P4-based programmable switch secure programmable in-band network telemetry method and system

Abstract

The present application relates to the technical field of in-band network telemetry, and particularly relates to a secure programmable in-band network telemetry method and system based on a programmable switch P4, a security policy is set according to a telemetry service business requirement and is stored on a server by using a security policy mapping database; a controller generates a telemetry data packet instruction and sends the telemetry data packet instruction to a P4 switch at a data level; the P4 switch performs in-band network telemetry according to the telemetry data packet instruction and encrypts telemetry data of a corresponding telemetry data type according to the security policy, feeds back generated telemetry result data to the server, the server receives the telemetry result data and stores the telemetry result data after decryption, and the server monitors a network state in which the P4 switch is located in real time during in-band network telemetry and dynamically adjusts the security policy according to the network state and the business requirement, so that confidentiality and integrity protection of the telemetry data can be realized while security and transmission performance can be taken into account.

Description

Technical Field

[0001] This invention relates to the field of in-band network telemetry technology, and in particular to a secure programmable in-band network telemetry method and system based on a programmable switch P4. Background Technology

[0002] With the rapid updates of internet business applications and the continuous growth of user scale, modern networks are exhibiting characteristics of "high speed, large scale, multiple access, and unpredictability," leading to increasingly complex demands on network performance and security. This, in turn, places high demands on network management, all of which rely on timely and effective network measurement and monitoring. Traditional network measurement and software-defined measurement methods are insufficient to meet the needs of efficient, accurate, and personalized services. The emergence of in-band network telemetry technology based on the programmable data plane has brought new opportunities to the field of network telemetry. Utilizing P4 programmable switches, network administrators can customize packet processing logic to achieve efficient in-band network telemetry, thereby enabling real-time, high-precision monitoring of network status. Working groups such as P4.0rg and EETF IPPM are researching and standardizing the architecture and protocols of in-band network telemetry, resulting in numerous RFC documents that have garnered widespread attention from equipment manufacturers. These developments have significantly promoted research based on INT technology.

[0003] Building upon this, J. Vestin et al. proposed the FS-INT scheme, supporting both rate-based and event-based sampling strategies to adapt to different monitoring needs. M. Ji proposed an online learning-based algorithm (INTaaS) to dynamically allocate resources for INT tasks to maximize Quality of Service (QoS). Liu Zhengzheng et al. proposed an active network telemetry mechanism that supports flexible on-demand acquisition of telemetry data by designing a dual-stack probe data packet format. Most of these studies focus on improving the reliability and effectiveness of in-band network telemetry data acquisition, but they have neglected the data security of in-band network telemetry. Potential software vulnerabilities, backdoors, and viruses in the network can lead to the malicious theft and tampering of in-band network telemetry data. This potential security risk to telemetry data directly affects the system assessment and decision-making of network security, and also incurs huge costs for users and network operations while causing data loss. Currently, researchers are focusing on the security of programmable data planes. Chen Xiaoqi proposed an AES encryption method based on scrambled lookup table technology, and F. Hauser proposed an IPsec encryption method to ensure the security of forwarded data. However, these methods are primarily used for encrypting forwarded data and are not suitable for encrypting telemetry data. Furthermore, while encryption algorithms ensure security, they also incur higher resource costs, particularly the AES algorithm, which consumes a large amount of memory and has a long compilation time, leading to reduced network throughput. Balancing security and transmission performance is a crucial issue that must be considered in practical applications of in-band network telemetry. Summary of the Invention

[0004] To address this issue, the present invention provides a secure programmable in-band network telemetry method and system based on a programmable switch P4, which solves the problems of existing in-band network telemetry data having security threats and being unable to effectively balance security and transmission performance.

[0005] According to the design scheme provided by the present invention, on the one hand, a secure programmable in-band network telemetry method based on a programmable switch P4 is provided, comprising:

[0006] The target user sets up a security policy based on the telemetry service business requirements and uses the security policy mapping database to store the data on the server. The target user is a legitimate registered user of the telemetry service business platform. The security policy includes: a custom telemetry data type and a data security level corresponding to the telemetry data type. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data type.

[0007] The controller generates telemetry data packet instructions based on telemetry service requirements and security policies, and sends the telemetry data packet instructions to the P4 switch at the data layer;

[0008] The P4 switch executes in-band network telemetry based on telemetry data packet instructions and encrypts and protects telemetry data of corresponding telemetry data types according to security policies to generate telemetry result data and feed it back to the server.

