Intelligent VPN service automatic opening system and resource conflict detection method thereof

Abstract

The invention discloses an intelligent VPN (Virtual Private Network) service automatic opening system and a resource conflict detection method thereof, and belongs to the technical field of VPN services. The system comprises a network structure module for realizing identification of an SDN controller and a communication link in a network structure; the interface protocol module is used for realizing a function of defining service requirements by a software protocol and realizing parameter characteristic capture of SDN controller operation; the node layering module can realize layering and dynamic updating of a control plane in combination with the time span of the VPN business service; the VPN service automatic opening detection optimization module is used for realizing resource conflict range detection of the SDN controller and realizing configuration optimization of a deployment configuration scheme before automatic opening of the VPN service; according to the method and the device, the dynamic resource detection limit of the sub-service cross-node of the SDN controller can be calibrated before the VPN service is opened, and the security isolation after the VPN service is opened is facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of VPN services, in particular to an intelligent VPN service automatic activation system and a resource conflict detection method thereof. Background Art

[0002] VPN, or Virtual Private Network, refers to a dedicated secure data communication network built on a public network infrastructure by an ISP or other NSP. This dedicated network is logical rather than physical. As an operating system of the network, the SDN controller does not directly control the network hardware, but it runs as software, which is conducive to network automation management and improves the efficiency of VPN, allowing users to customize the network that best meets their needs.

[0003] When it comes to centralized and intelligent SDN control strategies for VPN services, along with the continuous demand for VPN service expansion, the difficulty of carrying the capacity requirements for dynamic resource conflicts is also increasing; in the process of implementing network protocol interaction through programming interfaces within the SDN controller, the SDN controller, as a central node, implements the isolation of the control plane and the data plane to achieve the configuration and management of VPN services; defining business requirements through software protocols can indeed promote the efficiency of SDN integrated control, but as for the VPN service itself, it is difficult to calibrate the dynamic detection boundaries of resources of the SDN controller across nodes for each service before the VPN service is opened, which is not conducive to the security isolation after the VPN service is opened. Summary of the invention

[0004] The purpose of the present invention is to provide an intelligent VPN service automatic activation system and a resource conflict detection method thereof to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] An intelligent VPN service automatic activation system, the system comprises: a network structure module, an interface protocol module, a node layering module and a VPN service automatic activation detection optimization module;

[0007] The network structure module is used to compile and count the various SDN controllers and communication links in the network structure;

[0008] The interface protocol module is used to provide the SDN controller with an interactive protocol for the internal programming interface, and based on the VPN business service function, to capture the communication link accessed by the internal programming interface between the SDN controllers; and to collect the proportion of the number of clock cycles generated by the SDN controller as the control plane node when the internal programming interface of the SDN controller accesses the communication link;

[0009] The node stratification module is used to collect the clock cycle ratio and generate a control plane node set; to stratify the VPN service time range, and use the VPN service time range as the clock cycle range generated from the beginning of access to the end of no access for each communication link, and perform a dynamic update operation of the control plane node set;

[0010] The VPN service automatic activation detection optimization module is used to detect the resource conflict range of the SDN controller based on the updated control plane node set, and quantitatively characterize the conflict overlap scale between the SDN controllers; based on the conflict overlap scale, recommend a deployment configuration solution for automatic activation of the VPN service.

[0011] Furthermore, the network structure module includes a network structure identification unit and a link information coordination unit:

[0012] The network structure identification unit is used to identify the SDN controller and each programming interface inside the SDN controller in the network structure, so as to uniformly encode each SDN controller and each programming interface into a file;

[0013] The link information coordination unit is used to separate each programming interface through a communication link to form a link interface set.

