network creation request, allocating the same second network state information and using the same second network state information as a normalized second network state information; constructing target network state information based on the first network state information and the normalized second network state information, and generating a network control message based on the target network state information; and sending the network control message to network element devices, so that the network element devices can generate a network topology corresponding to the network creation request based on the network control message. This effectively ensures that the network control message is not erroneous or attacked.

Description

Technical Field

[0001] This invention relates to the field of network component security processing technology, and in particular to an intrinsic security processing method and apparatus for Neutron network components. Background Technology

[0002] Neutron is a network management component in OpenStack. During application, network resources can be managed through backend service plugins, and network status information can be maintained in a database. Based on these plugins, business logic is built to generate network control messages, which are then sent to an agent via a remote procedure call protocol. The agent parses the network control messages and invokes basic network components to configure the network, thus achieving the goal of Neutron network component controlling the network.

[0003] However, in the current process of neutron network components controlling the network, it is not possible to effectively guarantee that the network control messages obtained will not be erroneous or attacked, thus affecting the accurate control of the network by neutron network components.

[0004] Therefore, finding an effective method for intrinsic security handling of Neutron network components to ensure that network control messages are not erroneous or attacked has become a research hotspot. Summary of the Invention

[0005] This invention provides an intrinsic security processing method and apparatus for Neutron network components, which effectively ensures that network control messages are not erroneous or attacked, thereby ensuring that the Neutron network component accurately generates the network topology corresponding to the network creation request.

[0006] This invention provides an intrinsic security processing method for Neutron network components. The method includes: acquiring a network creation request, wherein the network creation request includes service parameter information for creating a network; sending the network creation request to multiple heterogeneous executors, and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor, wherein the first network state information is used to characterize feature information for constructing a network topology; when multiple first network state information are parsed to originate from the same network creation request, allocating the same second network state information, and using the same second network state information as a normalized second network state information, wherein the second network state information is necessary information for constructing a network topology that may have different value possibilities during processing by different heterogeneous executors; constructing target network state information based on the first network state information and the normalized second network state information, and generating a network control message based on the target network state information; and sending the network control message to network element devices, so that the network element devices generate the network topology corresponding to the network creation request based on the network control message.

[0007] According to the inherent security processing method of Neutron network components provided by the present invention, the step of obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous execution entity specifically includes: adding the same request synchronization identification code and the same service synchronization identification code to each network creation request sent to each heterogeneous execution entity based on each heterogeneous execution entity; obtaining corresponding first network state information based on each network creation request with the same request synchronization identification code and the same service synchronization identification code; wherein, the multiple first network state information are parsed to be derived from the same network creation request by the following method: parsing the multiple first network state information to obtain the request synchronization identification code and service synchronization identification code of each first network state information; when the request synchronization identification code and service synchronization identification code of each first network state information are the same, determining that the multiple first network state information are derived from the same network creation request.

[0008] According to the inherent security processing method of Neutron network components provided by the present invention, before parsing the plurality of first network state information to obtain the request synchronization identification code and service synchronization identification code of each first network state information, the method further includes: constructing the plurality of first network state information according to a preset message format to obtain a plurality of constructed first network state information, wherein the preset message format matches the network creation request; writing the plurality of constructed first network state information to a request message queue; and extracting the plurality of constructed first network state information from the request message queue when an instruction to parse the plurality of first network state information is received; the step of parsing the plurality of first network state information to obtain the request synchronization identification code and service synchronization identification code of each first network state information specifically includes: parsing the plurality of constructed first network state information to obtain the request synchronization identification code and service synchronization identification code of each first network state information.

[0009] According to the inherent security processing method of Neutron network component provided by the present invention, before generating network control messages based on the target network state information, the method further includes: writing the target network state information to a database; the generation of network control messages based on the target network state information specifically includes: retrieving the target network state information from the database and generating network control messages based on the target network state information.

[0010] According to a Neutron network component intrinsic security processing method provided by the present invention, before sending the network control message to the network element device so that the network element device generates the network topology corresponding to the network creation request based on the network control message, the method further includes: determining whether multiple network control messages are the same; the step of sending the network control message to the network element device so that the network element device generates the network topology corresponding to the network creation request based on the network control message specifically includes: in the case that multiple network control messages are the same network control message, sending the network control message to the network element device so that the network element device generates the network topology corresponding to the network creation request based on the network control message.

[0011] According to the inherent security processing method of Neutron network component provided by the present invention, the method further includes: in the case that multiple network control messages are different network control messages, initiating an alarm reminder to indicate that the network topology created by the user has an error.

[0012] According to the inherent security processing method of Neutron network component provided by the present invention, before determining whether the multiple network control messages are the same, the method further includes: constructing the multiple network control messages according to a preset network control message format to obtain constructed network control messages; writing the multiple constructed network control messages to a request message queue; and retrieving the multiple constructed network control messages from the request message queue when an instruction is received to determine whether the multiple network control messages are the same; the determination of whether the multiple network control messages are the same specifically includes: determining whether the multiple constructed network control messages are the same.

