Network composer and communication link composing method

Abstract

The invention provides a network composer and a communication link composing method, relates to the technical field of communication, and is used for solving the problem of low communication quality between communication devices. The network orchestrator comprises a service layer, an orchestration layer and a strategy configuration layer. Wherein the service layer is used for acquiring demand information of a to-be-transmitted service. And the arrangement layer is used for monitoring the credibility of a plurality of preset network devices in the network domain, carrying out credible path topology on the to-be-transmitted service based on the demand information and the credibility of each preset network device, and arranging a communication link corresponding to the to-be-transmitted service. And the policy configuration layer is used for generating a target communication policy based on the communication link corresponding to the to-be-transmitted service, and sending the target communication policy to a plurality of preset network devices.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network orchestrator and a communication link orchestration method. Background Art

[0002] As a commonly used network design method, distributed network architecture can flexibly distribute network functions to multiple network devices to carry communication services in different scenarios.

[0003] At present, in the process of carrying business interactions between communication devices, the distributed network architecture needs to orchestrate the network devices in the distributed network architecture (ie, network orchestration) and determine a communication link for carrying communication services to realize business interactions between communication devices.

[0004] However, as the business interaction environment between communication devices becomes more and more complex, the demand for communication services carried by communication links is also increasing. Therefore, how to improve the communication quality between communication devices through network orchestration of communication links has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a network orchestrator and a communication link orchestration method for solving the problem of low communication quality between communication devices.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a network orchestrator, which includes: a business layer, an orchestration layer, and a policy configuration layer. Among them, the business layer is used to obtain demand information of the business to be transmitted. The orchestration layer is used to monitor the trustworthiness of multiple preset network devices in the network domain, and based on the demand information and the trustworthiness of each preset network device, perform a trusted path topology for the business to be transmitted, and orchestrate the communication link corresponding to the business to be transmitted. The policy configuration layer is used to generate a target communication strategy based on the communication link corresponding to the business to be transmitted, and send the target communication strategy to multiple preset network devices.

[0008] In a second aspect, the present application provides a communication link orchestration method, which is applied to a network orchestration device, including: obtaining demand information of a service to be transmitted, the service to be transmitted is a communication service between a transmitting end and a receiving end, and the demand information includes: a communication quality requirement for a communication link between the transmitting end and the receiving end. Based on the demand information, at least one second network device is obtained from a plurality of first network devices, the first network device is a network device among a plurality of preset network devices whose credibility is greater than a first preset threshold, the preset network device is a network device between a transmitting end and a receiving end, and the communication quality of a communication link formed by at least one second network device meets the communication quality requirement in the demand information. According to at least one second network device, a target communication strategy is generated, and the target communication strategy is used to instruct at least one second network device to transmit the service to be transmitted. The target communication strategy is sent to at least one second network device.

[0009] The technical solution provided by the present application brings at least the following beneficial effects: based on the business requirements of the service to be transmitted, the function is expanded on the basis of the traditional scheduler, and multiple network devices with a high degree of trust can be determined between the sending end and the receiving end corresponding to the service to be transmitted. And from the communication links composed of multiple network devices with a high degree of trust, the communication links whose communication quality meets the communication quality requirements of the service are selected as the communication links carrying the service to be transmitted, so that the communication links arranged for the service to be transmitted can meet the security requirements and communication quality requirements at the same time, so as to improve the communication quality between devices.

[0010] Optionally, before the method of "obtaining at least one second network device from multiple first network devices based on the demand information", the method further includes: obtaining the credibility of each preset network device. Based on the first preset threshold, obtaining multiple first network devices from multiple preset network devices.

[0011] Optionally, the demand information also includes: the security level required for the service to be transmitted during the transmission process. After the above method of "obtaining the trust level of each preset network device", the method also includes: determining whether the security level is greater than a first preset threshold. The above method of "obtaining multiple first network devices from multiple preset network devices based on the first preset threshold" includes: when the security level is less than or equal to the first preset threshold, obtaining multiple first network devices from multiple preset network devices based on the first preset threshold.

[0012] Optionally, the method further includes: when the security level is greater than a first preset threshold, based on the security level, obtaining multiple first network devices from multiple preset network devices, the credibility of the first network devices being greater than the security level.

[0013] Optionally, after the above method of "obtaining demand information of the service to be transmitted", the method further includes: determining whether the security level is greater than a second preset threshold. The above method of "obtaining the trustworthiness of each preset network device" includes: when the security level is greater than the second preset threshold, obtaining the trustworthiness of each preset network device.

[0014] Optionally, after the above-mentioned method of "sending the target communication strategy to at least one second network device", the method further includes: obtaining the degree of trust of each preset network device at the current moment in real time. According to the degree of trust and demand information of multiple preset network devices at the current moment, the target communication strategy is updated in real time to obtain an updated target communication strategy. Among them, the updated target communication strategy is used to instruct at least one third network device among the multiple preset network devices to transmit the service to be transmitted, the communication quality of the communication link formed by at least one third network device at the current moment meets the communication quality requirement in the demand information, and the degree of trust of the third network device at the current moment is greater than the first preset threshold.

[0015] In a third aspect, the present application provides a communication link orchestration device, which is applied to a network orchestration device and includes: an acquisition module and a processing module.

[0016] An acquisition module is used to acquire demand information of a service to be transmitted, where the service to be transmitted is a communication service between a transmitting end and a receiving end, and the demand information includes: a communication quality requirement for a communication link between the transmitting end and the receiving end. A processing module is used to acquire at least one second network device from a plurality of first network devices based on the demand information, where the first network device is a network device whose credibility is greater than a first preset threshold among a plurality of preset network devices, and the preset network device is a network device between a transmitting end and a receiving end, and the communication quality of a communication link formed by at least one second network device meets the communication quality requirement in the demand information. The processing module is also used to generate a target communication strategy based on at least one second network device, where the target communication strategy is used to instruct at least one second network device to transmit the service to be transmitted. The processing module is also used to send the target communication strategy to at least one second network device.

[0017] In a fourth aspect, the present application provides a communication link orchestration device, the device comprising: a processor and a memory, the processor and the memory are coupled, the memory is used to store one or more programs, the one or more programs include computer execution instructions, when the device is running, the processor executes the computer execution instructions stored in the memory to implement the communication link orchestration method described in the first aspect or any optional one of the first aspect.

[0018] In a fifth aspect, the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the communication link orchestration method described in the first aspect or any optional aspect of the first aspect.

[0019] In a sixth aspect, the present application provides a computer program product, which is applied to a server. The computer program product includes computer instructions. When the computer instructions are executed on the server, the server implements the communication link orchestration method described in the first aspect or any optional aspect in the first aspect.

