Security service chain arrangement method and device, equipment and medium

Abstract

The invention relates to the technical field of mobile communication, in particular to a security service chain arrangement method, device and equipment and a medium, which are used for improving the flexibility and reliability of low-orbit satellite network security service chain arrangement. The method comprises the following steps: automatically arranging a security service chain of a low earth orbit satellite network by adopting a particle swarm algorithm to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents a security service strategy and a node sequence provided by each target physical node in the target security service chain, and a target function of the particle swarm algorithm is bandwidth consumption of the physical nodes in the security service chain; according to the target security service chain strategy sequence, deploying a corresponding security service strategy on each target physical node to obtain an initial target security service chain; and for the to-be-forwarded task message, determining a scheduling routing scheme of the task message based on the first state information of the target security service chain, and forwarding the task message according to the scheduling routing scheme.

Description

Background Art

[0002] With the development of low-orbit satellite networks, their applications in communication, navigation, remote sensing and other fields are becoming more and more extensive. However, low-orbit satellite networks have some unique characteristics, such as dynamic changes in satellite orbits, signal delays, and complex network topology, which bring challenges to the security protection of low-orbit satellite networks.

[0003] Traditional network security technologies have certain limitations in low-orbit satellite networks. For example, traditional security protection measures are difficult to adapt to the dynamic changes of low-orbit satellite networks and cannot achieve flexible network path selection and network service chain orchestration. At the same time, traditional technologies are also insufficient in dealing with problems such as signal delays and bandwidth limitations in low-orbit satellite networks.

[0004] In summary, how to improve the flexibility and reliability of low-orbit satellite network security service chain orchestration is an urgent issue to be addressed. Summary of the invention

[0005] The embodiments of the present application provide a security service chain orchestration method, device, electronic device and storage medium to improve the flexibility and reliability of low-orbit satellite network security service chain orchestration.

[0006] An embodiment of the present application provides a security service chain orchestration method, including:

[0007] The particle swarm algorithm is used to automatically arrange the security service chain of the low-orbit satellite network to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents: the security service strategy and node sequence provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain;

[0008] According to the target security service chain strategy sequence, deploy corresponding security service strategies on each target physical node to obtain an initial target security service chain;

[0009] For a task message to be forwarded, a scheduling and routing scheme of the task message is determined based on the first state information of the target security service chain, and the task message is forwarded according to the scheduling and routing scheme.

[0010] An embodiment of the present application provides a security service chain arrangement device, including:

[0011] An automatic arrangement unit is used to automatically arrange the security service chain of the low-orbit satellite network by using a particle swarm algorithm to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents: the security service strategy and node sequence provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain;

[0012] A deployment unit, configured to deploy corresponding security services on each target physical node according to the target security service chain policy sequence to obtain an initial target security service chain;

[0013] The task message forwarding unit is used to determine a scheduling routing scheme of the task message to be forwarded based on the first state information of the target security service chain, and forward the task message according to the scheduling routing scheme.

[0014] Optionally, the security service chain orchestration device further includes:

[0015] An adjustment unit is used to adjust the target security service chain according to second status information during the forwarding process of the task message; the second status information includes at least one of the following: the current node status of each target physical node, the current link status of the target security service chain, and the business demand status of the task message.

[0016] Optionally, the automatic arrangement unit is specifically used for:

[0017] Based on the security services provided by each physical node in the target security service chain and the bandwidth consumption corresponding to each physical node, an objective function of a particle swarm algorithm is established to minimize the bandwidth consumption of each physical node in the target security service chain;

[0018] Taking the security service strategies and node order provided by each physical node in the security service chain as control variables, the constraint conditions based on the capability requirements of the security service chain are established;

[0019] According to the objective function and the constraint conditions, the control variables are solved using the particle swarm algorithm to obtain a target security service chain strategy sequence.

[0020] Optionally, the constraint condition includes a node constraint condition and a link constraint condition, and the automatic arrangement unit is specifically used to:

[0021] Establish node constraints according to the resource allocation rules of the physical nodes, where the node constraints are used to constrain the security service chain: the resource requirements of each physical node for deploying the security service policy do not exceed the resource capacity of the corresponding physical node;

[0022] A link constraint condition is established according to the bandwidth allocation rule of the sub-link, and the link constraint condition is used to constrain the security service chain: the bandwidth requirement of the sub-link will not exceed the maximum bandwidth capacity of the physical link.

[0023] Optionally, the constraint condition further includes a mapping constraint condition, and the automatic arrangement unit is further used for:

[0024] A mapping constraint condition is established according to a mapping rule between a physical node and a security service policy. The mapping constraint condition is used to constrain the security service chain: the security service policies on each physical node are independent of each other.

[0025] Optionally, if there are at least two conflicting security service policies in the target security service chain policy sequence, the deployment unit is further used to:

[0026] For at least two conflicting security service policies, obtaining a priority of each of the conflicting security service policies;

[0027] According to the priorities of the conflicting security service policies, the execution order of the conflicting security service policies in the target security service chain policy sequence is adjusted, and the conflicting security service policies after the adjusted execution order are combined to obtain an updated target security service chain policy sequence.

[0028] Optionally, the adjustment unit is specifically used for:

[0029] If it is determined according to the second state information that any target physical node in the target security service chain fails, the target physical node is replaced with a standby physical node;

[0030] If it is determined according to the second status information that the link status of any sub-link in the target security service chain is abnormal, replacing the sub-link with another sub-link with a normal link status;

[0031] If it is determined according to the second status information that the business requirement state of the task message has changed, the security service chain is rearranged according to the current business requirement.

[0032] Optionally, the task message forwarding unit is specifically used to:

[0033] Based on the first state information of the target security service chain, a service chain identifier is specified in the task message using SRv6 to obtain a scheduling routing solution for the task message.

[0034] Optionally, the adjustment unit is further used for:

[0035] According to the adjusted target security service chain, the corresponding service chain identifier is updated in the task message using SRv6 to obtain an updated scheduling routing scheme, and the task message is forwarded according to the updated scheduling routing scheme.

[0036] An electronic device provided in an embodiment of the present application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned security service chain orchestration methods.

[0037] An embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any one of the above-mentioned security service chain orchestration methods.

[0038] An embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs any step of the above-mentioned security service chain orchestration method.

[0039] The beneficial effects of this application are as follows:

[0040] The embodiments of the present application provide a method, device, electronic device and storage medium for arranging a security service chain. First, the present application adopts a particle swarm algorithm to automatically arrange the security service chain of a low-orbit satellite network, which can improve the efficiency and flexibility of the arrangement of the service chain. By taking the bandwidth consumption of the physical node as the objective function, the particle swarm algorithm searches for the optimal solution in a global scope and generates a target security service chain policy sequence, thereby clarifying the security service policy and its execution order to be provided by each physical node. This arrangement method effectively reduces the waste of bandwidth resources, improves resource utilization, and solves the problem of limited bandwidth in low-orbit satellite networks. On this basis, according to the generated policy sequence, the corresponding security service policy is automatically deployed on the target physical node to form an initial target security service chain, realizing the automation and efficiency of service chain deployment and reducing the complexity of manual operation. At the same time, for the task message to be forwarded, based on the first state information of the target security service chain, a task scheduling routing scheme can be dynamically generated, and the task message can be quickly forwarded according to the scheme, thereby reducing the delay and packet loss rate of data transmission and improving the transmission reliability and efficiency of the task. In addition, since the topology of low-orbit satellite networks changes frequently and resources are unevenly distributed, the particle swarm algorithm can be used to orchestrate the service chain, which can quickly respond to dynamic changes in the network, adjust strategies and routes in real time to adapt to business needs, and significantly enhance the stability and adaptability of the network, providing an efficient, intelligent, and secure service chain solution for low-orbit satellite networks.

[0041] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 A schematic diagram of an application scenario of an embodiment of the present application;

[0044] Figure 2 A flowchart of a security service chain arrangement method provided in an embodiment of the present application;

[0045] Figure 3 A flow chart for obtaining a target security service chain policy sequence provided in an embodiment of the present application;

[0046] Figure 4 A flowchart of implementing automatic orchestration of a security service chain using a particle swarm algorithm provided in an embodiment of the present application;

[0047] Figure 5 An implementation flow chart of a security service chain orchestration method for solving policy conflict problems provided in an embodiment of the present application;

[0048] Figure 6 A schematic diagram of a low-orbit satellite node, a ground station, and a user terminal of a low-orbit satellite network collaboratively processing a task message provided in an embodiment of the present application;

[0049] Figure 7 A flowchart of a method based on security service chain orchestration provided in an embodiment of the present application;

[0050] Figure 8 A schematic diagram of the structure of a security service chain orchestration device in an embodiment of the present application;

[0051] Fig. 9 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0053] The following is an introduction to some concepts involved in the embodiments of the present application.

