Link switching methods, apparatus, computer equipment, readable storage media, and program products

Abstract

This application relates to a link switching method, apparatus, computer device, computer-readable storage medium, and computer program product, applied in the field of cloud computing technology and specifically to an SDN control system. The SDN control system includes a control layer link topology pool and a redundant link pool. The method includes: dynamically selecting a link to be switched from the control layer link topology pool; selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool provides a link switching source for the control layer link topology pool; and updating the link to be switched in the control layer link topology pool to the target link. This method can improve the operational security of the SDN architecture.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and in particular to a link switching method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] To achieve more flexible and efficient networking, SDN (Software Defined Network) architecture is typically used for network deployment.

[0003] SDN architecture is a decoupled architecture that separates the control layer from the forwarding layer. While this brings high customization and controllability, it is also vulnerable to network architecture attacks such as SDN bypass attacks and SDN topology pollution attacks, resulting in lower operational security for SDN architecture. Summary of the Invention

[0004] Therefore, it is necessary to provide a link switching method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the operational security of SDN architecture in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a link switching method applied to an SDN control system, wherein the SDN control system includes a control layer link topology pool and a redundant link pool; including:

[0006] Dynamically select the link to be switched from the control layer link topology pool;

[0007] Select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool;

[0008] Update the links to be switched in the control layer link topology pool to the target link.

[0009] In one embodiment, dynamically selecting a link to be switched from the control layer link topology pool includes at least one of the following:

[0010] The link to be switched is randomly and dynamically selected from the control layer link topology pool;

[0011] Based on the link status information of multiple control layer links in the control layer link topology pool, a link to be switched is dynamically selected from the control layer link topology pool.

[0012] In one embodiment, the link status information includes link usage time information and network attack information recorded when a control layer link in the control layer link topology pool is subjected to a network attack; the step of dynamically selecting a link to be switched from the control layer link topology pool based on the link status information of multiple control layer links in the control layer link topology pool includes:

[0013] Based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information;

[0014] Based on the priority information, the link to be switched is dynamically selected from the control layer link topology pool.

[0015] In one embodiment, the method further includes:

[0016] Obtain the global topology information of the control layer, and based on the global topology information of the control layer, construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool;

[0017] The redundant link pool is constructed based on the at least one redundant link.

[0018] In one embodiment, the global topology information includes physical topology information and logical topology information; the step of constructing at least one redundant link that is different from multiple control layer links in the control layer link topology pool based on the global topology information of the control layer includes:

[0019] Based on the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain the updated physical topology information;

[0020] Based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed.

[0021] In one embodiment, updating the link to be switched in the control layer link topology pool to the target link includes:

[0022] Obtain the link data of the target link and convert the link data into routing control interface data;

[0023] Based on the routing control interface data, the links to be switched in the control layer link topology pool are updated to the target link.

[0024] Secondly, this application also provides a link switching device applied to an SDN control system, the SDN control system including a control layer link topology pool and a redundant link pool; including:

[0025] The selection module is used to dynamically select links to be switched from the control layer link topology pool;

[0026] A matching module is used to select a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool;

[0027] The replacement module is used to update the links to be switched in the control layer link topology pool to the target link.

[0028] In one embodiment, the selection module is further configured to: randomly and dynamically select a link to be switched from the control layer link topology pool; dynamically select a link to be switched from the control layer link topology pool based on the link status information of multiple control layer links in the control layer link topology pool.

[0029] In one embodiment, the link usage information includes link usage time information and network attack information recorded when a control layer link in the control layer link topology pool is attacked; the selection module is also used to evaluate the switching priority of each control layer link in the control layer link topology pool based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, and obtain priority information; and dynamically select the link to be switched from the control layer link topology pool based on the priority information.

[0030] In one embodiment, the apparatus further includes: a generation module, configured to acquire global topology information of the control layer in the SDN architecture, and based on the global topology information of the control layer, construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool; and construct a redundant link pool based on the at least one redundant link.

[0031] In one embodiment, the global topology information includes physical topology information and logical topology information; the generation module is further configured to update the physical topology information of the control layer according to the logical topology information of the control layer to obtain updated physical topology information; and construct at least one redundant link according to the updated physical topology information and the logical topology information of the control layer.

[0032] In one embodiment, the replacement module is further configured to acquire link data of the target link and convert the link data into routing control interface data; and update the link to be switched in the control layer link topology pool to the target link based on the routing control interface data.