[0009] The server receives telemetry results data, decrypts and stores it, and monitors the network status of the P4 switch in real time during in-band network telemetry, and dynamically adjusts the security policy according to the network status and business needs.

[0010] As a secure programmable in-band network telemetry method based on a programmable switch P4 according to the present invention, the target user further sets a security policy according to the telemetry service requirements, including:

[0011] The target user uses the interactive interface in the telemetry service business platform and sets the corresponding data security level for each telemetry data type according to the telemetry service business requirements. The telemetry data types include: switch ID, ingress port number, hop-by-hop delay, queue occupancy, ingress timestamp, egress timestamp, egress port number, and transmission rate.

[0012] Based on the types of telemetry data and their corresponding data security levels, obtain the security policies required by the target user.

[0013] As a secure programmable in-band network telemetry method based on a programmable switch P4 according to the present invention, further comprising, whereby the target user sets a security policy according to the telemetry service requirements, the method also includes:

[0014] The target user uses the interactive interface in the telemetry service platform to adjust the telemetry data type and set the telemetry range corresponding to the telemetry data type according to the telemetry service requirements. The telemetry data type adjustment includes: adding, deleting and / or modifying the type. The telemetry range is the service network, the network link in the service network, or the switch node in the network link.

[0015] As a secure programmable in-band network telemetry method based on a P4 programmable switch according to the present invention, the P4 switch further encrypts and protects the corresponding type of telemetry data according to a security policy during the execution of in-band network telemetry, including:

[0016] The telemetry data types to be encrypted and those not to be encrypted are obtained according to the security policy matching table. The telemetry data corresponding to the telemetry data type to be encrypted is encrypted and protected using the data security level corresponding to the telemetry data type to be encrypted. The security policy matching table stores the telemetry data types to be encrypted that correspond to the target user's security policy.

[0017] The encrypted telemetry data and the unencrypted telemetry data are sent into the forwarding process, so that the telemetry data can be matched and forwarded or discarded according to the forwarding matching table in the forwarding process.

[0018] As a further step in the present invention, the secure programmable in-band network telemetry method based on a programmable switch P4 further includes encrypting and protecting the telemetry data, comprising:

[0019] The encryption algorithm is matched from the encryption entries according to the data security level. The encryption algorithm includes a first encryption algorithm for secure encryption of telemetry data and a second encryption algorithm for integrity encryption of telemetry data. The encryption entries pre-store multiple data security levels and encryption algorithms corresponding to each data security level.

[0020] The matched encryption algorithm is used to provide dual encryption protection for telemetry data, ensuring both security and integrity.

[0021] As a secure programmable in-band network telemetry method based on a programmable switch P4 of the present invention, the method further includes dynamically adjusting the security strategy according to network status and service requirements, comprising:

[0022] The network link security weight is obtained based on the user-set data security level, the corresponding data security level in the current network, and the highest data security level.

[0023] The network transmission performance weight is obtained based on the network link security weight and the network transmission delay and the maximum network link transmission delay obtained from the most recent telemetry.

[0024] A comprehensive evaluation index of network security and performance is obtained by using network link security weight and network link transmission performance weight;

[0025] The data security level in the security strategy is dynamically adjusted based on the comprehensive evaluation indicators and the encryption algorithm complexity corresponding to each data security level, in order to balance in-band network security and network performance loss.

[0026] As a further aspect of the secure programmable in-band network telemetry method based on a programmable switch P4 of the present invention, dynamically adjusting the data security level in the security policy includes:

[0027] The network performance loss of adjacent data security levels is estimated by using the encryption algorithm complexity corresponding to the current data security level and the encryption algorithm complexity corresponding to adjacent data security levels. The adjacent data security levels include: high data security level, which is one level higher than the current data security level, and low data security level, which is one level lower than the current data security level.

[0028] If the comprehensive evaluation index is greater than the network performance loss of selecting a high data security level, then the data security level in the current network will be adjusted to a high data security level and the current security policy will be updated. The updated security policy will be sent to the P4 switch through the controller.

[0029] If the overall evaluation index is less than the network performance loss of selecting a low data security level, then the data security level in the current network will be adjusted to a low data security level and the current security policy will be updated. The updated security policy will then be sent to the P4 switch through the controller.