[0013] This invention also provides an intrinsic security processing device for a Neutron network component. The device includes: an acquisition module for acquiring a network creation request, wherein the network creation request includes service parameter information for creating a network; a sending module for sending the network creation request to multiple heterogeneous executors and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor, wherein the first network state information is used to characterize feature information for constructing a network topology; a parsing module for allocating the same second network state information when multiple first network state information are parsed to originate from the same network creation request, and using the same second network state information as a normalized second network state information, wherein the second network state information is necessary information for constructing a network topology that may have different value possibilities during processing by different heterogeneous executors; a construction module for constructing target network state information based on the first network state information and the normalized second network state information, and generating a network control message based on the target network state information; and a generation module for sending the network control message to network element devices, so that the network element devices generate the network topology corresponding to the network creation request based on the network control message.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the intrinsic security processing method of the Neutron network component as described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the intrinsic security processing method for the Neutron network component as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the intrinsic security processing method of the Neutron network component as described above.

[0017] The inherent security processing method and apparatus for Neutron network components provided by this invention obtains a network creation request, sends the network creation request to multiple heterogeneous execution entities, and obtains multiple first network state information corresponding to the network creation request based on each heterogeneous execution entity; when it is determined that multiple first network state information originates from the same network creation request, the same second network state information is allocated and used as the normalized second network state information; a target network state information is constructed based on the first network state information and the normalized second network state information, and a network control message is generated based on the target network state information. The network control message is then sent to network element devices, enabling the network element devices to generate a network topology corresponding to the network creation request based on the network control message. This effectively ensures that the network control message is free from errors or attacks, thereby ensuring that the Neutron network component accurately generates the network topology corresponding to the network creation request. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating the intrinsic security processing method for Neutron network components provided by this invention;

[0020] Figure 2 This is a schematic diagram of the process provided by the present invention for obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor;

[0021] Figure 3 This is a flowchart illustrating the process of parsing multiple first network status information to obtain the request synchronization identification code and service synchronization identification code of each first network status information, as provided by the present invention.

[0022] Figure 4 This is a functional structure diagram of the intrinsic security processing of the Neutron network component provided by the present invention;

[0023] Figure 5 This is a schematic diagram of the intrinsic security processing device for the Neutron network component provided by the present invention.

[0024] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] In the process of building network topology based on Neutron network components, the calculation process of service plugins is the core process of Neutron network component control in building network topology. Ensuring that the calculation process of service plugins is error-free or not attacked is crucial to ensuring the correct network configuration by Neutron. The calculation process of service plugins can include managing network resources and storing network status information in a database; and constructing network control messages and sending them to message middleware or network elements via RPC.

[0027] The inherent security handling method for Neutron network components provided by this invention protects the process of Neutron service plugins managing network resources, ensuring that database messages sent to database agents are error-free, and also protects the process of Neutron service plugins constructing network control messages, ensuring that network control messages sent to agents or network elements are error-free.

[0028] Figure 1 This is one of the flowcharts illustrating the intrinsic security processing method for Neutron network components provided by this invention.

[0029] The following will combine Figure 1 The intrinsic security processing method for Neutron network components provided by this invention will be described.

[0030] In an exemplary embodiment of the present invention, combined with Figure 1 As can be seen, the intrinsic security processing method of Neutron network components may include steps 110 to 150, and each step will be described below.

[0031] In step 110, a network creation request is obtained.

[0032] In one embodiment, a network creation request can be obtained. This request may include service parameter information for creating the network, such as the network name and service parameters.

[0033] In step 120, a network creation request is sent to multiple heterogeneous executors, and multiple first network status information corresponding to the network creation request are obtained based on each heterogeneous executor.

[0034] In one embodiment, the network creation request can be copied and sent to multiple heterogeneous executors, and then multiple first network status information corresponding to the network creation request can be obtained based on each heterogeneous executor.

[0035] In this context, a heterogeneous execution entity can be a heterogeneous execution entity with different operating systems forming its runtime environment. During application, the Neutron network component can be placed into a heterogeneous execution entity with different operating systems forming its runtime environment.

[0036] Among them, the first network state information can be used to characterize the feature information for constructing the network topology.

[0037] In step 130, if multiple first network status information are parsed and found to originate from the same network creation request, the same second network status information is assigned and used as the normalized second network status information.

[0038] In one embodiment, multiple first network state information can be parsed. If the parsed first network state information originates from the same network creation request, the same second network state information can be assigned, and this same second network state information can be used as the normalized second network state information. The second network state information is necessary information for constructing the network topology, which may have different value possibilities during processing by different heterogeneous executors.

[0039] It should be noted that the second network state information, for example, could be a segment ID. The segment ID is randomly assigned; if the segment IDs of heterogeneous execution entities are inconsistent, it can lead to abnormal adjudication results. To adapt to the adjudication process, the allocation of segment IDs needs to be postponed. That is, if multiple pieces of the first network state information are found to originate from the same network creation request, the same second network state information is assigned, and this same second network state information is used as the normalized second network state information.