[0014] Furthermore, the interface protocol module includes a protocol access unit and a resource feature tag unit:

[0015] The protocol access unit is used to provide an interactive protocol between programming interfaces during the VPN service process. When a programming interface generates an access behavior to a communication link, the SDN controller is locked through the accessed programming interface and the accessed communication link is captured;

[0016] The resource feature label unit is used to collect the clock cycle feature parameter generated by the SDN controller during the period from the beginning of the communication link being accessed to the end of the communication link being accessed, wherein the clock cycle feature parameter is the cumulative sum of the number of clock cycles generated when each programming interface inside the SDN controller executes a code program; and is used to collect the total number of clock cycles generated by the accessed communication link when the programming interface inside the SDN controller accesses the communication link.

[0017] Furthermore, the node layering module includes a control plane node unit and a layering update unit:

[0018] The control plane node unit is used to collect the proportion of clock cycles generated when the programming interface inside the SDN controller accesses each communication link to generate a control plane node set;

[0019] The hierarchical update unit is used to pre-divide VPN service time range segments, and hierarchically define the clock cycle range generated from the beginning of access to the end of no access to the communication link based on the VPN service time range segments, so as to meet the update requirements of the control plane node set.

[0020] Furthermore, the VPN service automatic activation detection and optimization module includes an activation detection unit and a resource conflict optimization unit:

[0021] The activation detection unit is used to select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the upper and lower limits of the detected resource conflict range, and calibrate the conflict overlap scale between SDN controllers based on the resource conflict range;

[0022] The resource conflict optimization unit determines whether there is a security isolation requirement between SDN controllers based on the conflict overlap scale, and based on the determination result, does not recommend the SDN controller with the security isolation requirement to deploy and configure the VPN service within the VPN service time range.

[0023] An intelligent VPN service resource conflict detection method, the method comprising the following steps:

[0024] Step S1: Identify the SDN controller in the network structure, the programming interface and communication link inside the SDN controller;

[0025] Step S2: Using the SDN controller as the control plane, lock each SDN controller that generates VPN service behavior and capture the adapted communication link, and collect the proportion of the number of clock cycles based on the capture result of the communication link;

[0026] Step S3: recording the collected clock cycle ratio into the control plane node set, and updating the control plane node set in layers based on the VPN business service time range;

[0027] Step S4: Select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the scope of resource conflicts between SDN controllers, analyze the conflict overlap of VPN services before activation based on the resource conflict scope, and determine whether there is a need for security isolation between SDN controllers based on the conflict overlap.

[0028] Furthermore, the specific implementation process of step S1 includes:

[0029] Coordinate all programming interfaces provided by the SDN controller and all communication links of each programming interface network, and uniformly encode the programming interfaces and communication links respectively. The i-th programming interface is recorded as M i , let the rth communication link be CL r ;

[0030] The communication link includes the programming interface that provides VPN service. r The group captures each programming interface and forms a communication link CL r The link interface set is denoted as L(CL r )={M i |i∈[1,I]}, where I represents the total number of programming interfaces.

[0031] Furthermore, the specific implementation process of step S2 includes:

[0032] Considering an SDN controller as a control plane node, based on the VPN service functions provided by the programming interfaces of the SDN controller, each communication link is captured. e The internal programming interface accesses the communication link CL r , then for the communication link CL r To capture;

[0033] Based on the capture behavior of the communication link, through the e-th SDN controller SDN e Internal programming interface to access the communication link CL r When SDN controller SDN is obtained e The proportion of clock cycles generated when accessing the internal programming interface is recorded as h(SDN e |CL r ), the clock cycle ratio is: r From the beginning of access to the end of access, the SDN controller SDN e The internal programming interfaces access the communication link CL r The ratio of the cumulative sum of the number of clock cycles generated when the communication link CL r The total number of clock cycles generated from the beginning of being accessed to the end of being accessed.

[0034] Furthermore, the specific implementation process of step S3 includes:

[0035] SDN controller SDN e When viewed as a control plane node, collect SDN controller SDN e The proportion of clock cycles generated when the internal programming interface accesses each communication link and generates the control plane node set P (SDN e )={h(SDN e |CL r )|r∈[1,R]}, where R represents the total number of communication links;

[0036] The VPN service time range is pre-divided into segments, and the xth VPN service time range segment is used as the clock cycle range generated from the beginning of access to the end of no access to each communication link, and each control plane node set is updated within the clock cycle range, and the control plane node set P (SDN e ) The corresponding updated control plane node set is recorded as P x (SDN e ).