[0030] Furthermore, this invention also provides a secure programmable in-band network telemetry system based on a P4 programmable switch, comprising: a server, a controller, and a P4 switch, wherein...

[0031] The server is used by target users to set security policies according to the telemetry service business requirements, and to store the security policy mapping database on the server. The target users are legitimate registered users of the telemetry service business platform. The security policy includes: custom telemetry data types and data security levels corresponding to the telemetry data types. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data types.

[0032] The controller is used to generate telemetry data packet instructions based on telemetry service requirements and security policies, and send the telemetry data packet instructions to the P4 switch at the data layer.

[0033] The P4 switch is used to perform in-band network telemetry according to telemetry data packet instructions, encrypt and protect telemetry data of corresponding telemetry data types according to security policies, generate telemetry result data and feed it back to the server, so that the server can receive the telemetry result data, decrypt and store it. During the in-band network telemetry process, the server monitors the network status of the P4 switch in real time and dynamically adjusts the security policy according to the network status and service requirements.

[0034] The beneficial effects of this invention are:

[0035] This invention leverages the programmable data plane characteristics of P4 to integrate national cryptographic algorithms with in-band network telemetry technology. It also introduces an encryption / decryption mechanism to achieve secure programmable telemetry based on P4, protecting the confidentiality and integrity of telemetry data and addressing security threats during telemetry data transmission. Based on feedback scheduling, the encryption algorithm is dynamically adjusted according to real-time network status and user security requirements, balancing security and transmission performance during in-band network telemetry. It also addresses the mismatch between encryption algorithms and data security requirements in existing secure forwarding mechanisms. Deployment in the network is possible using a client-server separation model, allowing users to easily configure the client to upload telemetry requests to the server, which then deploys and completes the telemetry task. The user-friendly interface enables secure in-band telemetry, overcoming the high barriers and difficulties in telemetry deployment and configuration. Attached image description:

[0036] Figure 1 This is a schematic diagram of the secure programmable in-band network telemetry process based on the programmable switch P4 in the embodiment.

[0037] Figure 2 This is a schematic diagram of the secure programmable in-band telemetry network deployment architecture in the embodiment;

[0038] Figure 3 This is a schematic diagram of the encryption mechanism in the embodiment;

[0039] Figure 4 This is a schematic diagram of the encrypted telemetry data packet structure in the embodiment;

[0040] Figure 5 This is a schematic diagram of the INT data packet format in the embodiment.

[0041] Figure 6 This is a schematic diagram of the telemetry data packet decryption process in the embodiment;

[0042] Figure 7 This is a schematic diagram of the feedback scheduling process in the embodiment. Detailed implementation method:

[0043] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0044] To address the security threats, inability to balance data security and transmission performance, and high deployment and configuration barriers inherent in existing in-band network telemetry data, this invention provides embodiments, see [link to embodiments]. Figure 1 As shown, a secure programmable in-band network telemetry method based on a programmable switch P4 is provided, comprising:

[0045] S101. The target user sets a security policy based on the telemetry service business requirements and stores it on the server using the security policy mapping database. The target user is a legitimate registered user of the telemetry service business platform. The security policy includes: a custom telemetry data type and a data security level corresponding to the telemetry data type. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data type.

[0046] Specifically, target users can set security policies based on their telemetry service business needs, which may include:

[0047] The target user uses the interactive interface in the telemetry service business platform and sets the corresponding data security level for each telemetry data type according to the telemetry service business requirements. The telemetry data types include: switch ID, ingress port number, hop-by-hop delay, queue occupancy, ingress timestamp, egress timestamp, egress port number, and transmission rate.

[0048] Based on the types of telemetry data and their corresponding data security levels, obtain the security policies required by the target user.

[0049] The target user uses the interactive interface in the telemetry service platform to adjust the telemetry data type and set the telemetry range corresponding to the telemetry data type according to the telemetry service requirements. The telemetry data type adjustment includes: adding, deleting and / or modifying the type. The telemetry range is the service network, the network link in the service network, or the switch node in the network link.