[0040] In step 140, target network state information is constructed based on the first network state information and the normalized second network state information, and network control messages are generated based on the target network state information.

[0041] In step 150, a network control message is sent to the network element device so that the network element device can generate a network topology corresponding to the network creation request based on the network control message.

[0042] In one embodiment, the first network state information and the normalized second network state information can be combined to construct the target network state information. Then, a network control message is generated based on the target network state information.

[0043] Furthermore, network control messages are sent to network elements so that they can generate the network topology corresponding to the network creation request based on these messages. By shifting the normalization logic (such as segment ID allocation) in network resource management to a later stage, and adapting to the service-side decision-making process, a reasonable intrinsic security modification is made to the network resource management process. This ensures the security of the process without affecting the original network resource management logic, effectively preventing errors or attacks on network control messages, and thus ensuring that the Neutron network component accurately generates the network topology corresponding to the network creation request.

[0044] The inherent security processing method for Neutron network components provided by this invention involves: acquiring a network creation request; sending the network creation request to multiple heterogeneous execution entities; obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous execution entity; when multiple first network state information are found to originate from the same network creation request, allocating the same second network state information and using this same second network state information as a normalized second network state information; constructing target network state information based on the first network state information and the normalized second network state information; generating a network control message based on the target network state information; and sending the network control message to network element devices, enabling the network element devices to generate a network topology corresponding to the network creation request based on the network control message. This effectively ensures that the network control message is free from errors or attacks, thereby ensuring that the Neutron network component accurately generates the network topology corresponding to the network creation request.

[0045] Figure 4 This is a functional structure diagram of the intrinsic security processing of the Neutron network component provided by the present invention.

[0046] The following will combine Figure 4 The functional structure of the intrinsic security processing of Neutron network components is explained. It can be understood that the functional structure can be considered as the main body capable of executing the intrinsic security processing methods of Neutron network components.

[0047] Combination Figure 4 As can be seen, the request-side distribution module and the business-side adjudication module are standard components modified for inherent security, while the database, message middleware, and network infrastructure components are native Neutron modules. Other modules modified and added to adapt to inherent security are the subject of this invention. The function of each module is described in detail below.

[0048] The request-side distribution module is responsible for copying client API requests multiple times and distributing them to various heterogeneous Neutron component executors. It then receives responses from these executors, compares the results, and forwards them to the client. To ensure the business-side adjudication module can identify that the adjudication messages are triggered by the same request, the request-side distribution module adds the same request synchronization identifier to each distributed request. This identifier is randomly generated by the request-side distribution module, and the business-side adjudication module uses this identifier and the business synchronization identifier of the adjudication message issued by the plugin to determine if it is the same message requiring adjudication.

[0049] The API service processing module, also known as the Neutron service plugin, handles the logical calculations for managing network resources (network, subnet, port) and constructing network control messages based on client API requests. After these calculations, the API service processing module sends database messages to the database proxy to save the network state, or sends network control messages to the network infrastructure components to configure the network.

[0050] The message processing module is used for request message construction, response retrieval, and reading and writing message queues. Database messages sent by the Neutron network component's service plugins to the database agent, as well as network control messages sent to the agent, are inserted into the request message queue through the message processing module. Request message construction refers to filling the message according to the request message format. The message content includes the message ID (request synchronization identifier + function name sending the message), message type (database message or network control message), and message payload (if it's a database message, it includes the table name and network status information; if it's a network control message, it includes the agent name and control parameters or commands). Response message retrieval refers to searching for the response result in the response queue using the original request message ID. After retrieving the response message, the message processing module returns it to the API business processing module.

[0051] Message queues, including request message queues and response message queues, serve as the communication medium between message processing modules and asynchronous processing modules. The message processing module inserts request messages into the request message queue, and the asynchronous processing module retrieves messages from it. Similarly, the asynchronous processing module inserts response messages into the response message queue, and the message processing module retrieves response messages from it.

[0052] The asynchronous processing module is a separate process responsible for monitoring the message request queue and retrieving messages sequentially from it. It selects the topic and push method based on the message type and message load. Database messages are uniformly pushed to the database agent topic using a synchronous call method, which always provides a response. Network control messages are pushed to the corresponding topic based on the agent name using an asynchronous call method, which does not require a response.

[0053] The business-side adjudication module compares the RPC requests sent from the asynchronous processing module to the message middleware. If the results are consistent, the results are forwarded to the message middleware.

[0054] The message middleware is used to transmit messages from the business-side adjudication module to the database agent or agent.

[0055] The database broker is used to retrieve database messages from the message broker, parse the message content, perform necessary consistency processing based on the parsing results, write the message to the database, and then construct a response payload to send to the message broker.

[0056] The agent is used to obtain network control messages from the message middleware, parse the message content, and control the network infrastructure components to configure the network.