[0037] Furthermore, the specific implementation process of step S4 includes:

[0038] Quantitative analysis of SDN controllers based on control plane node sets e Resource conflict ranges in different clock cycle ranges:

[0039] In the control plane node set P x (SDN e ) respectively select the maximum and minimum values ​​of the proportion of the number of clock cycles, and record them as ma{P x (SDN e )} and mi{P x (SDN e )}, based on the maximum value and the minimum value, calculate the SDN controller SDN e The upper limit of the resource conflict range Compute SDN Controller SDN e The lower limit of the resource conflict range SDN controller SDN e The resource conflict range within the xth clock cycle is expressed as RCR (SDN e |x)=[mi(e,x),ma(e,x)]; where, represents the mean of the proportion of clock cycles, and σ represents the standard deviation of the proportion of clock cycles, and E represents the total number of SDN controllers;

[0040] According to the above method, the clock cycle is the most basic and smallest time unit in the computer. The fixed-length time interval defined by the CPU clock represents the time experienced by the processor from one time point to the next same time point. In one clock cycle, the CPU completes a most basic action. In the process of the SDN controller implementing VPN service through the software protocol, the software program operation is indispensable, and the VPN service performance and expansion requirements carried by the communication link in the process are essentially the consumption of the clock cycle ratio. In the process of studying the clock cycle ratio, the Nair criterion is combined. The Nair criterion is used to detect outliers in the data set, also known as gross errors. Through an infinite loop, it is evaluated whether a maximum or minimum value in a set of measured values ​​significantly deviates from other values, so that it can be regarded as an outlier and eliminated. The present invention does not require an infinite loop to eliminate outliers, but only needs to obtain the resource conflict range through the maximum and minimum values. The purpose is to obtain the conflict overlap scale to realize the conflict judgment before the VPN service is opened between different SDN controller configurations.

[0041] Quantifying the resource conflict range RCR (SDN e |x) and resource conflict range RCR(SDN e+1 |x) between the conflict coincidence scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] = q{ma(e, x), ma(e+1, x)}-Q{mi(e, x), mi(e+1, x)}, where ma(e+1, x) represents the SDN controller SDN e+1 The upper limit of the resource conflict range, mi(e+1, x) represents the SDN controller SDN e+1 The lower limit of the resource conflict range, q{} represents the minimum value selection function, and Q{} represents the maximum value selection function;

[0042] Preset scale factor, if the conflict overlaps scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] is greater than or equal to the scale factor, it means that within the xth clock cycle range, the SDN controller SDN e SDN with SDN Controller e+1 If there is a need for security isolation between them, it is not recommended to use the SDN controller during the xth VPN service time range. e SDN with SDN Controller e+1 To deploy and configure VPN business services.

[0043] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: in an intelligent VPN service automatic activation system and a resource conflict detection method thereof provided by the present invention, a network structure module realizes the identification of an SDN controller and a communication link in a network structure; an interface protocol module realizes the function of defining service requirements by a software protocol and realizes the capture of parameter characteristics of the operation of an SDN controller; a node stratification module can realize the stratification and dynamic update of the control plane in combination with the time span of VPN service; a VPN service automatic activation detection optimization module realizes the resource conflict range detection of an SDN controller and realizes the configuration optimization of a deployment configuration scheme before the VPN service is automatically activated; the present invention can realize the calibration of the dynamic detection boundary of resources of an SDN controller across nodes for each service before the VPN service is activated, which is beneficial to the security isolation after the VPN service is activated. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0045] Figure 1 The invention is a schematic diagram of the steps of an intelligent VPN service automatic activation system and a resource conflict detection method thereof. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In the first embodiment of the present invention, a smart VPN service automatic activation system is provided, the system comprising: a network structure module, an interface protocol module, a node layering module and a VPN service automatic activation detection optimization module;

