Service path determination method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses a service path determination method and device, a nonvolatile storage medium and electronic equipment. The method comprises the following steps: controlling a node in a communication network to send a simulation message to an adjacent node, and obtaining a detection result of a simulation message sending and receiving process; a network quality matrix is determined according to the detection result, rows in the network quality matrix represent source nodes, and columns in the network quality matrix represent destination nodes; determining a metric value of the candidate service path in the communication network according to the network quality matrix and candidate nodes involved in the candidate service path; and determining the candidate service path with the highest metric value from the candidate service paths as a main service path, and determining the candidate service path with the second highest metric value as a standby service path. According to the method and the device, the technical problems of low resource utilization rate and difficulty in extension caused by scheduling the resources of the secure resource pool by adopting an explicit path in related technologies are solved.

Description

Technical Field

[0001] The present application relates to the technical field of security resource pools, and in particular to a method, device, non-volatile storage medium, and electronic device for determining a service path. Background Art

[0002] At present, the main technology used in related technologies is to implement the primary and backup routes of resource scheduling in the secure resource pool through explicit paths. Explicit paths usually refer to fixed paths pre-defined through the network. These paths usually do not change after the network is configured, unless the network administrator makes manual adjustments or the network policy changes. This statically configured explicit path has its advantages, but it also has some limitations, including lack of flexibility, difficulty in expansion, slow response, low resource utilization, and difficulty in automation.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a service path determination method, device, non-volatile storage medium and electronic device to at least solve the technical problems of low resource utilization and difficulty in expansion caused by the use of explicit paths to schedule resources in a security resource pool in related technologies.

[0005] According to one aspect of an embodiment of the present application, a service path determination method is provided, comprising: controlling a node in a communication network to send a simulation message to an adjacent node, and obtaining detection results of the simulation message sending and receiving process, wherein the detection results include a sending timestamp, a receiving timestamp, packet loss information and traffic statistics data of the simulation message; determining a network quality matrix based on the detection results, wherein rows in the network quality matrix represent source nodes, columns represent destination nodes, and elements in the network quality matrix are routing performance indicators between nodes in corresponding rows and columns; determining a metric value corresponding to a candidate service path in the communication network based on the network quality matrix and candidate nodes involved in the candidate service path, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; determining the candidate service path with the highest metric value from among the candidate service paths as the primary service path, and determining the candidate service path with the second highest metric value as the backup service path.

[0006] Optionally, determining the measurement value corresponding to the candidate service path in the communication network according to the network quality matrix and the candidate nodes involved in the candidate service path includes: determining the connection relationship between each candidate node, and determining all candidate node pairs in the candidate service path based on the connection relationship, wherein the candidate node pair includes two adjacent candidate nodes and the same candidate node is in one or two candidate node pairs; determining the elements corresponding to the candidate node pairs; determining the node measurement value corresponding to the connection relationship based on the elements corresponding to the candidate node pairs; and determining the sum of all node measurement values ​​as the measurement value of the candidate service path.

[0007] Optionally, determining the node measurement value corresponding to the candidate node pair based on the elements corresponding to the candidate node pair includes: normalizing each type of performance indicator contained in the network quality matrix; determining the normalized values ​​of each type of performance indicator contained in the elements corresponding to the candidate node pair; and determining the node measurement value based on the normalized values ​​of each type of performance indicator.

[0008] Optionally, determining the node measurement value based on the normalized performance indicator values ​​includes: determining a preset business type; determining the weight corresponding to each performance indicator type based on the business type; and performing weighted summation processing on the normalized performance indicator values ​​based on the weights to obtain the node measurement value.

[0009] Optionally, the performance indicator includes at least one of the following: transmission delay, transmission jitter information, packet loss rate and bandwidth utilization.

[0010] Optionally, the performance indicator is determined in the following manner: determining the transmission delay based on the sending timestamp and receiving timestamp of the simulation message; determining the transmission jitter information based on the transmission delay corresponding to multiple consecutive simulation messages; determining the bandwidth utilization based on traffic statistics data and bandwidth information between nodes in the communication network.

