Link switching method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a link switching method and device, computer equipment, a computer readable storage medium and a computer program product, which are applied to the technical field of cloud computing and applied to an SDN (Software Defined Network) control system, and the SDN control system comprises a control layer link topology pool and a redundant link pool. The method comprises the following steps: dynamically selecting a link to be switched from the control layer link topology pool; a target link matched with the link to be switched is selected from the redundant link pool, and the redundant link pool is used for providing a link switching source for the control layer link topology pool; and updating the link to be switched in the control layer link topology pool to be the target link. By adopting the method, the operation security of the SDN architecture can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and in particular to a link switching method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] To achieve more flexible and efficient networking, the SDN (Software Defined Network) architecture is usually used for networking deployment.

[0003] The SDN architecture is an architecture that separates and decouples the control layer from the forwarding layer. Although this can bring highly customized and controllable technical convenience, it is also vulnerable to network architecture attacks such as SDN bypass attacks and SDN topology pollution attacks, resulting in low operational security of the SDN architecture. Summary of the invention

[0004] Based on this, it is necessary to provide a link switching method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the operational security of the SDN architecture in response to the above technical problems.

[0005] In a first aspect, the present application provides a link switching method, which is applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; including:

[0006] Dynamically selecting a link to be switched from the control layer link topology pool;

[0007] Selecting a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0008] The link to be switched in the control layer link topology pool is updated to the target link.

[0009] In one of the embodiments, dynamically selecting a link to be switched from the control layer link topology pool includes at least one of the following:

[0010] Randomly and dynamically selecting a link to be switched from the control layer link topology pool;

[0011] According to the link status information of multiple control layer links in the control layer link topology pool, a link to be switched is dynamically selected from the control layer link topology pool.

[0012] In one of the embodiments, the link status information includes link usage time information and network attack information recorded when the control layer link in the control layer link topology pool is attacked by the network; the dynamically selecting the link to be switched from the control layer link topology pool according to the link status information of multiple control layer links in the control layer link topology pool includes:

[0013] According to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information;

[0014] According to the priority information, a link to be switched is dynamically selected from the control layer link topology pool.

[0015] In one embodiment, the method further comprises:

[0016] Acquire global topology information of the control layer, and construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer;

[0017] The redundant link pool is constructed according to the at least one redundant link.

[0018] In one of the embodiments, the global topology information includes physical topology information and logical topology information; and constructing at least one redundant link different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer includes:

[0019] According to the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain updated physical topology information;

[0020] At least one redundant link is constructed according to the updated physical topology information and the logical topology information of the control layer.

[0021] In one of the embodiments, updating the link to be switched in the control layer link topology pool to the target link includes:

[0022] Acquire link data of the target link, and convert the link data into routing control interface data;

[0023] According to the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

[0024] In a second aspect, the present application further provides a link switching device, which is applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; including:

[0025] A selection module, used to dynamically select a link to be switched from the control layer link topology pool;

[0026] A matching module, used for selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool is used for providing a link switching source for the control layer link topology pool;

[0027] The replacement module is used to update the link to be switched in the control layer link topology pool to the target link.

[0028] In one of the embodiments, the selection module is also used for at least one of the following: randomly and dynamically selecting a link to be switched from the control layer link topology pool; dynamically selecting a link to be switched from the control layer link topology pool based on link status information of multiple control layer links in the control layer link topology pool.

[0029] In one of the embodiments, the link usage information includes link usage time information and network attack information recorded when the control layer link in the control layer link topology pool is attacked by the network; the selection module is also used to evaluate the switching priority of each control layer link in the control layer link topology pool according to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool to obtain priority information; according to the priority information, dynamically select the link to be switched from the control layer link topology pool.

[0030] In one of the embodiments, the device also includes: a generation module, used to obtain global topology information of the control layer in the SDN architecture, and construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool based on the global topology information of the control layer; and construct a redundant link pool based on at least one redundant link.

[0031] In one of the embodiments, the global topology information includes physical topology information and logical topology information; the generation module is also used to update the physical topology information of the control layer according to the logical topology information of the control layer to obtain updated physical topology information; and construct at least one redundant link according to the updated physical topology information and the logical topology information of the control layer.