[0057] It should be noted that the request-side distribution module can be used to obtain network creation requests and copy and forward them to multiple heterogeneous executors.

[0058] API business processing module, message processing module, message queue, and asynchronous processing module can constitute a heterogeneous execution entity, among which, Figure 4 The diagram illustrates three heterogeneous execution entities. In this embodiment, by introducing a message processing module, an asynchronous processing module, and a database proxy module, the process of managing network resources and writing to the database in the Neutron service plugin is separated. This allows for adaptation to the intrinsic security transformation framework. Furthermore, by moving the computational logic requiring normalization in managing network resources (such as allocating segment IDs) to the database proxy module, the business-side adjudication process is adapted. Thus, a reasonable intrinsic security transformation is performed on the process of managing network resources in the service plugin. This method does not affect the original logic of managing network resources while ensuring the security of the process.

[0059] This invention protects both the process of Neutron managing network resources and the process of constructing network control messages, ensuring that the network state stored in the database and the network control messages received by the agent are not sent incorrectly or tampered with.

[0060] Figure 2This is a schematic diagram of the process provided by the present invention for obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor.

[0061] The following will combine Figure 2 The process of obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor is explained.

[0062] In an exemplary embodiment of the present invention, combined with Figure 2 As can be seen, obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor can include steps 210 and 220, which will be described in detail below.

[0063] In step 210, based on each heterogeneous executor, the same request synchronization identifier and the same service synchronization identifier are added to each network creation request sent to each heterogeneous executor.

[0064] In step 220, based on each network creation request that adds the same request synchronization identification code and the same service synchronization identification code, the corresponding first network status information is obtained.

[0065] Among them, the parsing of multiple first network status information is found to originate from the same network creation request, which is achieved in the following way:

[0066] Multiple first network status information are parsed to obtain the request synchronization identification code and service synchronization identification code for each first network status information;

[0067] If the request synchronization identification code and service synchronization identification code of each first network status information are the same, it is determined that multiple first network status information originate from the same network creation request.

[0068] In one embodiment, each heterogeneous execution entity can add the same request synchronization identifier and the same service synchronization identifier to each network creation request sent to each heterogeneous execution entity; then, based on each network creation request with the same request synchronization identifier and the same service synchronization identifier, the corresponding first network status information is obtained. Since a network creation request may trigger multiple messages requiring adjudication, using the request synchronization identifier and the service synchronization identifier together as the basis for judgment can improve the accuracy of the judgment. In one example, the service synchronization identifier can be the name of a service function; in this embodiment, the specific form of the service synchronization identifier is not limited.

[0069] In one example, multiple first network status information can be parsed to obtain the request synchronization identification code and service synchronization identification code for each first network status information. If the request synchronization identification code and service synchronization identification code are all the same, it is determined that the multiple first network status information originates from the same network creation request. In this embodiment, using both the request synchronization identification code and the service synchronization identification code as the basis for determining whether multiple first network status information originates from the same network creation request can improve the accuracy of the determination.

[0070] Figure 3 This is a flowchart illustrating the process of parsing multiple first network status information to obtain the request synchronization identification code and service synchronization identification code for each first network status information, as provided by the present invention.

[0071] The following will combine Figure 3 The process of parsing multiple first network status information to obtain the request synchronization identification code and service synchronization identification code of each first network status information is explained.

[0072] In an exemplary embodiment of the present invention, combined with Figure 3 As can be seen, parsing multiple first network status information to obtain the request synchronization identification code and service synchronization identification code of each first network status information may include steps 310 to 340, and each step will be described below.

[0073] In step 310, multiple first network status information are constructed according to a preset message format to obtain multiple constructed first network status information.

[0074] In one embodiment, multiple first network state information messages can be constructed according to a preset message format to obtain multiple constructed first network state information messages. The preset message format may include a message ID, message type, and payload. If the network creation request is a network creation request, the corresponding message payload may mainly include Layer 2 network description information such as tenant ID, network name, and MTU. If the network creation request is a subnet creation request, the message payload may mainly include Layer 3 network information such as tenant ID, subnet name, Layer 2 network ID, and subnet address range. The preset message format matches the network creation request.

[0075] In step 320, multiple post-construction first network status information are written to the request message queue.

[0076] In step 330, upon receiving an instruction to parse multiple first network state information, multiple constructed first network state information are extracted from the request message queue.

[0077] In step 340, the multiple constructed first network status information are parsed to obtain the request synchronization identification code and service synchronization identification code of each first network status information.

[0078] In one embodiment, multiple constructed first network state information items can be written to a request message queue. Upon receiving an instruction to parse the multiple first network state information items, the request message queue can extract the multiple constructed first network state information items. The extraction of the multiple constructed first network state information items from the request message queue can be implemented using an asynchronous processing module.

[0079] Furthermore, multiple constructed first network status information can be parsed to obtain the request synchronization identification code and service synchronization identification code for each first network status information.