[0033] Thirdly, this application also provides a computer device applied to an SDN control system, the SDN control system including a control layer link topology pool and a redundant link pool; including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the following steps:

[0034] Dynamically select the link to be switched from the control layer link topology pool;

[0035] Select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool;

[0036] Update the links to be switched in the control layer link topology pool to the target link.

[0037] Fourthly, this application also provides a computer-readable storage medium for use in an SDN control system, the SDN control system including a control layer link topology pool and a redundant link pool; a computer program is stored thereon, and when the computer program is executed by a processor, it performs the following steps:

[0038] Dynamically select the link to be switched from the control layer link topology pool;

[0039] Select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool;

[0040] Update the links to be switched in the control layer link topology pool to the target link.

[0041] Fifthly, this application also provides a computer program product applied to an SDN control system, the SDN control system including a control layer link topology pool and a redundant link pool; including a computer program that, when executed by a processor, performs the following steps:

[0042] Dynamically select the link to be switched from the control layer link topology pool;

[0043] Select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool;

[0044] Update the links to be switched in the control layer link topology pool to the target link.

[0045] The aforementioned link switching method, apparatus, computer equipment, computer-readable storage medium, and computer program product are applied to an SDN control system, which includes a control layer link topology pool and a redundant link pool. The method involves dynamically selecting a link to be switched from the control layer link topology pool; selecting a target link matching the link to be switched from the redundant link pool, wherein the redundant link pool provides a link switching source for the control layer link topology pool; and updating the link to be switched in the control layer link topology pool to the target link. This ensures that the control layer links in the SDN architecture's control layer link topology pool are not static but can be switched. Compared to fixed SDN architecture control layer links, when subjected to network architecture attacks such as SDN bypass attacks or SDN topology pollution attacks, attackers need to try more attack schemes and require more attack time, making them less likely to be successfully attacked. Therefore, this improves the operational security of the SDN architecture. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is an application environment diagram of the link switching method in one embodiment;

[0048] Figure 2 This is a flowchart illustrating a link switching method in one embodiment;

[0049] Figure 3 This is a schematic diagram of the SDN architecture in one embodiment;

[0050] Figure 4 This is a flowchart illustrating the steps of dynamically selecting a link to be switched from the control layer link topology pool based on the link status information of multiple control layer links in the control layer link topology pool in one embodiment.

[0051] Figure 5 This is a flowchart illustrating the steps for generating a redundant link pool in one embodiment.

[0052] Figure 6 This is a structural block diagram of a link switching device in one embodiment;

[0053] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] It should be noted that all information and data involved in this application (including but not limited to data used for analysis, stored data, and displayed data) are information and data authorized by the user or fully authorized by all parties, and the acquisition, transmission, storage, use, and processing of related data comply with the relevant provisions of national laws and regulations. Users can refuse content pushed to them (e.g., link switching results). In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0056] In this attack, when attackers use a bypass attack method to target an SDN architecture, they send probe packets to both the control layer and data layer links of the SDN architecture. Based on the return time of the probe packets, they identify overlapping links between the control layer and data layer links and launch attacks on those links. For example, they send slow attack packets to those links to disrupt or even block data transmission on the corresponding control layer and data layer links. This allows attackers to not only attack the network layer but also indirectly attack the control layer through the control layer links.

[0057] Thus, through the link switching method provided in this application embodiment, the control layer links in the SDN architecture are replaced. Therefore, when an attacker uses an SDN side-channel attack to attack the SDN architecture, they need to send more probe packets and spend more time identifying the overlapping links between the control layer links and the data layer links. In other words, it is not easy to identify the overlapping links between the control layer links and the data layer links, and therefore it is not easy to be attacked successfully using an SDN side-channel attack. Thus, the operational security of the SDN architecture is improved.

[0058] In one attack, when an attacker uses an SDN topology pollution attack to target an SDN architecture, the attacker tamperes with the topology of the control layer links of the SDN architecture. This allows the attacker to launch an attack on the SDN architecture by simulating a host receiving traffic from the SDN architecture.

[0059] Thus, through the link switching method provided in this application embodiment, the control layer links in the SDN architecture will be replaced. Therefore, when an attacker attacks the SDN architecture using the SDN topology pollution attack method, the attacker needs to constantly tamper with the topology structure of the replaced control layer links. The attacker needs to try more tampering schemes and requires a longer attack time, which makes it less likely to be successfully attacked using the SDN topology pollution attack method. Therefore, the operational security of the SDN architecture is improved.