[0011] Optionally, before controlling a node in the communication network to send a simulation message to an adjacent node, the service path determination method further includes: determining device information of each device in the communication network, the device information including at least one of the following: device type, port identifier, network address, the communication network including a security resource pool network; determining a link topology map of the communication network based on the device information; and determining nodes in the communication network based on the link topology map.

[0012] Optionally, the service path determination method also includes: after the detection result changes, updating the network quality matrix according to the changed detection result; updating the measurement value of the candidate service path according to the updated network quality matrix; determining the candidate service path with the largest updated measurement value as the primary path, and determining the candidate service path with the second largest updated measurement value as the backup service path.

[0013] According to another aspect of an embodiment of the present application, a service path determination device is also provided, including: a message processing module, used to control a node in a communication network to send a simulated message to an adjacent node, and obtain detection results of the simulated message sending and receiving process, wherein the detection results include a sending timestamp, a receiving timestamp, packet loss information and traffic statistics of the simulated message; a network controller module, used to determine a network quality matrix based on the detection results, wherein rows in the network quality matrix represent source nodes, columns represent destination nodes, and elements in the network quality matrix are routing performance indicators between nodes in corresponding rows and columns; according to the network quality matrix and the candidate nodes involved in the candidate service path, determine a metric value corresponding to the candidate service path in the communication network, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; a service orchestration module, used to determine the candidate service path with the highest metric value from each candidate service path as the primary service path, and determine the candidate service path with the second highest metric value as the backup service path.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute the service path determination method.

[0015] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the service path determination method is executed when the program is run.

[0016] According to another aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, and the computer program implements the service path determination method when executed by a processor.

[0017] In an embodiment of the present application, a node in a control communication network is used to send a simulation message to a neighboring node, and the detection results of the simulation message sending and receiving process are obtained, wherein the detection results include the sending timestamp, receiving timestamp, packet loss information and traffic statistics of the simulation message; a network quality matrix is ​​determined based on the detection results, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between the nodes in the corresponding rows and columns; based on the network quality matrix and the candidate nodes involved in the candidate service path, a metric value corresponding to the candidate service path in the communication network is determined, wherein the metric value is used to reflect the selection priority of the candidate service path. The method comprises the following steps: a) determining the priority of the selected service path, and the larger the metric value is, the higher the priority is; b) determining the candidate service path with the highest metric value as the primary service path from among the candidate service paths, and determining the candidate service path with the second highest metric value as the backup service path; and c) determining the metric value of the candidate service path according to the routing performance index, and determining the primary service path and the backup service path according to the metric value, thereby achieving the purpose of determining the optimal primary service path and the backup service path according to the routing performance index, thereby achieving the technical effect of dynamically determining the optimal service path, and further solving the technical problem of low resource utilization and difficulty in expansion caused by scheduling resources of the security resource pool by explicit paths in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 It is a structural schematic diagram of a computer terminal (mobile terminal) provided according to an embodiment of the present application;

[0020] Figure 2 It is a flowchart of a method for determining a service path provided according to an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of a simulation message provided according to an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of a network quality matrix provided according to an embodiment of the present application;

[0023] Figure 5 It is a schematic diagram of a service path and a service path issuance process provided according to an embodiment of the present application;

[0024] Figure 6 It is a structural diagram of a service path determination device provided according to an embodiment of the present application;

[0025] Figure 7 It is a schematic diagram of a workflow of a service path determination device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0029] Security Resource Pool: An integrated security solution based on cloud computing and virtualization technology. It realizes security capabilities as a service, forming a centrally managed security capability pool, realizing unified scheduling and management of security resources in an elastic and on-demand manner, and providing independent security services for multi-tenant users.

[0030] Business Orchestration: A technology for managing and automating business processes. It involves organizing the various links and tasks in the business process in a certain logical order to improve efficiency, reduce costs, and enhance business flexibility and responsiveness.

[0031] Message: In computer networks, it refers to a data unit consisting of two parts, the header and the payload. The header contains control information such as the source address and destination address, while the payload carries the data that actually needs to be transmitted.