[0020] In the above scheme, the technical problems that can be solved and the technical effects achieved by the communication link orchestration device, equipment, computer storage medium or computer program product can be referred to the technical problems and technical effects solved by the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of an SDN architecture provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a communication system provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of a TPCM system architecture provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of another communication system provided in an embodiment of the present application;

[0025] Figure 5 A flow chart of a communication link arrangement method provided in an embodiment of the present application;

[0026] Figure 6 An example flow chart of constructing a trusted network topology provided in an embodiment of the present application;

[0027] Figure 7 A flowchart of another communication link arrangement method provided in an embodiment of the present application;

[0028] Figure 8 An example flow chart of collecting trusted information of a network device provided in an embodiment of the present application;

[0029] Fig. 9 A flowchart of another communication link arrangement method provided in an embodiment of the present application;

[0030] Fig.10 A flowchart of another communication link arrangement method provided in an embodiment of the present application;

[0031] Fig.11 A flowchart of another communication link arrangement method provided in an embodiment of the present application;

[0032] Fig.12 An example flow chart of a trusted network topology update provided in an embodiment of the present application;

[0033] Fig.13 An example flow chart of a trusted service orchestration provided in an embodiment of the present application;

[0034] Fig.14 A schematic diagram of the structure of a communication link arrangement device provided in an embodiment of the present application;

[0035] Fig.15 A schematic diagram of the structure of a communication link arrangement device provided in an embodiment of the present application;

[0036] Fig.16 A conceptual partial view of a computer program product provided for an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] In this article, the character " / " generally indicates that the objects before and after are in an "or" relationship. For example, A / B can be understood as A or B.

[0039] The terms “first” and “second” in the description and claims of the present application are used to distinguish different objects rather than to describe a specific order of the objects.

[0040] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not limited to the listed steps or modules, but may optionally include other steps or modules that are not listed, or may optionally include other steps or modules that are inherent to these processes, methods, products or devices.

[0041] In addition, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present concepts in a specific way.

[0042] Before introducing in detail the communication link arrangement method provided by the embodiment of the present application, the implementation environment and application scenarios of the embodiment of the present application are first introduced.

[0043] First, the application scenarios of the embodiments of the present application are introduced.

[0044] Distributed network architecture is a widely used network design method. Its core concept is to flexibly and efficiently deploy various network functions on multiple network devices to carry and optimize communication business needs in various complex scenarios. For example, the network orchestration of communication links can be completed by combining distributed network architecture with software defined networking (SDN).

[0045] Among them, SDN is an emerging network architecture whose core features are the centralization and programmability of network control functions. This architecture separates the network control plane (i.e., control layer) from the forwarding plane (forwarding layer), allowing network control functions to be transferred from network devices to external computing devices, thereby achieving centralized control and dynamic adjustment of the network (i.e., network services of different business applications in the business layer), such as Figure 1 As shown in the figure. The control layer centrally controls network devices through standard interfaces. Network devices generate forwarding tables by receiving control signals and process traffic data based on these tables. Therefore, complex distributed network protocols are no longer required for data forwarding. In other words, SDN networks have flexible scalability and programmability, which can fully meet various business needs.

[0046] However, in the SDN architecture, it is difficult for one SDN controller to control all forwarding capabilities of the network layer. The network orchestrator can connect to all SDN controllers, has the function of collecting and maintaining the global view of network resources and resource status, and can perform resource orchestration and orchestration policy delivery operations according to business needs. That is, the traditional network orchestrator has the ability to collect, maintain and orchestrate traditional network resource information.

[0047] However, as the business interaction environment between communication devices becomes more and more complex, the demand for communication services carried by communication links is also increasing.

[0048] For example, as specific services have higher requirements for data privacy and security, especially for user data and enterprise data with high confidentiality and privacy, how to enhance security and privacy capabilities on the control plane and data plane is a problem that network operators need to solve. On the one hand, path security issues should be fully considered when arranging control plane routing; on the other hand, network devices are important infrastructure for network connections, and ensuring the credibility of network devices themselves is also crucial to improving data plane security.

[0049] That is, when network devices are hacked or illegal software and applications exist, it may lead to security risks such as failure of end-to-end encryption in data transmission and illegal analysis of private data. Especially when it comes to virtualization and resource sharing scenarios, security and privacy issues are more prominent. Therefore, as an important security mechanism, trusted path can establish a trusted path to protect the integrity and confidentiality of data and information.

[0050] In summary, how to improve the communication quality between communication devices through network orchestration of communication links has become a technical problem that needs to be solved urgently.

[0051] In order to solve the above problems, an embodiment of the present application provides a communication link orchestration method, and the communication link orchestration method provided by the embodiment of the present application is applied to the scenario of orchestrating communication links. The embodiment of the present application can expand the functions on the basis of the traditional orchestrator based on the business needs of the business to be transmitted, and can determine multiple network devices with a high degree of trust between the sending end and the receiving end corresponding to the business to be transmitted. And from the communication links composed of multiple network devices with a high degree of trust, the communication links whose communication quality meets the communication quality requirements of the business are screened out as the communication links that carry the business to be transmitted, so that the communication links arranged for the business to be transmitted can meet the security requirements and communication quality requirements at the same time, so as to improve the communication quality between devices.

[0052] The implementation environment of the embodiments of the present application is introduced below.

[0053] like Figure 2As shown, it is a schematic diagram of a communication system provided in an embodiment of the present application, and the communication system may include: at least one user device (such as user device 201 and user device 202), a communication link arrangement device 203, a functional network element 204, and at least one network device (such as network device 205, network device 206, network device 207) between the user device 201 and the user device 202. Among them, the communication link arrangement device 203 can perform wired / wireless communication with the user device 201, the functional network element 204, and the network devices 205, 206, and 207, the functional network element 204 can perform wired / wireless communication with the network devices 205, 206, and 207, and the user device 201 can perform wired / wireless communication with the user device 202 through at least one network device among the network devices 205, 206, and 207.

[0054] Specifically, the communication link arrangement device 203 may receive the demand information of the service to be transmitted that the user equipment 201 (i.e., the transmitting end) is about to send to the user equipment 202 (i.e., the receiving end), and query the trustworthiness of multiple network devices (such as network device 205, network device 206, and network device 207) between the user equipment 201 and the user equipment 202 through the functional network element 204. Then, the communication link arrangement device 203 may select network devices with a trustworthiness greater than the trustworthiness threshold from the network devices 205, 206, and 207 based on the trustworthiness threshold (i.e., the first preset threshold) to simulate at least one communication link between the user equipment 201 and the user equipment 202, and select the communication link whose communication quality meets the communication quality requirement in the above-mentioned demand information from the at least one simulated communication link as the communication link between the user equipment 201 and the user equipment 202 for transmitting the service to be transmitted. Then, the communication link arrangement device 203 can instruct any network device in the communication link to transmit the service to be transmitted between the user equipment 201 and the user equipment 202 (i.e., send a communication strategy for instructing the transmission of the service to be transmitted to the network device in the communication link).

[0055] Exemplarily, if the trust levels of network device 205, network device 206, and network device 207 are all greater than the trust threshold, the at least one simulated communication link may include: link A formed by network device 205 and network device 206, link B formed by network device 205 and network device 207, link C formed by network device 206 and network device 207, and link D formed by network device 205, network device 206, and network device 207.