[0032] In one of the embodiments, the replacement module is further used to obtain link data of the target link and convert the link data into routing control interface data; based on the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

[0033] In a third aspect, the present application further provides a computer device, applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; and includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0034] Dynamically selecting a link to be switched from the control layer link topology pool;

[0035] Selecting a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0036] The link to be switched in the control layer link topology pool is updated to the target link.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium, which is applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; a computer program is stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Dynamically selecting a link to be switched from the control layer link topology pool;

[0039] Selecting a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0040] The link to be switched in the control layer link topology pool is updated to the target link.

[0041] In a fifth aspect, the present application further provides a computer program product, which is applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; and includes a computer program, which implements the following steps when executed by a processor:

[0042] Dynamically selecting a link to be switched from the control layer link topology pool;

[0043] Selecting a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0044] The link to be switched in the control layer link topology pool is updated to the target link.

[0045] The link switching method, device, computer equipment, computer-readable storage medium and computer program product are applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; dynamically selecting a link to be switched from the control layer link topology pool; selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; updating the link to be switched in the control layer link topology pool to the target link, so that the control layer link in the control layer link topology pool of the SDN architecture is not static, but can be switched. Therefore, compared with the control layer link of the fixed SDN architecture, when the attacker is attacked by a network architecture such as an SDN bypass attack or an SDN topology pollution attack, the attacker needs to try more attack schemes and needs a longer attack time, so it is less likely to be successfully attacked, thereby improving the operation security of the SDN architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 An application environment diagram of a link switching method in an embodiment;

[0048] Figure 2 A schematic diagram of a link switching method in an embodiment;

[0049] Figure 3 A schematic diagram of the structure of an SDN architecture in an embodiment;

[0050] Figure 4 A schematic diagram of a process for dynamically selecting a link to be switched from the control layer link topology pool according to link status information of multiple control layer links in the control layer link topology pool in an embodiment;

[0051] Figure 5 A schematic diagram of a flow chart of steps for generating a redundant link pool in one embodiment;

[0052] Figure 6 is a structural block diagram of a link switching device in one embodiment;

[0053] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that the information and data involved in this application (including but not limited to data for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the acquisition, transmission, storage, use and processing of relevant data are in compliance with the relevant provisions of national laws and regulations. For content pushed to users (for example, link switching results, etc.), users can refuse or conveniently refuse content push, etc. In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0056] Among them, when the attacker uses the SDN bypass attack method to attack the SDN architecture, the attacker sends probe packets to both the control layer link and the data layer link of the SDN architecture, and identifies the link part where the control layer link and the data layer link have cross-overlapping according to the return time of the probe packet, and launches an attack on the link part. For example, a slow attack packet is sent to the link part to disrupt or even block the data transmission on the control layer link and the data layer link corresponding to the overlapping link part, thereby not only attacking the network layer, but also indirectly attacking the control layer through the control layer link.

[0057] In this way, through the link switching method provided in the embodiment of the present application, the control layer link in the SDN architecture will be replaced. Then, when the attacker uses the SDN bypass attack method to attack the SDN architecture, he needs to send more probe packets, and it takes a longer time to identify the cross-overlapping link parts of the control layer link and the data layer link. That is, it is not easy to identify the cross-overlapping link parts of the control layer link and the data layer link, and thus it is not easy to be successfully attacked by using the SDN bypass attack method. Therefore, the operation security of the SDN architecture is improved.

[0058] Among them, when the attacker uses the SDN topology pollution attack to attack the SDN architecture, the attacker will tamper with the topology structure of the control layer link of the SDN architecture, so that the attacker can attack the SDN architecture by simulating the host to receive the traffic of the SDN architecture.

[0059] In this way, through the link switching method provided in the embodiment of the present application, the control layer link in the SDN architecture will be replaced. Then, when the attacker attacks the SDN architecture in the form of an SDN topology pollution attack, it is necessary to constantly tamper with the topology structure of the replaced control layer link. The attacker needs to try more tampering schemes and requires a longer attack time, and thus it is not easy to be successfully attacked by the SDN topology pollution attack. Therefore, the operational security of the SDN architecture is improved.