[0054] Low-orbit satellite network: The low-orbit satellite network is composed of satellites operating in low earth orbit (LEO), with the characteristics of wide coverage, low communication delay, and high bandwidth utilization. It can provide efficient communication, navigation and monitoring services to users around the world, and is particularly suitable for complex, dynamic and high-reliability network environments.

[0055] Security service chain: In the low-orbit satellite network, the security service chain refers to the description of the process of forwarding mission messages in the low-orbit satellite network in accordance with the established order required by the business logic, passing through the security service policies on multiple designated security service physical nodes. These security service policies include firewalls, intrusion detection, web application firewalls, etc.

[0056] Security service chain orchestration: Security service chain orchestration refers to the process of dynamically adjusting the security service chain execution order in the low-orbit satellite network by optimizing the configuration of various security service nodes according to mission requirements and security service strategies. When performing security service chain orchestration, it mainly relies on the orchestration of virtualized security resources. By deploying security resource strategies on low-orbit satellite network nodes, a security resource pool is formed, and then the mission message is pulled to the security resource pool for security protection.

[0057] Security service chain strategy sequence: The security service chain strategy sequence refers to the order of physical nodes and their corresponding security service strategies that the mission message needs to pass through in the low-orbit satellite network according to the pre-arranged security service chain. The security service chain strategy sequence not only describes the execution order of each security service node, but also clarifies the specific security service strategy that needs to be implemented on each physical node.

[0058] Security resource pool: The security resource pool is a key component for the centralized management of security service strategies in low-orbit satellite networks. It virtualizes traditional security devices (such as firewalls, intrusion detection systems, etc.) and deploys them on dedicated virtualization servers to form a centralized resource management platform. Virtualized security devices are connected to form a resource pool through dedicated switches. Since the security devices in the security resource pool are run in a virtualized form, user business traffic cannot be directly serialized through physical devices as in the traditional way, but needs to be guided to each virtualized security device in the resource pool for processing through traffic diversion technology.

[0059] Virtual Network Function: A virtual network function (VNF) is a specific network function instance implemented through virtualization technology. It deploys the functions of traditional network devices (such as routers, firewalls, intrusion detection systems, etc.) in the form of software on general hardware or cloud environments. Virtual network functions include not only traditional network functions (such as data routing, traffic forwarding, network optimization, etc.), but also security-related functions (such as firewalls, intrusion detection, antivirus, traffic cleaning and other security service functions).

[0060] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0061] like Figure 1 As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes multiple low-orbit satellites 110, multiple ground stations 120 and multiple user terminals 130.

[0062] In an embodiment of the present application, the transmission order of the mission message between the devices is flexible and diverse. For example, the mission message can be transmitted from the user terminal device 130 to the low-orbit satellite 110, and then from the low-orbit satellite to the ground station 120, and finally enter the external network. Similarly, it is also possible to transmit the mission message from the external network to the low-orbit satellite through the ground station, and finally reach the user terminal device. In addition, direct transmission of mission messages is supported between low-orbit satellites. For example, after a low-orbit satellite receives a mission message, it can be transmitted to other low-orbit satellites, and then the target low-orbit satellite sends the mission message to the ground station 120. This communication between low-orbit satellites can be one-to-one or one-to-many.

[0063] During the communication process, the roles of devices are flexible. The sender can be any of the user terminal, low-orbit satellite or ground station, and the receiver can also be any of these devices. After receiving the task message, the receiver can also switch roles and transmit the task message to other devices as a sender. The sender can also process the task message from other devices as a receiver.

[0064] In order to ensure the security of mission messages transmitted in the low-orbit satellite network, the security service chain is required to guide the mission messages in the process of sending or receiving them. The security service chain ensures that the mission messages pass through multiple security service nodes in sequence according to the predefined security service policies and processes, including but not limited to firewalls, intrusion detection systems (IDS), Web application firewalls (WAF), etc., to ensure that the messages can obtain comprehensive security protection during transmission.

[0065] In an optional implementation, the low-orbit satellite 110, the ground station 120, and the user terminal 130 may communicate with each other via a communication network.

[0066] In an optional implementation, the communication network is a wired network or a wireless network.

[0067] It should be noted that Figure 1 The number of devices and connection methods shown are only examples. In actual application scenarios, there is no limit to the number of low-orbit satellites, ground stations, and user terminals. It can be freely expanded according to the network scale and business needs. For example, in a large-scale low-orbit satellite constellation network, it can include thousands of low-orbit satellites and hundreds of ground stations to form a global communication and security network.

[0068] In addition, the embodiments of the present application can be applied to various scenarios, including not only aerospace communication scenarios, but also including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving and other scenarios.

[0069] The application scenarios mentioned above will be described in detail below. In the aerospace communication scenario, the low-orbit satellite network undertakes important data transmission tasks. This application can realize the automatic orchestration of the security service chain of the low-orbit satellite network to ensure the safe transmission of aerospace communication data. Through security orchestration, data can be encrypted, authenticated and other security processing to prevent data from being stolen or tampered with. At the same time, when a satellite fails, it automatically switches to the backup satellite node to improve the reliability of communication.

[0070] In smart transportation scenarios, the demand for communication between vehicles and transportation infrastructure is increasing. Low-orbit satellite networks can provide wide-area coverage communication services for smart transportation. This application can ensure the security of data transmission in smart transportation systems. For example, communication data between vehicles and traffic control centers can be encrypted and authenticated through a security service chain to prevent malicious attacks. In addition, by optimizing the scheduling of network traffic, the transmission efficiency of traffic data can be improved, providing support for real-time decision-making in smart transportation systems.

[0071] In emergency rescue scenarios, low-orbit satellite networks can provide fast and reliable communication guarantees for rescue teams. This application can ensure the safe transmission of emergency rescue data, such as video images of the rescue site, personnel location and other information can be safely transmitted to prevent illegal access. At the same time, through the dynamic scheduling of network resources, the bandwidth requirements of emergency rescue communications can be prioritized to improve rescue efficiency.

[0072] The following describes the security service chain orchestration method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0073] See also Figure 2 As shown, it is an implementation flow chart of a security service chain orchestration method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0074] S21: Use the particle swarm algorithm to automatically arrange the security service chain of the low-orbit satellite network to obtain the target security service chain policy sequence; wherein, the target security service chain policy sequence represents: the security service policies and node order provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain.

[0075] Specifically, the target security service chain strategy sequence refers to the strategy combination finally selected by the particle swarm algorithm after optimization. These strategy combinations are obtained by minimizing bandwidth consumption through the objective function of the particle swarm algorithm, where the security service strategy of each physical node has been determined, and the order of the physical nodes providing the above security service strategy is also fixed. The objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain.

[0076] In the embodiments of the present application, the security service strategy refers to a set of rules for security protection and management of mission messages in a low-orbit satellite network. These strategies include, but are not limited to, firewalls, intrusion detection systems, web application firewalls, traffic cleaning, malware detection and other network security functions. It should be noted here that the security service strategies listed above are only some common examples, and the specific security service strategy types can be flexibly configured according to the needs of actual application scenarios. Therefore, this application does not specifically limit the specific security service strategy types and implementation methods of this application.

[0077] In actual applications, these security service policies are centrally managed and provided through the security resource pool. The security resource pool is a collection of security service functions built based on virtualization technology, in which virtualized security device instances are deployed, which can flexibly provide the above security service policies. When the mission message enters the low-orbit satellite network, the resource pool will assign the corresponding security service policy to the mission message according to the orchestrated security service chain, thereby achieving effective protection and management of the mission message.

[0078] In order to achieve the optimal security service chain arrangement and ensure that the nodes and security service combinations that the mission message passes through in the low-orbit satellite network have the minimum bandwidth consumption, this application uses the particle swarm algorithm to automatically arrange the security service chain. The following will explain the specific process of the particle swarm algorithm to obtain the target security service chain strategy sequence, see Figure 3 As shown, it is a flow chart for obtaining a target security service chain policy sequence provided in an embodiment of the present application, and the steps are shown in S31 to S33:

[0079] S31: Based on the security services provided by each physical node in the target security service chain and the bandwidth consumption corresponding to each physical node, an objective function of the particle swarm algorithm is established to minimize the bandwidth consumption of each physical node in the target security service chain.