[0050] like Figure 2As shown, an INT domain contains three main functional nodes: INT Source, INT Sink, and INT Transit Hop. INT Source and INT Sink can be considered the start and end points of the telemetry line. INTSource is responsible for indicating the traffic requiring information collection and the information to be collected. INT Sink is responsible for processing the received information and reporting it to the monitoring equipment. INT Transit Hop can be considered all devices on the line that support INT telemetry. For telemetry administrators, service traffic requiring telemetry will have an INT header added to the source node, containing an instruction set (INT Instruction) specifying the type of information to be collected, thus becoming an INT packet. When it reaches the relevant INT Transit Hop node, the collected information (INT Metadata) will be inserted into the INT packet according to the instruction set. Finally, all INT information is popped from the INT Sink node and sent to the monitoring equipment. For service users, the above INT traffic processing is completely transparent; users cannot and do not need to be aware of this information. In the in-band network telemetry architecture, switching devices forward and process data packets carrying telemetry instructions. When telemetry data packets pass through the device, these telemetry instructions tell network devices with network telemetry capabilities what network status information should be collected and written.

[0051] In this solution, the server front-end provides users with a user-friendly interface, allowing them to customize secure telemetry services according to their needs. The server back-end implements four main functions: identity authentication, security policy, key management, and telemetry data processing. Identity authentication ensures that only legitimately verified users can access and operate the system. Security policies, employing custom encryption mechanisms, allow for different encryption methods for different telemetry data. A dynamic feedback scheduling mechanism adjusts the encryption algorithm based on network conditions, balancing security and transmission performance. Key management handles key generation and updating, key storage, and key revocation and termination during encryption and decryption. Telemetry data processing decrypts, processes, and stores collected telemetry data for analysis. The controller communicates with the server, receives administrator intents, and translates user telemetry requests into specific instructions. This information is then used to configure the P4 switches at the data layer, enabling them to perform secure network telemetry as required. The P4 switches are used for adding and protecting telemetry data. During in-band network telemetry, user-defined security policies can be used to select appropriate encryption algorithms to encrypt different telemetry data, ensuring data security and integrity.

[0052] In the specific workflow, the network administrator connects to the SecPro telemetry platform and accesses the client's INT server. Using a user-friendly interface, the administrator can customize telemetry data types, telemetry ranges, and select the desired security policies. The server's requests are converted into executable instructions through intent translation and transmitted to the controller. The controller then receives the instructions from the server and configures the switches accordingly, loading the appropriate security features into the in-band telemetry. After receiving the control instructions from the controller, the P4 switch obtains the necessary parameter information for the telemetry functions and operates accordingly. Throughout the telemetry process, the server monitors the real-time network status of the encrypted network and performs algorithmic adjustments based on security policy requirements.

[0053] Customized telemetry services are achieved by selecting different combinations of telemetry data. Different telemetry data have different security requirements, and in practical applications, different networks have different security level requirements. For example, special units such as government agencies and research institutes usually have higher levels of protection requirements for network information and data. To address these needs, this solution designs a flexible and definable encryption mechanism, allowing administrators to select the telemetry data to be encrypted and the encryption algorithm to implement a definable encryption mechanism.

[0054] like Figure 3 As shown, after the controller and switch connect for the first time, the controller queries the security policy mapping database to obtain the user-defined security policy, generates the corresponding flow table, and sends it to the security policy function block and encryption function block of the P4 switch. When the switch receives telemetry data, it first matches it against the security policy function block. The security policy matching table is used to filter telemetry data types that meet the encryption conditions. If a match is successful, the data is sent to the encryption function block; if a match fails, the data is sent to the forwarding module and matched against the forwarding matching table. The encryption function block selects the corresponding encryption method for different telemetry data types based on the encryption policy issued by the controller. The encrypted telemetry data is then sent to the forwarding function block for forwarding or discarding.

[0055] S102. The controller generates telemetry data packet instructions based on telemetry service requirements and security policies, and sends the telemetry data packet instructions to the P4 switch at the data layer.

[0056] The S103 and P4 switches execute in-band network telemetry based on telemetry data packet instructions and encrypt and protect telemetry data of corresponding telemetry data types according to security policies to generate telemetry result data and send it back to the server.

[0057] In this embodiment, a telemetry data encryption mechanism can be added to the P4 switch to achieve data encryption. This encryption mechanism can utilize the `Extern` function of SIMON, SM4, MD5, etc., along with other algorithms and parameters required for encryption. The processing flow is as follows: First, data packets are received from the security policy function block and then matched against encryption entries pre-issued by the controller and stored locally. Different encryption algorithms are used for different telemetry data types, while a hash algorithm is used for integrity verification. The structure of the encrypted telemetry data packet is as follows: Figure 4 As shown, the structure of in-band network telemetry data packets is as follows: Figure 5 As shown in Table 1, the Instruction Bitmap is a telemetry requirement instruction bitmap, where each bit represents a telemetry data item.

