Trusted path orchestration system, method and device, storage medium and program product

Abstract

The invention provides a trusted path arrangement system, method and device, a storage medium and a program product, relates to the technical field of communication, and is used for reducing path security risks and improving service quality. The system comprises a trusted path composer and network management equipment, the trusted path composer is in communication connection with the network management equipment; the trusted path composer is used for acquiring the trusted state of the network equipment and generating a network equipment trusted information base based on the trusted state of the network equipment, and the network equipment trusted information base is used for storing the trusted state of the network equipment in the network; the trusted path arrangement device is also used for receiving the trusted path service requirement, determining a trusted path arrangement strategy based on the trusted path service requirement and the network equipment trusted information base, and issuing the trusted path arrangement strategy to the network management equipment; and the network management equipment is used for generating a trusted path based on the trusted path arrangement strategy.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a trusted path orchestration system, method, device, storage medium and program product. Background Art

[0002] The core feature of software defined networking (SDN) is the centralization and programmability of network control functions. The SDN architecture separates the control plane from the forwarding plane of the network, allowing the network control function to be transferred from network devices to external computing devices, thereby achieving centralized control and dynamic adjustment of the network.

[0003] SDN has flexible scalability and programmability, which can fully meet the needs of various businesses. However, when network devices are attacked by hackers or there are illegal software and applications, it may lead to security risks such as failure of end-to-end encryption in data transmission and illegal parsing of private data. As the requirements for data privacy and security of specific businesses continue to increase, especially when it comes to virtualization and resource sharing scenarios, how to enhance security and privacy capabilities on the control and data planes to ensure the security and reliability of SDN for user data and enterprise data with high confidentiality and privacy is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a trusted path orchestration system, method, device, storage medium and program product for reducing path security risks and improving service quality.

[0005] In a first aspect, the present application provides a trusted path orchestration system, including: a trusted path orchestrator and a network management device; a communication connection between the trusted path orchestrator and the network management device; the trusted path orchestrator is used to obtain the trusted state of the network device, and generate a network device trusted information base based on the trusted state of the network device, the network device trusted information base is used to store the trusted state of the network device in the network; the trusted path orchestrator is also used to receive trusted path business requirements, determine the trusted path orchestration strategy based on the trusted path business requirements and the network device trusted information base, and issue the trusted path orchestration strategy to the network management device; the network management device is used to generate a trusted path based on the trusted path orchestration strategy.

[0006] The trusted path orchestration system provided by the present application adds a trusted path orchestrator to the network control layer of the SDN architecture, so that the control layer can obtain the trusted status and trusted path business requirements of the network devices in the network forwarding layer, and can generate and issue trusted path orchestration policies based on the trusted status and trusted path business requirements of the network devices. The trusted path orchestrator enables the network control layer of the SDN architecture to have the ability to orchestrate trusted paths, and the trusted paths generated based on the trusted path orchestration policies can improve the security of data transmission and the ability to protect information integrity. The trusted path orchestration system provided by the present application can be implemented by adding a trusted path orchestrator to the traditional SDN architecture, while meeting the trusted path business requirements and reducing the impact on the original orchestrator, and the deployment process is simple and convenient.

[0007] In a possible implementation, the system also includes: an orchestrator; a trusted path orchestrator, specifically used to determine the orchestration requirements based on the trusted path business requirements, and send the orchestration requirements to the orchestrator; the orchestrator, used to generate a path orchestration policy set that meets the orchestration requirements based on the orchestration requirements, and send the path orchestration policy set to the trusted path orchestrator; the trusted path orchestrator, specifically used to determine the trusted path orchestration policy based on the path orchestration policy set and the network device trusted information base.

[0008] Another possible implementation manner is a trusted path orchestrator, which is specifically used to obtain an evaluation result of a trusted state of a network device sent by the network device.

[0009] In another possible implementation, the system also includes a trusted assessment server; the trusted assessment server is communicatively connected to the trusted path orchestrator; the trusted assessment server is used to obtain trusted certification information of the network device, determine the trusted status of the network device based on the trusted certification information, and send the trusted status of the network device to the trusted path orchestrator; the trusted path orchestrator is specifically used to obtain the trusted status sent by the trusted assessment server.

[0010] In another possible implementation, the trusted assessment server is further used to send the changed trusted state to the trusted path orchestrator when the trusted state of the network device changes; the trusted path orchestrator is further used to update the trusted information base of the network device based on the changed trusted state.

[0011] In another possible implementation, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0012] In a second aspect, the present application provides a trusted path orchestration method, which is applied to a trusted path orchestrator, the trusted path orchestrator including a network device trusted information library, the network device trusted information library being used to indicate the trusted status of the network device; the method comprising: responding to received trusted path business requirements, determining a trusted path orchestration strategy based on the trusted path business requirements and the network device trusted information library; and issuing the trusted path orchestration strategy to a network management device.

[0013] The trusted path orchestration method provided in this application can determine the trusted path orchestration strategy based on the trusted state of the network device and the trusted path business requirements. The trusted path generated based on the trusted path orchestration strategy can not only meet the trusted path business requirements, but also improve the security of the data transmission process and the protection capability of information integrity.

[0014] A possible implementation method is to determine a trusted path orchestration strategy based on a trusted path business requirement and a trusted information base of a network device, including: determining an orchestration requirement based on the trusted path business requirement; and sending the orchestration requirement to an orchestrator, so that the orchestrator generates a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement; receiving the orchestration strategy set sent by the orchestrator; and determining a trusted path orchestration strategy based on the orchestration strategy set and a trusted information base of a network device.

[0015] In another possible implementation manner, the method further includes: acquiring a trusted state of the network device; and generating a trusted information library of the network device based on the trusted state of the network device.

[0016] Another possible implementation manner is to obtain the trust status of the network device, including: obtaining the trust status of the network device sent by a trust evaluation server; or obtaining an evaluation result of the trust status of the network device sent by the network device.

[0017] In another possible implementation manner, the method further includes: when the trusted state of the network device changes, receiving the changed trusted state; and updating the trusted information library of the network device based on the changed trusted state.

[0018] In a third aspect, a trusted path orchestration method is applied to a trusted assessment server, the method comprising: obtaining trusted certification information of a network device; determining a trusted state of the network device based on the trusted certification information; sending the trusted state of the network device to a trusted path orchestrator, so that the trusted path orchestrator generates a trusted information base for the network device based on the trusted state of the network device; the trusted information base for the network device is used to assist the trusted path orchestrator in determining a trusted path orchestration strategy when the trusted path orchestrator receives a trusted path business requirement.

[0019] The trusted path orchestration method provided by the present application can determine the trusted state of a network device based on the trusted certification information of the network device, so that the control layer has the ability to perceive and parse the trusted information of the network device, so that the trusted path orchestrator can generate a trusted path orchestration strategy that meets the trusted path business requirements. The trusted path generated based on the trusted path orchestration strategy can not only meet the trusted path business requirements, but also improve the security of the data transmission process and the ability to protect the integrity of the information.

[0020] A possible implementation method is to obtain the trusted certification information of the network device, including: sending a measurement request message to the network device, the measurement request information is used to request measurement of the trusted status of the network device; receiving measurement response information sent by the network device, the measurement response information includes the trusted certification information of the network device.

