Cloud native network identifier mapping method

Abstract

According to the cloud native network identifier mapping method provided by the invention, intelligent connection from the physical terminal to the cloud service is realized, and meanwhile, the continuity of the service in a cloud native environment is ensured. The method comprises the following steps: a cloud native network generates and stores a terminal attribute identifier and an access attribute identifier of a terminal, generates a service attribute identifier corresponding to each business service for the terminal based on a plurality of business services provided for the terminal by a network twin space, and registers the service attribute identifiers to a distributed DNS (Domain Name System); the cloud native network generates a global ID for the terminal, and establishes and maintains a mapping relationship between the global ID and a terminal attribute identifier, an access attribute identifier, a service attribute identifier, a channel attribute identifier, a connection attribute identifier and a service attribute identifier of the terminal; and the terminal realizes service connection establishment and data transmission through the service attribute identifier, and the mapping relationship is updated in real time in the process.

Description

Technical Field

[0001] The present application relates to the field of cloud native technology, and in particular to a cloud native network identity mapping method. Background Art

[0002] In the traditional Internet architecture, IP addresses, as an important tool for identifying user identity and location, are used for connection management of various services and authentication of user identity.

[0003] However, in scenarios where user locations frequently change, IP address fluctuations caused by these changes not only lead to unstable service connections but can also trigger a series of security risks, including user identity fraud and malicious attacks. For example, when users switch networks between different geographic locations, they may face frequent IP address changes, which can cause the original connection to be interrupted or delayed, affecting the user experience. In addition, frequent IP address changes make it difficult to maintain stable service connections, especially for online games and video conferencing that require high stability. For example, some websites or services may record IP addresses to identify user login status and security. However, due to the volatility of IP addresses, malicious users can forge or dynamically change IP addresses to bypass authentication mechanisms and carry out attacks such as identity theft and data tampering.

[0004] Therefore, in order to overcome the above problems, how to build a more reliable identity authentication mechanism and ensure the stability of service connections is a problem that needs to be solved. Summary of the Invention

[0005] An embodiment of the present application provides a cloud-native network identity mapping method to ensure the stability of service connections.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a cloud-native network identity mapping method, wherein the cloud-native network includes a network twin space that provides multiple business services, and the method includes:

[0008] The cloud-native network generates and stores the terminal attribute identifier and access attribute identifier of the terminal. Based on the various business services provided by the network twin space for the terminal, it generates a service attribute identifier corresponding to each business service for the terminal and registers it in the distributed DNS system.

[0009] The cloud-native network generates a global ID for the terminal and establishes and maintains a mapping relationship between the global ID and the terminal's terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and business attribute identifier.

[0010] The mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and business attribute identifier of the terminal is established and maintained. The process includes:

[0011] The upper-layer application of the terminal initiates a connection request to the cloud-native network through a unique service attribute identifier;

[0012] The cloud-native network uses a distributed DNS system to resolve the business corresponding to the network twin space corresponding to the unique service attribute identifier. Based on the pre-established service level agreement, it generates the connection attribute identifier of the corresponding business. It then selects the path based on the connection attribute identifier and generates the channel attribute identifier composed of multiple physical links.

[0013] The cloud-native network adds service attribute identifiers to the data streams transmitted by the terminals and selects a physical link for data transmission based on the channel attribute identifiers and service attribute identifiers.

[0014] During the process, the mapping relationship is updated in real time.

[0015] Secondly, a cloud-native network identity mapping architecture is provided, which includes unified identity management services, terminal management services, access management services, network twin identity management services, domain name management services, channel management services, connection management services and business management services.

[0016] Terminal management service, used to generate and store terminal attribute identification of terminals;

[0017] Access management service, used to generate and store terminal access attribute identification;

[0018] The network twin identification management service is used to generate service attribute identification corresponding to each business service for the terminal based on the various business services provided by the network twin space;

[0019] Domain name management service, used to register the service attribute identifier corresponding to each business service into the distributed DNS system;

[0020] Unified identity management service, used to generate a global ID for the terminal and establish and maintain the mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier;

[0021] Connection management service, used to receive connection requests initiated by upper-layer applications of the terminal through unique service attribute identifiers;

[0022] Domain name management service, which is used to resolve the business corresponding to the network twin space corresponding to the unique service attribute identifier based on the distributed DNS system;

[0023] The connection management service is also used to generate connection attribute identifiers for corresponding services based on pre-established service level agreements;

[0024] Channel management service, used to select a path based on the connection attribute identifier and generate a channel attribute identifier composed of multiple physical links;

[0025] Service management service, used to add service attribute identifiers to the data stream transmitted by the terminal, and select a physical link for data transmission based on the channel attribute identifier and the service attribute identifier;

[0026] The mapping relationship is updated in real time.