[0032] With the rapid development of cloud computing technology, users have increasing requirements for unified, flexible, and diversified security capabilities in hybrid IT environments. In particular, with the emergence of deployment forms such as public cloud, private cloud, hybrid cloud, and multi-cloud, users' demand for unified management has increased rapidly. In this context, traditional security hardware cannot be deployed in the cloud, and there are problems with elastic expansion and on-demand combination of security capabilities. The security resource pool integrates multiple security capabilities to effectively solve the problem of security islands in enterprise security construction, helping users to reduce security construction costs while unifying and coordinating products, and effectively solving many user security compliance, private cloud security, hybrid cloud security, unified security management and other issues.

[0033] Currently, the main method to implement the primary and backup routes of resource scheduling in the secure resource pool is through explicit paths. Explicit paths usually refer to fixed paths pre-defined through the network. These paths usually do not change after the network is configured unless the network administrator makes manual adjustments or the network policy changes. This statically configured explicit path has its advantages, but it also has some limitations, including lack of flexibility, difficulty in expansion, slow response, low resource utilization, and difficulty in automation.

[0034] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0035] According to an embodiment of the present application, a method embodiment of a service path determination method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a service path determination method. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0037] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0038] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the business path determination method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned business path determination method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0039] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0040] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0041] In the above operating environment, the embodiment of the present application provides a method for determining a service path, such as Figure 2 As shown, the method comprises the following steps:

[0042] Step S202, controlling the nodes in the communication network to send simulation messages to neighboring nodes, and obtaining detection results of the simulation message sending and receiving process, wherein the detection results include the sending timestamp, receiving timestamp, packet loss information and traffic statistics of the simulation message;

[0043] In the technical solution provided in step S202, before controlling the node in the communication network to send a simulation message to the neighboring node, the service path determination method also includes: determining the device information of each device in the communication network, the device information includes at least one of the following: device type, port identifier, network address, the communication network includes a security resource pool network; determining the link topology map of the communication network based on the device information; determining the nodes in the communication network based on the link topology map.

[0044] In some embodiments of the present application, each node in the communication network can actively send a message to a neighboring node at a preset time (such as N seconds). Figure 3 The simulated messages shown in the figure are used to detect the network. These messages contain key information such as timestamp, message length, router ID, etc., which ensures the traceability and manageability of the messages. In the process of sending simulated messages by nodes, the links between each node and the nodes can be traversed to obtain the detection results.

[0045] Step S204, determining a network quality matrix according to the detection result, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between the nodes in the corresponding rows and columns;

[0046] In the technical solution provided in step S204, the routing performance index includes at least one of the following: transmission delay, transmission jitter information, packet loss rate and bandwidth utilization. Figure 4 As shown, the rows and columns represent the source node and the destination node respectively. Each element in the matrix contains four parameter values ​​l, j, p, b, which represent delay (ms), jitter (ms), packet loss (%), and bandwidth utilization (%) respectively.

[0047] As an optional implementation, the routing performance indicator is determined in the following manner: determining the transmission delay based on the sending timestamp and receiving timestamp of the simulated message; determining the transmission jitter information based on the transmission delay corresponding to multiple consecutive simulated messages; determining the bandwidth utilization based on traffic statistics data and bandwidth information between nodes in the communication network.

[0048] In some embodiments of the present application, jitter can also be calculated by comparing the timestamp differences of consecutive messages, packet loss can be detected through sequence number tracking and confirmation mechanisms, and bandwidth utilization can be calculated by monitoring interface traffic statistics of network devices.

[0049] Step S206, determining a metric value corresponding to the candidate service path in the communication network according to the network quality matrix and the candidate nodes involved in the candidate service path, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority;

[0050] In the technical solution provided in step S206, the step of determining the measurement value corresponding to the candidate service path in the communication network according to the network quality matrix and the candidate nodes involved in the candidate service path includes: determining the connection relationship between the candidate nodes, and determining all candidate node pairs in the candidate service path based on the connection relationship, wherein the candidate node pair includes two adjacent candidate nodes, and the same candidate node is in one or two candidate node pairs; determining the elements corresponding to the candidate node pairs; determining the node measurement value corresponding to the connection relationship based on the elements corresponding to the candidate node pairs; and determining the sum of all node measurement values ​​as the measurement value of the candidate service path.