[0021] In another possible implementation, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0022] In another possible implementation, after sending the trusted state of the network device to the trusted path orchestrator, the method further includes: when the trusted state of the network device changes, sending the changed trusted state to the trusted path orchestrator, so that the trusted path orchestrator updates the trusted information base of the network device based on the changed trusted state.

[0023] In a fourth aspect, the present application provides a trusted path orchestration device, including: a determination module and a communication module, the determination module is used to respond to the received trusted path business requirements, determine the trusted path orchestration strategy based on the trusted path business requirements and the network device trusted information library; the communication module is used to issue the trusted path orchestration strategy to the network management device.

[0024] A possible implementation method includes a determination module, which is specifically used to determine the orchestration requirements based on the trusted path business requirements; a communication module, which is specifically used to send the orchestration requirements to the orchestrator, so that the orchestrator generates a path orchestration strategy set that meets the orchestration requirements based on the orchestration requirements; and a receiving orchestration strategy set sent by the orchestrator. The determination module is also specifically used to determine the trusted path orchestration strategy based on the orchestration strategy set and a trusted information base of a network device.

[0025] In another possible implementation, the communication module is further used to obtain the trusted state of the network device; and the determination module is further used to generate a trusted information base of the network device based on the trusted state of the network device.

[0026] In another possible implementation manner, the communication module is specifically configured to obtain the trust status of the network device sent by the trust evaluation server; or to obtain the evaluation result of the trust status of the network device sent by the network device.

[0027] In another possible implementation, the communication module is further used to receive the changed trusted state when the trusted state of the network device changes; and the determination module is further used to update the trusted information base of the network device based on the changed trusted state.

[0028] In a fifth aspect, the present application provides a trusted path orchestration device, comprising: a communication module and a determination module, the communication module being used to obtain trusted certification information of a network device; the determination module being used to determine a trusted state of the network device based on the trusted certification information; the communication module being further used to send the trusted state of the network device to a trusted path orchestrator, so that the trusted path orchestrator generates a trusted information base for the network device based on the trusted state of the network device; the trusted information base for the network device being used to assist the trusted path orchestrator in determining a trusted path orchestration strategy when the trusted path orchestrator receives a trusted path business requirement.

[0029] In a possible implementation, the communication module is specifically used to send a measurement request message to a network device, the measurement request information is used to request measurement of the trusted state of the network device; and receive measurement response information sent by the network device, the measurement response information includes trusted certification information of the network device.

[0030] In another possible implementation, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0031] Another possible implementation method is that after sending the trusted state of the network device to the trusted path orchestrator, the communication module is also used to send the changed trusted state to the trusted path orchestrator when the trusted state of the network device changes, so that the trusted path orchestrator updates the trusted information base of the network device based on the changed trusted state.

[0032] In a sixth aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the second aspect or the third aspect above.

[0033] In a seventh aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an electronic device, the electronic device implements the method of the second aspect or the third aspect mentioned above.

[0034] In an eighth aspect, the present application provides a computer program product, which includes a computer program; when the computer program runs in an electronic device, the electronic device implements the method of the second aspect or the third aspect above.

[0035] The beneficial effects of the fourth to eighth aspects mentioned above refer to the corresponding description of the second or third aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of an SDN network architecture is provided for this application;

[0037] Figure 2 A functional composition framework diagram of a trusted computing module provided for this application;

[0038] Figure 3 An architectural diagram of a trusted path orchestration system provided for this application;

[0039] Figure 4 An architectural diagram of another trusted path orchestration system provided for this application;

[0040] Figure 5 A functional architecture diagram of a trusted path orchestration system provided for this application;

[0041] Figure 6 A flow chart of a trusted path orchestration method provided for this application

[0042] Figure 7 A flowchart of another trusted path orchestration method provided for this application;

[0043] Figure 8 A flowchart of another trusted path orchestration method provided by this application;

[0044] Fig. 9 A flowchart of another trusted path orchestration method provided by this application;

[0045] Fig.10 A flowchart of another trusted path orchestration method provided by this application;

[0046] Fig.11 A schematic diagram of the composition of a trusted path orchestration device provided in this application;

[0047] Fig.12 A schematic diagram of the composition of another trusted path orchestration device provided by this application;

[0048] Fig.13 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0049] The trusted path orchestration method provided by this application will be described in detail below with reference to the accompanying drawings.

[0050] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0051] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0052] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0053] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0054] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical items or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0055] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0056] In order to clearly describe the technical solution of the embodiment of the present application, the SDN network architecture and trusted computing technology involved in the present application are briefly introduced below.

[0057] SDN is an emerging network architecture whose core features are the centralization and programmability of network control functions. The SDN network architecture separates the control layer from the forwarding layer of the network, allowing the network control function to be transferred from network devices to external computing devices, thereby achieving centralized control and dynamic adjustment of the network.

[0058] like Figure 1 The figure shows a schematic diagram of the SDN network architecture, which includes the service layer, control layer and forwarding layer.

[0059] Among them, the business layer is used to provide various business applications, such as firewall, load balancing, traffic analysis, intrusion detection, etc. Business layer applications can communicate with the control layer through interfaces.

[0060] The control layer is responsible for the management and control of the entire network, including routing decisions, traffic engineering, security policies, QoS management, etc. The control layer centrally controls the network devices of the forwarding layer through standard interfaces. The core of the control layer is the SDN controller.

[0061] The SDN controller can uniformly monitor and control the network devices at the forwarding layer, and perform link discovery, topology management, and flow table delivery through southbound protocols such as the OpenFlow protocol. It provides standard northbound interfaces to upper-layer applications, through which upper-layer applications can effectively schedule and configure resources on the underlying network to achieve automatic and flexible network management and control. The SDN controller is the command center of the SDN architecture, which instructs network devices to forward traffic by sending control instructions to network devices.

[0062] The forwarding layer performs the task of forwarding and processing data packets, and is usually composed of network devices such as switches and routers. The network devices in the forwarding layer generate a forwarding table by receiving control signals sent by the control layer, and process traffic data based on this table, so there is no need for complex distributed network protocols to forward data.

[0063] Trusted computing technology is a technical system used to improve the security and credibility of the platform. It can improve the integrity, confidentiality and availability of the computing platform through the combination of hardware and software, thereby providing users with a more secure and reliable computing environment.

[0064] Commonly used trusted computing modules include: trusted platform module (TPM), trusted platform control module (TPCM) and trusted cryptography module (TCM).

[0065] Among them, TPM is a microchip that can be installed on the computer's motherboard, communicates with the rest of the system through the hardware bus, and can provide basic security-related functions, mainly used to provide encryption key services.

[0066] Devices that contain a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called "wrapping" or "binding" the key, helps prevent the key from being compromised. Each TPM has a master wrapping key, called the Storage Root Key, which is stored in the TPM itself. The private portion of the Storage Root Key or Endorsement Key created in the TPM is never exposed to any other component, software, process, or user.