[0080] In yet another exemplary embodiment of the present invention, the preceding text continues... Figure 1 The embodiment described above serves as an example. Before generating network control messages based on target network state information (corresponding to step 140), the Neutron network component's intrinsic security processing method further includes the following steps:

[0081] Write the target network status information into the database;

[0082] The generation of network control messages based on target network state information can be achieved in the following ways:

[0083] The target network status information is retrieved from the database, and a network control message is generated based on the target network status information.

[0084] In one embodiment, the obtained target network status information can be written to a database, allowing users to easily obtain and manage network topology service parameter information directly from the database. Furthermore, the target network status information can be retrieved from the database, and network control messages can be generated based on this information, thereby enabling the construction of the network topology.

[0085] It is understood that the process of managing network resources and sending business processes has been introduced above. In order to further introduce the present invention, the following will describe the business process of managing network resources and sending business processes in conjunction with the following embodiments.

[0086] In one embodiment, it can be combined with Figure 4 Let's take managing network resources as an example.

[0087] During the application process, the API business processing module can receive client requests (corresponding to network creation requests) forwarded by the request-side distribution module. If it is a request to create a network, the process of managing network resources mainly involves allocating a segment ID, then sending the network status information including the segment ID to the message processing module, and finally having the database agent write to the database.

[0088] Because the segment IDs are randomly assigned by the system, the segment IDs of the three heterogeneous execution entities are inconsistent, leading to abnormal adjudication results in the business-side adjudication module. To adapt to the adjudication process, the segment ID allocation process needs to be moved to the database proxy module. The network status information sent by the API business processing module does not include the segment ID. When the database proxy module detects that a network service is being created, it first allocates a segment ID, and then writes it to the database in conjunction with the network status information received from the message middleware. That is, if multiple pieces of the first network status information are parsed to originate from the same network creation request, the same second network status information is allocated, and this same second network status information is used as the normalized second network status information. The target network status information composed of the first network status information and the normalized second network status information is then written to the database for users to manage network resources, ensuring that the database messages of the database proxy do not contain errors.

[0089] In another embodiment, the message processing module can construct a request message according to the database message format and insert it into the request message queue. If it is a network creation request, the message payload mainly includes Layer 2 network description information such as tenant ID, network name, and MTU. If it is a subnet creation request, the message payload mainly includes Layer 3 network information such as tenant ID, subnet name, Layer 2 network ID, and subnet address range. This enables the writing of multiple constructed first network status information messages into the request message queue.

[0090] Furthermore, the asynchronous processing module can retrieve messages from the request message queue and select a database proxy topic based on the message type and message load. That is, upon receiving an instruction to parse multiple sets of first network state information, the request message queue can extract multiple sets of constructed first network state information, which can be implemented by the asynchronous processing module.

[0091] The message push method is synchronous push. The asynchronous processing module sends a request message to the business-side adjudication module and blocks to wait for a response.

[0092] In another embodiment, the service-side adjudication module adjudicates the request information; if the results are the same, the request is forwarded to the message middleware. Furthermore, the database proxy can receive messages from the message middleware, parse the messages, and perform subsequent processing based on the parsing results. That is, based on the first network state information and the normalized second network state information, target network state information is constructed, and network control messages are generated based on the target network state information.

[0093] In one embodiment, forwarding a request to a message middleware may involve sending the request to a preset location and obtaining the path of the preset location, which is then used to extract the corresponding request message based on the path.

[0094] In another embodiment, the asynchronous processing module can also receive database message request responses and then sequentially insert them into the response message queue. The message processing module can retrieve the database message response from the response message queue based on the database message request ID and return it to the API business processing module. The API business processing module can receive the database response information, create a network plugin, read Layer 2 network status information including the segment ID from the database based on the data index ID in the response information, and construct a client response based on this information to notify the user to complete the network resource management related to the network creation request.

[0095] In yet another exemplary embodiment of the present invention, the description above continues. Figure 1 Taking the corresponding embodiment as an example, before sending the network control message to the network element device so that the network element device can generate the network topology corresponding to the network creation request based on the network control message (corresponding to step 150), the Neutron network component's intrinsic security processing method further includes the following steps:

[0096] Determine whether multiple network control messages are identical;

[0097] Furthermore, the network control message is sent to the network element device so that the network element device can generate the network topology corresponding to the network creation request based on the network control message. This can be achieved in the following way:

[0098] When multiple network control messages are the same, the network control message is sent to the network element device so that the network element device can generate a network topology corresponding to the network creation request based on the network control message.

[0099] In one embodiment, the service adjudication module can determine whether network control messages corresponding to multiple heterogeneous executors are identical. Furthermore, if multiple network control messages are identical, the network control message can be sent to network element devices, enabling the network element devices to generate a network topology corresponding to the network creation request based on the network control message.

[0100] In yet another exemplary embodiment of the present invention, continuing with the previously described embodiments as examples, the intrinsic security processing method for Neutron network components further includes the following steps:

[0101] If multiple network control messages are different, an alarm will be triggered to alert the user that there is an error in the network topology they created.