[0051] As an optional implementation, the step of determining the node metric value corresponding to the candidate node pair based on the elements corresponding to the candidate node pair includes: normalizing each type of routing performance indicator contained in the network quality matrix; determining the normalized values ​​of each type of routing performance indicator contained in the elements corresponding to the candidate node pair; and determining the node metric value based on the normalized values ​​of each type of routing performance indicator.

[0052] In some embodiments of the present application, the step of determining the node measurement value based on the normalized performance indicator values ​​of various types includes: determining a preset business type; determining the weight corresponding to each routing performance indicator type based on the business type; and performing weighted summation processing on the normalized routing performance indicator values ​​of various types based on the weights to obtain the node measurement value.

[0053] In some embodiments of the present application, the specific process of determining each candidate service path is as follows:

[0054] The first step is to obtain the user's business needs and determine the weights of each key performance indicator at each network node based on the user's business needs. The weights corresponding to each key performance indicator can be the same or different, and are pre-set according to the user's business needs. Let the current node pair be i, and the weights of each indicator are w_latency[i], w_jitter[i], w_packetloss[i], and w_bandwidth[i], which correspond to the weights of latency, jitter, packet loss, and bandwidth utilization, respectively.

[0055] For example, in the anti-DOOS scenario of the gaming business, since the gaming business requires low latency, a general indicator weight template can be designed, such as: {w_latency[i] = 40%, w_jitter[i] = 20%, w_packetloss[i] = 20%, w_bandwidth[i] = 20%}, and applied to all gaming business scenarios. In addition, if a special business requires customized services, the indicator weight template for the business can be customized according to the needs of the business and combined with the actual test results, and input into the algorithm unit through the controller for use.

[0056] In the second step, let the actual measured values ​​corresponding to each indicator be L, J, P, and B. Each indicator is normalized to ensure that they are at the same magnitude. The formula is as follows:

[0057]

[0058] Where L min , L max , J min , J max , P min , P max , B min , B max are the minimum and maximum values ​​of each indicator respectively.

[0059] The third step is to calculate the node metric value S of node pair i according to the preset weights corresponding to each key performance parameter and the normalized key performance indicators at node pair i. i , as shown below:

[0060] S i =(w_latency[i]*L ′ [i])+(w_jitter[i]*J ′ [i])+(w_packetloss[i]*P ′ [i])+(w_bandwidth[i]*

[0061] B ′ [i])

[0062] The fourth step is to calculate the comprehensive metric S_total of the entire path from node pair i to node pair n. The comprehensive metric of the path is equal to the metric value S of each node from node pair i to node pair n. i The calculation formula of the path comprehensive metric is as follows:

[0063]

[0064] Where S kIt is the comprehensive metric value of node pair k, and the value of k traverses from i to n.

[0065] It should be noted that the adjacent nodes included in the candidate node pair in the candidate service path are a source node and a destination node. For example, when the candidate service path contains five nodes numbered 1, 2, 3, 4, and 5, and the connection relationship between the five nodes is 1-2-3-4-5, the candidate node pairs corresponding to the candidate service path include (1,2), (2,3), (3,4), and (4,5). In other words, any two nodes that have a connection relationship in the candidate service path will correspond to a candidate node pair.

[0066] Step S208: Determine the candidate service path with the highest metric value from among the candidate service paths as the primary service path, and determine the candidate service path with the second highest metric value as the backup service path.

[0067] In the technical solution provided in step S208, if Figure 5 As shown in the figure, after selecting the path with the highest comprehensive metric as the primary path and the path with the second highest comprehensive metric as the backup service path, a set of path information including one primary and one backup can be generated, which is translated into a set of policy items for packet matching conditions and forwarding, that is, a flow table. After that, it is transmitted to each node device in the network through the flow table delivery mechanism, ensuring that each node searches and forwards data packets according to the delivered policy, thereby forming a controllable and optimal security service chain.