[0060] The link switching method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers, and the SDN control system is deployed on the server 104. The server 104 dynamically selects the link to be switched from the control layer link topology pool; selects the target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; updates the link to be switched in the control layer link topology pool to the target link. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0061] In an exemplary embodiment, Figure 2 As shown, a link switching method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps 202 to 206. Among them:

[0062] Step 202: Dynamically select a link to be switched from the control layer link topology pool.

[0063] In the SDN architecture of step 202, the control layer realizes data communication with the network layer through the forwarding layer, referring to Figure 3 The control layer transmits control data to the network layer through the control layer link, and realizes data interaction between the control layer and the network layer through the data layer link.

[0064] Exemplarily, dynamically selecting a link to be switched from the control layer link topology pool includes at least one of the following items: randomly and dynamically selecting a link to be switched from the control layer link topology pool; dynamically selecting a link to be switched from the control layer link topology pool based on link status information of multiple control layer links in the control layer link topology pool.

[0065] Furthermore, links to be switched are randomly and dynamically selected from the control layer link topology pool, including: obtaining a preset number of links set on demand, the preset number of links can be set by the user on demand, and can also be determined according to the attack intensity against the SDN architecture. Specifically, the higher the attack intensity against the SDN architecture, the larger the preset number of links; dynamically and randomly selecting links to be switched whose number is the same as the preset number of links from the control layer link topology pool. For example, when the preset number of links is 3, dynamically and randomly selecting 3 links to be switched from the control layer link topology pool.

[0066] Step 204: Select a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool.

[0067] Exemplarily, step 204 includes: obtaining first link attribute information of the link to be switched, and obtaining second link attribute information of at least one redundant link in the redundant link pool; and selecting a target link whose corresponding second link attribute information matches the first link attribute information from at least one redundant link in the redundant link pool.

[0068] The link attribute information includes at least one of link connection attribute information and link transmission attribute information.

[0069] Further, selecting a target link whose corresponding second link attribute information matches the first link attribute information from at least one redundant link in the redundant link pool includes: obtaining similarities between the first link attribute information and the second link attribute information of at least one redundant link; selecting a target link whose corresponding similarity is greater than a preset similarity threshold from at least one redundant link in the redundant link pool, where the preset similarity threshold can be set by the user as needed or can be an empirical value, or selecting a target link whose corresponding similarity is the maximum value among all similarities from at least one redundant link in the redundant link pool.

[0070] Step 206: Update the link to be switched in the control layer link topology pool to the target link.

[0071] Exemplarily, step 206 includes: acquiring link data of the target link, and converting the link data into routing control interface data; and updating the link to be switched in the control layer link topology pool to the target link according to the routing control interface data.

[0072] Furthermore, the link data is converted into routing control interface data, including: obtaining a data mapping relationship, wherein the data mapping relationship includes a mapping relationship between the link data of the same data under the control layer dimension and the routing control interface data under the routing control dimension; and mapping the link data into routing control interface data through the data mapping relationship.

[0073] The link switching method is applied to an SDN control system, and the SDN control system includes a control layer link topology pool and a redundant link pool; dynamically selecting a link to be switched from the control layer link topology pool; selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; updating the link to be switched in the control layer link topology pool to the target link, so that the control layer link in the control layer link topology pool of the SDN architecture is not static, but can be switched. Therefore, compared with the control layer link of the fixed SDN architecture, when the attacker is attacked by a network architecture such as an SDN bypass attack or an SDN topology pollution attack, the attacker needs to try more attack plans and needs a longer attack time, so it is less likely to be attacked successfully, thereby improving the operation security of the SDN architecture.

[0074] In an exemplary embodiment, Figure 4 As shown, a method for accurately selecting a link to be switched is provided, wherein the link status information includes the link usage time information and the network attack information recorded when the control layer link in the control layer link topology pool is attacked by the network; according to the link status information of multiple control layer links in the control layer link topology pool, the link to be switched is dynamically selected from the control layer link topology pool, including steps 302 to 304. Among them:

[0075] Step 302: According to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information.