[0102] In one embodiment, if multiple network control messages are different network control messages, an alarm can also be triggered to alert the user that there is an error in the network topology they created.

[0103] In yet another exemplary embodiment of the present invention, continuing with the above-described embodiments as an example, the Neutron network component's intrinsic security processing method may further include the following steps before determining whether multiple network control messages are identical:

[0104] Multiple network control messages are constructed according to a preset network control message format to obtain the constructed network control message;

[0105] Write multiple post-construction network control messages to the request message queue;

[0106] Upon receiving an instruction to adjudicate multiple network control messages, multiple constructed network control messages are retrieved from the request message queue;

[0107] The determination of whether multiple network control messages are identical can be achieved in the following ways:

[0108] Determine whether multiple post-construction network control messages are identical.

[0109] In one embodiment, multiple network control messages can be constructed according to a preset network control message format to obtain a constructed network control message, and the constructed network control message can be inserted into a request message queue.

[0110] Furthermore, upon receiving an instruction to adjudicate multiple network control messages, multiple post-construction network control messages can be retrieved from the request message queue. In one example, the asynchronous processing module can retrieve post-construction network control messages from the request message queue, select different agent topics based on message type and message load, and use asynchronous push as the message push method. The asynchronous processing module sends a request message to the business-side adjudication module without receiving a response. Further, different agent agents can receive post-construction network control messages from the message queue in the message middleware and adjudicate whether multiple post-construction network control messages are identical. If multiple post-construction network control messages are identical, the network control message can be distributed to the network element device, enabling the network element device to generate a network topology corresponding to the network creation request based on the network control message.

[0111] As described above, the inherent security processing method for the Neutron network component provided by this invention involves: acquiring a network creation request; sending the network creation request to multiple heterogeneous execution entities; obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous execution entity; when multiple first network state information are found to originate from the same network creation request, allocating the same second network state information and using this same second network state information as the normalized second network state information; constructing target network state information based on the first network state information and the normalized second network state information; generating a network control message based on the target network state information; and sending the network control message to the network element device, so that the network element device can generate the network topology corresponding to the network creation request based on the network control message. This effectively ensures that the network control message is not erroneous or attacked, thereby ensuring that the Neutron network component accurately generates the network topology corresponding to the network creation request.

[0112] Based on the same concept, the present invention also provides an intrinsic security processing device for Neutron network components.

[0113] The intrinsic security processing apparatus for Neutron network components provided by the present invention will be described below. The intrinsic security processing apparatus for Neutron network components described below can be referred to in correspondence with the intrinsic security processing method for Neutron network components described above.

[0114] Figure 5 This is a schematic diagram of the intrinsic security processing device for the Neutron network component provided by the present invention.

[0115] In an exemplary embodiment of the present invention, combined with Figure 5As can be seen, the intrinsic security processing device of the Neutron network component may include an acquisition module 510, a sending module 520, a parsing module 530, a construction module 540, and a generation module 550. Each module will be described in detail below.

[0116] The acquisition module 510 can be configured to acquire a network creation request, wherein the network creation request includes service parameter information for creating a network;

[0117] The sending module 520 can be configured to send the network creation request to multiple heterogeneous execution entities, and obtain multiple first network status information corresponding to the network creation request based on each of the heterogeneous execution entities, wherein the first network status information is used to characterize the feature information of constructing the network topology;

[0118] The parsing module 530 can be configured to allocate the same second network state information when multiple first network state information are parsed as originating from the same network creation request, and use the same second network state information as the normalized second network state information, wherein the second network state information is necessary information for constructing the network topology that may have different value possibilities during processing by different heterogeneous executors;

[0119] The construction module 540 can be configured to construct target network state information based on the first network state information and the normalized second network state information, and generate network control messages based on the target network state information;

[0120] The generation module 550 can be configured to send the network control message to the network element device, so that the network element device generates the network topology corresponding to the network creation request based on the network control message.

[0121] In an exemplary embodiment of the present invention, the sending module 520 may obtain multiple first network status information corresponding to the network creation request based on each of the heterogeneous executors in the following manner:

[0122] Based on each of the heterogeneous executors, the same request synchronization identifier and the same service synchronization identifier are added to each of the network creation requests sent to each of the heterogeneous executors;

[0123] Based on each network creation request that adds the same request synchronization identification code and the same service synchronization identification code, the corresponding first network status information is obtained.

[0124] Among them, the following method is used to parse out multiple first network status information from the same network creation request:

[0125] The request synchronization identification code and service synchronization identification code of each first network status information are parsed to obtain the request synchronization identification code and service synchronization identification code of each first network status information.

[0126] If the request synchronization identification code and service synchronization identification code of each of the first network status information are the same, it is determined that multiple first network status information originate from the same network creation request.