[0058] Table 1. Meaning of Bits in Instruction Bitmap

[0059]

[0060] The corresponding bit position is set to 1 for the data that the telemetry task needs to measure.

[0061] After uploading the telemetry request, users can select the relevant network information that needs to be telemetryd. Common network telemetry metadata is shown in Table 2 below:

[0062] Table 2 Network Telemetry Metadata

[0063]

[0064]

[0065] In addition to customizable telemetry data types, users can also select the scope of telemetry to be performed, which can be the entire network, a specific link, or a particular switch node.

[0066] Specifically, during in-band network telemetry execution, the P4 switch encrypts and protects the corresponding type of telemetry data according to a security policy, which can be designed to include:

[0067] The telemetry data types to be encrypted and those not to be encrypted are obtained according to the security policy matching table. The telemetry data corresponding to the telemetry data type to be encrypted is encrypted and protected using the data security level corresponding to the telemetry data type to be encrypted. The security policy matching table stores the telemetry data types to be encrypted that correspond to the target user's security policy.

[0068] The encrypted telemetry data and the unencrypted telemetry data are sent into the forwarding process, so that the telemetry data can be matched and forwarded or discarded according to the forwarding matching table in the forwarding process.

[0069] During the encryption process of telemetry data, an encryption algorithm can be matched from the encryption entries according to the data security level. The encryption algorithm includes a first encryption algorithm for secure encryption of telemetry data and a second encryption algorithm for integrity encryption of telemetry data. The encryption entries pre-store multiple data security levels and encryption algorithms corresponding to each data security level. The matched encryption algorithm is used to perform dual encryption protection of telemetry data for both security and integrity.

[0070] S104. The server receives telemetry result data, decrypts and stores it, and monitors the network status of the P4 switch in real time during in-band network telemetry, and dynamically adjusts the security policy according to the network status and business requirements.

[0071] A decryption mechanism can be installed in the telemetry data processing of the telemetry server, so that after receiving the telemetry data uploaded by the last-hop switch, the server decrypts it before viewing the specific telemetry information. For example... Figure 6 As shown, during the decryption process, the encryption algorithm corresponding to each type of telemetry data can be obtained by viewing the security policy mapping table, and then the corresponding key can be selected for decryption.

[0072] Among them, the security policy, which is dynamically adjusted according to network status and business needs, can be designed to include:

[0073] The network link security weight is obtained based on the user-set data security level, the corresponding data security level in the current network, and the highest data security level.

[0074] The network transmission performance weight is obtained based on the network link security weight and the network transmission delay and the maximum network link transmission delay obtained from the most recent telemetry.

[0075] A comprehensive evaluation index of network security and performance is obtained by using network link security weight and network link transmission performance weight;

[0076] The data security level in the security strategy is dynamically adjusted based on the comprehensive evaluation indicators and the encryption algorithm complexity corresponding to each data security level, in order to balance in-band network security and network performance loss.

[0077] Specifically, dynamically adjusting the data security level in a security policy may include:

[0078] The network performance loss of adjacent data security levels is estimated by using the encryption algorithm complexity corresponding to the current data security level and the encryption algorithm complexity corresponding to adjacent data security levels. The adjacent data security levels include: high data security level, which is one level higher than the current data security level, and low data security level, which is one level lower than the current data security level.

[0079] If the comprehensive evaluation index is greater than the network performance loss of selecting a high data security level, then the data security level in the current network will be adjusted to a high data security level and the current security policy will be updated. The updated security policy will be sent to the P4 switch through the controller.

[0080] If the overall evaluation index is less than the network performance loss of selecting a low data security level, then the data security level in the current network will be adjusted to a low data security level and the current security policy will be updated. The updated security policy will then be sent to the P4 switch through the controller.

[0081] User-defined encryption methods enhance the flexibility of telemetry data confidentiality encryption. However, while ensuring the security of telemetry information, this also incurs greater resource overhead, especially for computationally complex encryption algorithms, which have a more significant impact on network performance. Balancing security and transmission performance is a crucial issue that must be considered in practical applications.

[0082] Based on the aforementioned dynamic security strategy, this solution employs a dynamic feedback-based encryption algorithm scheduling mechanism that balances performance loss and security level. This mechanism dynamically adjusts the encryption algorithm according to network conditions, ensuring data security while maintaining transmission performance. Under different security levels and encryption algorithms, the feedback scheduling algorithm defines a comprehensive evaluation index G for security and system performance, and switches encryption algorithms based on this index.