[0060] The link switching method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be placed in the cloud or on other network servers. The SDN control system is deployed on server 104. Server 104 dynamically selects links to be switched from the control layer link topology pool; selects target links matching the links to be switched from the redundant link pool, where the redundant link pool provides a source of link switching for the control layer link topology pool; and updates the links to be switched in the control layer link topology pool to the target links. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0061] In one exemplary embodiment, such as Figure 2 As shown, a link switching method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps 202 to 206. Wherein:

[0062] Step 202: Dynamically select the link to be switched from the control layer link topology pool.

[0063] In the SDN architecture of step 202, the control layer communicates with the network layer through the forwarding layer, as shown in the reference. Figure 3 The control layer transmits control data to the network layer through the control layer link, and realizes data interaction between the control layer and the network layer through the data layer link.

[0064] For example, dynamically selecting a link to be switched from the control layer link topology pool includes at least one of the following: randomly and dynamically selecting a link to be switched from the control layer link topology pool; dynamically selecting a link to be switched from the control layer link topology pool based on the link status information of multiple control layer links in the control layer link topology pool.

[0065] Furthermore, the process of randomly and dynamically selecting links to be switched from the control layer link topology pool includes: obtaining a preset number of links that can be set as needed by the user or determined by the attack strength against the SDN architecture; specifically, the higher the attack strength against the SDN architecture, the larger the preset number of links; and dynamically and randomly selecting links to be switched from the control layer link topology pool with the same number of links as the preset number of links. For example, if the preset number of links is 3, then 3 links to be switched are dynamically and randomly selected from the control layer link topology pool.

[0066] Step 204: Select a target link from the redundant link pool that matches the link to be switched. The redundant link pool is used to provide a source of link switching for the control layer link topology pool.

[0067] For example, step 204 includes: obtaining first link attribute information of the link to be switched, and obtaining second link attribute information of at least one redundant link in the redundant link pool; selecting a target link from the at least one redundant link in the redundant link pool whose second link attribute information matches the first link attribute information.

[0068] The link attribute information includes at least one of the link connection attribute information and the link transmission attribute information.

[0069] Further, selecting a target link from at least one redundant link in the redundant link pool whose second link attribute information matches the first link attribute information includes: obtaining the similarity between the first link attribute information and the second link attribute information of at least one redundant link; selecting a target link from at least one redundant link in the redundant link pool whose similarity is greater than a preset similarity threshold, wherein the preset similarity threshold can be set by the user as needed or can be an empirical value, or selecting a target link from at least one redundant link in the redundant link pool whose similarity is the maximum value among all similarities.

[0070] Step 206: Update the links to be switched in the control layer link topology pool to the target links.

[0071] For example, step 206 includes: obtaining link data of the target link and converting the link data into routing control interface data; and updating the link to be switched in the control layer link topology pool to the target link based on the routing control interface data.

[0072] Further, converting link data into routing control interface data includes: obtaining data mapping relationships, wherein the data mapping relationships include the mapping relationship between link data under the control layer dimension and routing control interface data under the routing control dimension; and mapping link data to routing control interface data through the data mapping relationships.

[0073] The link switching method described above is applied to an SDN control system, which includes a control layer link topology pool and a redundant link pool. The method involves dynamically selecting a link to be switched from the control layer link topology pool; selecting a target link from the redundant link pool that matches the link to be switched (the redundant link pool provides a source of link switching for the control layer link topology pool); and updating the link to be switched in the control layer link topology pool to the target link. This ensures that the control layer links in the SDN architecture's control layer link topology pool are not static but can be switched. Compared to fixed control layer links in an SDN architecture, when attacked by network architecture attacks such as SDN bypass attacks or SDN topology pollution attacks, attackers need to try more attack schemes and require more time, making them less likely to be successfully attacked. Therefore, this improves the operational security of the SDN architecture.

[0074] In one exemplary embodiment, such as Figure 4 As shown, a method for accurately selecting a link to be switched is provided. The link status information includes link usage time information and network attack information recorded when a control layer link in the control layer link topology pool is subjected to a network attack. Based on the link status information of multiple control layer links in the control layer link topology pool, a link to be switched is dynamically selected from the control layer link topology pool, including steps 302 to 304. Wherein:

[0075] Step 302: Based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, evaluate the switching priority of each control layer link in the control layer link topology pool to obtain priority information.