[0056] If only the communication quality corresponding to link B among at least one of the above-simulated communication links (i.e., link A, link B, link C, and link D) can meet the communication quality requirements in the demand information, then the communication link between user equipment 201 and user equipment 202 for transmitting the service to be transmitted is link B, and the communication link orchestration device 203 can issue a communication strategy for indicating the transmission of the service to be transmitted to the network device 205 and the network device 207 in link B.

[0057] In some embodiments, the communication system may only include: user equipment 201, user equipment 202, communication link arrangement device 203, and network equipment 205, network equipment 206, and network equipment 207. The communication link arrangement device 203 may perform wired / wireless communication with user equipment 201, network equipment 205, network equipment 206, and network equipment 207, and user equipment 201 may perform wired / wireless communication with user equipment 202 through at least one of network equipment 205, network equipment 206, and network equipment 207.

[0058] That is to say, the above communication system may not include the functional network element 204, and the communication link orchestration device 203 may directly monitor the trustworthiness of the network devices 205, 206, and 207.

[0059] Exemplarily, the communication link arrangement device 203 may receive the demand information of the service to be transmitted that the user equipment 201 is about to send to the user equipment 202, and query the trustworthiness of the network equipment 205, the network equipment 206, and the network equipment 207. Then, the communication link arrangement device 203 may select network devices with a trustworthiness greater than the trustworthiness threshold from the network equipment 205, the network equipment 206, and the network equipment 207 based on the trustworthiness threshold to simulate at least one communication link between the user equipment 201 and the user equipment 202, and select the communication link whose communication quality meets the communication quality requirement in the above-mentioned demand information from the at least one simulated communication link as the communication link for transmitting the service to be transmitted between the user equipment 201 and the user equipment 202. Then, the communication link arrangement device 203 may instruct any network device in the communication link to transmit the service to be transmitted between the user equipment 201 and the user equipment 202.

[0060] It should be noted that the user equipment (such as user equipment 201 and user equipment 202) may be a terminal. The terminal may be a mobile phone, tablet computer, desktop, laptop, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, etc. with transceiver functions, and the present application does not impose any special restrictions on the specific form of the terminal. It may perform human-computer interaction with the user through one or more methods such as keyboard, touch pad, touch screen, remote control, voice interaction, or handwriting device.

[0061] The communication link orchestration device 203 may be a network orchestrator.

[0062] That is to say, by extending the trusted state maintenance function of the network device to the network orchestrator, the network orchestrator can collect, verify, update and maintain the trusted state of the network device, so that it has the trusted path orchestration function. It is able to establish and maintain the network trusted path topology, and establish a mapping relationship between the network device orchestratable resources and the trusted network device according to the trusted state (i.e., the degree of trustworthiness) of the network device reported by the functional network element 204. Having the ability to parse and orchestrate the trusted information of the network device is crucial to improving the communication quality between communication devices.

[0063] Alternatively, the communication link orchestration device 203 may be composed of a network orchestrator and an SDN controller (i.e., the communication link orchestration device 203 may include a network orchestrator and an SDN controller). Alternatively, the communication link orchestration device 203 may be composed of a network orchestrator and a network management system (NMS) system (i.e., the communication link orchestration device 203 may include a network orchestrator and an NMS system). Alternatively, the communication link orchestration device 203 may be composed of a network orchestrator and an element management system (EMS) system (i.e., the communication link orchestration device 203 may include a network orchestrator and an EMS system).

[0064] Among them, the SDN controller uniformly monitors and controls the underlying forwarding plane network devices, and performs link discovery, topology management, flow table delivery and other behaviors through southbound protocols such as OpenFlow. Provide standard northbound interfaces to upper-layer applications, through which upper-layer applications can effectively schedule and configure resources for the underlying network to achieve automatic and flexible network management and control. The controller is the command center, which transmits commands on how to forward traffic by sending control instructions to network devices, but does not actually execute these commands.

[0065] The EMS system or NMS system covers aspects such as equipment management, performance management, fault management, and security management of network equipment. When the EMS / NMS has the function of collecting and evaluating the trusted measurement information of network equipment, the network element with the remote attestation and verification function of network equipment can obtain the trusted measurement information and trusted status of network equipment from the EMS system or NMS system.

[0066] Functional network element 204 may be a core network element. The core network element may include various network functions, such as access and mobility management function (AMF), session management function (SMF), user plane function (UPF), policy control function (PCF), unified data management (UDM), location management function (LMF), etc.

[0067] The network device (such as network device 205, network device 206, network device 207) can be a non-transparent forwarding network device. It can be an Internet protocol (IP) network device, such as customer premises equipment (CPE), a switch, a router, a broadband remote access server (BRAS) device. It can also be a transmission network device, such as an optical transport network (OTN) device. It can also be an access network device, such as an optical network unit (ONU), a multi-function optical network terminal (ONT), an optical line terminal (OLT), etc.

[0068] In some embodiments, a first module for monitoring the degree of trust is deployed in the network device. The first module may include: a trusted platform module (TPM), a trusted platform control module (TPCM), a trusted cryptography module (TCM), a secure element (SE) and other security chips and application systems. It has the ability to measure the trusted hardware and software and runtime status of the network device, the ability to generate secret keys, the ability to store secret keys, and the ability to remotely prove.

[0069] Among them, TPM is a microchip that provides basic security-related functions involving encryption keys. TPM is installed on the motherboard of the computer (i.e., network device 205, network device 206, network device 207), and it communicates with the rest of the system using a hardware bus. Devices containing TPM can create encryption keys and encrypt them so that these keys can only be decrypted by TPM. This process is usually called "wrapping" or "binding" keys, which helps prevent key leakage.

[0070] Each TPM has a master wrapping key, called the storage root key, which is stored in the TPM itself. The private portion of the storage root key or endorsement key created in the TPM is never disclosed to any other component, software, process, or user. The TPM chip has platform integrity measurement and remote attestation capabilities, which are used to evaluate the integrity of the platform startup process and running process and the integrity of the running code, as well as to prove the credibility of the state of the TPM platform itself. The TPM module can obtain the trusted feature values ​​of the software and hardware of the device platform, and record the execution integrity status of all software and hardware modules of the platform, thereby building a trust chain for the trusted computing platform. If any module is infected by malicious software, its trust chain value will inevitably change.

[0071] TPCM is a hardware module integrated into a trusted platform, which is mainly used to establish and protect the source of trust, and provide a series of trusted computing functions such as trusted platform control, integrity measurement, secure storage, trusted reporting and cryptographic services.

[0072] TCM is a trusted cryptographic module that uses the SM series national secret algorithm and provides trusted root and cryptographic operation functions. Similar to TPM, TPCM and TCM also have remote attestation and integrity measurement capabilities.