[0048] The network structure module is used to compile and count the various SDN controllers and communication links in the network structure;

[0049] Preferably, the network structure module includes a network structure identification unit and a link information coordination unit:

[0050] A network structure identification unit, used to identify the SDN controller and each programming interface inside the SDN controller in the network structure, so as to uniformly encode and file each SDN controller and each programming interface;

[0051] A link information coordination unit, used to separate each programming interface through a communication link to form a link interface set;

[0052] The interface protocol module is used to provide the SDN controller with an interactive protocol for the internal programming interface, and based on the VPN business service function, to capture the communication link accessed by the internal programming interface between the SDN controllers; and to collect the proportion of the number of clock cycles generated by the SDN controller as the control plane node when the internal programming interface of the SDN controller accesses the communication link;

[0053] Preferably, the interface protocol module includes a protocol access unit and a resource feature tag unit:

[0054] The protocol access unit is used to provide an interactive protocol between programming interfaces during the VPN service process. When a programming interface generates an access behavior to a communication link, the SDN controller is locked through the accessed programming interface and the accessed communication link is captured.

[0055] The resource feature label unit is used to collect the clock cycle feature parameters generated by the SDN controller during the period from the beginning of the communication link being accessed to the period of no access. The clock cycle feature parameters are the cumulative sum of the number of clock cycles generated when the code programs are executed by each programming interface inside the SDN controller; and is used to collect the total number of clock cycles generated by the accessed communication link when the programming interface inside the SDN controller accesses the communication link;

[0056] The node stratification module is used to collect the proportion of clock cycles and generate a control plane node set; it is used to stratify the VPN service time range, and use the VPN service time range as the clock cycle range generated from the beginning of access to the end of no access for each communication link, and perform a dynamic update operation of the control plane node set;

[0057] Preferably, the node layering module includes a control plane node unit and a layering update unit:

[0058] The control plane node unit is used to collect the proportion of clock cycles generated when the programming interface inside the SDN controller accesses each communication link to generate a control plane node set;

[0059] A hierarchical update unit, used to pre-divide VPN service time range segments, and hierarchically divide the clock cycle range generated from the beginning of access and utilization to the period of no access and utilization of the communication link by the VPN service time range segments, so as to meet the update requirements of the control plane node set;

[0060] The VPN service automatic activation detection and optimization module is used to detect the resource conflict range of the SDN controller based on the updated control plane node set, and quantitatively characterize the conflict overlap scale between SDN controllers; based on the conflict overlap scale, it recommends the deployment configuration scheme for automatic activation of VPN services;

[0061] Preferably, the VPN service automatic activation detection optimization module includes an activation detection unit and a resource conflict optimization unit:

[0062] The detection unit is enabled to select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the upper and lower limits of the detected resource conflict range, and calibrate the conflict overlap scale between SDN controllers based on the resource conflict range;

[0063] The resource conflict optimization unit determines whether there is a security isolation requirement between SDN controllers based on the conflict overlap scale. Based on the determination result, it is not recommended to deploy and configure VPN service with SDN controllers that have security isolation requirements within the VPN service time range.

[0064] See also Figure 1 In the second embodiment, a method for detecting conflict of intelligent VPN service resources is provided, the method comprising the following steps:

[0065] Step S1: Identify the SDN controller in the network structure, the programming interface and communication link inside the SDN controller;

[0066] Exemplarily, all programming interfaces provided by the SDN controller and all communication links of each programming interface network are coordinated, and the programming interfaces and communication links are uniformly coded respectively, and the i-th programming interface is recorded as M i , let the rth communication link be CL r ;

[0067] The communication link contains a programming interface that provides VPN service. r The group captures each programming interface and forms a communication link CL r The link interface set is denoted as L(CL r )={M i |i∈[1,I]}, where I represents the total number of programming interfaces;