[0076] The network attack information in step 302 includes at least one of the total number of network attacks and the network attack time. The total number of network attacks includes at least one of the number of successful attacks, the total number of network attacks, and the number of failed attacks. The network attack time is used to characterize the cumulative attack duration against the link.

[0077] For example, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is assessed to obtain attack risk assessment information; based on the attack risk assessment information, the switching priority of each control layer link in the control layer link topology pool is assessed to obtain priority information.

[0078] As one embodiment, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is assessed to obtain the attack risk assessment result. This includes: for each control layer link, obtaining a preset assessment rule, and using the preset assessment rule, assessing the attack risk corresponding to the control layer link based on the link usage time information and network attack information of the control layer link to obtain the attack risk assessment information of the control layer link.

[0079] As another embodiment, based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the attack success risk of each control layer link in the control layer link topology pool is assessed to obtain attack risk assessment information. This includes: obtaining an attack risk assessment model pre-trained from multiple training samples, wherein each training sample consists of the link usage time information and network attack information of the training link and the real attack risk label corresponding to the training link; for each control layer link, the attack risk corresponding to the control layer link is assessed based on the link usage time information and network attack information of the control layer link using the attack risk assessment model to obtain the attack risk assessment information of the control layer link.

[0080] Furthermore, using an attack risk assessment model, the attack risk corresponding to the control layer link is assessed based on the link usage time information and network attack information of the control layer link, resulting in attack risk assessment information for the control layer link. This includes: extracting link usage time features from the link usage time information of the control layer link and extracting attack link features from the network attack information of the control layer link using the attack risk assessment model; weighting the link usage time features with a first weight to obtain usage time-weighted features, and weighting the attack link features with a second weight to obtain attack link-weighted features. The first and second weights are set as needed; the greater the impact of link usage time information on the attack risk assessment, the higher the first weight is set; the greater the impact of network attack information on the attack risk assessment, the higher the second weight is set. Using the attack risk assessment model, the attack risk corresponding to the control layer link is assessed based on the usage time-weighted features and the attack link-weighted features, resulting in attack risk assessment information for the control layer link.

[0081] The preset evaluation rules or attack risk assessment models all follow the following rules: the longer the link usage time information represents, the higher the attack risk represented by the generated attack risk assessment information; the more network attacks, the higher the attack risk represented by the generated attack risk assessment information; the longer the cumulative attack time against the link represented by the network attack time, the higher the attack risk represented by the generated attack risk assessment information.

[0082] Therefore, considering that the longer the control layer link is used, the more times it may be attacked, and the higher the risk of attack on the control layer link, the higher the attack risk represented by the generated attack risk assessment information. Furthermore, considering that the more network attacks the control layer link receives, that is, the more times attackers attempt to attack the control layer link, the higher the risk of attack on the control layer link, and therefore, the higher the attack risk represented by the generated attack risk assessment information.

[0083] Based on the attack risk assessment information, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information, including: priority information includes the switching priority of each control layer link in the control layer link topology pool; basic priority information is obtained, where the basic priority information is the baseline priority uniformly corresponding to all control layer links, which can usually be set to 1; for each control layer link, based on the attack risk assessment information of the control layer link, the corresponding switching priority is generated, where the higher the attack risk represented by the attack risk assessment information, the larger the priority coefficient; the priority coefficient and the basic priority are fused to obtain the switching priority of the control layer link, where the fusion method between the priority coefficient and the basic priority can be either summation fusion or product fusion.

[0084] As another embodiment, step 304 includes: for each control layer link, mapping the attack risk assessment information of the control layer link to the switching priority of the control layer link through a priority mapping relationship, wherein the higher the attack risk represented by the attack risk assessment information, the higher the switching priority obtained by mapping.

[0085] Step 304: Dynamically select the link to be switched from the control layer link topology pool based on priority information.

[0086] For example, step 304 includes: dynamically selecting links to be switched from the control layer link topology pool whose priority information meets the preset priority conditions, wherein the higher the switching priority represented by the priority information, the easier it is to be selected as the link to be switched.

[0087] Furthermore, selecting a link from the control layer link topology pool whose priority information meets the preset priority conditions includes: selecting a link from the control layer link topology pool whose switching priority is greater than a preset priority threshold, wherein the preset priority threshold can be set by the user as needed or can be an empirical value; or selecting a link from the control layer link topology pool whose switching priority is the maximum among all switching priorities.