[0076] The network attack information in step 302 includes at least one of the total number of network attacks and the network attack time. The total number of network attacks includes at least one of the number of successful attacks, the total number of network attacks and the number of failed attacks. The network attack time is used to characterize the cumulative attack duration on the link.

[0077] Exemplarily, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is evaluated to obtain attack risk assessment information; based on the attack risk assessment information, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information.

[0078] As an embodiment, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is evaluated to obtain an attack risk assessment result, including: for each control layer link, obtaining a preset evaluation rule, and using the preset evaluation rule, evaluating the attack risk corresponding to the control layer link based on the link usage time information and network attack information of the control layer link to obtain attack risk assessment information of the control layer link.

[0079] As another embodiment, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is evaluated to obtain attack risk assessment information, including: obtaining an attack risk assessment model obtained by pre-training with multiple training samples, wherein each training sample consists of the link usage time information and network attack information of the training link and a real attack risk label corresponding to the training link; for each control layer link, using the attack risk assessment model, the attack risk corresponding to the control layer link is evaluated according to the link usage time information and network attack information of the control layer link to obtain the attack risk assessment information of the control layer link.

[0080] Furthermore, through the attack risk assessment model, the attack risk corresponding to the control layer link is evaluated according to the link usage time information and the network attack information of the control layer link, and the attack risk assessment information of the control layer link is obtained, including: through the attack risk assessment model, the link usage time characteristics are extracted from the link usage time information of the control layer link, and the attack link characteristics are extracted from the network attack information of the control layer link; the link usage time characteristics are weighted by the first weight to obtain the usage time weighted characteristics, and the attack link characteristics are weighted by the second weight to obtain the attack link weighted characteristics, wherein the first weight and the second weight are set on demand, and the greater the influence of the link usage time information on the attack risk assessment, the higher the first weight is set; the greater the influence of the network attack information on the attack risk assessment, the higher the second weight is set; through the attack risk assessment model, the attack risk corresponding to the control layer link is evaluated according to the usage time weighted characteristics and the attack link weighted characteristics, and the attack risk assessment information of the control layer link is obtained.

[0081] Among them, the preset evaluation rules or attack risk assessment models all follow the following rules: the longer the link usage time represented by the link usage time information, the higher the attack risk represented by the generated attack risk assessment information; the more network attacks there are, the higher the attack risk represented by the generated attack risk assessment information; the longer the cumulative attack time on the link represented by the network attack time, the higher the attack risk represented by the generated attack risk assessment information.

[0082] In this way, considering that the longer the link usage time of the control layer link is, the more times the control layer link may be attacked, then the risk of the control layer link being attacked is higher, and therefore, the attack risk represented by the generated attack risk assessment information is higher; considering that the more network attacks on the control layer link are, that is, the more times the attacker attempts to attack the control layer link, then the risk of the control layer link being attacked is higher, and therefore, the attack risk represented by the generated attack risk assessment information is higher.

[0083] According to the attack risk assessment information, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information, including: the priority information includes the switching priority of each control layer link in the control layer link topology pool; the basic priority information is obtained, wherein the basic priority information is a benchmark priority uniformly corresponding to all control layer links, which can usually be set to 1; for each control layer link, according to the attack risk assessment information of the control layer link, the switching priority corresponding to the control layer link is generated, wherein the higher the attack risk represented by the attack risk assessment information, the greater the priority coefficient; the priority coefficient and the basic priority are merged to obtain the switching priority of the control layer link, wherein the fusion method between the priority coefficient and the basic priority can be a sum fusion or a product fusion.

[0084] As another embodiment, step 304 includes: for each control layer link, mapping the attack risk assessment information of the control layer link to the switching priority of the control layer link through a priority mapping relationship, wherein the higher the attack risk represented by the attack risk assessment information, the higher the switching priority obtained by the mapping.

[0085] Step 304: dynamically select a link to be switched from the control layer link topology pool according to the priority information.

[0086] Exemplarily, step 304 includes: dynamically selecting a link to be switched whose corresponding priority information meets a preset priority condition from the control layer link topology pool, wherein the higher the switching priority represented by the priority information, the easier it is to be selected as the link to be switched.