[0068] Step S2: Using the SDN controller as the control plane, lock each SDN controller that generates VPN service behavior and capture the adapted communication link, and collect the proportion of the number of clock cycles based on the capture result of the communication link;

[0069] For example, an SDN controller is regarded as a control plane node, and the VPN service functions provided by the programming interfaces of the SDN controller are used to capture each communication link. e The internal programming interface accesses the communication link CL r , then for the communication link CL r To capture;

[0070] Based on the capture behavior of the communication link, through the e-th SDN controller SDN e Internal programming interface to access the communication link CL r When SDN controller SDN is obtained e The proportion of clock cycles generated when accessing the internal programming interface is recorded as h(SDN e |CL r ), the proportion of clock cycles is: in the communication link CL r From the beginning of access to the end of access, the SDN controller SDN e The internal programming interfaces access the communication link CL r The ratio of the cumulative sum of the number of clock cycles generated when the communication link is CL r The total number of clock cycles generated from the beginning of the access to the end of the access;

[0071] Step S3: Record the collected clock cycle ratio into the control plane node set, and update the control plane node set in layers based on the VPN business service time range;

[0072] For example, the SDN controller SDN e When viewed as a control plane node, collect SDN controller SDN e The proportion of clock cycles generated when the internal programming interface accesses each communication link and generates the control plane node set P (SDN e )={h(SDN e |CL r )|r∈[1,R]}, where R represents the total number of communication links;

[0073] The VPN service time range is pre-divided into segments, and the xth VPN service time range segment is used as the clock cycle range generated from the beginning of access to the end of no access to each communication link, and each control plane node set is updated within the clock cycle range, and the control plane node set P (SDN e ) The corresponding updated control plane node set is recorded as P x (SDN e );

[0074] Step S4: Select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the resource conflict range between SDN controllers, analyze the conflict overlap of VPN services before activation based on the resource conflict range, and determine whether there is a need for security isolation between SDN controllers based on the conflict overlap;

[0075] Exemplary, quantitative analysis of SDN controllers based on control plane node setse Resource conflict ranges in different clock cycle ranges:

[0076] In the control plane node set P x (SDN e ) respectively select the maximum and minimum values ​​of the proportion of the number of clock cycles, and record them as ma{P x (SDN e )} and mi{P x (SDN e )}, based on the maximum and minimum values, calculate the SDN controller SDN e The upper limit of the resource conflict range Compute SDN Controller SDN e The lower limit of the resource conflict range SDN controller SDN e The resource conflict range within the xth clock cycle is expressed as RCR (SDN e |x)=[mi(e,x),ma(e,x)]; where, represents the mean of the proportion of clock cycles, and σ represents the standard deviation of the proportion of clock cycles, and E represents the total number of SDN controllers;

[0077] Quantifying the resource conflict range RCR (SDN e |x) and resource conflict range RCR(SDN e+1 |x) between the conflict coincidence scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] = q{ma(e, x), ma(e+1, x)}-Q{mi(e, x), mi(e+1, x)}, where ma(e+1, x) represents the SDN controller SDN e+1 The upper limit of the resource conflict range, mi(e+1, x) represents the SDN controller SDN e+1 The lower limit of the resource conflict range, q{} represents the minimum value selection function, and Q{} represents the maximum value selection function;

[0078] Preset scale factor, if the conflict overlaps scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] is greater than or equal to the scale factor, it means that within the xth clock cycle range, the SDN controller SDN e SDN with SDN Controller e+1 If there is a need for security isolation between them, it is not recommended to use the SDN controller during the xth VPN service time range.e SDN with SDN Controller e+1 To deploy and configure VPN business services.