[0083] Based on the differences in the types of telemetry data, security requirements, and the feasibility of encryption algorithms, three security levels are divided from low to high, as shown in Table 3.

[0084] Table 3 Correspondence between Security Levels and Security Requirements

[0085]

[0086] Set a comprehensive evaluation index G for security and system performance:

[0087]

[0088] Among them, W s For link security weights, W p G represents the link transmission performance weight, and G is the ratio of the two.

[0089] W s The possible values ​​are as follows:

[0090]

[0091] S′ represents the user's security level requirements, and S represents the current network security level. max This represents the highest security level as defined.

[0092] Transmission performance weight W p Adjustments are made based on current security risks, network latency, and throughput changes. Values ​​are as follows:

[0093]

[0094] D is the network transmission delay obtained from the most recent telemetry. max The maximum delay specified for normal transmission of the link. When analyzing network transmission performance, the two key performance indicators of throughput and delay are usually the focus, and throughput is often affected by system network latency. Therefore, W... p Only W is used in the calculation. s And delays.

[0095] With the evaluation metric G and its calculation formula, encryption algorithms can be switched by specifying judgment criteria. The switching criteria are as follows:

[0096]

[0097] Arrange them in descending order of processing performance to generate a set Q(P1, P2, ..., P...). n ), P i This represents the processing performance loss of the i-th encryption algorithm. The magnitude of the performance loss is positively correlated with the computational complexity of various encryption algorithms.

[0098] In this proposed solution, a weighted feedback algorithm is introduced, such as... Figure 7 As shown, the security weight Ws and transmission performance weight Wp are adjusted according to the network security status and link status, thereby selecting a suitable encryption algorithm and avoiding unnecessary performance loss caused by using encryption algorithms with excessively high computational complexity, thus balancing security and transmission performance.

[0099] Furthermore, based on the above method, this embodiment of the invention also provides a secure programmable in-band network telemetry system based on a P4 programmable switch, comprising: a server, a controller, and a P4 switch, wherein...

[0100] The server is used by target users to set security policies according to the telemetry service business requirements, and to store the security policy mapping database on the server. The target users are legitimate registered users of the telemetry service business platform. The security policy includes: custom telemetry data types and data security levels corresponding to the telemetry data types. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data types.

[0101] The controller is used to generate telemetry data packet instructions based on telemetry service requirements and security policies, and send the telemetry data packet instructions to the P4 switch at the data layer.

[0102] The P4 switch is used to perform in-band network telemetry according to telemetry data packet instructions, encrypt and protect telemetry data of corresponding telemetry data types according to security policies, generate telemetry result data and feed it back to the server, so that the server can receive the telemetry result data, decrypt and store it. During the in-band network telemetry process, the server monitors the network status of the P4 switch in real time and dynamically adjusts the security policy according to the network status and service requirements.

[0103] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0105] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0106] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0107] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A secure programmable in-band network telemetry method based on a programmable switch P4, characterized in that, Include: The target user sets up a security policy based on the telemetry service business requirements and stores the security policy mapping database on the server. The target user is a legitimate registered user of the telemetry service business platform. The security policy includes: a custom telemetry data type and a data security level corresponding to the telemetry data type. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data type. The telemetry data type includes: switch ID, ingress port number, hop-by-hop delay, queue occupancy, ingress timestamp, egress timestamp, egress port number, and transmission rate. The controller generates telemetry data packet instructions based on telemetry service requirements and security policies, and sends the telemetry data packet instructions to the P4 switch at the data layer; The P4 switch performs in-band network telemetry based on the telemetry data packet instruction, and obtains the telemetry data type to be encrypted by bitwise field by bit through the Instruction Bitmap of the telemetry data packet instruction according to the security policy matching table. It uses the encryption algorithm specified by the data security level corresponding to the telemetry data type to be encrypted to encrypt and protect the telemetry data corresponding to the telemetry data type to be encrypted. The security policy matching table stores the telemetry data types to be encrypted corresponding to the target user's security policy, so as to generate telemetry result data and feed it back to the server. The server receives, decrypts, and stores telemetry results. During in-band network telemetry, the server monitors the network status of the P4 switch in real time and uses network link security weights and network link transmission performance weights to obtain a comprehensive evaluation index of network security and performance. Based on this comprehensive evaluation index and the encryption algorithm complexity corresponding to each data security level, the server dynamically adjusts the data security level in the security policy to balance in-band network security and network performance loss. The comprehensive evaluation index is expressed as follows: , For link security weights, As a weight for link transmission performance, The ratio of these two factors is used to dynamically adjust the data security level in the security policy. This includes: estimating the network performance loss of adjacent data security levels using the encryption algorithm complexity corresponding to the current data security level and the encryption algorithm complexity corresponding to adjacent data security levels. The adjacent data security levels include: a high data security level one level higher than the current data security level and a low data security level one level lower than the current data security level. If the comprehensive evaluation index is greater than the network performance loss of selecting the high data security level, the current data security level is adjusted to the high data security level and the current security policy is updated. The updated security policy is then distributed to the P4 switch through the controller. If the comprehensive evaluation index is less than the network performance loss of selecting the low data security level, the current data security level is adjusted to the low data security level and the current security policy is updated. The updated security policy is then distributed to the P4 switch through the controller.