[0073] like Figure 3As shown, the system architecture of TPCM may include: computing component 301, TPCM chip 302, trusted cryptographic module 303, trusted software base 304 and TPCM management module 305. Among them, TPCM chip 302 includes computing component interface, function interface, function service, basic software, trusted cryptographic module interface and basic hardware, and the basic software and trusted cryptographic module interface and basic hardware are interconnected.

[0074] The TPCM chip 302 can exchange data with the computing component 301 through the computing component interface. The TPCM chip 302 can exchange data with the trusted software base 304 and the TPCM management module 305 through the functional interface. The TPCM chip 302 can exchange data with the trusted cryptographic module 303 through the trusted cryptographic module interface.

[0075] In some embodiments, the network orchestrator may include: a business layer, an orchestration layer, and a policy configuration layer. The business layer is used to obtain demand information of the business to be transmitted. The orchestration layer is used to monitor the trustworthiness of multiple preset network devices in the network domain, and based on the demand information and the trustworthiness of each preset network device, perform a trusted path topology for the business to be transmitted, and orchestrate the communication link corresponding to the business to be transmitted. The policy configuration layer is used to generate a target communication strategy based on the communication link corresponding to the business to be transmitted, and send the target communication strategy to multiple preset network devices.

[0076] In combination with the interaction between the communication link arrangement device 203 and the functional network element 204 in the above communication system, and the policy delivery of the communication link arrangement device 203 to the network device, as shown in FIG. Figure 4 As shown, the network device trusted information management module of the orchestration layer in the network orchestrator can query the trusted status information (i.e., the trusted status evaluation results of the network devices, such as the degree of trustworthiness) of specific network devices (such as network devices 205, 206, and 207) to remotely prove and verify the functional network element (i.e., functional network element 204) of the network device, and record the trusted status information at the current moment.

[0077] The network resource management module in the orchestration layer can obtain the trusted status information of the network device from the network device trusted information management module, and map and match the network device identifier with the network resource identifier. The network resource management module builds and maintains the trusted network topology based on the trusted status information of the network resources. The policy generation and configuration module of the policy configuration layer forms a trusted path orchestration strategy based on the orchestration results.

[0078] When network devices are located in the same network domain, the target communication strategy can be issued through an SDN controller or NMS system. When network devices involve different network domains, the network orchestrator can issue the target communication strategy to multiple SDN controllers or NMS systems corresponding to different network domains, and the SDN controller or NMS system can issue configuration parameters to the relevant network devices in their respective network domains.

[0079] Among them, the business layer has business management capabilities, user business demand acquisition, analysis and mapping, analysis of business needs or business templates, mapping them to the network resource view, and conversion of business needs into network function needs.

[0080] The orchestration layer has the ability to maintain and orchestrate network resource status. The orchestration layer includes a network resource management module, a network device trusted information management module, and a trusted resource orchestration module.

[0081] The network resource management module has the function of managing network resource status information, which can manage the network resources of the domain and maintain the status of network resources in the domain, such as link information, topology information, etc. It has the function of mapping trusted resources, and obtains the trusted status information of network devices from the network device trusted information management module. It has the function of maintaining trusted topology, mapping the trusted status of network devices to local network resources, and generating and maintaining trusted resource topology. This topology information is a subset of the original network resource topology information, and only contains network devices or network resources with a status of "trusted", such as trusted routing topology.

[0082] The network equipment trusted information management module has the function of collecting the trusted status of network equipment. It periodically collects the trusted status of network equipment from the network equipment remote attestation and verification function network element. The trusted status is the trusted status evaluation result provided by the network equipment remote attestation and verification function network element based on the trusted measurement of the network equipment. When the trusted status of the network equipment changes, it receives the trusted status update information actively reported by the network equipment remote attestation and verification function network element. It has the function of trusted status management, stores and maintains the trusted status information of network equipment in its management domain, and responds to the trusted information query of the network resource management module.

[0083] The trusted resource orchestration module has the trusted resource orchestration function. It orchestrates trusted resources based on network configuration requirements, builds a network trusted path topology based on the trusted status of network devices, and maintains the network trusted path topology. It implements trusted path orchestration, receives trusted path-related business requirements from the business system, executes trusted path orchestration, and formulates trusted path policies. It has the traditional resource orchestration function. When the business is a non-trusted orchestration business, it orchestrates resources in the way of a traditional orchestrator.

[0084] The policy generation and configuration module of the policy configuration layer has the function of generating orchestration policy configuration, which can generate network orchestration configuration policies according to the orchestration results, and send the policies to the SDN controller, EMS system or NMS system through the unified interface function, which will implement the policies for network devices.

[0085] To summarize, the embodiments of the present application can add trusted orchestration capabilities of routing paths on the basis of traditional network resource orchestration capabilities, can synchronize trusted status information of network devices from remote proof verification function network elements of network devices, build trusted resource topologies such as trusted routing topologies, and can use the trusted status of network devices as path orchestration factors to perform trusted network path orchestration according to business needs, formulate trusted path policies and issue them to corresponding network devices, thereby ensuring the credibility of network devices on routing paths, and thus meeting business needs such as trusted path orchestration and trusted traffic engineering.

[0086] After introducing the application scenario and implementation environment of the embodiment of the present application, the communication link arrangement method provided by the embodiment of the present application is described in detail below in combination with the above-mentioned implementation environment.

[0087] The methods in the following embodiments can all be implemented in the above application scenarios and implementation environments. The following takes the communication link orchestration device as a network orchestrator as an example, and specifically describes the embodiments of the present application in conjunction with the accompanying drawings of the specification.

[0088] Figure 5 The following is a flow chart of a communication link arrangement method provided in an embodiment of the present application. Figure 5 As shown, the method may include: S501-S504.

[0089] S501: Obtain demand information of a service to be transmitted.

[0090] The service to be transmitted is the communication service between the sending end and the receiving end.

[0091] It should be noted that the embodiment of the present application does not limit the service type of the service to be transmitted. For example, the service type of the service to be transmitted may be a voice service, or a video service, or a streaming media service.

[0092] In the embodiment of the present disclosure, the requirement information may include: a communication quality requirement for a communication link between a transmitting end and a receiving end.

[0093] It should be noted that the embodiment of the present application does not limit the indicator of communication quality requirements. For example, the indicator of communication quality requirements may be path reachability. For another example, the indicator of communication quality requirements may be quality of service (QoS). For another example, the indicator of communication quality requirements may be routing information. For another example, the indicator of communication quality requirements may be link state information. For another example, the indicator of communication quality requirements may be latency information.

[0094] As a possible implementation manner, the network orchestrator may receive demand information of the service to be transmitted reported by the sender.

[0095] As another possible implementation, the network scheduler may receive the to-be-transmitted service reported by the sender, wherein the to-be-transmitted service includes demand information.

[0096] That is to say, the demand information obtained by the network orchestrator may be directly reported and sent by the sending end, or the demand information obtained by the network orchestrator may be indirectly carried in the to-be-transmitted service reported by the sending end.