[0067] The TPM chip has platform integrity measurement and remote attestation functions, which are used to evaluate the integrity of the platform startup process and operation process and the integrity of the running code, as well as to prove the credibility of the TPM platform itself. The TPM module can obtain the trusted feature values ​​of the software and hardware of the device platform, and record the execution integrity status of all software and hardware modules of the platform, thereby building a trust chain for the trusted computing platform. If any module is infected by malicious software, the trust chain value of the TPM will change.

[0068] TPCM is a hardware module integrated into a trusted platform, which is mainly used to establish and safeguard the source of trust, and provide a series of trusted computing functions such as trusted platform control, integrity measurement, secure storage, trusted reporting and cryptographic services.

[0069] TCM is a trusted cryptographic module that uses the SM series national secret algorithm, provides trusted root and cryptographic operation functions, and can ensure the confidentiality and integrity of data.

[0070] It should be noted that TPCM and TCM also have remote attestation and integrity measurement capabilities.

[0071] like Figure 2 The figure shows the functional composition framework of the trusted computing module, taking TCMP as an example, including computing component interface, functional interface, functional service, basic software, trusted cryptographic module interface, and basic hardware.

[0072] Among them, the computing component interface can communicate with the computing components in the computer system to provide computing power and data processing capabilities for TCMP.

[0073] The functional interface includes the application programming interface (API) provided by TPCM to the outside world, allowing other components to call the services of TPCM. The functional interface can communicate with the trusted software base (TSB) and TPCM management.

[0074] Trusted Software Base refers to the software part in the trusted computing environment, which includes the operating system, drivers, and other security-related software components. TSB can communicate with the functional interface of TCMP to provide overall security and trustworthiness for TCMP. TPCM management can communicate with the functional interface to manage and control TCMP.

[0075] Functional services include various security functions and services of TPCM, such as key management, identity authentication, data encryption, etc.

[0076] The basic software is the basic software layer of TPCM, responsible for managing the basic operations and services of TPCM.

[0077] The trusted cryptographic module interface can communicate with the TCM, send encryption / decryption requests to the TCM and receive the results.

[0078] Basic hardware This refers to all the hardware components that make up the physical structure of TCMP, including memory, hard disk, input and output devices, etc.

[0079] The above is an introduction to the SDN network architecture and trusted computing technology involved in this application, which will not be repeated below.

[0080] SDN networks have flexible scalability and programmability, and can fully meet a variety of business needs. However, when the network devices at the forwarding layer contain illegal software and applications or are attacked by hackers, end-to-end encryption in data transmission may fail, and may even lead to security risks such as illegal parsing of private data. Especially when it comes to virtualization and resource sharing scenarios, security and privacy issues are more prominent.

[0081] As specific services have higher requirements for data privacy and security, especially for user data and enterprise data with high confidentiality and privacy, how to enhance security and privacy capabilities at the control layer and forwarding layer is a problem that network operators need to solve. On the one hand, path security issues should be fully considered when arranging routing at the control layer; on the other hand, network devices are important infrastructure for network connections, and ensuring the credibility of network devices themselves is also crucial to improving data plane security.

[0082] In response to the above technical problems, the present application provides a trusted path orchestration system, the idea of ​​which is to add a trusted path orchestrator to the network control layer of the SDN architecture, so that the control layer can obtain the trusted status and trusted path business requirements of the network devices in the network forwarding layer, and can generate and issue trusted path orchestration policies based on the trusted status and trusted path business requirements of the network devices. The trusted path orchestrator enables the network control layer of the SDN architecture to have the ability to orchestrate trusted paths, and the trusted paths generated based on the trusted path orchestration policies can improve the security of data transmission and the ability to protect information integrity. The trusted path orchestration system provided by the present application can be implemented by adding a trusted path orchestrator to the traditional SDN architecture, while meeting the trusted path business requirements and reducing the impact on the original orchestrator, and the deployment process is simple and convenient.

[0083] The embodiments provided in this application are described in detail below in conjunction with the accompanying drawings.

[0084] like Figure 3 As shown, it is an architecture diagram of a trusted path orchestration system provided by the present application, including: a trusted path orchestrator 101, an orchestrator 102, a network management device 104 and a network device 105.

[0085] In some embodiments, the trusted path orchestrator 101 is in communication with the trusted business system and is capable of acquiring the trusted path business requirements sent by the trusted business system.

[0086] In some embodiments, the trusted path orchestrator 101 is used to obtain the trusted state of the network device 105, and generate a network device trusted information base based on the trusted state of the network device 105, and the network device trusted information base is used to store the trusted state of the network device 105 in the network. The trusted path orchestrator 101 is also used to receive trusted path business requirements, determine the trusted path orchestration strategy based on the trusted path business requirements and the network device trusted information base, and issue the trusted path orchestration strategy to the network management device 104.

[0087] In some embodiments, the trusted path orchestrator 101 is specifically configured to obtain an evaluation result of the trusted state of the network device 105 sent by the network device 105 .

[0088] In some embodiments, the trusted path orchestrator 101 is specifically used to determine the orchestration requirements based on the trusted path business requirements, and send the orchestration requirements to the orchestrator 102. The orchestrator 102 is used to generate a path orchestration policy set that meets the orchestration requirements based on the orchestration requirements, and send the path orchestration policy set to the trusted path orchestrator. The trusted path orchestrator 101 is specifically used to determine the trusted path orchestration policy based on the path orchestration policy set and the network device trusted information base.

[0089] It should be noted that the orchestration requirements include the requirements for resources in the path. The trusted path orchestrator 101 can determine the requirements for resources in the path based on the trusted path business requirements. Exemplarily, the orchestration requirements may include requirements for path bandwidth, latency, link cost, quality of service (QoS), etc. The trusted path business requirements include the requirements for path trust capabilities of services in different application scenarios, but the orchestration requirements do not include the requirements for path trust capabilities, that is, the orchestration requirements do not require the trust capabilities of the network devices 105 in the path, which makes it unnecessary for the orchestrator 102 to pay attention to the trust status of the network devices 105 when generating a path orchestration policy set based on the orchestration requirements.

[0090] In some embodiments, orchestrator 102 is in communication with a business system and is capable of acquiring business requirements sent by the business system.

[0091] In some embodiments, the orchestrator 102 may have a global view collection and maintenance function for network resources and resource status, and may perform resource orchestration and orchestration policy delivery operations according to business requirements. Specifically, the network resource management module in the orchestrator 102 stores network resource information, such as node information, link status information, routing information, board information, etc. The orchestrator 102 can generate an orchestration policy based on the orchestration requirements and network resource information.

[0092] In some embodiments, the network management device 104 may be a device for uniformly monitoring and controlling the network device 105 at the forwarding layer. Exemplarily, the network management device 104 may be at least one of an SDN controller, an element management system (EMS) and a network management system (NMS).

[0093] Among them, EMS and NMS are used to perform aspects such as device management, performance management, fault management and security management of the network device 105 .

[0094] It should be noted that the EMS and NMS may have the function of collecting and evaluating the trustworthy metric information of the network device 105 .

[0095] In some embodiments, the network management device 104 can generate a trusted path based on a trusted path orchestration policy. Exemplarily, the network management device 104 generates a trusted path by sending configuration parameters to the network device 105 .

[0096] In some embodiments, there are multiple network devices 105. The present application does not limit the number of network devices 105.

