Network control method and system

Abstract

The invention discloses a network control method and system. The method comprises the following steps: collecting and maintaining network state information of forwarding layer equipment through a southbound interface; generating a network strategy on the basis of requirements of an application layer and in combination with the network state information, and issuing the network strategy to forwarding layer equipment through the southbound interface; and obtaining network state information from the forwarding layer, and scheduling and optimally distributing network traffic based on the network state information. A'strategy making and issuing 'module and a'flow scheduling and optimizing' module are integrated in the same controller layer, close cooperation and closed-loop control of strategy decision and flow execution are achieved, and the defects that in the prior art, strategies are difficult to execute efficiently and consistently, and the strategies cannot be dynamically adjusted according to the real-time flow state are overcome.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication processing, and particularly relates to a network control method and system. BACKGROUND

[0002] In related technologies, in the network architecture of different AI computing cards, network strategy and traffic scheduling are usually separated, which is difficult to efficiently and consistently execute, and cannot dynamically adjust the strategy according to real-time traffic state. SUMMARY

[0003] The main purpose of the present application is to provide a network control method and system to solve the problems in related technologies.

[0004] In order to achieve the above purpose, according to the first aspect of the present application, a network control method is provided, including: collecting and maintaining network state information of forwarding layer devices through a southbound interface; generating network strategy based on the requirements of the application layer and combining the network state information, and issuing the network strategy to the forwarding layer devices through the southbound interface; obtaining network state information from the forwarding layer, and scheduling and optimizing the distribution of network traffic based on the network state information.

[0005] Optionally, formulating network strategy based on the requirements of the application layer and combining the network state information includes: comparing the target in the business requirement with the real condition in the network state information to match the optimal scheme that meets the business requirement; and converting the optimal scheme into specific configuration commands that can be executed by the forwarding layer devices.

[0006] Optionally, generating network strategy includes generating routing strategy: constructing access control rules based on logical switch ports, the rules including source port matching conditions, protocol type field matching conditions and action instructions, wherein the action instructions include allowing related connections, allowing specific port traffic or discarding traffic.

[0007] Optionally, scheduling and optimizing the distribution of network traffic based on the network state information includes: classifying data packets based on pre-defined conditions through a logical traffic classifier; setting QoS marks for the classified traffic; issuing the marked traffic strategy to the forwarding layer devices through the southbound interface

[0008] According to a second aspect of the present application, a network control system is provided, comprising an SDN control layer, wherein the SDN control layer comprises: a network state information collection unit configured to collect and maintain network state information of forwarding layer devices through a southbound interface; a network policy generation and forwarding unit configured to generate a network policy based on requirements of an application layer and in combination with the network state information, and to issue the network policy to the forwarding layer devices through the southbound interface; and a network traffic scheduling and optimization unit configured to obtain network state information from the forwarding layer, and to schedule and optimally allocate network traffic based on the network state information.

[0009] Optionally, formulating the network policy based on the requirements of the application layer and in combination with the network state information comprises: matching a target in the service requirements with a real condition in the network state information to match an optimal scheme that satisfies the service requirements; and converting the optimal scheme into specific configuration commands that can be executed by the forwarding layer devices.

[0010] Optionally, generating the network policy comprises generating a routing policy: constructing an access control rule based on a logical switch port, the rule comprising a source port matching condition, a protocol type field matching condition and an action instruction, wherein the action instruction comprises allowing a relevant connection, allowing specific port traffic or discarding traffic.

[0011] Optionally, scheduling and optimally allocating network traffic based on the network state information comprises: classifying data packets based on predefined conditions through a logical traffic classifier; setting a QoS mark for the classified traffic; and issuing the marked traffic policy to the forwarding layer devices through a southbound interface.

[0012] According to a third aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for causing a computer to execute the method of any one of the first aspect.

[0013] According to a fourth aspect of the present application, an electronic device is provided, comprising: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to cause the at least one processor to execute the method of any one of the implementation manners of the first aspect.

[0014] The network control method and system of the embodiment, wherein the method comprises collecting and maintaining network state information of a forwarding layer device through a southbound interface; generating a network policy based on the requirement of an application layer and in combination with the network state information, and issuing the network policy to the forwarding layer device through the southbound interface; obtaining network state information from the forwarding layer, and scheduling and optimizing distribution of network traffic based on the network state information. The "policy making and issuing" and "traffic scheduling and optimization" modules are integrated in the same controller layer, realizing close cooperation and closed-loop control of policy decision and traffic execution, and thus overcoming the deficiencies in the prior art that the policy is difficult to be efficiently and consistently executed, and cannot be dynamically adjusted according to real-time traffic state. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the specific embodiments or the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or the prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0016] Figure 1 is a flowchart of the network control method of the embodiment of the present application;

[0017] Figure 2 is a schematic diagram of the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the technical personnel in the art better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort should be within the scope of protection of the present application.

[0019] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0020] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0021] According to the embodiments of the present application, a method is provided, which comprises the following steps 101 to 103 as shown in the figure: Figure 1

[0022] Step 101: Collect and maintain the network state information of the forwarding layer device through the southbound interface.

[0023] In this step, the network state information includes network topology, device state, link state and traffic information.