[0080] In the embodiment of the present application, each "particle" in the particle swarm algorithm represents a possible combination of security service chain strategies, which can also be called an orchestration solution. The "orchestration solution" here refers to a specific arrangement of physical node selection and security service sequence, representing the path that the task message passes through in the security service chain and the service strategy combination corresponding to the physical node.

[0081] When initializing the particle swarm, multiple groups of particles (i.e., multiple strategy combinations) are randomly generated. The initial bandwidth consumption of these particles may not be optimal, but it provides a starting point for the particle swarm algorithm to optimize the orchestration solution. Then, the fitness of each particle is evaluated through the preset objective function (minimization of total bandwidth consumption), and the evaluation results are used to guide the update and optimization of subsequent particles.

[0082] Through such initial construction and evaluation, a clear optimization direction is provided for subsequent steps.

[0083] The above introduces the construction of the objective function and the generation of initial particles. The following will explain the optimization process of the particle swarm algorithm in combination with the constraints.

[0084] S32: Taking the security service strategy and node order provided by each physical node in the security service chain as control variables, establish constraint conditions based on the capability requirements of the security service chain.

[0085] In the embodiment of the present application, during the particle swarm algorithm optimization process, the security service policies and node order provided by each physical node in the security service chain are required as control variables, based on which constraints based on the capability requirements of the security service chain are established.

[0086] These constraints play a guiding role in the solution process, which is equivalent to the termination conditions of the particle swarm algorithm, ensuring that the optimization results meet the actual deployment requirements. At the same time, the particle swarm will exclude solutions that do not meet the constraints during the solution process.

[0087] Constraints are based on the capability requirements of the security service chain, including node constraints and link constraints. The following is a detailed introduction to node constraints and link constraints:

[0088] (I) Node constraints.

[0089] Node constraints are established based on the resource allocation rules of physical nodes. Node constraints are used to constrain the security service chain: the resource requirements of each physical node to deploy a security service policy do not exceed the resource capacity of the corresponding physical node.

[0090] Optionally, a node constraint condition can be expressed as follows: For any physical node Physical Node n i The total demand for resource r by all virtual network function instances deployed on node n cannot exceed i Available resource capacity,

[0091]

[0092] Where N represents the set of all physical nodes in the low-orbit satellite network topology, ni Represents a physical node in the low-orbit satellite network security service link;

[0093] Indicates deployment on a physical node n i A collection of virtual machine instances stored on a physical node. A virtual machine instance refers to a specific implementation instance of a virtual network function. It runs on a physical node, consumes the resources of the physical node, and is used to carry specific network functions or security service functions. It includes the following two parts:

[0094] Indicates that it is placed on a physical node n i The network security service capabilities of low-orbit satellites on the Internet, such as firewall functions and traffic cleaning;

[0095] It represents the business combination corresponding to the low-orbit satellite network security service chain. The business combination is part of the overall operation of the low-orbit satellite network security service chain. It contains elements such as applications, service modules, configuration information, etc. related to the operation of the security service chain. These elements work together to realize the network functions supported by the cloud network security service chain. For example, the business combination can include routing forwarding elements, load balancing elements, etc.

[0096] m j Represents a physical node n i A unit factor is a basic element in the information instance set stored on a physical node in a security service link. It represents the components of various information instances related to the physical node.

[0097] R represents a set of resource types requested in the virtual network function, such as CPU, memory, bandwidth, etc., and r represents a type of resource, which can be CPU, memory, or bandwidth;

[0098] Represents the unit factor relative to the number of data requests for class r resources, Represents physical node n i The amount of data that can be provided by r-type resources.

[0099] Therefore, Formula 1 indicates that for physical node n i A collection of all virtual network function instances on Their total demand for a certain type of resource r Cannot exceed physical node n i The total supply of this type of resource r

[0100] In an optional embodiment, it is assumed that there is a physical node n in the low-orbit satellite network. i It provides the following resources: 16 CPU cores, 64 GB memory, and 100 Mbps bandwidth. i The following virtual network function instances are deployed on the virtual router instance m j : Requires 4-core CPU, 16GB memory, 20Mbps bandwidth and virtual firewall instance m j : Requires a 6-core CPU, 32GB of memory, and 40Mbps bandwidth.

[0101] Then use Formula 1 to verify whether the node constraints are met:

[0102] For CPU resources: 4+6=10≤16 satisfies the constraint)

[0103] For memory resources: 16+32=48≤64 (satisfies the constraint)

[0104] For bandwidth resources: 20+40=60≤100 (satisfies the constraint)

[0105] Therefore, the resource allocation on the physical node satisfies the node constraint.

[0106] (ii) Link constraints.

[0107] Link constraints are established based on the bandwidth allocation rules of the sub-links. The link constraints are used to constrain the security service chain: the bandwidth demand of the sub-link will not exceed the maximum bandwidth capacity of the physical link.

[0108] Optionally, a link constraint condition may be expressed as follows:

[0109]

[0110] Among them, placing virtual network functions in the low-orbit satellite network security service link is mainly divided into virtual links constructed on the service link and physical links actually included in the low-orbit satellite network topology. Link constraints are also one of the constraints to ensure the automatic orchestration of the service chain, which can ensure that the bandwidth provided is within a controllable range.

[0111] Among them, S(l i ) indicates that in link l i The total bandwidth that can be provided, for random physical links, u(l i ) cannot exceed S(l i), C represents all requests mapped on the low-orbit satellite network service link, P represents the requests received on the low-orbit satellite network service function chain, and p j represents the virtual service link corresponding to the low-orbit satellite network security service request, w(p j ) represents the virtual service link p j The actual corresponding physical link set, Indicates virtual service link p j The amount of bandwidth resource requests received in .

[0112] Exemplarily, a low-orbit satellite security service chain includes three virtual service links p1, p2, and p3, and these virtual links are mapped to actual physical links l1, l2, and l3 in the low-orbit satellite network, respectively.

[0113] For the physical link 11, its maximum available bandwidth S(l1) is 100 Mbps, for the physical link l2, its maximum available bandwidth S(l2) is 150 Mbps, and for the physical link l3, its maximum available bandwidth S(l3) is 200 Mbps.

[0114] The bandwidth requirement of virtual service link p1 is 50Mbps, the bandwidth requirement of p2 is 60Mbps, and the bandwidth requirement of p3 is 80Mbps. Then the virtual link is mapped to the physical link: w(p j ) is mapped to l1, w(p j ) is mapped to l2, w(p j ) is mapped to l2 and l3 (shared link resources), then according to formula 2:

[0115] For link l1, satisfies u(l1)≤S(l1) (i.e. 50Mbps≤100Mbps); for link l2, Satisfy u(l2)≤S(l2) (i.e. 140Mbps≤150Mbps); for link l3: Full u(l3)≤S(l3) (i.e. 80Mbps≤200Mbps).

[0116] The calculation of the link constraints in the above example shows that the bandwidth requirements of each virtual link are within the available bandwidth range of the mapped physical link, satisfying u(l i )≤S(l i ) constraint, indicating that the resource mapping of the current service chain is feasible and will not cause link overload.

[0117] Through the above-mentioned node constraints and link mapping conditions, the node constraints ensure that the resource consumption of each physical node will not exceed its capacity limit, while the link constraints ensure that the bandwidth demand of the virtual link will not exceed the carrying capacity of the physical link. This dual constraint mechanism avoids the occurrence of resource overload and loss of control, and ensures the stability and reliability of the service chain in terms of resource use. At the same time, through the reasonable planning of constraints, the low-orbit satellite network can flexibly respond to dynamically changing environments, such as changes in satellite positions and changes in resource loads. The constraint calculation of node and link resources provides the feasibility of dynamically expanding or reducing the service chain: when a new virtual network function is required, the node constraints can evaluate the carrying capacity of the physical node. When the service chain path needs to be readjusted, the link constraints can ensure that the bandwidth resources on the new path meet the demand. This flexibility enables the low-orbit satellite network to adapt to more complex application scenarios.

[0118] In an optional embodiment, the constraint condition further includes a mapping constraint condition, and the mapping constraint condition is described below:

[0119] (III) Mapping constraints.