2. The secure programmable in-band network telemetry method based on a programmable switch P4 according to claim 1, characterized in that, Target users set security policies based on their telemetry service business needs, including: Target users utilize the interactive interface in the telemetry service business platform and set corresponding data security levels for each type of telemetry data according to the telemetry service business requirements. Based on the types of telemetry data and their corresponding data security levels, obtain the security policies required by the target user.

3. The secure programmable in-band network telemetry method based on a programmable switch P4 according to claim 2, characterized in that, The target user sets up a security policy based on the telemetry service business requirements, which also includes: The target user uses the interactive interface in the telemetry service platform to adjust the telemetry data type and set the telemetry range corresponding to the telemetry data type according to the telemetry service requirements. The telemetry data type adjustment includes: adding, deleting and / or modifying the type. The telemetry range is the service network, the network link in the service network or the switch node in the network link.

4. The secure programmable in-band network telemetry method based on a programmable switch P4 according to claim 1, characterized in that, During in-band network telemetry execution, P4 switches encrypt and protect corresponding types of telemetry data according to security policies, and also include: Encrypted and unencrypted telemetry data are sent to the forwarding process, where the telemetry data is matched and forwarded or discarded based on the forwarding matching table.

5. The secure programmable in-band network telemetry method based on a programmable switch P4 according to claim 1 or 4, characterized in that, Encryption protection of telemetry data includes: The encryption algorithm is matched from the encryption entries according to the data security level. The encryption algorithm includes a first encryption algorithm for secure encryption of telemetry data and a second encryption algorithm for integrity encryption of telemetry data. The encryption entries pre-store multiple data security levels and encryption algorithms corresponding to each data security level. The matched encryption algorithm is used to provide dual encryption protection for telemetry data, ensuring both security and integrity.

6. The secure programmable in-band network telemetry method based on a programmable switch P4 according to claim 1, characterized in that, Dynamically adjusting security policies based on network conditions and business needs also includes: The network link security weight is obtained based on the user-set data security level, the corresponding data security level in the current network, and the highest data security level. The network transmission performance weight is obtained based on the network link security weight and the network transmission delay and the maximum network link transmission delay obtained from the most recent telemetry.

7. A secure programmable in-band network telemetry system based on a programmable switch P4, characterized in that, Based on the method described in claim 1, it comprises: a server, a controller, and a P4 switch, wherein, The server is used by target users to set security policies according to the telemetry service business requirements, and to store the security policy mapping database on the server. The target users are legitimate registered users of the telemetry service business platform. The security policy includes: custom telemetry data types and data security levels corresponding to the telemetry data types. Different data security levels use corresponding specified encryption algorithms to meet the security requirements of the telemetry data types. The controller is used to generate telemetry data packet instructions based on telemetry service requirements and security policies, and send the telemetry data packet instructions to the P4 switch at the data layer. The P4 switch is used to perform in-band network telemetry according to telemetry data packet instructions, encrypt and protect telemetry data of corresponding telemetry data types according to security policies, generate telemetry result data and feed it back to the server, so that the server can decrypt and store the received telemetry result data. In addition, the server monitors the network status of the P4 switch in real time during the in-band network telemetry process and dynamically adjusts the security policy according to the network status and service requirements.

8. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method as described in any one of claims 1 to 6.

Images