[0097] In some embodiments, the network device 105 may be a network device responsible for forwarding and transmitting data packets. Exemplarily, the network device 105 may be an IP network device, such as customer premise equipment (CPE), a router, a switch, a broadband remote access server (BRAS), etc.; the network device 105 may also be a transmission network device, such as an optical transport network (OTN) device; the network device 105 may also be an access network device, such as an optical network unit (ONU), a multi-function optical network terminal (ONT), and an optical line terminal (OLT) device, etc. This application does not limit the specific form of the network device 105.

[0098] In some embodiments, a network device 105 may include one or more trusted computing modules according to the actual deployment situation, so that the network device 105 can have one or more capabilities such as network device hardware and software and runtime state trust measurement capabilities, key generation capabilities, key storage capabilities, remote certification capabilities, etc. The trusted computing module in the network device 105 can be a security chip or an application system. This application does not limit the number and specific form of the trusted computing modules in the network device 105.

[0099] Exemplarily, the trusted computing module in the network device 105 may include at least one of the following: TPM, TPCM, TCM, and a secure element (SE), etc.

[0100] In some embodiments, the trusted computing module in the network device 105 enables the network device 105 to have a trusted state evaluation function. Exemplarily, when the trusted computing module in the network device 105 is a TPCM, the network device 105 can send the evaluation result of the trusted state of the network device 105 to the trusted path orchestrator 101.

[0101] In some embodiments, the trusted path orchestration system further includes a trusted evaluation server, such as Figure 4 As shown, it is an architecture diagram of another trusted path orchestration system provided by the present application, including: a trusted path orchestrator 101, an orchestrator 102, a trusted assessment server 103, a network management device 104 and a network device 105.

[0102] In some embodiments, the trusted assessment server 103 is used to obtain the trusted certification information of the network device 105, determine the trusted state of the network device 105 based on the trusted certification information, and send the trusted state of the network device 105 to the trusted path orchestrator 101. The trusted path orchestrator 101 is specifically used to obtain the trusted state sent by the trusted assessment server.

[0103] In some embodiments, the trustworthy certification information of the network device 105 includes at least one of the following: trustworthy measurement information of the network device 105 ; and an evaluation result of the trustworthy status of the network device 105 .

[0104] In some embodiments, the trusted assessment server 103 can utilize the security measurement capabilities of the trusted computing module deployed in the network device to measure the integrity of the actual system and application of the network device, realize the trusted data collection, evaluation and information sharing of the network device 105, so that the trusted path orchestrator 101 can complete the trusted resource orchestration according to the credibility data of the network device 105, and meet the security and credibility requirements of the trusted path business.

[0105] In some embodiments, the trusted assessment server 103 is further configured to send the changed trusted state to the trusted path orchestrator 101 when the trusted state of the network device 105 changes; the trusted path orchestrator 101 is further configured to update the network device trusted information base based on the changed trusted state.

[0106] like Figure 5 As shown, it is a functional architecture diagram of the trusted path orchestration system provided by this application. The functions of the trusted path orchestrator 101 include: trusted business management, trusted information management, trusted path orchestration and orchestration policy delivery; the functions of the orchestrator 102 include path orchestration and orchestration result synchronization; the functions of the trusted evaluation server 103 include trusted proof information collection and trusted status verification; the functions of the network management device 104 include policy configuration delivery.

[0107] In some embodiments, the trusted path orchestrator 101 can perform trusted business management. Exemplarily, the trusted path orchestrator 101 can obtain the trusted path business requirements of the user from the trusted business system, parse the trusted path business requirements to determine the orchestration requirements, and send the orchestration requirements to the orchestrator 102, so that the orchestrator 102 can perform path orchestration based on the orchestration requirements.

[0108] In some embodiments, the trusted path orchestrator 101 can perform trusted information management. Exemplarily, the trusted path orchestrator 101 can generate a network device trusted information base according to the trusted status of the network device generated by the trusted evaluation server 103, and can update and maintain the network device trusted information base.

[0109] In some embodiments, trusted path orchestrator 101 can perform trusted path orchestration. Exemplarily, trusted path orchestrator 101 can determine a trusted path orchestration policy based on a path orchestration policy set sent by orchestrator 102 and a network device trusted information base.

[0110] In some embodiments, the trusted path orchestrator 101 can issue an orchestration policy. Exemplarily, the trusted path orchestrator 101 can send the trusted path orchestration policy to the network management device 104, so that the network management device 104 generates a trusted path based on the trusted path orchestration policy.

[0111] In some embodiments, the orchestrator 102 can perform path orchestration and synchronization of orchestration results. Exemplarily, the orchestrator 102 can generate a path orchestration strategy set that meets the orchestration requirements based on the orchestration requirements, and send the path orchestration strategy set to the trusted path orchestrator 101 .

[0112] In some embodiments, the orchestrator 102 can also obtain and store network resource information. Exemplarily, the network resource management module in the orchestrator 102 stores network resource information, such as node information, link status information, routing information, board information, etc.

[0113] In some embodiments, the trusted evaluation server 103 can collect trusted certification information and verify the trusted status. Exemplarily, the trusted evaluation server 103 can obtain the trusted certification information of the network device 105, determine the trusted status of the network device based on the trusted certification information, and send the trusted status of the network device 105 to the trusted path orchestrator 101.

[0114] In some embodiments, the network management device 104 can issue policy configurations. Exemplarily, the network management device 104 can send configuration parameters to the network device 105 based on the trusted path orchestration policy to complete the configuration of the trusted path orchestration policy and generate a trusted path.

[0115] The trusted path orchestration system provided by the present application adds a trusted path orchestrator to the network control layer of the SDN architecture, so that the control layer can obtain the trusted status and trusted path business requirements of the network devices in the network forwarding layer, and can generate and issue trusted path orchestration policies based on the trusted status and trusted path business requirements of the network devices. The trusted path orchestrator enables the network control layer of the SDN architecture to have the ability to orchestrate trusted paths, and the trusted paths generated based on the trusted path orchestration policies can improve the security of data transmission and the ability to protect information integrity. The trusted path orchestration system provided by the present application can be implemented by adding a trusted path orchestrator to the traditional SDN architecture, while meeting the trusted path business requirements and reducing the impact on the original orchestrator, and the deployment process is simple and convenient.

[0116] It should be noted that the system architecture described in the embodiments of the present application is for more clearly illustrating the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can know that with the evolution of the system architecture, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0117] See also Figure 6 , is a flow chart of a trusted path orchestration method provided in an embodiment of the present application. Figure 6 As shown, the trusted path orchestration method provided in the present application can be implemented by the above-mentioned trusted path orchestrator, and specifically includes the following steps S201 to S202.

[0118] S201. In response to a received trusted path service requirement, a trusted path orchestration strategy is determined based on the trusted path service requirement and a network device trusted information library.

[0119] In some embodiments, the trusted path orchestrator may obtain the trusted path service requirements from the trusted service system. Exemplarily, a user proposes a trusted path service requirement to the trusted service system, and the trusted service system sends the trusted path service requirement to the trusted path orchestrator.