[0120] Mapping constraints are established based on the mapping rules of physical nodes and security service policies. The mapping constraints are used to constrain the security service chain: the security service policies on each physical node are independent of each other, ensuring a balanced configuration of resources between virtual network functions and physical nodes.

[0121] Optionally, a link constraint condition may be expressed as follows:

[0122]

[0123] Where V represents the resource state of the node, φ is the empty set symbol, and represents the resource constraint of the physical node. Formula 3 represents the resource set summary of all physical nodes, which must cover the resource requirement set of the entire virtual network function. Formula 4 represents any two physical nodes n i and n j The resource allocation on each node is independent and does not conflict with each other.

[0124] For example, the network topology includes three physical nodes n1, n2, and n3, which have the following resource states: n1, CPU 4 cores, memory 16GB; n2, CPU 6 cores, memory 32GB; n3, CPU 8 cores, memory 64GB. There are three virtual network function instances that need to be deployed: function instance v1, which requires a CPU 2 core and memory 8GB function instance; v2, which requires a CPU 4 core and memory 16GB function instance; v3, which requires a CPU 6 core and memory 24GB. Map function instance v1 to physical node n1, map function instance v2 to physical node n2, and map function instance v3 to physical node n3.

[0125] According to formula 3 and formula 4, Check {v1}∩{v2}=φ, {v2}∩{v3}=φ, {v1}∩{v3}=φ. The results are all φ, which satisfies the mapping constraints.

[0126] By mapping constraints, node constraints and link constraints are supplemented to avoid interference or conflict between resources of different nodes, so that each physical node can independently manage and allocate its resources to the corresponding virtual network functions, thereby realizing effective management and optimal configuration of resources in the security service chain and ensuring the stable operation of the entire cloud network security service chain.

[0127] The above constraints ensure the feasibility of the target security service chain strategy combination and the reasonable allocation of resources. The following will further explain how to use the objective function and constraints to solve the optimal security service chain strategy sequence in combination with the optimization process of the particle swarm algorithm.

[0128] S33: According to the objective function and constraints, the particle swarm algorithm is used to solve the control variables to obtain the target security service chain strategy sequence.

[0129] In the process of solving the optimal security service chain strategy sequence by using the objective function and constraint conditions, the target security service chain strategy sequence is obtained through continuous iterative solution.

[0130] See also Figure 4 As shown, it is an implementation flow chart of a particle swarm algorithm provided in an embodiment of the present application to realize automatic orchestration of a security service chain, and the steps are shown in S401 to S406:

[0131] S401: Initialize the particle swarm and randomly generate a group of particles, each particle represents a possible strategy combination, also called an orchestration solution.

[0132] S402: Perform fitness evaluation on each particle according to a predetermined evaluation function.

[0133] S403: Record the position of the particle with the best fitness. In each iteration, record the particle with the best fitness in the current particle group (i.e., the strategy combination with the lowest bandwidth consumption), which is called the global optimal solution. At the same time, each particle will also record its historical best position (individual optimal position).

[0134] S404: Update the speed and position of the particle. According to the individual historical optimal position and the global optimal position, adjust the speed and position of the particle (i.e., optimize the strategy combination) to gradually approach the optimal solution.

[0135] In this application, this process is equivalent to rearranging the node order of the security service chain and the security service allocation to obtain a better bandwidth allocation solution.

[0136] S405: Determine whether the constraint condition is satisfied. If the constraint condition is satisfied, execute S406. If the constraint condition is not satisfied, repeat the above S402 to S404 for iteration until the constraint condition is satisfied.

[0137] S406: Output the optimal solution. The particle position with the best final fitness is the optimal solution, which represents the best target security service chain strategy combination.

[0138] Through the above process, the particle swarm algorithm is used to model the particle swarm of the security service chain strategy and optimize iteratively for multiple rounds, thus realizing the automatic orchestration process with the minimum bandwidth consumption. By setting the objective function and constraints reasonably and dynamically adjusting the position and speed of the particles, it is ensured that the algorithm can quickly converge to the optimal solution in the complex low-orbit satellite network environment, thereby generating a target security service chain strategy sequence that meets actual needs.

[0139] S22: According to the target security service chain policy sequence, deploy corresponding security service policies on each target physical node to obtain an initial target security service chain.

[0140] In an optional embodiment, the automated orchestration tool Ansible may be used to implement and deploy the target security service chain on each target physical node.

[0141] Exemplarily, first, after optimization through the particle swarm algorithm, the target security service chain policy sequence is obtained. This sequence determines the specific security services that need to be deployed on each physical node and their order. For example: physical node 1: firewall (Firewall), physical node 2: intrusion detection system (IDS), physical node 3: malware detection (MalwareDetection). After determining the policy sequence of the target security service chain, the Ansible automation tool can be used for deployment. Ansible can help automate configuration management and software deployment to ensure that security services are correctly configured and run on each physical node according to the expected policy sequence.

[0142] Ansible uses inventory files to specify managed hosts or nodes. Each Ansible node is classified into different groups, such as firewall nodes, IDS nodes, malware detection nodes, etc. The inventory file specifies the IP address, host name, and other information of each Ansible node so that Ansible can communicate with the low-orbit satellite network.

[0143] Specifically, it will automatically connect to the specified physical node and complete the deployment of each task in sequence according to the policy sequence. For example, for a firewall node, Ansible will automatically install and configure the firewall service; for an IDS node, Ansible will install the intrusion detection system and configure the corresponding rules; for a malware detection node, Ansible will install and start the malware detection service.

[0144] Ansible will output the execution results of each task, and users can view these outputs to ensure that the services on each node have been successfully deployed and enabled. If the service deployment of any node fails, Ansible will provide error information to help users troubleshoot.

[0145] By using automated orchestration tools, security service chains can be deployed efficiently and consistently on each target physical node of the low-orbit satellite network. This automated approach reduces the complexity and error rate of manual configuration, ensuring rapid deployment and efficient operation of security services.

[0146] In the embodiment of the present application, if an automated orchestration tool is used to implement and deploy a security service chain, if it is found that there are at least two conflicting security service policies in the target security service chain policy sequence, then the corresponding security service is deployed on each target physical node, and before the initial target security service chain is obtained, the following steps of resolving policy conflicts are also included, see Figure 5 As shown, it is an implementation flow chart of a security service chain orchestration method for solving policy conflict problems provided by an embodiment of the present application. The specific implementation process of the method is shown in S51 to S53 as follows:

[0147] S51: For at least two conflicting security service policies, obtain the priority of each conflicting security service policy.

[0148] In an embodiment of the present application, when a decision node of a low-orbit satellite network detects that there are at least two conflicting security service policies in the target security service chain policy sequence, the decision node first opens a northbound interface, which is responsible for communicating with other systems or databases. Through this interface, the decision node can request and receive priority information about each conflicting security service policy. This priority information is usually determined by evaluating the needs and importance of each security service policy, such as the policy's demand for bandwidth, computing resources, and their role in security protection.

[0149] S52: adjusting the execution order of the conflicting security service policies in the target security service chain policy sequence according to the priority of each conflicting security service policy, and combining the conflicting security service policies after the adjusted execution order to obtain an updated target security service chain policy sequence.

[0150] Among them, the nodes and service policies in the security service chain are optimized or reordered according to the priority of the policy. Specifically, this adjustment may involve the correspondence between policies and nodes, or the adjustment of the node order, or a combination of the two. The following will explain in detail:

[0151] Method 1: Adjust the correspondence between strategies and nodes:

[0152] If there are conflicts between multiple security service policies (for example, some policies need to be executed first, while some policies must be executed later), a possible adjustment method is to rearrange the correspondence between policies and physical nodes. That is, change the policy originally deployed on a node and redeploy it to other physical nodes. For example, the traffic cleaning policy originally deployed on node A may need to be migrated to node B for execution due to conflicts with firewall rules.

[0153] This adjustment not only changes the order of policies, but also changes the distribution of policies on physical nodes to avoid conflicts.

[0154] Method 2: Adjust the node order:

[0155] The second adjustment method is to change the order of physical nodes. For example, if a policy needs to be executed in a specific order, and the original node order does not meet this requirement, the order of the nodes can be adjusted to ensure that high-priority security services are executed first. For example, the firewall policy must be executed first, followed by traffic cleaning. If the existing node order does not meet this requirement, the node order can be adjusted so that the firewall policy is executed first and the traffic cleaning policy is executed later, achieving the optimal execution order.