[0079] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0080] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An intelligent VPN service automatic activation system, characterized in that: The system includes: a network structure module, an interface protocol module, a node layering module and a VPN service automatic opening detection optimization module; The network structure module is used to compile and count the various SDN controllers and communication links in the network structure; The interface protocol module is used to provide the SDN controller with an interactive protocol for the internal programming interface, and based on the VPN business service function, to capture the communication link accessed by the internal programming interface between the SDN controllers; and to collect the proportion of the number of clock cycles generated by the SDN controller as the control plane node when the internal programming interface of the SDN controller accesses the communication link; The node stratification module is used to collect the clock cycle ratio and generate a control plane node set; to stratify the VPN service time range, and use the VPN service time range as the clock cycle range generated from the beginning of access to the end of no access for each communication link, and perform a dynamic update operation of the control plane node set; The VPN service automatic activation detection optimization module is used to detect the resource conflict range of the SDN controller based on the updated control plane node set, and quantitatively characterize the conflict overlap scale between the SDN controllers; based on the conflict overlap scale, recommend a deployment configuration solution for automatic activation of the VPN service.

2. The intelligent VPN service automatic activation system according to claim 1, characterized in that: The network structure module includes a network structure identification unit and a link information coordination unit: The network structure identification unit is used to identify the SDN controller and each programming interface inside the SDN controller in the network structure, so as to uniformly encode each SDN controller and each programming interface into a file; The link information coordination unit is used to separate each programming interface through a communication link to form a link interface set.

3. The intelligent VPN service automatic activation system according to claim 2, characterized in that: The interface protocol module includes a protocol access unit and a resource feature label unit: The protocol access unit is used to provide an interactive protocol between programming interfaces during the VPN service process. When a programming interface generates an access behavior to a communication link, the SDN controller is locked through the accessed programming interface and the accessed communication link is captured; The resource feature label unit is used to collect the clock cycle feature parameter generated by the SDN controller during the period from when the communication link is accessed to when it is no longer accessed, wherein the clock cycle feature parameter is the cumulative sum of the number of clock cycles generated when each programming interface inside the SDN controller executes a code program; It is used to collect the total number of clock cycles generated by the accessed communication link when the internal programming interface of the SDN controller accesses the communication link.

4. The intelligent VPN service automatic activation system according to claim 3, characterized in that: The node layering module includes a control plane node unit and a layering update unit: The control plane node unit is used to collect the proportion of clock cycles generated when the programming interface inside the SDN controller accesses each communication link to generate a control plane node set; The hierarchical update unit is used to pre-divide VPN service time range segments, and hierarchically define the clock cycle range generated from the beginning of access to the end of no access to the communication link based on the VPN service time range segments, so as to meet the update requirements of the control plane node set.

5. The intelligent VPN service automatic activation system according to claim 4, characterized in that: The VPN service automatic activation detection and optimization module includes an activation detection unit and a resource conflict optimization unit: The activation detection unit is used to select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the upper and lower limits of the detected resource conflict range, and calibrate the conflict overlap scale between SDN controllers based on the resource conflict range; The resource conflict optimization unit determines whether there is a security isolation requirement between SDN controllers based on the conflict overlap scale, and based on the determination result, does not recommend the SDN controller with the security isolation requirement to deploy and configure the VPN service within the VPN service time range.

6. The intelligent VPN service resource conflict detection method according to claim 5 is applied to an intelligent VPN service automatic activation system according to any one of claims 1 to 5, characterized in that: The method includes: Step S1: Identify the SDN controller in the network structure, the programming interface and communication link inside the SDN controller; Step S2: Using the SDN controller as the control plane, lock each SDN controller that generates VPN service behavior and capture the adapted communication link, and collect the proportion of the number of clock cycles based on the capture result of the communication link; Step S3: recording the collected clock cycle ratio into the control plane node set, and updating the control plane node set in layers based on the VPN business service time range; Step S4: Select the maximum and minimum values ​​of the proportion of the number of clock cycles in the updated control plane node set to quantify the scope of resource conflicts between SDN controllers, analyze the conflict overlap of VPN services before activation based on the resource conflict scope, and determine whether there is a need for security isolation between SDN controllers based on the conflict overlap.