[0087] Furthermore, a link to be switched whose corresponding priority information satisfies a preset priority condition is selected from the control layer link topology pool, including: selecting a link to be switched whose corresponding switching priority is greater than a preset priority threshold from the control layer link topology pool, wherein the preset priority threshold can be set by the user as needed or can be an empirical value; or selecting a link to be switched whose corresponding switching priority is the maximum value among all switching priorities from the control layer link topology pool.

[0088] In this embodiment, the switching priority of each control layer link in the control layer link topology pool is evaluated according to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool to obtain priority information; according to the priority information, the link to be switched is dynamically selected from the control layer link topology pool, and the link usage time information and network attack information are used as the basis for evaluating the priority information, and the influence of the usage time factor and the network attack factor on the switching priority of the control layer link is taken into consideration, thereby improving the generation accuracy of the priority information of the control layer link, and the priority information is the basis for selecting the link to be switched from the control layer link topology pool, thereby improving the operation security of the SDN architecture.

[0089] In an exemplary embodiment, Figure 5 As shown, in order to provide a method for accurately generating a redundant link pool, the method further includes steps 402 to 404. Among them:

[0090] Step 402: Acquire global topology information of the control layer, and construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer.

[0091] As one embodiment, the global topology information includes physical topology information and logical topology information; based on the global topology information of the control layer, at least one redundant link that is different from multiple control layer links in the control layer link topology pool is constructed, including: based on the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain updated physical topology information; based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed.

[0092] Further, at least one redundant link is constructed according to the updated physical topology information and the logical topology information of the control layer, including: combining the updated physical topology information and the logical topology information of the control layer to obtain at least one redundant link.

[0093] Step 404: construct a redundant link pool according to at least one redundant link.

[0094] Exemplarily, step 404 includes: combining at least one redundant link to obtain a redundant link pool corresponding to the SDN architecture.

[0095] In this embodiment, by obtaining the global topology information of the control layer in the SDN architecture, and constructing at least one redundant link that is different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer; constructing a redundant link pool according to the at least one redundant link, ensuring that the redundant links contained in the redundant link pool for replacement are different from the multiple control layer links in the control layer link topology pool, so that when the link to be switched is subsequently replaced, the attacker does not know the target link for replacement, which increases the difficulty of the attacker's attack on the SDN architecture, thereby improving the operation security of the SDN architecture.

[0096] As a detailed embodiment, a link to be switched is randomly and dynamically selected from a control layer link topology pool; and / or, based on link usage time information and network attack information of multiple control layer links in the SDN architecture, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information; based on the priority information, a link to be switched is dynamically selected from the control layer link topology pool; the global topology information of the control layer is obtained, and based on the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain updated physical topology information; based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed; based on the at least one redundant link, a redundant link pool is constructed.

[0097] Furthermore, a target link that matches the link to be switched is selected from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; link data of the target link is obtained, and the link data is converted into routing control interface data; based on the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

[0098] In this way, a link to be switched is dynamically selected from the control layer link topology pool; a target link matching the link to be switched is selected from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; and the link to be switched in the control layer link topology pool is updated to the target link. In this way, the control layer links in the control layer link topology pool of the SDN architecture are not static, but can be switched. Therefore, compared with the control layer links of the fixed SDN architecture, when the attacker attacks the network architecture such as SDN bypass attack or SDN topology pollution attack, the attacker needs to try more attack schemes and needs a longer attack time. Therefore, it is less likely to be attacked successfully, thereby improving the operation security of the SDN architecture.

[0099] Furthermore, by taking the link usage time information and network attack information as the basis for evaluating the priority information, the influence of the usage time factor and the network attack factor on the switching priority of the control layer link is taken into consideration, thereby improving the accuracy of generating the priority information of the control layer link. The priority information is the basis for selecting the link to be switched from the control layer link topology pool, thereby improving the operational security of the SDN architecture; and, ensuring that the redundant links contained in the redundant link pool for replacement are different from the multiple control layer links in the control layer link topology pool, so that when the link to be switched is subsequently replaced, the attacker does not know the target link for replacement, thereby increasing the difficulty of the attacker's attack on the SDN architecture, thereby improving the operational security of the SDN architecture.