[0156] This adjustment is usually based on the order of nodes in the security service chain to optimize the traffic processing order of the entire service chain.

[0157] Method 3: Both the strategy and node order can be adjusted:

[0158] In some cases, you may need to adjust both the policy and the node order. For example, some security service policies are closely related to physical nodes, but are also subject to the influence of the node order. In this case, you must consider adjusting both the policy and the node order to obtain the best security protection effect and bandwidth efficiency.

[0159] For example, suppose there are multiple nodes A, B, and C in the network, and the firewall policy of node A conflicts with the traffic cleaning policy of node B. In this case, it may be necessary to adjust the firewall policy from node A to node C, and adjust the order of the nodes to ensure that the firewall policy of node C can be executed before traffic cleaning.

[0160] After adjusting the execution order of the conflicting security service policies in the target security service chain policy sequence in the above manner, the conflicting security service policies after the adjusted execution order are combined, as will be specifically described below:

[0161] Combining conflicting security service strategies after adjusting the execution order means integrating strategies with complementary functions in the adjusted strategy sequence so that they cooperate with each other to complete multi-level security protection for network traffic, and obtaining an updated target security service chain strategy sequence after combining.

[0162] For example, in a low-orbit satellite network, there may be a conflict in the execution order between security intrusion detection and protection and traffic cleaning strategies. The solution is to deploy the intrusion detection strategy on node A to ensure that it is executed first, and then deploy the traffic cleaning strategy on node B and set it to be executed after intrusion detection, so that traffic cleaning will not interfere with the intrusion detection process. Ultimately, the combination of intrusion detection and protection and traffic cleaning strategies can provide stronger security protection effects.

[0163] In an optional implementation, the conflicting security service policies after adjusting the execution order can be combined by adjusting the execution scope of the conflicting policies through fine-grained control, and assigning appropriate data flow types or attributes to each conflicting policy. Exemplarily, still taking the conflicting policies as intrusion detection and traffic cleaning as an example, the risk level or traffic characteristics of the task message can be classified to dynamically adjust its processing path in the service chain, so that only high-risk traffic passes the intrusion detection first, and low-risk traffic is directly cleaned to reduce resource consumption, while ensuring that high-risk traffic is fully analyzed first to avoid conflicts caused by consistent policy processing of all traffic.

[0164] Through the above method, the problem caused by policy conflicts in the target security service chain policy sequence is solved, and multi-level security service functions are realized by adjusting the priority of conflicting policies and combining functionally complementary policies. The adjusted security policy optimizes the execution order and resource allocation, eliminates policy conflicts in the low-orbit satellite network, reduces network congestion, and thus effectively reduces the CPU load and significantly reduces CPU utilization.

[0165] S53: Finally, according to the updated target security service chain policy sequence, use the automated orchestration tool to deploy the corresponding security service on each target physical node to obtain the initial target security service chain.

[0166] Through the above process of resolving policy conflicts, the relationship between various security service policies can be automatically coordinated and managed, so that the decision node can correctly orchestrate network flow transmission according to the priority of the network service chain, eliminate conflicts in the low-orbit satellite network, reduce network congestion, thereby reducing CPU load and CPU utilization, and at the same time transmit the decision results to the corresponding flow regulation point.

[0167] The above introduces the process of deploying corresponding security service policies on each target physical node according to the target security service chain policy sequence to obtain the initial target security service chain. It also introduces how to resolve policy conflicts when there are policy conflicts, and re-deploy corresponding security service policies on each target physical node according to the target security service chain policy sequence to obtain the initial target security service chain. The following will introduce how to forward task messages according to the initial target security service chain.

[0168] S23: For the task message to be forwarded, determine a scheduling routing scheme for the task message based on the first state information of the target security service chain, and forward the task message according to the scheduling routing scheme.

[0169] Among them, mission messages refer to data packets transmitted in the low-orbit satellite network. These data packets contain user business requests or mission instructions. Their core goal is to process and forward them securely according to the specified service chain. Mission messages usually include but are not limited to the following key information: source address, which is the IP address of the user terminal, used to identify the source of data; destination address, which is the target service chain identifier and the IP address of the final service node, used to guide the mission message to be transmitted along the specified path; business demand information, such as dynamic adjustment of security service policy priority, delay requirements, bandwidth requirements and other parameters, used to indicate the service level required by the mission message.

[0170] In an embodiment of the present application, a scheduling and routing scheme of the task message is determined based on the first state information of the target security service chain, and the scheduling and routing scheme indicates a specific forwarding path of the task message.

[0171] For the task message to be forwarded, the specific forwarding path of the task message is obtained according to the first state information of the target security service chain, which is described in detail below:

[0172] In the embodiment of the present application, the message forwarding path of the task message is obtained according to the first state information of the target security service chain, which will be described in detail below:

[0173] Firstly, in the process of forwarding the task message, first state information in the security resource pool is obtained; the security resource pool is used for centralized management and provision of security service policies.

[0174] The security resource pool is a centralized resource management module responsible for scheduling and managing security service resources in the network, including physical nodes, link resources, and security service policies. During the operation of the security service chain, the security resource pool centrally manages the state information of the security resource pool. The state information is generated during the operation of the security service chain and stored in the security resource pool. The flow adjustment point dynamically adjusts the specific forwarding of the target task message through the target security service chain according to the state information. The following will introduce it in detail.

[0175] In the process of forwarding task messages, the flow regulation point first needs to obtain the latest first state information from the security resource pool. The first state information includes but is not limited to the following:

[0176] 1. Data traffic related information: such as the real-time traffic size, traffic distribution, and traffic burstiness on each link or node. This helps the traffic regulation node understand the current network load status so as to reasonably allocate resources and adjust routes.

[0177] 2. Security service processing progress: The progress of each security service node in processing data packets or business requests, such as the progress of firewall rule detection, the scanning progress of the intrusion detection system, etc., so that subsequent nodes can prepare to receive and process data in time.

[0178] 3. Service chain node status: including the operating status of each node (such as servers, security devices, etc.), such as whether it is running normally, whether there are faults or performance bottlenecks, etc. If a node has a problem, the route can be adjusted in time to bypass the node.

[0179] 4. Security incident information: whether security incidents such as intrusion behavior and abnormal traffic patterns have been detected, as well as the location and severity of the security incident, so that appropriate response measures can be taken, such as strengthening protection and blocking related connections.

[0180] 5. Resource usage: The resource usage of each node (such as CPU, memory, bandwidth, etc.) ensures reasonable allocation of resources and avoids excessive occupation of certain node resources and affects the overall service chain performance.

[0181] 6. Data transmission status: Whether the data is transmitted normally in the service chain, whether there is data loss, delay, retransmission, etc., to ensure the integrity and timeliness of the data.

[0182] Through this status information, the flow regulation point can understand the operation status and resource usage of the entire security service chain in real time, so as to select the best forwarding path for the task message.

[0183] After obtaining this first state information, the flow regulation point will comprehensively consider the specific requirements of the task message (such as bandwidth, latency requirements, etc.) and the current network status, evaluate the load and resource availability of each target physical node, and dynamically adjust the forwarding path of the task message.

[0184] Specifically, the flow regulation point will select the optimal forwarding path based on the source address, destination address and other parameters of the task message, combined with the current network status, resource usage of each node, traffic load and security events, to ensure that data traffic can be transmitted efficiently and quickly. At the same time, the flow regulation point will also ensure the smooth transmission of the task message between each security service policy node (i.e., the target physical node) based on the security protection strategy and real-time status information to avoid network congestion or security risks.

[0185] Finally, the flow regulation point forwards the mission message along the correct path according to the calculated scheduling routing plan, ensuring that the mission message can reach the destination safely and efficiently in the low-orbit satellite network. This process monitors the network status in real time, dynamically adjusts the forwarding path, optimizes the use of network resources, and ensures the efficient operation of the service chain.

[0186] In an optional implementation, the scheduling routing scheme obtained by the flow scheduling node is transmitted to the controller of the low-orbit satellite network to achieve directional processing of data traffic. This process communicates through a message queue, which uses an asynchronous communication method. The sender sends the scheduling information to the queue without waiting for the receiver's response. Due to the characteristics of asynchronous communication, this method can significantly improve the response speed of the security service chain, thereby speeding up the processing and forwarding efficiency of data traffic. Through the message queue, the communication between the flow scheduling node and the controller is more efficient, avoiding the delay caused by synchronous waiting, and improving the real-time and stability of the network. Especially in the case of dynamically adjusting the service chain and routing, it helps to quickly respond to changes in network status and adjustments to business needs.