[0127] In an exemplary embodiment of the present invention, the sending module 520 may further be configured to:

[0128] Multiple first network status information are constructed according to a preset message format to obtain multiple constructed first network status information, wherein the preset message format matches the network creation request;

[0129] Write multiple sets of constructed first network status information to the request message queue;

[0130] Upon receiving an instruction to parse multiple sets of the first network state information, the multiple sets of constructed first network state information are extracted from the request message queue.

[0131] The sending module 520 can also parse multiple pieces of the first network status information to obtain the request synchronization identification code and service synchronization identification code for each piece of the first network status information in the following manner:

[0132] The constructed first network status information is parsed to obtain the request synchronization identification code and service synchronization identification code for each of the first network status information.

[0133] In an exemplary embodiment of the present invention, the generation module 550 may further be configured to:

[0134] Write the target network status information into the database;

[0135] The generation module 550 can generate network control messages based on the target network state information in the following ways:

[0136] The target network status information is retrieved from the database, and a network control message is generated based on the target network status information.

[0137] In an exemplary embodiment of the present invention, the generation module 550 may further be configured to:

[0138] Determine whether multiple network control messages are identical;

[0139] The generation module 550 can also send the network control message to the network element device in the following way, so that the network element device can generate the network topology corresponding to the network creation request based on the network control message:

[0140] In the event that multiple network control messages are the same network control message, the network control message is sent to the network element device so that the network element device can generate the network topology corresponding to the network creation request based on the network control message.

[0141] In an exemplary embodiment of the present invention, the generation module 550 may further be configured to:

[0142] If multiple network control messages are different, an alarm will be triggered to alert the user that there is an error in the network topology created.

[0143] In an exemplary embodiment of the present invention, the generation module 550 may further be configured to:

[0144] Multiple network control messages are constructed according to a preset network control message format to obtain the constructed network control message;

[0145] Write multiple constructed network control messages to the request message queue;

[0146] Upon receiving an instruction to adjudicate multiple network control messages, the multiple constructed network control messages are retrieved from the request message queue;

[0147] The generation module 550 can determine whether multiple network control messages are the same in the following ways:

[0148] Determine whether multiple constructed network control messages are identical.

[0149] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can invoke logical instructions in the memory 630 to execute an intrinsic security processing method for the Neutron network component. This method includes: acquiring a network creation request, wherein the network creation request includes service parameter information for creating a network; sending the network creation request to multiple heterogeneous executors and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor, wherein the first network state information is used to characterize feature information for constructing a network topology; when multiple first network state information are parsed to originate from the same network creation request, allocating the same second network state information and using the same second network state information as a normalized second network state information, wherein the second network state information is necessary information for constructing a network topology that may have different values ​​during processing by different heterogeneous executors; constructing target network state information based on the first network state information and the normalized second network state information, and generating a network control message based on the target network state information; and sending the network control message to a network element device, so that the network element device generates the network topology corresponding to the network creation request based on the network control message.

[0150] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the intrinsic security processing method of the Neutron network component provided by the above methods. The method includes: obtaining a network creation request, wherein the network creation request includes service parameter information for creating a network; sending the network creation request to multiple heterogeneous executors, and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor, wherein the first network state information is used to characterize feature information for constructing the network topology; and in the process of decryption... When multiple pieces of the first network state information originate from the same network creation request, the same second network state information is allocated, and this same second network state information is used as the normalized second network state information. The second network state information is necessary information for constructing the network topology, as it may have different value possibilities during processing by different heterogeneous execution entities. Based on the first network state information and the normalized second network state information, target network state information is constructed, and a network control message is generated based on the target network state information. The network control message is then sent to network element devices, enabling the network element devices to generate the network topology corresponding to the network creation request based on the network control message.

[0152] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an intrinsic security processing method for the Neutron network component provided by the methods described above. The method includes: obtaining a network creation request, wherein the network creation request includes service parameter information for creating a network; sending the network creation request to multiple heterogeneous executors, and obtaining multiple first network state information corresponding to the network creation request based on each heterogeneous executor, wherein the first network state information is used to characterize feature information for constructing a network topology; and parsing the multiple first network state information... In cases originating from the same network creation request, the same second network state information is allocated, and this same second network state information is used as a normalized second network state information. The second network state information is necessary information for constructing the network topology, as it may have different value possibilities during processing by different heterogeneous executors. Based on the first network state information and the normalized second network state information, target network state information is constructed, and a network control message is generated based on the target network state information. The network control message is then sent to network element devices, enabling the network element devices to generate the network topology corresponding to the network creation request based on the network control message.