[0068] In some embodiments of the present application, the service path determination method also includes: after the detection result changes, updating the network quality matrix according to the changed detection result; updating the measurement value of the candidate service path according to the updated network quality matrix; determining the candidate service path with the largest updated measurement value as the primary path, and determining the candidate service path with the second largest updated measurement value as the backup service path.

[0069] By performing periodic network detection on the communication network, when the network quality changes, the comprehensive metric S_total can be recalculated in time according to the changed information, and then a new primary and backup path can be selected to form a new service chain and issue it. In addition, when a new device enters the communication network or an existing network device is disconnected from the network, a network detection request can be re-initiated to collect new performance indicator parameter information, return new parameter information, calculate, select routes, arrange, and issue a new security service chain.

[0070] The nodes in the control communication network are controlled to send simulation messages to the neighboring nodes, and the detection results of the simulation message sending and receiving process are obtained, wherein the detection results include the sending timestamp, receiving timestamp, packet loss information and traffic statistics of the simulation message; a network quality matrix is ​​determined according to the detection results, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between the nodes in the corresponding rows and columns; according to the network quality matrix and the candidate nodes involved in the candidate service path, the metric values ​​corresponding to the candidate service path in the communication network are determined, wherein the metric values ​​are used to reflect the selection priority of the candidate service path, And the larger the metric value is, the higher the selection priority is; the candidate business path with the highest metric value is determined from among the candidate business paths as the primary business path, and the candidate business path with the second highest metric value is determined as the backup business path. By determining the metric value of the candidate business path according to the routing performance indicator, and determining the primary business path and the backup business path according to the metric value, the purpose of determining the optimal primary business path and the backup business path according to the routing performance indicator is achieved, thereby achieving the technical effect of dynamically determining the optimal business path, and further solving the technical problem of low resource utilization and difficulty in expansion caused by the use of explicit paths to schedule resources of the security resource pool in the related technology.

[0071] The present application provides a device for determining a service path. Figure 6 is a schematic diagram of the structure of the device. Figure 6 It can be seen that the device includes: a message processing module 60, which is used to control the nodes in the communication network to send simulated messages to the neighboring nodes, and obtain the detection results of the simulated message sending and receiving process, wherein the detection results include the sending timestamp, receiving timestamp, packet loss information and traffic statistics of the simulated message; a network controller module 62, which is used to determine the network quality matrix according to the detection results, wherein the rows in the network quality matrix represent the source nodes, the columns represent the destination nodes, and the elements in the network quality matrix are the routing performance indicators between the nodes in the corresponding rows and columns; according to the network quality matrix and the candidate nodes involved in the candidate service path, determine the metric value corresponding to the candidate service path in the communication network, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; a service orchestration module 64, which is used to determine the candidate service path with the highest metric value from each candidate service path as the main service path, and determine the candidate service path with the second highest metric value as the backup service path.

[0072] In some embodiments of the present application, before controlling a node in the communication network to send a simulation message to a neighboring node, the network controller module 62 is also used to: determine device information of each device in the communication network, the device information including at least one of the following: device type, port identifier, network address, the communication network including a security resource pool network; determine a link topology map of the communication network based on the device information; determine a node in the communication network based on the link topology map.

[0073] In some embodiments of the present application, the routing performance indicator includes at least one of the following: transmission delay, transmission jitter information, packet loss rate and bandwidth utilization.

[0074] In some embodiments of the present application, the routing performance indicator is determined in the following manner: determining the transmission delay based on the sending timestamp and receiving timestamp of the simulated message; determining the transmission jitter information based on the transmission delay corresponding to multiple consecutive simulated messages; determining the bandwidth utilization based on traffic statistics data and the bandwidth information between nodes in the communication network.

[0075] In some embodiments of the present application, the business orchestration module 64 determines the step of determining the measurement value corresponding to the candidate business path in the communication network based on the network quality matrix and the candidate nodes involved in the candidate business path, including: determining the connection relationship between the candidate nodes, and determining all candidate node pairs in the candidate business path based on the connection relationship, wherein the candidate node pair includes two adjacent candidate nodes, and the same candidate node is in one or two candidate node pairs; determining the elements corresponding to the candidate node pairs; determining the node measurement value corresponding to the connection relationship based on the elements corresponding to the candidate node pairs; and determining the sum of all node measurement values ​​as the measurement value of the candidate business path.