[0097] S502: Based on the demand information, obtain at least one second network device from multiple first network devices.

[0098] The first network device is a network device whose credibility is greater than a first preset threshold among a plurality of preset network devices, and the preset network device is a network device between a sending end and a receiving end.

[0099] Exemplarily, the network devices between the transmitting end and the receiving end (i.e., the preset network devices) include: device A, device B, device C, and device D. Among them, the trustworthiness of device A is 0.5, the trustworthiness of device B is 1, the trustworthiness of device C is 1.5, and the trustworthiness of device D is 5. If the first preset threshold is 1, the multiple first network devices include device C and device D.

[0100] As a possible implementation method, the network scheduler can simulate the communication link between the transmitter and the receiver based on multiple first network devices to obtain at least one simulated link. Then, the network scheduler can determine the communication quality of each simulated link, and based on the communication quality requirements in the demand information, select the simulated links whose communication quality can meet the communication quality requirements from all simulated links as the communication links for transmitting the services to be transmitted. Among them, the communication link for transmitting the services to be transmitted is composed of at least one second network device among the multiple first network devices, that is, the communication quality of the communication link composed of at least one second network device meets the communication quality requirements in the demand information.

[0101] Exemplarily, the multiple first network devices may include: device A, device B, and device C, and the multiple simulated links obtained by device A, device B, and device C may include: link A formed by device A and device B, link B formed by device A and device C, link C formed by device B and device C, and link D formed by device A, device B, and device C. If only the communication quality of link C among the multiple simulated links can meet the communication quality requirement in the requirement information, then the at least one second network device may include device B and device C.

[0102] It should be noted that for the process of the network orchestrator determining the communication quality of the simulated link, reference can be made to the description of the communication quality of the simulated communication link when transmitting services in the prior art, which will not be repeated here.

[0103] The following is an introduction to the above-mentioned method of simulating a communication link with specific examples. Figure 6 As shown, the process includes the following steps (1) to (3).

[0104] Step (1), when the network resource management module in the network orchestrator already stores the collected and reported node information, link information, board information and other network resource information, the network resource management module in the network orchestrator can obtain the trusted information of the network device from the network device trusted information management module (i.e., obtain the trusted information of the device).

[0105] In step (2), the network resource management module maps the network device identifier with the network resource identifier (i.e., trusted resource mapping), and identifies the network resources on the network device node in a trusted state as trusted network resources. For example, the link between two network devices in a trusted state is regarded as a trusted link, and the link resource is a trusted network resource.

[0106] Step (3), the network resource management module constructs and maintains a trusted network topology, such as a trusted routing topology, a trusted link topology (ie, trusted topology establishment), etc., based on the trusted state information of the network resources.

[0107] S503: Generate a target communication strategy according to at least one second network device.

[0108] The target communication strategy is used to instruct at least one second network device to transmit the service to be transmitted.

[0109] As a possible implementation, the network orchestrator may generate a target communication strategy based on the device information of each second network device, wherein the target communication strategy may include the device information of each second network device.

[0110] It should be noted that the embodiments of the present application do not limit the device information of the network device. For example, the device information of the network device may be a device identifier (such as a device name, a device serial number, etc.). For another example, the device information of the network device may be device address information (such as a media access control (MAC) address, an Internet protocol (IP) address, etc.). For another example, the device information of the network device may be device configuration parameters (such as device interface parameters, etc.).

[0111] That is, the network orchestrator can orchestrate network devices with a higher degree of trust, and form a target communication strategy based on the orchestration results that meet the communication quality requirements among multiple orchestration results.

[0112] S504: Send a target communication policy to at least one second network device.

[0113] As a possible implementation manner, the network orchestrator may send the target communication policy to each second network device in a directionally manner based on the device information of each second network device.

[0114] As another possible implementation method, the network orchestrator can broadcast the target communication strategy to multiple preset network devices, so that the second network device whose device information can match the device information in the target communication strategy among the multiple preset network devices receives the target communication strategy, thereby sending the target communication strategy to each second network device among at least one second network device.

[0115] The technical solution provided by the above embodiment brings at least the following beneficial effects: based on the business requirements of the service to be transmitted, the function is expanded on the basis of the traditional scheduler, and multiple network devices with high credibility can be determined between the sending end and the receiving end corresponding to the service to be transmitted. And from the communication links composed of multiple network devices with high credibility, the communication links whose communication quality meets the communication quality requirements of the service are selected as the communication links carrying the service to be transmitted, so that the communication links arranged for the service to be transmitted can meet the security requirements and communication quality requirements at the same time, so as to improve the communication quality between devices.

[0116] In some embodiments, Figure 7 As shown, before S502, the arrangement of the communication link may further include: S701-S702.

[0117] S701. Obtain the credibility of each preset network device.

[0118] It should be noted that in an embodiment of the present application, the network orchestrator can directly communicate and interact with the preset network device to obtain the trustworthiness of the preset network device, or the network orchestrator can indirectly obtain the trustworthiness of the preset network device by initiating a query request to the remote attestation and verification function network element of the network device.

[0119] Exemplarily, take the example of a network orchestrator indirectly obtaining the degree of trustworthiness of a preset network device. First, the trusted computing module in the preset network device measures the integrity of the actual system and application of the preset network device to generate trusted status information (i.e., degree of trustworthiness). The network device remote attestation and verification function network element then collects and evaluates the trusted status information. Then, the network device remote attestation and verification function network element can share the trusted status information of the preset network device with the network orchestrator, so that the network orchestrator uses the network device remote attestation and verification function network element to share the trusted status information of the preset network device, and completes the trusted resource orchestration to meet the security and credibility requirements of the trusted path service.

[0120] The following is an introduction to the method for obtaining the credibility of the above network devices with reference to specific examples. Figure 8 As shown, the process includes the following steps (a) to (c).

[0121] Step (a), when the network device remote attestation verification function network element has completed the verification of the integrity and timeliness of the trusted measurement information in the remote attestation response sent by the network device, and compared it with the trusted measurement information baseline value, it will generate and store the network device trusted status assessment result. At this time, the trusted status information of the network device is already stored in the network element. Under the above premise, the network device trusted information management module in the network orchestrator queries the network device remote attestation verification function network element for the trusted status information of a specific network device (i.e., obtains the device trusted information), and needs to send information such as the device ID when querying.

[0122] Step (b), the network device remote attestation and verification function network element queries the specific network device trusted status information (ie, trusted information query) based on the network device identification information, and returns the trusted status evaluation result of the network device (ie, device trusted information response).

[0123] Step (c), the network device trusted information management module in the network orchestrator will record the trusted status information of the corresponding network device (i.e., device trusted information storage). And when the trusted status of the network device in the network device remote attestation and verification function network element changes, the network device remote attestation and verification function network element can also actively notify the trusted status of the network device through event triggering.

[0124] S702: Based on a first preset threshold, obtain multiple first network devices from multiple preset network devices.