[0187] The above process describes how the flow regulation point determines the scheduling routing scheme of the task message based on the first state information of the target security service chain, and forwards the task message according to the scheme. Next, the scheduling routing scheme of the task message can specify the service chain identifier by adopting SRv6 (Segment Routing over IPv6) technology, thereby realizing the forwarding of the task message.

[0188] For the task message to be forwarded, based on the first state information of the target security service chain, SRv6 is used to specify the service chain identifier in the task message to obtain a scheduling routing solution for the task message, and the task message is forwarded according to the scheduling routing solution.

[0189] Among them, SRv6 is a source routing technology based on IPv6. It specifies a series of segments in the header of each mission message. These segments represent the addresses of each hop in the network. Through these segments, the mission message can be forwarded along the specified path in the network without relying on traditional routing table lookup. SRv6 is a source routing technology. In the low-orbit satellite network, it can realize the free selection of low-orbit satellite nodes and paths, and has the function of assisting and guiding the transmission of network data packets along the specified path.

[0190] First, in an embodiment of the present application, when deploying the target security service chain, SRv6 is used to embed a service chain identifier in the task message. This service chain identifier indicates along which service chain path the task message should be forwarded. Specifically, the service chain identifier contains the physical nodes that the task message needs to pass through in sequence and their security service policy information. Through SRv6, the task message can pass through these nodes in sequence according to the definition of the target security service chain to perform the required security services (such as firewalls, traffic cleaning, etc.).

[0191] Secondly, in the process of forwarding the mission message, the specific forwarding path of the message is guided according to the destination address information of SRv6. By specifying the service chain identifier in the destination address, the message passes through different security service chains in sequence according to the specified service chain order to complete the security protection of the low-orbit satellite node.

[0192] Through the above process, SRv6 provides flexible and efficient path guidance capabilities in the low-orbit satellite network, which can dynamically adjust the forwarding path of the mission message according to the real-time status of the network, while ensuring the sequential delivery of the mission message in the security service chain. The use of SRv6 enables the low-orbit satellite network to flexibly select nodes according to the actual needs of the security service chain, thereby improving the security, reliability and performance of the low-orbit satellite network.

[0193] In addition, the target security service chain is not fixed. As the network environment and task requirements change, the service chain needs to be dynamically adjusted according to the real-time situation. The following will introduce the details:

[0194] During the forwarding process of the task message, the target security service chain is adjusted according to the second state information; the second state information includes at least one of the following: the current node state of each target physical node, the current link state of the target security service chain, and the business demand state of the task message.

[0195] Target physical node status: including but not limited to the node's CPU utilization, memory usage, task processing delay, etc., reflecting the node's current load and operating status.

[0196] Target security service chain link status: including but not limited to link delay, packet loss rate, bandwidth usage, etc., indicating the transmission quality of the link.

[0197] Business requirement status of task messages: real-time changes in task requirements, including but not limited to dynamic adjustment of latency requirements, bandwidth requirements, or security service policy priorities.

[0198] The specific process of dynamically adjusting the target security service chain according to the second state information is described below:

[0199] The following will explain the status information including the current node status of the target physical node, the current link status of the target security service chain, and the business requirement status of the task message:

[0200] Case 1: if it is determined according to the second state information that any target physical node in the target security service chain fails, the target physical node is replaced with a standby physical node;

[0201] In an embodiment of the present application, the second state information of the physical node is obtained from the security resource pool. When a fault (such as hardware damage or resource exhaustion) is detected in the target physical node, the node is marked as unavailable. Other physical nodes in the security resource pool with sufficient resources and providing the same security service capabilities are selected as replacements. The service chain identification information in the task message is updated, and the task message is directed to the new physical node to complete the task processing to ensure that the service is not interrupted.

[0202] When a target physical node fails, the flow regulation point will re-evaluate the forwarding path of the task message, reschedule the route and select the appropriate physical node to ensure that the task message can continue to be processed along the target security service chain.

[0203] Case 2: If it is determined according to the second status information that the link status of any sub-link in the target security service chain is abnormal, the sub-link is replaced with another sub-link with a normal link status.

[0204] In an embodiment of the present application, abnormalities in a sub-link include but are not limited to excessive delays, excessive packet loss rates, and link breakage. When the above situations occur, it is determined that the link can no longer support the transmission of task messages, and other sub-links that are in normal status and can meet business needs are selected from the security resource pool for replacement. By updating the service chain identifier, the task message is redirected to the new sub-link to ensure the quality and security of data transmission.

[0205] When an abnormality occurs in a sub-link, the flow regulation point will dynamically select an available alternative link based on the current link status and re-plan the transmission path of the task message to avoid data loss and transmission quality degradation. Case 3: If the business demand status of the task message is determined to have changed based on the second status information, the security service chain will be re-arranged based on the current business demand.

[0206] This may include adjusting the transmission path of the task message, reselecting nodes and links, or reconfiguring the security service policy according to the new business requirements. In this case, optimization methods such as particle swarm optimization can be used to re-plan the structure of the service chain to ensure that the task message is efficiently transmitted while meeting the new requirements. Subsequently, the flow regulation point will evaluate the current network status and business requirements in real time, and dynamically adjust the arrangement of the service chain to ensure that the task message can meet the requirements of latency, bandwidth, etc., while also ensuring data security and efficient transmission.

[0207] In addition, in the above process, the tasks of monitoring and dynamic adjustment are completed by the controller. The controller detects the status of the low-orbit satellite network in real time, generates task message scheduling instructions based on the status of the orbiting satellite network, and the instructions will be sent to the low-orbit satellite node or ground station, thereby realizing the directional scheduling and security protection of the task message in the low-orbit satellite network. This mechanism ensures that the network can be dynamically adjusted according to the actual situation, and realizes the efficient forwarding and security of the task message.

[0208] Through the above process, the efficient and secure forwarding of mission messages based on the target security service chain is achieved, and the service chain can be dynamically adjusted to adapt to changes in network status and business needs. It can obtain and analyze the target physical node status, sub-link status and business demand status of mission messages in real time, quickly respond to resource changes, link anomalies and mission demand adjustments in the network, and ensure the continuous availability and stability of the service chain. At the same time, the transmission efficiency and reliability of mission messages are improved. By replacing faulty nodes and abnormal links and re-arranging the service chain based on real-time needs, the data transmission delay and packet loss rate are significantly reduced, ensuring the efficient transmission of mission messages in the security service chain.

[0209] During the forwarding process of the task message, the task of adjusting the target security service chain according to the second state information is usually completed by the controller. Specifically, the controller evaluates the current network status based on the real-time second state information (such as the state of the target physical node, the link state, and the business demand state of the task message) and dynamically adjusts the target security service chain. When the controller determines that the service chain needs to be adjusted, it updates the service chain identifier in the task message and specifies the new path and node order.

[0210] According to the adjusted target security service chain, the corresponding service chain identifier is updated in the task message using SRv6 to obtain an updated scheduling and routing scheme, and the task message is forwarded according to the updated scheduling and routing scheme.

[0211] Specifically, the updated service chain identifier is embedded in the task message using SRv6 technology to ensure that the task message can be forwarded along the newly planned path. In this way, the task message can automatically adapt to the new transmission path according to changes in network and business needs, achieving efficient and secure forwarding.

[0212] Dynamically adjusting the target security service chain based on real-time second-state information can ensure that the task message always selects the optimal transmission path when the network environment or business needs change. Using SRv6 technology to update the service chain identifier, the task message automatically adapts to the new path to ensure the efficiency and security of data transmission. This dynamic adjustment improves the efficiency of network resource utilization, enhances the stability and availability of the service chain, and ensures the reliability of task message transmission.

[0213] The above process describes how to dynamically adjust the target security service chain based on real-time status information to ensure that the mission message can be efficiently and securely forwarded when the network environment or business requirements change. Through SRv6 technology, the service chain identifier of the mission message can be updated, so that the transmission path can be dynamically selected to ensure data reliability and transmission quality. Next, the application of SRv6 in low-orbit satellite networks will be specifically introduced with a specific implementation example.