[0027] In an embodiment of the present application, the global ID is used as the core anchor point, and dynamic mapping of the global ID and multiple dynamic attribute identifiers (terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier) ​​is used to achieve intelligent connection from the physical terminal to the cloud service, while ensuring the continuity of services in the cloud native environment.

[0028] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of the cloud-native network identity mapping architecture provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of this application. At the same time, in the description of the embodiments of the present application, the terms "first", "second", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0032] Figure 1A cloud-native network identity mapping method provided in an embodiment of the present application, and an architectural diagram of the application.

[0033] The cloud-native network includes a network twin space that provides multiple business services. The process of the cloud-native network identity mapping method is as follows:

[0034] 1. Terminal registration, identity initialization, and network twin space construction

[0035] The cloud-native network generates and stores the terminal attribute identifier and access attribute identifier of the terminal, and based on the various business services provided to the terminal by the network twin space, generates a service attribute identifier corresponding to each business service for the terminal and registers it to the distributed DNS system.

[0036] The cloud native network generates a global ID for the terminal and establishes and maintains a mapping relationship between the global ID and the terminal's terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and business attribute identifier.

[0037] Among them, the terminal attribute identifier and access attribute identifier of the terminal generated and stored by the cloud native network can be understood as:

[0038] The terminal registers the terminal attribute identifier with the cloud native network and stores the terminal attribute identifier. The stored terminal attribute identifier is specifically stored in the terminal attribute database in the cloud native network.

[0039] In addition, the terminal attribute identifier includes information such as device type, model, serial number, MAC address, capability characteristics (supported communication protocols, storage capacity, etc.), which is not specifically limited here.

[0040] The cloud-native network assigns the physical layer access attribute identifier and the network twin service access attribute identifier to the terminal based on the terminal attribute identifier, completing the terminal physical-virtual dual-domain address mapping.

[0041] Among them, based on the various business services provided by the network twin space for the terminal, a service attribute identifier corresponding to each business service is generated for the terminal and registered in the distributed DNS system, which can be understood as:

[0042] The network twin space provides a variety of business services for terminals, including mobile agents, transmission agents and security agents. There may also be other business services. No examples are given here. This application takes mobile agents, transmission agents and security agents as examples. A unique service attribute identifier is generated for each terminal for the mobile agent, transmission agent and security agent, and registered with the distributed DNS system. This makes it convenient for the upper-layer application of the terminal to initiate a connection request to the cloud native network through the unique service attribute identifier. The corresponding network twin space corresponding business is determined through the unique service attribute identifier. You can refer to the subsequent introduction for understanding.

[0043] In addition, the above service attribute identifier can be in URN format. The service attribute identifier can uniquely identify a type of service in the cloud native network regardless of the location of the terminal.

[0044] 2. Dynamic update of mapping relationship (service connection establishment, data transmission)

[0045] The mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and business attribute identifier of the terminal is established and maintained in real time during the service connection establishment and data transmission process between the terminal and the cloud native network. Specifically:

[0046] The upper-layer application of the terminal initiates a connection request to the cloud-native network through a unique service attribute identifier;

[0047] The cloud-native network uses a distributed DNS system to resolve the business corresponding to the network twin space corresponding to the unique service attribute identifier. Based on the pre-established service level agreement, it generates the connection attribute identifier of the corresponding business. It then selects the path based on the connection attribute identifier and generates the channel attribute identifier composed of multiple physical links.

[0048] The cloud-native network adds service attribute identifiers to the data streams transmitted by the terminals, and selects physical links for data transmission based on the channel attribute identifiers and service attribute identifiers.

[0049] Among them, the pre-established service level agreement can be manually formulated or it can be a formal contract or agreement reached between the service provider and the end user, which clearly stipulates the quality standards, performance indicators, availability requirements, support services, troubleshooting, etc. of the network service to ensure that the network service meets the expectations of both parties.