[0076] In some embodiments of the present application, the steps of determining the node metric value corresponding to the candidate node pair based on the elements corresponding to the candidate node pair by the business orchestration module 64 include: normalizing each type of routing performance indicator contained in the network quality matrix; determining the normalized values ​​of each type of routing performance indicator contained in the elements corresponding to the candidate node pair; and determining the node metric value based on the normalized values ​​of each type of routing performance indicator.

[0077] In some embodiments of the present application, the steps of determining the node measurement value based on the normalized performance indicator values ​​of various types by the service orchestration module 64 include: determining a preset service type; determining the weight corresponding to each routing performance indicator type based on the service type; and performing weighted summation processing on the normalized routing performance indicator values ​​of various types based on the weights to obtain the node measurement value.

[0078] In some embodiments of the present application, the service path determination device is also used to: after the detection result changes, update the network quality matrix according to the changed detection result; update the measurement value of the candidate service path according to the updated network quality matrix; determine the candidate service path with the largest updated measurement value as the primary path, and determine the candidate service path with the second largest updated measurement value as the backup service path.

[0079] As an optional implementation, the workflow of the above service path determination device is as follows: Figure 7 As shown. Figure 7 As can be seen from the figure, the network controller module 62 also includes a network detection unit, a matrix processing unit and an algorithm unit. The message processing module also includes a calculation unit and a detection unit.

[0080] In addition from Figure 7 It can be seen that after the service path determination device is connected to the security resource pool, the network controller module 62 will calculate the topology information of the security resource pool and send a simulation message through the message processing module 60. The message processing module 60 performs real-time detection of all resource nodes and routes, including key performance indicators such as latency, jitter, packet loss, and bandwidth utilization. Then the analysis data is provided to the network controller module 62 to form a network quality matrix, and the primary and backup paths are selected through the service chain arrangement algorithm. Then the service arrangement module 64 is used to issue the flow table and update it regularly to achieve the optimal arrangement of the service chain.

[0081] In some embodiments of the present application, Figure 7 As shown, the workflow of the above service path determination device includes the following steps:

[0082] In the first step, the network detection unit of the network controller module 62 automatically detects and collects information of all devices, such as device type, port identifier, network address, etc., so as to calculate the link topology of the security resource pool network. Once the network topology is calculated and determined, the detection unit notifies the detection unit of the message processing module 60 of these key topological conditions.

[0083] In the second step, the detection unit sends control information to all nodes in the network, so that the nodes actively send simulation messages to neighboring nodes every N seconds to perform network detection. These messages contain key information such as timestamp, message length, router ID, etc., which ensures the traceability and manageability of the messages. After traversing all network nodes and links, the detection results will be reported to the calculation unit of the message processing module 60.

[0084] In the third step, the calculation unit performs data preprocessing after receiving the performance indicator information: calculating the delay by the difference between two timestamps, calculating the jitter by comparing the timestamp difference of consecutive messages, detecting packet loss through sequence number tracking and confirmation mechanism, and calculating the bandwidth utilization by monitoring the interface traffic statistics of network devices.

[0085] In the fourth step, the pre-processed parameter data is sent to the matrix processing unit of the network controller module 62, which exhaustively enumerates all paths in the network and performs statistical processing on key performance indicators one by one, and finally forms a huge tenant-level network quality matrix. This matrix pays more attention to the analysis of network structure and paths, and can exhaustively enumerate all possible transmission paths in the network, and can capture every subtle dynamic in the network, including direct and indirect connections between nodes, possible routes of data flow, and potential bottlenecks and redundancies in the network.

[0086] In the fifth step, the algorithm unit of the network controller module 62 sets a weighted comprehensive evaluation algorithm model to calculate the quality matrix formed in the above steps. First, the weights are assigned to the parameters, and the metric value of each path is calculated through a formula.