[0153] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0154] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0155] It is further understood that although the operations are described in a specific order in the accompanying drawings in the embodiments of the present invention, this should not be construed as requiring these operations to be performed in the specific order or serial order shown, or requiring all the operations shown to obtain the desired result. In certain environments, multitasking and parallel processing may be advantageous.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for handling intrinsic security in a Neutron network component, characterized in that, The method includes: Obtain a network creation request, wherein the network creation request includes service parameter information for creating a network; The network creation request is sent to multiple heterogeneous execution entities, and multiple first network state information corresponding to the network creation request is obtained based on each heterogeneous execution entity. The first network state information is used to characterize the feature information of the network topology. When multiple first network status information are parsed and found to originate from the same network creation request, the same second network status information is assigned, and the same second network status information is used as the normalized second network status information. This is used to move the calculation logic that needs to be normalized in the management of network resources to the back end to adapt to the business side adjudication process. The second network status information is the necessary information for constructing the network topology, which may have different value possibilities in the process of being processed by different heterogeneous executors. The second network status information is the segment ID. Based on the first network state information and the normalized second network state information, target network state information is constructed, and network control messages are generated based on the target network state information. The network control message is sent to the network element device so that the network element device can generate the network topology corresponding to the network creation request based on the network control message.

2. The intrinsic security processing method for Neutron network components according to claim 1, characterized in that, The process of obtaining multiple first network status information corresponding to the network creation request based on each of the heterogeneous executors specifically includes: Based on each of the heterogeneous executors, the same request synchronization identifier and the same service synchronization identifier are added to each of the network creation requests sent to each of the heterogeneous executors; Based on each network creation request that adds the same request synchronization identification code and the same service synchronization identification code, the corresponding first network status information is obtained. Among them, the following method is used to parse out multiple first network status information from the same network creation request: The request synchronization identification code and service synchronization identification code of each first network status information are parsed to obtain the request synchronization identification code and service synchronization identification code of each first network status information. If the request synchronization identification code and service synchronization identification code of each of the first network status information are the same, it is determined that multiple first network status information originate from the same network creation request.

3. The intrinsic security processing method for Neutron network components according to claim 2, characterized in that, Before parsing the plurality of first network status information to obtain the request synchronization identification code and service synchronization identification code for each of the first network status information, the method further includes: Multiple first network status information are constructed according to a preset message format to obtain multiple constructed first network status information, wherein the preset message format matches the network creation request; Write multiple sets of constructed first network status information to the request message queue; Upon receiving an instruction to parse multiple sets of the first network state information, the multiple sets of constructed first network state information are extracted from the request message queue. The step of parsing multiple pieces of the first network status information to obtain the request synchronization identification code and service synchronization identification code for each piece of the first network status information specifically includes: The constructed first network status information is parsed to obtain the request synchronization identification code and service synchronization identification code for each of the first network status information.

4. The intrinsic security processing method for Neutron network components according to claim 1, characterized in that, Before generating the network control message based on the target network state information, the method further includes: Write the target network status information into the database; The generation of network control messages based on the target network state information specifically includes: The target network status information is retrieved from the database, and a network control message is generated based on the target network status information.

5. The intrinsic security processing method for Neutron network components according to claim 1, characterized in that, Before sending the network control message to the network element device so that the network element device generates the network topology corresponding to the network creation request based on the network control message, the method further includes: Determine whether multiple network control messages are identical; The step of sending the network control message to the network element device, so that the network element device generates the network topology corresponding to the network creation request based on the network control message, specifically includes: In the event that multiple network control messages are the same network control message, the network control message is sent to the network element device so that the network element device can generate the network topology corresponding to the network creation request based on the network control message.

6. The intrinsic security processing method for Neutron network components according to claim 5, characterized in that, The method further includes: If multiple network control messages are different, an alarm will be triggered to alert the user that there is an error in the network topology created.

7. The intrinsic security processing method for Neutron network components according to claim 5, characterized in that, Before determining whether the multiple network control messages are identical, the method further includes: Multiple network control messages are constructed according to a preset network control message format to obtain the constructed network control message; Write multiple constructed network control messages to the request message queue; Upon receiving an instruction to adjudicate multiple network control messages, the multiple constructed network control messages are retrieved from the request message queue; The determination of whether multiple network control messages are identical specifically includes: Determine whether multiple constructed network control messages are identical.

8. An intrinsic security processing device for a Neutron network component, characterized in that, The apparatus is used to implement the intrinsic security processing method for Neutron network components according to any one of claims 1 to 7, the apparatus comprising: The acquisition module is used to acquire a network creation request, wherein the network creation request includes service parameter information for creating a network; The sending module is used to send the network creation request to multiple heterogeneous execution entities, and obtain multiple first network status information corresponding to the network creation request based on each of the heterogeneous execution entities, wherein the first network status information is used to characterize the feature information of constructing the network topology; The parsing module is used to allocate the same second network state information when multiple first network state information are parsed as originating from the same network creation request, and to use the same second network state information as the normalized second network state information, wherein the second network state information is necessary information for constructing the network topology that may have different value possibilities during processing by different heterogeneous executors; The construction module is used to construct target network state information based on the first network state information and the normalized second network state information, and to generate network control messages based on the target network state information. The generation module is used to send the network control message to the network element device, so that the network element device generates the network topology corresponding to the network creation request based on the network control message.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the intrinsic security processing method for the Neutron network component as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the intrinsic security processing method for the Neutron network component as described in any one of claims 1 to 7.

Images