[0125] As a possible implementation, the network orchestrator may pre-store a first preset threshold value. The network orchestrator may obtain multiple first network devices from multiple preset network devices based on the first preset threshold value.

[0126] Exemplarily, the trust levels of multiple preset network devices include: the trust level of preset network device A is 0.5, the trust level of preset network device B is 1, the trust level of preset network device C is 1.5, and the trust level of preset network device D is 2. The first preset threshold is 1, then the multiple first network devices include: preset network device C and preset network device D.

[0127] It can be understood that by obtaining the trusted status information of the preset network device and based on the size relationship between the trusted status information and the first preset threshold, network devices with a higher degree of trust can be screened out to improve the communication quality between communication devices, thereby ensuring the security of the communication process of the service to be transmitted.

[0128] It should be noted that the security level of the business demand of the business to be transmitted determines whether the business demand of the business to be transmitted is a trusted business demand, and further determines whether it is a trusted orchestration business. The following embodiments can be used to determine whether the business demand of the business to be transmitted can be trusted for business orchestration according to the security level required by the business to be transmitted included in the demand information.

[0129] In some embodiments, Fig. 9 As shown, after S701, the arrangement of the communication link may further include: S901.

[0130] S901: Determine whether the security level is greater than a first preset threshold.

[0131] The demand information also includes: the security level required for the service to be transmitted during the transmission process.

[0132] Exemplarily, the multiple services to be transmitted include: service A, service B, and service C. The security level of service A is 0.5, the security level of service B is 1, and the security level of service C is 1.5. If the first preset threshold is 1, then the security level of service C to be transmitted is greater than the first preset threshold. In some embodiments, when the network orchestrator determines that the security level is less than or equal to the first preset threshold, the network orchestrator may execute S702.

[0133] That is, when the security level is less than or equal to the first preset threshold, S702 is executed to select a network device whose trustworthiness is greater than the first preset threshold from among the plurality of preset network devices as the first network device based on the trustworthiness of the plurality of preset network devices.

[0134] In other embodiments, when the network orchestrator determines that the security level is greater than the first preset threshold, the network orchestrator may execute S902.

[0135] S902. The network orchestrator obtains multiple first network devices from multiple preset network devices based on the security level.

[0136] The credibility of the first network device is greater than its security.

[0137] Exemplarily, in combination with the above embodiment, the security level of the service C to be transmitted is 1.5, and the security level of the service C to be transmitted is greater than the first preset threshold. The plurality of preset network devices include: device A, device B, device C, and device D. Among them, the trust level of device A is 0.5, the trust level of device B is 1, the trust level of device C is 1.5, and the trust level of device D is 5. If the first preset threshold is 1, the first network device is device D.

[0138] It is understandable that by comparing the relationship between the security level in the service requirements of the service to be transmitted and the first preset threshold, the first network device is selected according to different methods. In this way, the trustworthiness of the first network device and the security level in the service requirements of the service to be transmitted can be more matched, and a more suitable first network device can be selected, thereby improving the security level of the communication programming process.

[0139] In some embodiments, Fig.10 As shown, after S501, the arrangement of the communication link may further include: S1001.

[0140] S1001. Determine whether the security level is greater than a second preset threshold.

[0141] As a possible implementation, the network orchestrator may pre-store a second preset threshold. Based on the second preset threshold, the network orchestrator may determine whether the security level indicated in the acquired demand information of the service to be transmitted is greater than the second preset threshold, and further determine whether the service to be transmitted requires a communication link composed of a network device with a higher degree of trust to carry its transmission.

[0142] In some embodiments, when the network orchestrator determines that the security level is greater than a second preset threshold, the network orchestrator may execute S701.

[0143] Optionally, when the security level is less than or equal to a second preset threshold, the network orchestrator does not need to perform trusted service orchestration.

[0144] Exemplarily, in combination with the above embodiment, the security level of the service A to be transmitted is 0.5, the security level of the service B to be transmitted is 1, the security level of the service C to be transmitted is 1.5, and the second preset threshold is 0.8, then the security level of the service A to be transmitted is less than or greater than the second preset threshold, and there is no need to obtain the trust level of each preset network device. The security level of the service B to be transmitted and the security level of the service C to be transmitted are greater than the second preset threshold, and it is necessary to obtain the trust level of each preset network device.

[0145] It is understandable that by comparing the relationship between the security level in the service requirements of the service to be transmitted and the second preset threshold, it is determined whether it is a trusted orchestration service. It can be targeted to adapt to services to be transmitted with different security levels, thereby ensuring that the network equipment of the service to be transmitted is more secure during the transmission process and can perform trusted orchestration services.

[0146] It should be noted that the trustworthiness of network devices is updated in real time, and the trustworthiness at different times will affect the selection of network devices in the communication link, thereby changing the communication strategy. The following embodiments can be used to update the target communication strategy in real time according to the trustworthiness of each preset network device at the current moment.

[0147] In some embodiments, Fig.11 As shown, after S504, the arrangement of the communication link may further include: S1101-S1102.

[0148] S1101. Obtain the credibility of each preset network device at the current moment in real time.

[0149] As a possible implementation, based on S701, when the trusted state of the network device monitored by the network device remote attestation and verification function network element changes, the network device remote attestation and verification function network element can also actively notify the network orchestrator network device trusted information management module of the latest trusted state information of the network device through event triggering. The network device trusted information management module records and then notifies the network resource management module of the updated trusted state information of the network device.

[0150] S1102: Update the target communication strategy in real time according to the credibility and demand information of multiple preset network devices at the current moment to obtain an updated target communication strategy.

[0151] Among them, the updated target communication strategy is used to instruct at least one third network device among multiple preset network devices to transmit the service to be transmitted, the communication quality of the communication link formed by at least one third network device at the current moment meets the communication quality requirement in the demand information, and the credibility of the third network device at the current moment is greater than the first preset threshold.

[0152] Exemplarily, the first preset threshold is 1, and at time a, the credibility of preset network device A is 1.5, the credibility of preset network device B is 1.5, and the credibility of preset network device C is 1.5. Then preset network device A, preset network device B, and preset network device C are the first network devices, and the device whose communication quality meets the communication quality requirements in the demand information is selected as the second network device to generate the target communication strategy. At time b, the credibility of preset network device A is 1, the credibility of preset network device B is 0.5, and the credibility of preset network device C is 1.5. Then preset network device C is the first network device, and the device whose communication quality meets the communication quality requirements in the demand information is selected as the third network device to generate the updated target communication strategy. The first network devices in the original target communication strategy are preset network device A, preset network device B, and preset network device C, and the first network device in the updated target communication strategy is preset network device C.

[0153] The following is an introduction to the communication link update and maintenance method corresponding to the above target communication strategy with reference to a specific example. Fig.12 As shown, the steps include steps 1 to 4.

[0154] Step 1: The network device remote attestation and verification function network element proactively notifies the network device trusted information management module of the network orchestrator of the latest information on the trusted status of the network device (i.e., pushes the device trusted status update information).