[0050] The above process generates a connection attribute identifier for the corresponding service based on a pre-established service level agreement. A path is then selected based on the connection attribute identifier, and a channel attribute identifier consisting of multiple physical links is generated. This can be understood as follows:

[0051] Based on pre-defined service-level agreements, cloud-native networks generate connection attribute identifiers corresponding to the service. These identifiers are used within the network to precisely configure connection quality to meet the needs of different services. These identifiers include metadata such as session context and QoS policies. Based on these identifiers, a comprehensive analysis of multiple dimensions, including network topology, latency, and bandwidth, is then used to generate channel attribute identifiers (i.e., transmission channels composed of multiple physical links).

[0052] The cloud-native network adds service attribute identifiers to the data streams transmitted by the terminals and selects a physical link for data transmission based on the channel attribute identifiers and service attribute identifiers. This can be understood as follows:

[0053] Service attribute identifiers include data classification, data priority, and data encryption policy. During actual data transmission, the cloud-native network automatically selects the most appropriate physical link based on the attached channel attribute identifiers and service attribute identifiers to ensure fast and stable data transmission.

[0054] Furthermore, cloud-native networks rely on adaptive dynamic scheduling mechanisms. During operation, they dynamically adjust connection attribute identifiers based on network load, business demands, and changes in service quality. They also update transmission paths and adjust channel attribute identifiers accordingly. Furthermore, if a physical link fails, the cloud-native network automatically switches to a backup path to ensure service continuity.

[0055] It should also be noted that the cloud-native network also verifies the identity of the terminal and assigns terminal access rights. When the terminal sends a connection request, it determines whether to connect based on the pre-assigned terminal access rights.

[0056] In addition, the names of the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier in this application are only examples and can also be other names such as terminal identifier, access identifier, service identifier, channel identifier, connection identifier and business identifier, or other possible names, which are not limited here.

[0057] In summary, in this application, the global ID is used as the core anchor point, and the dynamic mapping of the global ID and multiple dynamic attribute identifiers (terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier) ​​is used to realize the intelligent connection from the physical terminal to the cloud service, while ensuring the continuity of services in the cloud native environment.

[0058] Combination of the above Figure 1 The cloud native network identification mapping method provided by the embodiment of this application is described in detail. Figure 1The cloud-native network identity mapping method architecture provided in the embodiments of the present application is described in detail.

[0059] like Figure 1 As shown, the architecture includes unified identity management service, terminal management service, access management service, network twin identity management service, domain name management service, channel management service, connection management service and business management service.

[0060] Terminal management service, used to generate and store terminal attribute identification of terminals;

[0061] Access management service, used to generate and store terminal access attribute identification;

[0062] The network twin identification management service is used to generate service attribute identification corresponding to each business service for the terminal based on the various business services provided by the network twin space;

[0063] Domain name management service, used to register the service attribute identifier corresponding to each business service into the distributed DNS system;

[0064] Unified identity management service, used to generate a global ID for the terminal and establish and maintain the mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier;

[0065] Connection management service, used to receive connection requests initiated by upper-layer applications of the terminal through unique service attribute identifiers;

[0066] Domain name management service, which is used to resolve the business corresponding to the network twin space corresponding to the unique service attribute identifier based on the distributed DNS system;

[0067] The connection management service is also used to generate connection attribute identifiers for corresponding services based on pre-established service level agreements;

[0068] Channel management service, used to select a path based on the connection attribute identifier and generate a channel attribute identifier composed of multiple physical links;

[0069] Service management service, used to add service attribute identifiers to the data stream transmitted by the terminal, and select a physical link for data transmission based on the channel attribute identifier and the service attribute identifier;

[0070] The mapping relationship is updated in real time.

[0071] It should be noted that the above-mentioned terminal management service is used to generate and store the terminal attribute identifier of the terminal and the access management service is used to generate and store the access attribute identifier of the terminal, including:

[0072] Terminal management service, used to receive registration information sent by the terminal, generate terminal attribute identification based on the registration information, and store the terminal attribute identification;

[0073] The access management service is used to allocate the physical layer access attribute identifier and the network twin service access attribute identifier to the terminal based on the terminal attribute identifier, and complete the terminal physical-virtual dual-domain address mapping.

[0074] In addition, the above architecture also includes authentication management services, which are used to verify the identity of terminals and assign terminal access rights.

[0075] In addition, for the above-mentioned specific implementation of the architecture, since it is basically similar to the method implementation, the description is relatively simple, and the relevant parts can be referred to the partial description of the method implementation.

[0076] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences between it and other embodiments.

[0077] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0078] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included within the scope of the claims of the present application.