[0214] In the embodiments of the present application, the application of SRv6 technology in low-orbit satellite networks is not only reflected in the message forwarding process, but also covers the collaborative work of low-orbit satellite nodes, ground stations and user terminals. When these devices all support SRv6 technology, low-orbit satellite nodes can act as source node classifiers for SRv6, responsible for identifying and processing messages according to the service ID of the mission message. The ground station is responsible for defining local behaviors, including the calling and management of services, to ensure that messages can be smoothly transmitted in the network according to the SRv6 protocol. When processing SRv6 messages, the ground station can execute corresponding services according to the service ID, and flexibly adjust the transmission path of the message according to actual conditions, such as dynamic changes in the satellite's orbit and network load.

[0215] See also Figure 6 As shown, it is a schematic diagram of a low-orbit satellite node, a ground station, and a user terminal of a low-orbit satellite network collaboratively processing task messages provided by an embodiment of the present application.

[0216] In an optional embodiment, the low-orbit satellite node acts as a source node classifier of the SRv6 protocol, responsible for identifying and processing messages according to the service ID in the mission message. When the low-orbit satellite node receives a mission message, it first parses the service ID in the message and decides which specific network operations to perform (such as security checks, traffic forwarding, etc.). The role of the low-orbit satellite node is to flexibly adjust the transmission path of the mission message according to the mission requirements and network status, and ensure that the mission is transmitted to the target node according to the predetermined rules.

[0217] The ground station is responsible for defining and executing local behaviors, including setting security policies and rules. The ground station identifies the specific services that need to be executed in the mission message based on the service ID, and ensures that the mission message can be smoothly transmitted through the low-orbit satellite network. The ground station processes the service ID in the message, and dynamically adjusts the transmission path according to the mission requirements and network conditions to optimize network resource allocation.

[0218] In the above process, the ground station defines security policies and service rules according to the dynamic situation of the low-orbit satellite network (such as satellite orbit changes, link quality, etc.) to ensure the security of network data transmission. In the process of forwarding mission messages, the ground station calls and executes corresponding security services (such as data encryption, identity authentication, etc.) according to the service ID in the message. In this way, the ground station effectively controls the security of data transmission and accurately guides the mission message through the required security service chain according to the service ID.

[0219] For user terminals, the user terminals initiate data transmission through the SRv6 protocol. The IP address of the user terminal is used as the data source address, and the destination address of the message corresponds to the service IP. Since the low-orbit satellite network adopts a computing-first data transmission strategy, the user terminal can reduce its dependence on intermediary service nodes such as ground stations and reduce computing power consumption. The data transmission path uses the ground station IP as the first hop, and then the service ID guides the next hop of data transmission. This method reduces network latency and improves data transmission efficiency.

[0220] In the low-orbit satellite network, when the low-orbit satellite node and the ground station jointly process the SRv6 message, the low-orbit satellite node identifies and executes the corresponding security service operation according to the service ID in the message, and flexibly adjusts the forwarding path of the mission message. The satellite node will dynamically adjust the message transmission path according to the real-time network conditions, such as link quality and satellite position, to ensure that the mission message can be transmitted quickly and safely. For example, when a satellite has a high load, the data traffic can be switched to a satellite node with a lighter load, thereby achieving network load balancing and optimal utilization of resources.

[0221] To achieve this goal, the low-orbit satellite network will update the service chain identifier to reflect the current scheduling routing plan in the mission message and ensure that the message is forwarded along the new, optimized path. During this adjustment process, the updated service chain identifier is embedded in the mission message through the SRv6 protocol, so that the mission message can automatically select the best path based on the new network conditions and load conditions. In this way, the mission message can be forwarded along the updated path, thereby improving transmission efficiency, reducing delays and packet loss, and ensuring data security and reliability. Through this dynamic path adjustment and service chain update, the low-orbit satellite network can efficiently adapt to network changes and ensure that the mission message can be transmitted on the optimal transmission path.

[0222] Through dynamic scheduling, the low-orbit satellite network can flexibly adjust the resource allocation and path selection of the security service chain according to changes in load, security requirements and satellite orbit. For example, when a satellite is overloaded, part of the traffic will be switched to other satellites to ensure efficient execution of the entire security service chain. Through this dynamic orchestration and optimization, SRv6 technology can fully consider the actual situation of satellite nodes in the low-orbit satellite network and ensure the efficiency and reliability of network security services.

[0223] See also Figure 7 As shown, it is a flow chart of a method based on security service chain orchestration provided in an embodiment of the present application.

[0224] See also Figure 7 As shown, it is a flow chart of a method based on security service chain orchestration provided in an embodiment of the present application.

[0225] First, the particle swarm orchestration algorithm initializes the particle swarm and evaluates the fitness of the particles to find the current global optimal solution, while recording and updating the speed and position of the particles in real time until the optimization termination condition is met. After obtaining the optimized solution, the security service chain is deployed according to the solution result, and the service chain is deployed on the low-orbit satellite network node. Then, the first state information of the security service chain is analyzed through the flow adjustment point to determine the forwarding path of the task message. In order to ensure the stability of the security service chain, the controller will continuously monitor the second state information of the target security service chain, including the operating status of the target physical node, the link status of the sub-link, and the business demand status of the task message. When a link failure or abnormal satellite node status is detected in the target security service chain, it will automatically switch to the backup physical node or backup link, and update the service chain identifier to maintain service continuity. If no fault is detected, but the business demand status of the task message changes, the system will dynamically adjust the orchestration of the security service chain according to the current demand, such as reconfiguring the transmission path or adjusting the security policy, and generate and issue new forwarding instructions through the controller. Finally, the task message is transmitted according to the optimized scheduling and routing scheme, and the execution of the security service chain is completed, ensuring the security and efficiency of data transmission.

[0226] Based on the same inventive concept, the embodiment of the present application also provides a security service chain arrangement device. Figure 8 As shown, it is a schematic diagram of the composition structure of the security service chain arrangement device 800, which may include:

[0227] The automatic arrangement unit 801 is used to automatically arrange the security service chain of the low-orbit satellite network by using a particle swarm algorithm to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents: the security service strategy and node sequence provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical node in the security service chain;

[0228] A deployment unit 802 is used to deploy corresponding security services on each target physical node according to the target security service chain policy sequence to obtain an initial target security service chain;

[0229] The task message forwarding unit 803 is used to determine a scheduling routing scheme for the task message to be forwarded based on the first state information of the target security service chain, and forward the task message according to the scheduling routing scheme.

[0230] Optionally, the security service chain orchestration device further includes:

[0231] The adjustment unit 804 is used to adjust the target security service chain according to the second status information during the forwarding process of the task message; the second status information includes at least one of the following: the current node status of each target physical node, the current link status of the target security service chain, and the business demand status of the task message.

[0232] Optionally, the automatic arrangement unit 801 is specifically used for:

[0233] Based on the security services provided by each physical node in the target security service chain and the bandwidth consumption corresponding to each physical node, an objective function of a particle swarm algorithm is established to minimize the bandwidth consumption of each physical node in the target security service chain;

[0234] Taking the security service strategies and node order provided by each physical node in the security service chain as control variables, the constraint conditions based on the capability requirements of the security service chain are established;

[0235] According to the objective function and the constraint conditions, the control variables are solved using the particle swarm algorithm to obtain a target security service chain strategy sequence.

[0236] Optionally, the constraint condition includes a node constraint condition and a link constraint condition, and the automatic arrangement unit 801 is specifically used for:

[0237] Establish node constraints according to the resource allocation rules of the physical nodes, where the node constraints are used to constrain the security service chain: the resource requirements of each physical node for deploying the security service policy do not exceed the resource capacity of the corresponding physical node;

[0238] A link constraint condition is established according to the bandwidth allocation rule of the sub-link, and the link constraint condition is used to constrain the security service chain: the bandwidth requirement of the sub-link will not exceed the maximum bandwidth capacity of the physical link.

[0239] Optionally, the constraint condition further includes a mapping constraint condition, and the automatic arrangement unit 801 is further used for:

[0240] A mapping constraint condition is established according to a mapping rule between a physical node and a security service policy. The mapping constraint condition is used to constrain the security service chain: the security service policies on each physical node are independent of each other.

[0241] Optionally, if there are at least two conflicting security service policies in the target security service chain policy sequence, the deployment unit 802 is further configured to:

[0242] For at least two conflicting security service policies, obtaining a priority of each of the conflicting security service policies;

[0243] According to the priorities of the conflicting security service policies, the execution order of the conflicting security service policies in the target security service chain policy sequence is adjusted, and the conflicting security service policies after the adjusted execution order are combined to obtain an updated target security service chain policy sequence.