[0155] Step 2: The network device trusted information management module records the trusted status information of the corresponding device (ie, updates the information record).

[0156] Step 3: The network device trusted information management module notifies the network resource management module of updated network device trusted information (ie, network device trusted status update information).

[0157] Step 4: Trusted resource mapping and trusted topology establishment. Figure 6 Steps (2) to (3) in the corresponding embodiment are not described in detail.

[0158] It is understandable that the network orchestrator can update the trusted network topology (i.e., the communication link used to transmit the service to be transmitted) according to the trusted state information of the updated network device, and reconfigure the communication strategy for the service to be transmitted based on the updated trusted network topology (i.e., the updated target communication strategy). In other words, by obtaining the trustworthiness of each preset network device at the current moment in real time, the corresponding target communication strategy at the current moment is generated. Different orchestration strategies can be adopted to respond to changes in the service to be transmitted, to ensure the security of network orchestration at the moment, and to improve the communication quality of communication orchestration.

[0159] The following describes the communication link arrangement method provided by the embodiment of the present application in conjunction with specific examples. Fig.13 As shown, the steps include steps one to six.

[0160] Step 1: The user device submits trusted path service requirements to the network orchestrator through the service system, such as trusted network slicing, traffic guidance to a specific source IP address segment or destination address segment.

[0161] Step 2: The network orchestrator service management module receives the trusted service requirements, maps the service requirements to the network configuration, and converts the service requirements into network resource orchestration requirements.

[0162] Step 3: If it is a trusted orchestration requirement, the trusted resource orchestration module performs resource orchestration according to the requirement (i.e., performs trusted orchestration, checks the trusted topology, and determines whether there are any network devices in a trusted state), completes trusted path orchestration based on the locally stored network device trusted state information, routing information, link state information, QoS, latency information, etc., and converts the business component correspondence into a network resource component connection relationship (i.e., performs orchestration based on the network devices in the trusted topology to determine whether other business requirements are met, such as path reachability, QoS requirements, etc.). If it is not a trusted orchestration business requirement, the process ends, returns a trusted orchestration failure result, and performs resource and capability orchestration according to the ordinary orchestration requirements, which will not be described in detail in the embodiments of this application.

[0163] Step 4: The network orchestrator policy production and configuration module forms a trusted path orchestration strategy (i.e., generates a trusted orchestration strategy) based on the orchestration results.

[0164] Step 5: The policy production and configuration module sends the trusted path orchestration policy to the SDN controller. If the trusted path involves different network domains, the network orchestrator can send the trusted path orchestration policy to multiple SDN controllers.

[0165] Step 6: The SDN controller sends configuration parameters to related network devices.

[0166] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of computer equipment. It is understandable that, in order to realize the above functions, the computer equipment includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the steps of the arrangement method of the communication link of each example described in the embodiment disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0167] The embodiment of the present application also provides a communication link arrangement device. The communication link arrangement device can be a computer device, a CPU in the above-mentioned computer device, a processing module for the arrangement of the communication link in the above-mentioned computer device, or a client for the arrangement of the communication link in the above-mentioned computer device.

[0168] The embodiment of the present application can divide the communication link arrangement device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0169] like Fig.14 FIG. 1 is a schematic diagram of a communication link arrangement device provided in an embodiment of the present application. The communication link arrangement device is used to execute Figure 5 , Figure 7 , Fig. 9 , Fig.10 or Fig.11 The communication link arrangement method shown in the figure, the communication link arrangement device 1400 may include: an acquisition module 1401 and a processing module 1402.

[0170] The acquisition module 1401 is used to obtain the demand information of the service to be transmitted, the service to be transmitted is the communication service between the sending end and the receiving end, and the demand information includes: the communication quality requirement for the communication link between the sending end and the receiving end. The processing module 1402 is used to obtain at least one second network device from multiple first network devices based on the demand information, the first network device is a network device whose credibility is greater than a first preset threshold among multiple preset network devices, the preset network device is a network device between the sending end and the receiving end, and the communication quality of the communication link formed by at least one second network device meets the communication quality requirement in the demand information. The processing module 1402 is also used to generate a target communication strategy based on at least one second network device, and the target communication strategy is used to instruct at least one second network device to transmit the service to be transmitted. The processing module 1402 is also used to send the target communication strategy to at least one second network device.

[0171] Optionally, the processing module 1402 is specifically configured to obtain the credibility of each preset network device. The processing module 1402 is further configured to obtain a plurality of first network devices from a plurality of preset network devices based on a first preset threshold.

[0172] Optionally, the demand information also includes: the security level required for the service to be transmitted during the transmission process. The processing module 1402 is specifically used to determine whether the security level is greater than a first preset threshold. The processing module 1402 is also used to obtain multiple first network devices from multiple preset network devices based on the first preset threshold when the security level is less than or equal to the first preset threshold.

[0173] Optionally, the processing module 1402 is specifically used to obtain multiple first network devices from multiple preset network devices based on the security level when the security level is greater than a first preset threshold, and the credibility of the first network devices is greater than the security level.

[0174] Optionally, the processing module 1402 is specifically configured to determine whether the security level is greater than a second preset threshold. The processing module 1402 is further configured to obtain the credibility of each preset network device when the security level is greater than the second preset threshold.

[0175] Optionally, the processing module 1402 is specifically used to obtain the trustworthiness of each preset network device at the current moment in real time. The processing module 1402 is also used to update the target communication strategy in real time according to the trustworthiness and demand information of multiple preset network devices at the current moment to obtain an updated target communication strategy. Among them, the updated target communication strategy is used to instruct at least one third network device among the multiple preset network devices to transmit the service to be transmitted, the communication quality of the communication link formed by at least one third network device at the current moment meets the communication quality requirement in the demand information, and the trustworthiness of the third network device at the current moment is greater than the first preset threshold.

[0176] Fig.15 1 is a schematic diagram of a communication link arrangement device according to an exemplary embodiment. The communication link arrangement device may include a processor 1502, and the processor 1502 is used to execute application code to implement the communication link arrangement method in this application.

[0177] Processor 1502 may be a CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0178] like Fig.15 As shown, the communication link arrangement device may further include a memory 1503. The memory 1503 is used to store application program codes for executing the solution of the present application, and the execution is controlled by the processor 1502.

[0179] The memory 1503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1503 may exist independently and be connected to the processor 1502 via the bus 1504. The memory 1503 may also be integrated with the processor 1502.

[0180] like Fig.15 As shown, the communication link orchestration device may further include a communication interface 1501, wherein the communication interface 1501, the processor 1502, and the memory 1503 may be coupled to each other, for example, via a bus 1504. The communication interface 1501 is used to perform information interaction with other devices, for example, to support information interaction between the communication link orchestration device and other devices.