[0088] In this embodiment, the switching priority of each control layer link in the control layer link topology pool is evaluated based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool to obtain priority information. Based on the priority information, links to be switched are dynamically selected from the control layer link topology pool. The link usage time information and network attack information are used as the evaluation criteria for the priority information. This takes into account the impact of usage time factors and network attack factors on the switching priority of control layer links, improving the accuracy of the generation of control layer link priority information. Since the priority information is the selection criterion for selecting links to be switched from the control layer link topology pool, the operational security of the SDN architecture is improved.

[0089] In one exemplary embodiment, such as Figure 5 As shown, to provide an accurate method for generating redundant link pools, the method further includes steps 402 to 404. Wherein:

[0090] Step 402: Obtain the global topology information of the control layer, and based on the global topology information of the control layer, construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool.

[0091] As one embodiment, the global topology information includes physical topology information and logical topology information; based on the global topology information of the control layer, constructing at least one redundant link that is different from multiple control layer links in the control layer link topology pool includes: updating the physical topology information of the control layer based on the logical topology information of the control layer to obtain updated physical topology information; and constructing at least one redundant link based on the updated physical topology information and the logical topology information of the control layer.

[0092] Furthermore, based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed, including: combining the updated physical topology information and the logical topology information of the control layer to obtain at least one redundant link.

[0093] Step 404: Construct a redundant link pool based on at least one redundant link.

[0094] For example, step 404 includes: combining at least one redundant link to obtain a redundant link pool corresponding to the SDN architecture.

[0095] In this embodiment, by obtaining the global topology information of the control layer in the SDN architecture, and based on the global topology information of the control layer, at least one redundant link is constructed that is different from multiple control layer links in the control layer link topology pool. Based on the at least one redundant link, a redundant link pool is constructed to ensure that the redundant links in the redundant link pool used for replacement are all different from multiple control layer links in the control layer link topology pool. This makes it so that when the link to be switched is replaced in the future, the attacker does not know the target link to be replaced, which increases the difficulty for the attacker to attack the SDN architecture. Therefore, the operational security of the SDN architecture is improved.

[0096] As a detailed embodiment, links to be switched are randomly and dynamically selected from the control layer link topology pool; and / or, based on the link usage time information and network attack information of multiple control layer links in the SDN architecture, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information; based on the priority information, links to be switched are dynamically selected from the control layer link topology pool; global topology information of the control layer is obtained, and the physical topology information of the control layer is updated based on the logical topology information of the control layer to obtain updated physical topology information; based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed; based on the at least one redundant link, a redundant link pool is constructed.

[0097] Furthermore, a target link matching the link to be switched is selected from the redundant link pool, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool; the link data of the target link is obtained and converted into routing control interface data; based on the routing control interface data, the link to be switched in the control layer link topology pool is updated to the target link.

[0098] In this way, by dynamically selecting links to be switched from the control layer link topology pool; selecting target links that match the links to be switched from the redundant link pool (where the redundant link pool provides a source of link switching for the control layer link topology pool); and updating the links to be switched in the control layer link topology pool to the target links, the control layer links in the SDN architecture's control layer link topology pool are not static but can be switched. Compared to fixed control layer links in an SDN architecture, when attacked by network architecture attacks such as SDN bypass attacks or SDN topology pollution attacks, attackers need to try more attack schemes and require more attack time, making it less likely to be successfully attacked. Therefore, the operational security of the SDN architecture is improved.

[0099] Furthermore, by using link usage time information and network attack information as the evaluation criteria for priority information, the impact of usage time factors and network attack factors on the switching priority of control layer links is taken into account, thereby improving the accuracy of generating control layer link priority information. Since priority information is the selection criterion for choosing links to be switched from the control layer link topology pool, this improves the operational security of the SDN architecture. In addition, by ensuring that the redundant links in the redundant link pool used for replacement are all different from multiple control layer links in the control layer link topology pool, attackers will not know the target link to be replaced when the link to be switched is replaced in the future, which increases the difficulty for attackers to attack the SDN architecture, thus improving the operational security of the SDN architecture.

[0100] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0101] Based on the same inventive concept, this application also provides a link switching device for implementing the link switching method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more link switching device embodiments provided below can be found in the limitations of the link switching method described above, and will not be repeated here.