[0087] In the sixth step, the path comprehensive metric calculated by the network controller module 62 is sent to the service arrangement module 64, and the path with the highest comprehensive metric value is selected as the main path, and the path with the second highest comprehensive metric value is selected as the backup service path, generating a set of path information including one main and one backup. It is then translated into a set of policy table items for packet matching conditions and forwarding, that is, a flow table. It is transmitted to each node device in the network through the flow table delivery mechanism to ensure that each node searches and forwards data packets according to the delivered policy, thereby forming a controllable and optimal security service chain.

[0088] Step 7: Monitor network quality changes in real time, and use the following two methods to ensure fast routing convergence and flexible management, and implement service chain updates and iterations:

[0089] Method 1: The message processing unit periodically performs network detection. When the network quality changes, the message processing unit promptly sends the change information to the controller to recalculate the comprehensive metric S_total, and then the service orchestrator module selects a new primary and backup path, forms a new service chain and issues it.

[0090] Mode 2: The network detection unit manages the network topology in real time. When a new device enters the network or an existing network device is disconnected from the network, the network detection unit will re-initiate a network detection request to the message processing module 60, requesting to collect new performance indicator parameter information, return new parameter information, calculate, select routes, arrange, and issue new security service chains.

[0091] It should be noted that the various modules in the above-mentioned business path determination device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0092] According to an embodiment of the present application, a non-volatile storage medium is also provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following service path method: control the nodes in the communication network to send simulated messages to adjacent nodes, and obtain the detection results of the simulated message sending and receiving processes, wherein the detection results include the sending timestamp, receiving timestamp, packet loss information and traffic statistics of the simulated message; determine a network quality matrix based on the detection results, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between the nodes in the corresponding rows and columns; determine the metric values ​​corresponding to the candidate service paths in the communication network based on the network quality matrix and the candidate nodes involved in the candidate service paths, wherein the metric values ​​are used to reflect the selection priority of the candidate service paths, and the larger the metric value, the higher the selection priority; determine the candidate service path with the highest metric value from each candidate service path as the main service path, and determine the candidate service path with the second highest metric value as the backup service path.

[0093] According to an embodiment of the present application, an electronic device is also provided, including a memory and a processor, the processor being used to run a program stored in the memory, wherein the following service path determination method is executed when the program is running: controlling a node in a communication network to send a simulation message to an adjacent node, and obtaining detection results of the simulation message sending and receiving process, wherein the detection results include a sending timestamp, a receiving timestamp, packet loss information and traffic statistics data of the simulation message; determining a network quality matrix based on the detection results, wherein rows in the network quality matrix represent source nodes, columns represent destination nodes, and elements in the network quality matrix are routing performance indicators between nodes in corresponding rows and columns; determining a metric value corresponding to a candidate service path in the communication network based on the network quality matrix and candidate nodes involved in the candidate service path, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; determining the candidate service path with the highest metric value from among the candidate service paths as the primary service path, and determining the candidate service path with the second highest metric value as the backup service path.

[0094] According to an embodiment of the present application, a computer program product is also provided, including a computer program, which implements the following service path determination method when executed by a processor: controlling a node in a communication network to send a simulation message to an adjacent node, and obtaining detection results of the simulation message sending and receiving process, wherein the detection results include a sending timestamp, a receiving timestamp, packet loss information and traffic statistics of the simulation message; determining a network quality matrix based on the detection results, wherein rows in the network quality matrix represent source nodes, columns represent destination nodes, and elements in the network quality matrix are routing performance indicators between nodes in corresponding rows and columns; determining a metric value corresponding to a candidate service path in the communication network based on the network quality matrix and the candidate nodes involved in the candidate service path, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; determining the candidate service path with the highest metric value from among the candidate service paths as the primary service path, and determining the candidate service path with the second highest metric value as the backup service path.