[0120] In some embodiments, the trusted path business requirements may be requirements for reducing the security risks of malicious tampering with the system and data theft, and improving business quality, such as trusted network slicing, traffic guidance to specific source IP address segments or destination address segments, etc.

[0121] It should be noted that the trusted path, as an important security mechanism, can establish a trusted path to protect the integrity and confidentiality of data and information. Services such as trusted slicing and trusted traffic guidance based on trusted path orchestration can effectively reduce the security risks of malicious system tampering and data theft, and improve service quality.

[0122] In some embodiments, Figure 7 As shown, the above-mentioned trusted path orchestration strategy is determined based on the trusted path business requirements and the trusted information library of the network device, which can be specifically implemented as the following S2011-S2013.

[0123] S2011. Determine an orchestration requirement based on the trusted path business requirement, and send the orchestration requirement to the orchestrator, so that the orchestrator generates a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement.

[0124] In some embodiments, the orchestration requirements include requirements for resources in the path. The trusted path orchestrator can determine the requirements for resources in the path based on the trusted path business requirements. Exemplarily, the orchestration requirements may include requirements for path bandwidth, latency, link cost, QoS, etc.

[0125] It should be noted that the trusted path business requirements include the requirements for path trust capabilities in different application scenarios, but the orchestration requirements do not include the requirements for path trust capabilities, that is, the orchestration requirements do not require the trust capabilities of network devices in the path. This means that the orchestrator does not need to pay attention to the trust status of network devices when generating a path orchestration policy set based on the orchestration requirements.

[0126] In some embodiments, the network resource management module in the orchestrator stores network resource information, such as node information, link status information, routing information, board information, etc. The orchestrator can generate an orchestration policy set based on orchestration requirements and network resource information.

[0127] Exemplarily, the orchestrator generates an orchestration strategy set based on the orchestration requirements and network resource information using an algorithm capable of implementing resource allocation and optimization, for example, using a shortest path algorithm or a load balancing algorithm to generate an orchestration strategy set based on the orchestration requirements and network resource information.

[0128] S2012. Receive an orchestration strategy set sent by the orchestrator.

[0129] S2013. Determine a trusted path orchestration strategy based on the orchestration strategy set and the network device trusted information library.

[0130] In some embodiments, the trusted path orchestrator may determine an orchestration policy in which all trusted states of network devices in the orchestration policy set are trusted as a trusted path orchestration policy.

[0131] In some embodiments, the trusted path orchestrator may determine an orchestration policy in which the trusted state of a network device in the orchestration policy set can meet the trusted path business requirements as a trusted path orchestration policy. Exemplarily, an orchestration policy that can meet the trusted path business requirements may be an orchestration policy in which the trusted state of a network device is an orchestration policy in which the proportion of trusted network devices to total network devices exceeds a preset threshold. The preset threshold is determined based on the trusted path business requirements.

[0132] In some embodiments, if the trusted path orchestration policy cannot be determined based on the orchestration policy set and the network device trusted information base, the trusted path orchestrator will send an orchestration failure message to the trusted business system. Exemplarily, when the trusted path business requirement requires that the trusted state of the network device of each node in the trusted path generated based on the trusted path orchestration policy is all trusted, but there is no orchestration policy in the orchestration policy set that the trusted state of the network devices is all trusted, the trusted path orchestrator sends an orchestration failure message to the trusted business system.

[0133] S202: Send the trusted path orchestration policy to the network management device.

[0134] In some embodiments, the network management device may be at least one of an SDN controller, an NMS, and an EMS.

[0135] In some embodiments, the network orchestrator may send the trusted path orchestration policy to multiple network management devices. Exemplarily, when the trusted path orchestration policy involves different network domains, the network orchestrator sends the trusted path orchestration policy to the network management devices in the multiple network domains.

[0136] In some embodiments, the network management device can generate a trusted path based on a trusted path orchestration policy. Exemplarily, the network management device completes the configuration of the trusted path orchestration policy by sending configuration parameters to the network device to generate the trusted path.

[0137] In some embodiments, before step S201, the above-mentioned trusted path orchestration method further includes the following steps a1 to a2.

[0138] Step a1: Obtain the trusted status of the network device.

[0139] In some embodiments, obtaining the trust status of the network device includes: obtaining the trust status of the network device sent by a trust evaluation server; or obtaining an evaluation result of the trust status of the network device sent by the network device.

[0140] In a possible implementation, when the trusted computing module of the network device has a trusted state evaluation function, the network device can send the trusted state evaluation result to the trusted path orchestrator. For example, when the trusted computing module of the network device is TCMP, TCMP can evaluate the integrity of the platform startup process and the running process and the integrity of the running code based on the hash value stored in the platform configuration registers (PCRs) to obtain the trusted state evaluation result.

[0141] Another possible implementation manner is that when the trusted computing module of the network device does not have a trusted state evaluation function, the trusted evaluation server determines the trusted state of the network device and sends it to the trusted path orchestrator.

[0142] In some embodiments, the network management device may also have a trusted status evaluation function. Exemplarily, when the network management device is an NMS or an EMS, the trusted path orchestrator may directly obtain the trusted status of the network device from the NMS or the EMS.

[0143] Step a2: Generate a network device trusted information database based on the trusted status of the network device.

[0144] In some embodiments, the network device trusted information library is used to indicate the trusted state of the network device. Exemplarily, the network device trusted information library includes the trusted state of the network device and the network device identification. Among them, the trusted state of the network device and the network device identification are one-to-one corresponding, and the network device identification can be the media access control address (MAC), IP address, host name, etc. of the network device.

[0145] In some embodiments, after generating the network device trusted information base, the trusted path orchestrator can also update and maintain the network device trusted information base. Exemplarily, updating and maintaining the network device trusted information base can be specifically implemented as the following steps a3 to a4.

[0146] Step a3: When the trusted state of the network device changes, the changed trusted state is received.

[0147] In some embodiments, receiving the changed trusted state includes: receiving the changed trusted state of the network device sent by a trusted evaluation server; or acquiring the changed trusted state sent by the network device.

[0148] Step a4: Based on the changed trusted state, update the network device trusted information database.

[0149] In some embodiments, the network device trusted information library includes the trusted status of the network device and the network device identification. The trusted status of the network device and the network device identification are one-to-one corresponding. The trusted status of the network device corresponding to the network device identification can be updated to obtain an updated network device trusted information library.

[0150] The trusted path orchestration method provided in this application can determine the trusted path orchestration strategy based on the trusted state of the network device and the trusted path business requirements. The trusted path generated based on the trusted path orchestration strategy can not only meet the trusted path business requirements, but also improve the security of the data transmission process and the protection capability of information integrity.

[0151] See also Figure 8 , is a flow chart of a trusted path orchestration method provided in an embodiment of the present application. Figure 8 As shown, the trusted path orchestration method provided by the present application can be implemented by the above-mentioned trusted evaluation server, and specifically includes the following steps S301 to S303.

[0152] S301. Obtain trusted certification information of a network device.

[0153] In some embodiments, the trusted certification information of the network device may be obtained by sending a measurement request message to the network device. Exemplarily, the above step S301 may be specifically implemented as follows S3011-S3012.

[0154] S3011. Send a measurement request message to a network device, where the measurement request message is used to request measurement of a trusted state of the network device.