[0100] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0101] Based on the same inventive concept, the embodiment of the present application also provides a link switching device for implementing the link switching method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more link switching device embodiments provided below can refer to the limitations on the link switching method above, and will not be repeated here.

[0102] In an exemplary embodiment, Figure 6 As shown, a link switching device 600 is provided, including: a selection module 602, a matching module 604 and a replacement module 606, wherein:

[0103] A selection module 602 is used to dynamically select a link to be switched from a control layer link topology pool;

[0104] A matching module 604 is used to select a target link that matches the link to be switched from a redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0105] The replacement module 606 is used to update the link to be switched in the control layer link topology pool to the target link.

[0106] In one of the embodiments, the selection module 602 is also used for at least one of the following: randomly and dynamically selecting a link to be switched from the control layer link topology pool; dynamically selecting a link to be switched from the control layer link topology pool based on link status information of multiple control layer links in the control layer link topology pool.

[0107] In one of the embodiments, the link usage information includes link usage time information and network attack information recorded when the control layer link in the control layer link topology pool is attacked by the network; the selection module 602 is also used to evaluate the switching priority of each control layer link in the control layer link topology pool according to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool to obtain priority information; according to the priority information, dynamically select the link to be switched from the control layer link topology pool.

[0108] In one of the embodiments, the device also includes: a generation module, used to obtain global topology information of the control layer in the SDN architecture, and construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool based on the global topology information of the control layer; and construct a redundant link pool based on at least one redundant link.

[0109] In one of the embodiments, the global topology information includes physical topology information and logical topology information; the generation module is also used to update the physical topology information of the control layer according to the logical topology information of the control layer to obtain updated physical topology information; and construct at least one redundant link according to the updated physical topology information and the logical topology information of the control layer.

[0110] In one of the embodiments, the replacement module 606 is further used to obtain link data of the target link and convert the link data into routing control interface data; based on the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

[0111] Each module in the link switching device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0112] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a link switching method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0113] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0114] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0115] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0116] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0117] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0118] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0119] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A link switching method, characterized in that: Applied to an SDN control system, the SDN control system includes a control layer link topology pool and a redundant link pool; the method includes: Dynamically selecting a link to be switched from the control layer link topology pool; Selecting a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; The link to be switched in the control layer link topology pool is updated to the target link.

2. The method according to claim 1, characterized in that: The dynamically selecting a link to be switched from the control layer link topology pool includes at least one of the following: Randomly and dynamically selecting a link to be switched from the control layer link topology pool; According to the link status information of multiple control layer links in the control layer link topology pool, a link to be switched is dynamically selected from the control layer link topology pool.

3. The method according to claim 2, characterized in that The link status information includes link usage time information and network attack information recorded when the control layer link in the control layer link topology pool is attacked by the network; the link to be switched is dynamically selected from the control layer link topology pool according to the link status information of multiple control layer links in the control layer link topology pool, including: According to the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information; According to the priority information, a link to be switched is dynamically selected from the control layer link topology pool.

4. The method according to claim 1, characterized in that The method further comprises: Acquire global topology information of the control layer, and construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer; The redundant link pool is constructed according to the at least one redundant link.

5. The method according to claim 4, characterized in that The global topology information includes physical topology information and logical topology information; and constructing at least one redundant link different from multiple control layer links in the control layer link topology pool according to the global topology information of the control layer, comprising: According to the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain updated physical topology information; At least one redundant link is constructed according to the updated physical topology information and the logical topology information of the control layer.

6. The method according to any one of claims 1 to 5, characterized in that The updating of the to-be-switched link in the control layer link topology pool to the target link comprises: Acquire link data of the target link, and convert the link data into routing control interface data; According to the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

7. A link switching device, characterized in that: Applied to an SDN control system, the SDN control system includes a control layer link topology pool and a redundant link pool; the device includes: A selection module, used to dynamically select a link to be switched from the control layer link topology pool; A matching module, used for selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool is used for providing a link switching source for the control layer link topology pool; The replacement module is used to update the link to be switched in the control layer link topology pool to the target link.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images