[0095] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0096] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0097] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0098] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0100] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for determining a service path, characterized in that: include: Control a node in a communication network to send a simulation message to a neighboring node, and obtain a detection result of the simulation message sending and receiving process, wherein the detection result includes a sending timestamp, a receiving timestamp, packet loss information and traffic statistics of the simulation message; Determine a network quality matrix according to the detection result, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between nodes in corresponding rows and columns; Determine, according to the network quality matrix and the candidate nodes involved in the candidate service path, a metric value corresponding to the candidate service path in the communication network, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; The candidate service path with the highest metric value is determined as a primary service path from among the candidate service paths, and the candidate service path with the second highest metric value is determined as a backup service path.

2. The service path determination method according to claim 1, characterized in that: Determining, according to the network quality matrix and the candidate nodes involved in the candidate service path, a metric value corresponding to the candidate service path in the communication network includes: Determine a connection relationship between each of the candidate nodes, and determine all candidate node pairs in the candidate service path according to the connection relationship, wherein the candidate node pairs include two adjacent candidate nodes, and the same candidate node is in one or two candidate node pairs; Determine the elements corresponding to the candidate node pairs; Determine the node metric value corresponding to the connection relationship according to the elements corresponding to the candidate node pairs; The sum of all the node metrics is determined as the metric of the candidate service path.

3. The service path determination method according to claim 2, characterized in that: Determining the node metric value corresponding to the candidate node pair according to the element corresponding to the candidate node pair includes: Normalizing various routing performance indicators contained in the network quality matrix respectively; Determine the normalized routing performance indicator values ​​of various types contained in the elements corresponding to the candidate node pairs; The node metric value is determined according to the normalized various routing performance indicator values.

4. The service path determination method according to claim 3, characterized in that: Determining the node metric value based on the normalized performance index values ​​includes: Determine the preset business type; Determine the weight corresponding to each routing performance indicator type according to the business type; The normalized various routing performance indicator values ​​are weighted and summed according to the weights to obtain the node metric value.

5. The service path determination method according to claim 1, characterized in that: The routing performance indicator includes at least one of the following: transmission delay, transmission jitter information, packet loss rate and bandwidth utilization.

6. The service path determination method according to claim 5, characterized in that: The routing performance indicator is determined in the following manner: Determining the transmission delay according to a sending timestamp and a receiving timestamp of the simulation message; Determining the transmission jitter information according to the transmission delays corresponding to a plurality of consecutive simulation messages; The bandwidth utilization is determined according to the traffic statistics and bandwidth information between nodes in the communication network.

7. The service path determination method according to claim 1, characterized in that: Before controlling a node in the communication network to send a simulation message to an adjacent node, the service path determination method further includes: Determine device information of each device in the communication network, the device information including at least one of the following: device type, port identifier, network address, the communication network including a security resource pool network; Determining a link topology diagram of the communication network according to the device information; Nodes in the communication network are determined according to the link topology graph.

8. The service path determination method according to claim 1, characterized in that: The service path determination method further includes: After the detection result changes, updating the network quality matrix according to the changed detection result; Updating the metric value of the candidate service path according to the updated network quality matrix; The candidate service path with the largest updated metric value is determined as the primary path, and the candidate service path with the second largest updated metric value is determined as the backup service path.

9. A service path determination device, characterized in that: include: A message processing module, used to control a node in a communication network to send a simulation message to a neighboring node, and obtain a detection result of the sending and receiving process of the simulation message, wherein the detection result includes a sending timestamp, a receiving timestamp, packet loss information and traffic statistics of the simulation message; A network controller module, configured to determine a network quality matrix according to the detection result, wherein the rows in the network quality matrix represent source nodes, the columns represent destination nodes, and the elements in the network quality matrix are routing performance indicators between the nodes in the corresponding rows and columns; determine a metric value corresponding to the candidate service path in the communication network according to the network quality matrix and the candidate nodes involved in the candidate service path, wherein the metric value is used to reflect the selection priority of the candidate service path, and the larger the metric value, the higher the selection priority; The service orchestration module is configured to determine, from among the candidate service paths, the candidate service path with the highest metric value as the primary service path, and determine the candidate service path with the second highest metric value as the backup service path.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the service path determination method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the service path determination method according to any one of claims 1 to 8 when running.

12. A computer program product, characterized in that The method comprises a computer program, which implements the service path determination method according to any one of claims 1 to 8 when executed by a processor.

Images