[0155] In some embodiments, the measurement request message may request to obtain specific trusted certification information. Exemplarily, the trusted certification information requested to be obtained may be used to prove at least one of the integrity of the trusted platform startup process in the network device, the integrity of the trusted platform running process in the network device, and the integrity of the running code.

[0156] S3012. Receive measurement response information sent by the network device, where the measurement response information includes trusted certification information of the network device.

[0157] In some embodiments, the measurement request message includes a one-time number (number used once, Nonce) generated by the trusted evaluation server. Nonce is a random number, and the measurement response message also includes the Nonce generated by the trusted evaluation server. Sending Nonce in the measurement response message can ensure the uniqueness and freshness of the data.

[0158] In some embodiments, the metric response information includes an attribute certificate (AK certificate) for authenticating the identity of the network device.

[0159] In some embodiments, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0160] In a possible implementation, when the trusted computing module of the network device has a trusted state evaluation function, in response to a measurement request message, the network device may send a trusted state evaluation result as measurement response information to a trusted evaluation server.

[0161] In another possible implementation, when the trusted computing module of the network device does not have a trusted state assessment function, in response to a measurement request message, the network device obtains trusted measurement information from the trusted computing module and sends the trusted measurement information of the network device as measurement response information to the trusted assessment server. Exemplarily, the trusted measurement information of the network device may be a PCR value of the trusted computing module.

[0162] S302: Determine the trust status of the network device based on the trust certification information.

[0163] In some embodiments, the trusted certification information includes an evaluation result of the trusted state, and the trusted state of the network device can be directly determined based on the evaluation result of the trusted state.

[0164] In some embodiments, the trusted certification information includes trusted measurement information of the network device, and the trusted measurement information can be compared with a reference value inside a trusted evaluation server to verify the integrity and timeliness of the trusted measurement information and determine the trusted status of the network device.

[0165] Exemplarily, the trusted measurement information may be the PCR value of a trusted computing module in a network device. The PCR value includes hash values ​​of a boot loader, an operating system kernel, and other key system files. Based on the comparison result between the PCR value and an internal reference value, it is possible to detect whether the system has been modified or replaced, thereby determining the trusted status of the network device.

[0166] S303: Send the trusted state of the network device to the trusted path orchestrator, so that the trusted path orchestrator generates a trusted information base of the network device based on the trusted state of the network device.

[0167] The network device trusted information base is used to assist the trusted path orchestrator in determining the trusted path orchestration strategy when the trusted path orchestrator receives a trusted path service demand.

[0168] In some embodiments, the network device trusted information library is used to indicate the trusted state of the network device. Exemplarily, the network device trusted information library includes the trusted state of the network device and the network device identification. Among them, the trusted state of the network device and the network device identification are one-to-one corresponding, and the network device identification can be the network device MAC, IP address, host name, etc.

[0169] In some embodiments, after sending the trusted state of the network device to the trusted path orchestrator, the method further includes: when the trusted state of the network device changes, sending the changed trusted state to the trusted path orchestrator, so that the trusted path orchestrator updates the trusted information base of the network device based on the changed trusted state.

[0170] Exemplarily, receiving the changed trusted state includes: receiving the changed trusted state of the network device sent by the trusted evaluation server; or acquiring the changed trusted state sent by the network device.

[0171] In some embodiments, the network device trusted information library includes the trusted status of the network device and the network device identification. The trusted status of the network device and the network device identification are one-to-one corresponding. The trusted status of the network device corresponding to the network device identification can be updated to obtain an updated network device trusted information library.

[0172] The following is an introduction to the trusted path arrangement method of the present application embodiment with reference to a specific embodiment. Fig. 9 As shown, the trusted path orchestration method of this embodiment can be specifically implemented as the following S501-S508.

[0173] S501. The trusted business system sends a trusted path business requirement to the trusted path orchestrator. Accordingly, the trusted path orchestrator receives the trusted path business requirement sent by the trusted business system.

[0174] S502: The trusted path orchestrator determines an orchestration requirement based on the trusted path service requirement.

[0175] In some embodiments, the orchestration requirements include requirements for resources in the path. The trusted path orchestrator can determine the requirements for resources in the path based on the trusted path business requirements. Exemplarily, the orchestration requirements may include requirements for path bandwidth, latency, link cost, QoS, etc.

[0176] It should be noted that the trusted path business requirements include the requirements for path trust capabilities in different application scenarios, but the orchestration requirements do not include the requirements for path trust capabilities, that is, the orchestration requirements do not require the trust capabilities of network devices in the path. This means that the orchestrator does not need to pay attention to the trust status of network devices when generating a path orchestration policy set based on the orchestration requirements.

[0177] S503: The trusted path orchestrator sends an orchestration requirement to the orchestrator, and correspondingly, the orchestrator receives the orchestration requirement sent by the trusted path orchestrator.

[0178] S504: The orchestrator generates a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement.

[0179] In some embodiments, the network resource management module in the orchestrator stores network resource information, such as node information, link status information, routing information, board information, etc. The orchestrator can generate an orchestration policy set based on orchestration requirements and network resource information.

[0180] Exemplarily, the orchestrator generates an orchestration strategy set based on the orchestration requirements and network resource information using an algorithm capable of implementing resource allocation and optimization, for example, using a shortest path algorithm or a load balancing algorithm to generate an orchestration strategy set based on the orchestration requirements and network resource information.

[0181] S505: The orchestrator sends a path orchestration policy set to the trusted path orchestrator. Correspondingly, the trusted path orchestrator receives the path orchestration policy set sent by the orchestrator.

[0182] S506: The trusted path orchestrator determines a trusted path orchestration policy based on the orchestration policy set and the network device trusted information library.

[0183] In some embodiments, the trusted path orchestrator may determine an orchestration policy in which all trusted states of network devices in the orchestration policy set are trusted as a trusted path orchestration policy.

[0184] In some embodiments, the trusted path orchestrator may determine an orchestration policy in which the trusted state of a network device in the orchestration policy set can meet the trusted path business requirements as a trusted path orchestration policy. Exemplarily, an orchestration policy that can meet the trusted path business requirements may be an orchestration policy in which the trusted state of a network device is an orchestration policy in which the proportion of trusted network devices to total network devices exceeds a preset threshold. The preset threshold is determined based on the trusted path business requirements.

[0185] In some embodiments, if the trusted path orchestration policy cannot be determined based on the orchestration policy set and the network device trusted information base, the trusted path orchestrator will send an orchestration failure message to the trusted business system. Exemplarily, when the trusted path business requirement requires that the trusted state of the network device of each node in the trusted path generated based on the trusted path orchestration policy is all trusted, but there is no orchestration policy in the orchestration policy set that the trusted state of the network devices is all trusted, the trusted path orchestrator sends an orchestration failure message to the trusted business system.

[0186] S507: The trusted path orchestrator sends the trusted path orchestration policy to the network management device. Correspondingly, the network management device receives the trusted path orchestration policy sent by the trusted path orchestrator.

[0187] S508: The network management device completes the configuration of the trusted path editing policy and generates a trusted path.