Claims

1. A cloud native network identity mapping method, characterized in that: The cloud native network includes a network twin space that provides multiple business services. The method includes: The cloud native network generates and stores the terminal attribute identifier and access attribute identifier of the terminal, and based on the various business services provided by the network twin space for the terminal, generates a service attribute identifier corresponding to each business service for the terminal, and registers it with the distributed DNS system; The cloud native network generates a global ID for the terminal, and establishes and maintains a mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and business attribute identifier of the terminal; The process of establishing and maintaining a mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier, and service attribute identifier of the terminal includes: The upper-layer application of the terminal initiates a connection request to the cloud native network through a unique service attribute identifier; The cloud native network, based on a distributed DNS system, resolves the business corresponding to the network twin space corresponding to the unique service attribute identifier; and generates a connection attribute identifier for the corresponding business based on a pre-established service level agreement; and then selects a path based on the connection attribute identifier to generate a channel attribute identifier consisting of multiple physical links; The cloud native network adds a service attribute identifier to the data stream transmitted by the terminal, and selects a physical link for data transmission based on the channel attribute identifier and the service attribute identifier; Wherein, during the process, the mapping relationship is updated in real time.

2. The cloud native network identity mapping method according to claim 1, characterized in that The cloud native network generates and stores a terminal attribute identifier and an access attribute identifier of the terminal, including: The terminal registers a terminal attribute identifier with the cloud native network and stores the terminal attribute identifier; The cloud native network allocates a physical layer access attribute identifier and a network twin service access attribute identifier to the terminal according to the terminal attribute identifier, completing the terminal physical-virtual dual-domain address mapping.

3. The cloud native network identity mapping method according to claim 1, characterized in that The cloud native network also verifies the identity of the terminal and assigns access rights to the terminal.

4. The cloud native network identity mapping method according to claim 1, characterized in that: The network twin space provides a variety of business services for the terminal, including: mobile agent, transmission agent and security agent.

5. The cloud native network identity mapping method according to claim 1, characterized in that The business attribute identifier includes: data classification, data priority and data encryption strategy.

6. A cloud-native network identity mapping architecture, characterized in that: The architecture includes unified identity management services, terminal management services, access management services, network twin identity management services, domain name management services, channel management services, connection management services and business management services. The terminal management service is used to generate and store the terminal attribute identifier of the terminal; The access management service is used to generate and store the access attribute identifier of the terminal; The network twin identification management service is used to generate a service attribute identification corresponding to each business service for the terminal based on the multiple business services provided by the network twin space for the terminal; The domain name management service is used to register the service attribute identifier corresponding to each business service in the distributed DNS system; The unified identification management service is used to generate a global ID for the terminal and establish and maintain a mapping relationship between the global ID and the terminal attribute identifier, access attribute identifier, service attribute identifier, channel attribute identifier, connection attribute identifier and business attribute identifier of the terminal; The connection management service is configured to receive a connection request initiated by an upper layer application of the terminal through a unique service attribute identifier; The domain name management service is used to resolve the business corresponding to the network twin space corresponding to the unique service attribute identifier based on the distributed DNS system; The connection management service is further used to generate a connection attribute identifier for the corresponding service based on a pre-established service level agreement; The channel management service is configured to select a path based on the connection attribute identifier and generate a channel attribute identifier consisting of multiple physical links; The service management service is configured to add a service attribute identifier to the data stream transmitted by the terminal, and select a physical link for data transmission based on the channel attribute identifier and the service attribute identifier; The mapping relationship is updated in real time.

7. The cloud-native network identity mapping architecture according to claim 1, characterized in that The terminal management service, used to generate and store a terminal attribute identifier of a terminal, and the access management service, used to generate and store an access attribute identifier of the terminal, include: The terminal management service is configured to receive registration information sent by the terminal, generate a terminal attribute identifier based on the registration information, and store the terminal attribute identifier; The access management service is used to allocate a physical layer access attribute identifier and a network twin service access attribute identifier to the terminal according to the terminal attribute identifier, thereby completing the physical-virtual dual-domain address mapping of the terminal.

8. The cloud-native network identity mapping architecture according to claim 1, characterized in that: The architecture further includes an authentication management service for verifying the identity of the terminal and allocating access rights to the terminal.

9. The cloud-native network identity mapping architecture according to claim 1, characterized in that The network twin space provides a variety of business services for the terminal, including: mobile agent, transmission agent and security agent.

10. The cloud native network identity mapping architecture according to claim 1, characterized in that The business attribute identifier includes: data classification, data priority and data encryption strategy.

Images