[0244] Optionally, the adjusting unit 804 is specifically configured to:

[0245] If it is determined according to the second state information that any target physical node in the target security service chain fails, the target physical node is replaced with a standby physical node;

[0246] If it is determined according to the second status information that the link status of any sub-link in the target security service chain is abnormal, replacing the sub-link with another sub-link with a normal link status;

[0247] If it is determined according to the second status information that the business requirement state of the task message has changed, the security service chain is rearranged according to the current business requirement.

[0248] Optionally, the task message forwarding unit 803 is specifically used to:

[0249] Based on the first state information of the target security service chain, a service chain identifier is specified in the task message using SRv6 to obtain a scheduling routing solution for the task message.

[0250] Optionally, the adjusting unit 804 is further configured to:

[0251] According to the adjusted target security service chain, the corresponding service chain identifier is updated in the task message using SRv6 to obtain an updated scheduling routing scheme, and the task message is forwarded according to the updated scheduling routing scheme.

[0252] First, the present application uses a particle swarm algorithm to automatically arrange the security service chain of the low-orbit satellite network, which can improve the efficiency and flexibility of the service chain arrangement. By taking the bandwidth consumption of the physical node as the objective function, the particle swarm algorithm searches for the optimal solution in the global scope and generates a target security service chain policy sequence, thereby clarifying the security service policy and its execution order to be provided by each physical node. This arrangement method effectively reduces the waste of bandwidth resources, improves resource utilization, and solves the problem of limited bandwidth in the low-orbit satellite network. On this basis, according to the generated policy sequence, the corresponding security service policy is automatically deployed on the target physical node to form the initial target security service chain, realizing the automation and efficiency of service chain deployment and reducing the complexity of manual operation. At the same time, for the task message to be forwarded, based on the first state information of the target security service chain, the task scheduling routing plan can be dynamically generated, and the task message can be quickly forwarded according to the plan, thereby reducing the delay and packet loss rate of data transmission and improving the transmission reliability and efficiency of the task. In addition, since the topology of low-orbit satellite networks changes frequently and resources are unevenly distributed, the particle swarm algorithm can be used to orchestrate the service chain, which can quickly respond to dynamic changes in the network, adjust strategies and routes in real time to adapt to business needs, and significantly enhance the stability and adaptability of the network, providing an efficient, intelligent, and secure service chain solution for low-orbit satellite networks.

[0253] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0254] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0255] After introducing the security service chain orchestration method and device according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0256] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0257] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a low-orbit satellite node, such as Figure 1 The low-orbit satellite node 120 shown in FIG. In this embodiment, the structure of the electronic device can be as follows: Fig. 9 As shown, it includes a memory 901 , a communication module 903 and one or more processors 902 .

[0258] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0259] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0260] The processor 902 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 902 is configured to implement the above-mentioned security service chain arrangement method when calling the computer program stored in the memory 901 .

[0261] The communication module 903 is used to communicate with terminal devices and other servers.

[0262] The specific connection medium between the memory 901, the communication module 903 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 904. The bus 904 is connected to the processor 902 via a bus 904. Fig. 9 The connections between the other components are only for illustration and are not intended to be limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig. 9The diagram shows that only one thick line is used, but this does not mean that there is only one bus or one type of bus.

[0263] The memory 901 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the security service chain arrangement method of the embodiment of the present application. The processor 902 is used to execute the above-mentioned security service chain arrangement method, such as Figure 2 shown.

[0264] In some possible implementations, various aspects of the security service chain orchestration method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the security service chain orchestration method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 2 Follow the steps shown in .

[0265] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0266] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0267] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0268] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0269] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user electronic device, as a separate software package, partially on the user electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0270] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0271] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0272] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0273] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0274] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0275] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0276] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0277] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security service chain arrangement method, characterized in that: The method comprises: The particle swarm algorithm is used to automatically arrange the security service chain of the low-orbit satellite network to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents: the security service strategy and node sequence provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain; According to the target security service chain strategy sequence, deploy corresponding security service strategies on each target physical node to obtain an initial target security service chain; For a task message to be forwarded, a scheduling and routing scheme of the task message is determined based on the first state information of the target security service chain, and the task message is forwarded according to the scheduling and routing scheme.

2. The method according to claim 1, characterized in that The method further comprises: During the forwarding process of the task message, the target security service chain is adjusted according to the second status information; the second status information includes at least one of the following: the current node status of each target physical node, the current link status of the target security service chain, and the business demand status of the task message.

3. The method according to claim 1, characterized in that The particle swarm algorithm is used to automatically arrange the security service chain in the low-orbit satellite network to obtain the target security service chain strategy sequence, including: Based on the security services provided by each physical node in the target security service chain and the bandwidth consumption corresponding to each physical node, an objective function of a particle swarm algorithm is established to minimize the bandwidth consumption of each physical node in the target security service chain; Taking the security service strategies and node order provided by each physical node in the security service chain as control variables, the constraint conditions based on the capability requirements of the security service chain are established; According to the objective function and the constraint conditions, the control variables are solved using the particle swarm algorithm to obtain a target security service chain strategy sequence.

4. The method according to claim 3, characterized in that The constraint conditions include node constraint conditions and link constraint conditions; the constraint conditions established based on the security service chain capability requirements include: Establish node constraints according to the resource allocation rules of the physical nodes, where the node constraints are used to constrain the security service chain: the resource requirements of each physical node for deploying the security service policy do not exceed the resource capacity of the corresponding physical node; A link constraint condition is established according to the bandwidth allocation rule of the sub-link, and the link constraint condition is used to constrain the security service chain: the bandwidth requirement of the sub-link will not exceed the maximum bandwidth capacity of the physical link.

5. The method according to claim 3 or 4, characterized in that The constraint condition also includes a mapping constraint condition, and the constraint condition established based on the security service chain capability requirement also includes: A mapping constraint condition is established according to a mapping rule between a physical node and a security service policy. The mapping constraint condition is used to constrain the security service chain: the security service policies on each physical node are independent of each other.

6. The method according to any one of claims 1 to 4, characterized in that: If there are at least two conflicting security service policies in the target security service chain policy sequence, before deploying corresponding security services on each target physical node according to the target security service chain policy sequence to obtain an initial target security service chain, the method further includes: For at least two conflicting security service policies, obtaining a priority of each of the conflicting security service policies; According to the priorities of the conflicting security service policies, the execution order of the conflicting security service policies in the target security service chain policy sequence is adjusted, and the conflicting security service policies after the adjusted execution order are combined to obtain an updated target security service chain policy sequence.

7. The method according to claim 2, characterized in that The adjusting the target security service chain according to the second state information includes: If it is determined according to the second state information that any target physical node in the target security service chain fails, the target physical node is replaced with a standby physical node; If it is determined according to the second status information that the link status of any sub-link in the target security service chain is abnormal, replacing the sub-link with another sub-link with a normal link status; If it is determined according to the second status information that the business requirement state of the task message has changed, the security service chain is rearranged according to the current business requirement.

8. The method according to claim 1, characterized in that The determining of the scheduling routing scheme of the task message based on the first state information of the target security service chain includes: Based on the first state information of the target security service chain, a service chain identifier is specified in the task message using SRv6 to obtain a scheduling routing solution for the task message.

9. The method according to claim 2, characterized in that In the process of forwarding the task message, adjusting the target security service chain according to the second state information also includes: According to the adjusted target security service chain, the corresponding service chain identifier is updated in the task message using SRv6 to obtain an updated scheduling routing scheme, and the task message is forwarded according to the updated scheduling routing scheme.

10. A security service chain arrangement device, characterized in that: include: An automatic arrangement unit is used to automatically arrange the security service chain of the low-orbit satellite network by using a particle swarm algorithm to obtain a target security service chain strategy sequence; wherein the target security service chain strategy sequence represents: the security service strategy and node sequence provided by each target physical node in the target security service chain, and the objective function of the particle swarm algorithm is the bandwidth consumption of the physical nodes in the security service chain; A deployment unit, configured to deploy corresponding security services on each target physical node according to the target security service chain policy sequence to obtain an initial target security service chain; The task message forwarding unit is used to determine a scheduling routing scheme of the task message to be forwarded based on the first state information of the target security service chain, and forward the task message according to the scheduling routing scheme.

11. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any method described in claims 1 to 9.

Images