[0188] In some embodiments, the network management device completes the configuration of the trusted path programming policy by sending configuration parameters to the network device to generate a trusted path.

[0189] Before generating the trusted path programming strategy, the trusted path programming method of this embodiment further includes generating and updating the trusted information library of the network device. Fig.10As shown, the trusted path orchestration method of this embodiment further includes the following S601-S608.

[0190] S601: The trust evaluation server sends a measurement request message to a network device. Correspondingly, the network device receives the measurement request message sent by the trust evaluation server.

[0191] S602: The network device generates measurement response information, where the measurement response information includes trusted certification information of the network device.

[0192] In some embodiments, the measurement request message includes a one-time number (number used once, Nonce) generated by the trusted evaluation server. Nonce is a random number, and the measurement response message also includes the Nonce generated by the trusted evaluation server. Sending Nonce in the measurement response message can ensure the uniqueness and freshness of the data.

[0193] In some embodiments, the metric response information includes an attribute certificate (AK certificate) for authenticating the identity of the network device.

[0194] In some embodiments, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0195] In a possible implementation, when the trusted computing module of the network device has a trusted state evaluation function, in response to a measurement request message, the network device may send a trusted state evaluation result as measurement response information to a trusted evaluation server.

[0196] In another possible implementation, when the trusted computing module of the network device does not have a trusted state assessment function, in response to a measurement request message, the network device obtains trusted measurement information from the trusted computing module and sends the trusted measurement information of the network device as measurement response information to the trusted assessment server. Exemplarily, the trusted measurement information of the network device may be a PCR value of the trusted computing module.

[0197] S603: The network device sends measurement response information to the trust evaluation server. Correspondingly, the trust evaluation server receives the measurement response information sent by the network device.

[0198] S604: The trust evaluation server determines the trust status of the network device based on the trust certification information.

[0199] In some embodiments, the trusted certification information includes an evaluation result of the trusted state, and the trusted state of the network device can be directly determined based on the evaluation result of the trusted state.

[0200] In some embodiments, the trusted certification information includes trusted measurement information of the network device, and the trusted measurement information can be compared with a reference value inside a trusted evaluation server to verify the integrity and timeliness of the trusted measurement information and determine the trusted status of the network device.

[0201] Exemplarily, the trusted measurement information may be the PCR value of a trusted computing module in a network device. The PCR value includes hash values ​​of a boot loader, an operating system kernel, and other key system files. Based on the comparison result between the PCR value and an internal reference value, it is possible to detect whether the system has been modified or replaced, thereby determining the trusted status of the network device.

[0202] S605: The trusted assessment server sends the trusted status of the network device to the trusted path orchestrator. Accordingly, the trusted path orchestrator accepts the trusted status of the network device sent by the trusted assessment server.

[0203] S606: The trusted path orchestrator generates a network device trusted information library based on the trusted state of the network device.

[0204] In some embodiments, the network device trusted information library is used to indicate the trusted state of the network device. Exemplarily, the network device trusted information library includes the trusted state of the network device and the network device identification. Among them, the trusted state of the network device and the network device identification are one-to-one corresponding, and the network device identification can be the network device MAC, IP address, host name, etc.

[0205] S607: When the trusted state of the network device changes, the trusted assessment server sends the changed trusted state to the trusted path orchestrator. Accordingly, the trusted path orchestrator accepts the changed trusted state sent by the trusted assessment server.

[0206] S608: The trusted path orchestrator updates the network device trusted information base based on the changed trusted state.

[0207] In some embodiments, after sending the trusted state of the network device to the trusted path orchestrator, the method further includes: when the trusted state of the network device changes, sending the changed trusted state to the trusted path orchestrator, so that the trusted path orchestrator updates the trusted information base of the network device based on the changed trusted state.

[0208] Exemplarily, receiving the changed trusted state includes: receiving the changed trusted state of the network device sent by the trusted evaluation server; or acquiring the changed trusted state sent by the network device.

[0209] In some embodiments, the network device trusted information library includes the trusted status of the network device and the network device identification. The trusted status of the network device and the network device identification are one-to-one corresponding. The trusted status of the network device corresponding to the network device identification can be updated to obtain an updated network device trusted information library.

[0210] The technical solution provided by the above embodiment brings at least the following beneficial effects: the trusted path orchestration method provided by the embodiment of the present application can determine the trusted path orchestration strategy based on the trusted state of the network device and the trusted path business requirements. The trusted path generated based on the trusted path orchestration strategy can not only meet the trusted path business requirements, but also improve the security of the data transmission process and the protection capability of information integrity.

[0211] It can be seen that the above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the embodiment of the present application provides a hardware structure and / or software module corresponding to each function. It should be easily appreciated by those skilled in the art that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0212] The embodiment of the present application can divide the functional modules of the trusted path orchestration device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0213] In some embodiments, the present application further provides a trusted path orchestration device, which may include one or more functional modules for implementing the trusted path orchestration method of the above method embodiment.

[0214] For example, Fig.11 A schematic diagram of the composition of a trusted path orchestration device provided in an embodiment of the present application. Fig.11 As shown, the trusted path orchestration device 700 includes: a determination module 701 and a communication module 702 .

[0215] The determination module 701 is used to determine a trusted path orchestration strategy in response to the received trusted path service requirement and based on the trusted path service requirement and a network device trusted information library.

[0216] The communication module 702 is used to send the trusted path orchestration policy to the network management device.

[0217] In some embodiments, determination module 701 is specifically used to determine the orchestration requirement based on the trusted path business requirement; communication module 702 is specifically used to send the orchestration requirement to the orchestrator, so that the orchestrator generates a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement; receive the orchestration strategy set sent by the orchestrator; determination module 701 is also specifically used to determine the trusted path orchestration strategy based on the orchestration strategy set and the network device trusted information base.

[0218] In some other embodiments, the communication module 702 is further used to obtain the trusted status of the network device; the determination module 701 is further used to generate a trusted information library of the network device based on the trusted status of the network device.

[0219] In some other embodiments, the communication module 702 is specifically used to obtain the trust status of the network device sent by the trust evaluation server; or to obtain the evaluation result of the trust status of the network device sent by the network device.

[0220] In some other embodiments, the communication module 702 is further used to receive the changed trusted state when the trusted state of the network device changes; the determination module 701 is further used to update the trusted information base of the network device based on the changed trusted state.

[0221] Fig.12 A schematic diagram of another trusted path orchestration device provided in an embodiment of the present application. Fig.12 As shown, the trusted path orchestration device 800 includes: a communication module 801 and a determination module 802 .

[0222] The communication module 801 is used to obtain the trusted certification information of the network device.

[0223] The determination module 802 is used to determine the trust status of the network device based on the trust certification information.

[0224] The communication module 801 is also used to send the trusted state of the network device to the trusted path orchestrator, so that the trusted path orchestrator generates a network device trusted information base based on the trusted state of the network device; the network device trusted information base is used to assist the trusted path orchestrator in determining the trusted path orchestration strategy when the trusted path orchestrator receives a trusted path business demand.

[0225] In some embodiments, the communication module 801 is specifically used to send a measurement request message to a network device, the measurement request information is used to request measurement of the trusted state of the network device; receive measurement response information sent by the network device, the measurement response information includes trusted certification information of the network device.