7. The intelligent VPN service resource conflict detection method according to claim 6, characterized in that: The specific implementation process of step S1 includes: Coordinate all programming interfaces provided by the SDN controller and all communication links of each programming interface network, and uniformly encode the programming interfaces and communication links respectively. The i-th programming interface is recorded as M i , let the rth communication link be CL r ; The communication link includes the programming interface that provides VPN service. r The group captures each programming interface and forms a communication link CL r The link interface set is denoted as L(CL r )={M i |i∈[1,I]}, where I represents the total number of programming interfaces.

8. The intelligent VPN service resource conflict detection method according to claim 7, characterized in that: The specific implementation process of step S2 includes: Considering an SDN controller as a control plane node, based on the VPN service functions provided by the programming interfaces of the SDN controller, each communication link is captured. e The internal programming interface accesses the communication link CL r , then the communication link CL r To capture; Based on the capture behavior of the communication link, through the e-th SDN controller SDN e Internal programming interface to access the communication link CL r When SDN controller SDN is obtained e The proportion of clock cycles generated when accessing the internal programming interface is recorded as h(SDN e |CL r ), the clock cycle number accounts for: in the communication link CL r From the beginning of access to the end of access, the SDN controller SDN e The internal programming interfaces access the communication link CL r The ratio of the cumulative sum of the number of clock cycles generated when the communication link CL r The total number of clock cycles generated from the beginning of being accessed to the end of being accessed.

9. The intelligent VPN service resource conflict detection method according to claim 8, characterized in that: The specific implementation process of step S3 includes: SDN controller SDN e When viewed as a control plane node, collect SDN controller SDN e The proportion of clock cycles generated when the internal programming interface accesses each communication link and generates the control plane node set P (SDN e )={h(SDN e |CL r )|r∈[1,R]}, where R represents the total number of communication links; The VPN service time range is pre-divided into segments, and the xth VPN service time range segment is used as the clock cycle range generated from the beginning of access to the end of no access to each communication link, and each control plane node set is updated within the clock cycle range, and the control plane node set P (SDN e ) The corresponding updated control plane node set is recorded as P x (SDN e ).

10. The intelligent VPN service resource conflict detection method according to claim 9, characterized in that: The specific implementation process of step S4 includes: Quantitative analysis of SDN controllers based on control plane node sets e Resource conflict ranges in different clock cycle ranges: In the control plane node set P x (SDN e ) respectively select the maximum and minimum values ​​of the proportion of the number of clock cycles, and record them as ma{P x (SDN e )} and mi{P x (SDN e )}, based on the maximum value and the minimum value, calculate the SDN controller SDN e The upper limit of the resource conflict range Compute SDN Controller SDN e The lower limit of the resource conflict range SDN controller SDN e The resource conflict range within the xth clock cycle is expressed as RCR (SDN e |x)=[mi(e,x),ma(e,x)]; where, represents the mean of the proportion of clock cycles, and σ represents the standard deviation of the proportion of clock cycles. E represents the total number of SDN controllers; Quantifying the resource conflict range RCR (SDN e |x) and resource conflict range RCR(SDN e+1 |x) between the conflict coincidence scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] = q{ma(e, x), ma(e+1, x)}-Q{mi(e, x), mi(e+1, x)}, where ma(e+1, x) represents the SDN controller SDN e+1 The upper limit of the resource conflict range, mi(e+1, x) represents the SDN controller SDN e+1 The lower limit of the resource conflict range, q{} represents the minimum value selection function, and Q{} represents the maximum value selection function; Preset scale factor, if the conflict overlaps scale MD[RCR(SDN e |x), RCR(SDN e+1 |x)] is greater than or equal to the scale factor, it means that within the xth clock cycle range, the SDN controller SDN e SDN with SDN Controller e+1 If there is a need for security isolation between them, it is not recommended to use the SDN controller during the xth VPN service time range. e SDN with SDN Controller e+1 To deploy and configure VPN business services.

Images