[0181] It should be pointed out that Fig.15 The device structure shown in the figure does not constitute a limitation on the arrangement device of the communication link, except Fig.15 In addition to the components shown, the communication link orchestration device may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0182] In actual implementation, the functions implemented by the processing module 1402 can be Fig.15 The processor 1502 shown calls the program code in the memory 1503 to implement.

[0183] The present application also provides a computer-readable storage medium, on which instructions are stored, and when the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer can execute the communication link arrangement method provided in the above-mentioned embodiment. For example, the computer-readable storage medium can be a memory 1503 including instructions, and the above instructions can be executed by the processor 1502 of the computer device to complete the above method. Optionally, the computer-readable storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0184] Fig.16 A conceptual partial view of a computer program product provided by an embodiment of the present application is exemplarily shown, where the computer program product includes a computer program for executing a computer process on a computing device.

[0185] In one embodiment, the computer program product is provided using a signal bearing medium 1600. The signal bearing medium 1600 may include one or more program instructions that, when executed by one or more processors, may provide the above-described Figure 5 , Figure 7 , Fig. 9 , Fig.10 or Fig.11 Thus, for example, reference to Figure 5 In the embodiment shown in , one or more features of S501 to S504 may be undertaken by one or more instructions associated with the signal bearing medium 1600. In addition, Fig.16 The program instructions in also describe example instructions.

[0186] In some examples, the signal bearing medium 1600 may include a computer readable medium 1601, such as, but not limited to, a hard drive, a compact disk (CD), a digital video disk (DVD), a digital tape, a memory, a read-only memory (ROM), or a random access memory (RAM), and the like.

[0187] In some implementations, the signal bearing medium 1600 may include a computer recordable medium 1602 such as, but not limited to, a memory, a read / write (R / W) CD, R / W, DVD, or the like.

[0188] In some implementations, signal bearing medium 1600 may include communication medium 1603 such as, but not limited to, digital and / or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0189] The signal bearing medium 1600 may be communicated by a wireless form of communication medium 1603. The one or more program instructions may be, for example, computer executable instructions or logic implemented instructions.

[0190] In some examples, such as for Fig.14 The described orchestration of communication links may be configured to provide various operations, functions, or actions in response to one or more program instructions via computer-readable media 1601 , computer-recordable media 1602 , and / or communication media 1603 .

[0191] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0192] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0193] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0194] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0195] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the full classification part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute the full classification part or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes various media that can store program codes, such as-U disk, mobile hard disk, ROM, RAM, disk or CD.

[0196] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network scheduler, characterized in that: The network orchestrator includes: a business layer, an orchestration layer and a policy configuration layer, wherein: The service layer is used to obtain demand information of the service to be transmitted; The orchestration layer is used to monitor the trustworthiness of multiple preset network devices in the network domain, and based on the demand information and the trustworthiness of each preset network device, perform a trusted path topology on the service to be transmitted, and orchestrate the communication link corresponding to the service to be transmitted; The policy configuration layer is used to generate a target communication policy based on the communication link corresponding to the service to be transmitted, and send the target communication policy to the multiple preset network devices.

2. A communication link arrangement method, characterized in that: Applied to a network orchestrator, the method comprises: Acquire demand information of a service to be transmitted, where the service to be transmitted is a communication service between a transmitting end and a receiving end, and the demand information includes: a demand for communication quality of a communication link between the transmitting end and the receiving end; Based on the demand information, obtaining at least one second network device from a plurality of first network devices, wherein the first network device is a network device whose credibility is greater than a first preset threshold among a plurality of preset network devices, the preset network device is a network device between the sending end and the receiving end, and the communication quality of the communication link formed by the at least one second network device meets the communication quality requirement in the demand information; generating a target communication strategy according to the at least one second network device, wherein the target communication strategy is used to instruct the at least one second network device to transmit the service to be transmitted; The target communication policy is sent to the at least one second network device.

3. The method according to claim 2, characterized in that Before acquiring at least one second network device from a plurality of first network devices based on the demand information, the method further includes: Obtaining the credibility of each of the preset network devices; Based on the first preset threshold, the multiple first network devices are obtained from the multiple preset network devices.

4. The method according to claim 3, characterized in that The demand information also includes: the security level required by the service to be transmitted during the transmission process; after obtaining the trust level of each of the preset network devices, the method further includes: Determining whether the safety level is greater than the first preset threshold; The acquiring the plurality of first network devices from the plurality of preset network devices based on the first preset threshold comprises: When the security level is less than or equal to the first preset threshold, the multiple first network devices are acquired from the multiple preset network devices based on the first preset threshold.

5. The method according to claim 4, characterized in that The method further comprises: In the case that the security level is greater than the first preset threshold, based on the security level, the multiple first network devices are obtained from the multiple preset network devices, and the credibility of the first network devices is greater than the security level.

6. The method according to claim 4 or 5, characterized in that: After obtaining the demand information of the service to be transmitted, the method further includes: Determining whether the safety level is greater than a second preset threshold; The obtaining of the credibility of each of the preset network devices includes: When the security level is greater than the second preset threshold, the credibility of each of the preset network devices is obtained.

7. The method according to any one of claims 3 to 5, characterized in that: After sending the target communication strategy to the at least one second network device, the method further includes: Obtaining the credibility of each of the preset network devices at the current moment in real time; According to the credibility of the plurality of preset network devices at the current moment and the demand information, the target communication strategy is updated in real time to obtain the updated target communication strategy; Among them, the updated target communication strategy is used to instruct at least one third network device among the multiple preset network devices to transmit the service to be transmitted, the communication quality of the communication link formed by the at least one third network device at the current moment meets the communication quality requirement in the demand information, and the credibility of the third network device at the current moment is greater than the first preset threshold.

8. A communication link arrangement device, characterized in that: Applied to a network orchestrator, the device comprises: An acquisition module, used to acquire demand information of a service to be transmitted, wherein the service to be transmitted is a communication service between a transmitting end and a receiving end, and the demand information includes: a demand for a communication quality of a communication link between the transmitting end and the receiving end; a processing module, configured to obtain at least one second network device from a plurality of first network devices based on the demand information, wherein the first network device is a network device whose credibility is greater than a first preset threshold among a plurality of preset network devices, the preset network device is a network device between the sending end and the receiving end, and the communication quality of the communication link formed by the at least one second network device meets the communication quality requirement in the demand information; The processing module is further used to generate a target communication strategy according to the at least one second network device, wherein the target communication strategy is used to instruct the at least one second network device to transmit the service to be transmitted; The processing module is further configured to send the target communication strategy to the at least one second network device.

9. A communication link arrangement device, characterized in that: include: Processor and memory; The processor is coupled to the memory; The memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the orchestration device of the communication link is running, the processor executes the computer-executable instructions stored in the memory to enable the orchestration device of the communication link to perform the method as described in any one of claims 2-7.

10. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When a computer executes the instructions, the computer performs the method according to any one of claims 2 to 7.

11. A computer program product, characterized in that The computer program product comprises computer program instructions, which, when executed, implement the method according to any one of claims 2 to 7.

Images