[0226] In some other embodiments, the trustworthy certification information of the network device includes at least one of the following: trustworthy measurement information of the network device; and an evaluation result of the trustworthy status of the network device.

[0227] In some other embodiments, after sending the trusted state of the network device to the trusted path orchestrator, the communication module 801 is further used to send the changed trusted state to the trusted path orchestrator when the trusted state of the network device changes, so that the trusted path orchestrator updates the trusted information base of the network device based on the changed trusted state.

[0228] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present invention provides a possible structural diagram of the electronic device involved in the above-mentioned embodiment. Fig.13 As shown, the electronic device 900 includes: a processor 902 , a communication interface 903 , and a bus 904 . Optionally, the electronic device 900 may further include a memory 901 .

[0229] The processor 902 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 902 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0230] The communication interface 903 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0231] The memory 901 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0232] As a possible implementation, the memory 901 may exist independently of the processor 902, and the memory 901 may be connected to the processor 902 via a bus 904 to store instructions or program codes. When the processor 902 calls and executes the instructions or program codes stored in the memory 901, the trusted path orchestration method provided in the embodiment of the present invention can be implemented.

[0233] In another possible implementation, the memory 901 may also be integrated with the processor 902 .

[0234] The bus 904 may be an extended industry standard architecture (EISA) bus, etc. The bus 904 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0235] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0236] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by computer instructions to instruct the relevant hardware, and the program can be stored in the above computer-readable storage medium. When the program is executed, it may include the processes of the above method embodiments. The computer-readable storage medium can be the memory or memory of any of the above embodiments. The above computer-readable storage medium can also be an external storage device of the above service calling device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the above service calling device. Further, the above computer-readable storage medium can also include both the internal storage unit of the above service calling device and an external storage device. The above computer-readable storage medium is used to store the above computer program and other programs and data required by the above service calling device. The above computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0237] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program product is run on a computer, the computer is enabled to execute any one of the trusted path orchestration methods provided in the above embodiments.

[0238] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A trusted path orchestration system, characterized in that: include: Trusted path orchestrator and network management equipment; The trusted path orchestrator is communicatively connected with the network management device; The trusted path orchestrator is used to obtain the trusted state of the network device and generate a network device trusted information base based on the trusted state of the network device, wherein the network device trusted information base is used to store the trusted state of the network device in the network; The trusted path orchestrator is further configured to receive a trusted path service requirement, determine a trusted path orchestration strategy based on the trusted path service requirement and the network device trusted information library, and issue the trusted path orchestration strategy to the network management device; The network management device is used to generate a trusted path based on the trusted path orchestration policy.

2. The system according to claim 1, characterized in that The system further comprises: an arranger; The trusted path orchestrator is specifically configured to determine an orchestration requirement based on the trusted path service requirement, and send the orchestration requirement to the orchestrator; The orchestrator is configured to generate a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement, and send the path orchestration strategy set to the trusted path orchestrator; The trusted path orchestrator is specifically configured to determine the trusted path orchestration policy based on the path orchestration policy set and the network device trusted information library.

3. The system according to claim 1, characterized in that The trusted path orchestrator is specifically configured to obtain an evaluation result of the trusted state of the network device sent by the network device.

4. The system according to claim 1, characterized in that The system further comprises a trusted assessment server; the trusted assessment server is communicatively connected with the trusted path orchestrator; The trusted evaluation server is used to obtain trusted certification information of the network device, determine the trusted state of the network device based on the trusted certification information, and send the trusted state of the network device to the trusted path orchestrator; The trusted path orchestrator is specifically configured to obtain the trusted status sent by the trusted assessment server.

5. The system according to claim 4, characterized in that The trusted assessment server is further configured to send the changed trusted state to the trusted path orchestrator when the trusted state of the network device changes; The trusted path orchestrator is further configured to update the network device trusted information library based on the changed trusted state.

6. The system according to claim 4, characterized in that The trusted certification information of the network device includes at least one of the following: Trusted measurement information of the network device; The evaluation result of the trustworthy status of the network device.

7. A trusted path orchestration method, characterized in that: Applied to a trusted path orchestrator, the trusted path orchestrator includes a network device trusted information base, the network device trusted information base is used to indicate a trusted state of a network device; the method includes: In response to the received trusted path service requirement, determining a trusted path orchestration strategy based on the trusted path service requirement and the network device trusted information base; Send the trusted path orchestration policy to the network management device.

8. The method according to claim 7, characterized in that The determining of the trusted path orchestration strategy based on the trusted path service requirement and the network device trusted information library includes: Determining an orchestration requirement based on the trusted path business requirement; and sending the orchestration requirement to the orchestrator, so that the orchestrator generates a path orchestration strategy set that meets the orchestration requirement based on the orchestration requirement; Receiving the orchestration strategy set sent by the orchestrator; The trusted path orchestration policy is determined based on the orchestration policy set and the network device trusted information library.

9. The method according to claim 7, characterized in that: The method further comprises: Get the trusted status of network devices; Based on the trusted state of the network device, the network device trusted information library is generated.

10. The method according to claim 9, characterized in that Get the trusted status of network devices, including: Acquire the trust status of the network device sent by the trust evaluation server; Alternatively, an evaluation result of the trustworthy state of the network device sent by the network device is obtained.

11. The method according to claim 10, characterized in that The method further comprises: When the trusted state of the network device changes, receiving the changed trusted state; Based on the changed trusted state, the network device trusted information library is updated.

12. A trusted path orchestration method, characterized in that: Applied to a trustworthy assessment server, the method comprises: Obtaining trusted certification information of network devices; Determining a trustworthy status of the network device based on the trustworthy certification information; The trusted state of the network device is sent to a trusted path orchestrator, so that the trusted path orchestrator generates a network device trusted information base based on the trusted state of the network device; the network device trusted information base is used to assist the trusted path orchestrator in determining a trusted path orchestration strategy when the trusted path orchestrator receives a trusted path business demand.

13. The method according to claim 12, characterized in that The obtaining of the trusted certification information of the network device includes: Sending a measurement request message to a network device, wherein the measurement request message is used to request measurement of a trusted state of the network device; The measurement response information sent by the network device is received, where the measurement response information includes the trusted certification information of the network device.

14. The method according to claim 12, characterized in that The trusted certification information of the network device includes at least one of the following: Trusted measurement information of the network device; The evaluation result of the trustworthy status of the network device.

15. The method according to claim 12, characterized in that After sending the trusted state of the network device to the trusted path orchestrator, the method further includes: When the trusted state of the network device changes, the changed trusted state is sent to the trusted path orchestrator, so that the trusted path orchestrator updates the network device trusted information base based on the changed trusted state.

16. An electronic device, characterized in that: It includes a processor and a memory, the processor is coupled to the memory; the memory is used to store computer instructions, and the computer instructions are loaded and executed by the processor to enable a computer device to implement a trusted path orchestration method as described in any one of claims 7 to 15.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer is enabled to execute the trusted path orchestration method according to any one of claims 7 to 15.

18. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed on an electronic device, the electronic device executes the trusted path orchestration method according to any one of claims 7 to 15.

Images