[0102] In one exemplary embodiment, such as Figure 6 As shown, a link switching device 600 is provided, including: a selection module 602, a matching module 604, and a replacement module 606, wherein:

[0103] Module 602 is used to dynamically select links to be switched from the control layer link topology pool;

[0104] The matching module 604 is used to select a target link that matches the link to be switched from the redundant link pool, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool;

[0105] Replace module 606 to update the links to be switched in the control layer link topology pool to the target link.

[0106] In one embodiment, the selection module 602 is further configured to: randomly and dynamically select a link to be switched from the control layer link topology pool; dynamically select a link to be switched from the control layer link topology pool based on the link status information of multiple control layer links in the control layer link topology pool.

[0107] In one embodiment, the link usage information includes link usage time information and network attack information recorded when a control layer link in the control layer link topology pool is attacked; the selection module 602 is further configured to evaluate the switching priority of each control layer link in the control layer link topology pool based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, and obtain priority information; and dynamically select the link to be switched from the control layer link topology pool based on the priority information.

[0108] In one embodiment, the apparatus further includes: a generation module, configured to acquire global topology information of the control layer in the SDN architecture, and based on the global topology information of the control layer, construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool; and construct a redundant link pool based on the at least one redundant link.

[0109] In one embodiment, the global topology information includes physical topology information and logical topology information; the generation module is further configured to update the physical topology information of the control layer according to the logical topology information of the control layer to obtain updated physical topology information; and construct at least one redundant link according to the updated physical topology information and the logical topology information of the control layer.

[0110] In one embodiment, the replacement module 606 is further configured to acquire the link data of the target link and convert the link data into routing control interface data; and update the link to be switched in the control layer link topology pool to the target link according to the routing control interface data.

[0111] Each module in the aforementioned link switching device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0112] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a link switching method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0113] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0114] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0115] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0116] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0117] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0118] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0119] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A link switching method, characterized in that, The method is applied to an SDN control system, which includes a control layer link topology pool and a redundant link pool; the method includes: Dynamically select the link to be switched from the control layer link topology pool; Select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a source of link switching for the control layer link topology pool; Update the links to be switched in the control layer link topology pool to the target link; The step of dynamically selecting a link to be switched from the control layer link topology pool includes: Based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, the switching priority of each control layer link in the control layer link topology pool is evaluated to obtain priority information. The network attack information is the information recorded when a control layer link in the control layer link topology pool is subjected to a network attack. Based on the priority information, a link to be switched is dynamically selected from the control layer link topology pool.

2. The method according to claim 1, characterized in that, The step of dynamically selecting a link to be switched from the control layer link topology pool also includes: The link to be switched is randomly and dynamically selected from the control layer link topology pool.

3. The method according to claim 1, characterized in that, The method further includes: Obtain the global topology information of the control layer, and based on the global topology information of the control layer, construct at least one redundant link that is different from multiple control layer links in the control layer link topology pool; The redundant link pool is constructed based on the at least one redundant link.

4. The method according to claim 3, characterized in that The global topology information includes physical topology information and logical topology information; the step of constructing at least one redundant link that is different from multiple control layer links in the control layer link topology pool based on the global topology information of the control layer includes: Based on the logical topology information of the control layer, the physical topology information of the control layer is updated to obtain the updated physical topology information; Based on the updated physical topology information and the logical topology information of the control layer, at least one redundant link is constructed.

5. The method according to any one of claims 1 to 4, characterized in that, The step of updating the link to be switched in the control layer link topology pool to the target link includes: Obtain the link data of the target link and convert the link data into routing control interface data; Based on the routing control interface data, the links to be switched in the control layer link topology pool are updated to the target link.

6. A link switching device, characterized in that, The device is applied to an SDN control system, which includes a control layer link topology pool and a redundant link pool; the device includes: The selection module is used to dynamically select links to be switched from the control layer link topology pool; A matching module is used to select a target link from the redundant link pool that matches the link to be switched, wherein the redundant link pool is used to provide a link switching source for the control layer link topology pool; The replacement module is used to update the links to be switched in the control layer link topology pool to the target link; The selection module is further configured to evaluate the switching priority of each control layer link in the control layer link topology pool based on the link usage time information and network attack information of multiple control layer links in the control layer link topology pool, and obtain priority information, wherein the network attack information is the information recorded when the control layer links in the control layer link topology pool are subjected to network attacks; and dynamically select the link to be switched from the control layer link topology pool according to the priority information.

7. The apparatus according to claim 6, characterized in that, The selection module is also used to randomly and dynamically select links to be switched from the control layer link topology pool.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images