[0024] After the controller is started, it initiates a connection to all Open vSwitch (OVS) instances in the network through the southbound interface. After the connection is established, the controller and the OVS perform initial capability negotiation, and the OVS reports its basic capabilities (supported table number, supported matching items, supported Actions) to the controller. The controller confirms the model and capability of each OVS, and prepares for subsequent accurate flow table instruction issuing.

[0025] The controller periodically sends port statistics request and flow table statistics request messages to all OVSs. The controller listens to the messages actively reported by the OVSs. The collected information includes port state: port number, name, MAC address, state (up / down), number of sent and received packets, number of dropped packets, number of errors. Flow table statistics: matching number (packet_count), byte number (byte_count), survival time (duration_sec) of each flow table item. Topology change: when a new port is created or a port link is disconnected, the OVS will immediately actively send an OFPT_PORT_STATUS message to the controller to notify the event. Real-time working state and traffic load of the network device are obtained, and changes in the network topology are immediately perceived.

[0026] Collecting link and tunnel information: the controller connects to the database server of the OVS through another southbound interface protocol OVSDB. The controller uses the monitor command to subscribe to changes in specific tables (such as Interface table, Bridge table, Tunnel table) in OVSDB. The collected information: interface detailed information: interface type (such as Geneve, VXLAN, GRE), tunnel remote IP, MTU, state. Bridge information: list of ports bound on the bridge. The establishment state and configuration information of the overlay network tunnel are obtained, which is the key to building the logical network topology.

[0027] ​Maintain unified network state: The controller cleans, correlates and integrates the raw data collected from the above-mentioned multiple channels, and stores them in its internal network state database. The processing can include correlating OpenFlow statistics from the same OVS with OVSDB configuration information; calculating the current physical and logical network topology according to the connection relationship of physical ports and tunnel interfaces; continuously updating the traffic counters, error counters and the like of each port.

[0028] This process is a cycle, and the controller continuously collects, updates and maintains these information. These real-time and accurate global state information will be immediately consumed by the "policy making and issuing" and "traffic scheduling and optimization" modules for intelligent decision making (for example, discovering that the congestion rate of a link reaches 90%, triggering the traffic scheduling algorithm to migrate part of the traffic to the idle link). After the decision is executed, the network state changes again, and the controller collects new data, thus forming a dynamic adaptive closed loop.

[0029] Step 102: Based on the application layer requirements and in combination with the network state information, network policies are formulated and issued to the forwarding layer devices through the southbound interface.

[0030] In this step, the implementation process of matching business requirements with specific network states is the concentrated embodiment of SDN intelligence. It is not a simple mapping, but a dynamic and continuous calculation and decision-making cycle. The process starts with the controller layer receiving business requirements from the application layer and network states from the forwarding layer. The core "policy making and issuing" module as a decision engine compares, analyzes and calculates the abstract business intent (such as "guaranteeing video conference quality") with the specific network real-time state (such as topology, traffic load).

[0031] Specifically, based on the application layer requirements and in combination with the network state information, network policies are formulated and issued to the forwarding layer devices through the southbound interface, which includes the following steps: input and perception: the controller layer needs to receive two types of information as the basis for decision making, one is the business requirements from the application layer, and the other is the network state.

[0032] Exemplarily, as for the business requirements, the instructions are issued after conversion through the soft SDN adaptation layer (OVN NorthDB). The adaptation layer converts the API calls of different applications or the configuration commands of administrators into a unified language that the controller can understand. The nature of business requirements is usually abstract and intent-based, such as "ensuring the highest priority of virtual machine access".

[0033] Exemplarily, in relation to the network state, a network policy is formulated based on the requirements of the application layer and in combination with the network state information, and the network policy is issued to the forwarding layer device through the southbound interface.

[0034] Further, the translated specific command (such as an OpenFlow flow table item) is issued to the corresponding OpenvSwitch instance through the southbound interface. After receiving the instruction, the OpenvSwitch updates its flow table and starts to perform operations such as forwarding, discarding, and marking on the data packet according to the new policy.

[0035] Step 103: Obtain network state information from the forwarding layer, and schedule and optimally allocate network traffic based on the network state information.

[0036] In this step, the generated policy is received, and based on the global real-time state of the network, a specific operation scheme for realizing the intention is calculated.

[0037] Further, the execution effect of the "traffic scheduling and optimization" changes the network state in real time and feeds back to the system. If the policy target fails to be realized, the controller can dynamically adjust the scheduling parameters or even trigger the policy module to reevaluate the policy, forming an intelligent closed loop of continuous optimization. Exemplarily, the change of the network state is continuously monitored (for example, whether the traffic of the new path is normal? Whether the congestion is released?). If the monitoring finds that the execution effect of the policy does not reach the expectation (for example, the new path also appears congestion), the controller will automatically trigger a new round of "matching-calculation-translation-issuing" process to dynamically adjust the policy until the business requirement is met.

[0038] The embodiment realizes the purpose of dynamically adjusting the policy according to the real-time traffic state, and overcomes the defect that in the traditional network, once the policy is configured to the device, it will remain the same until the administrator manually changes it again.

[0039] As an optional implementation manner of the embodiment, formulating the network policy based on the requirements of the application layer and in combination with the network state information includes: comparing the target in the business requirement with the real condition in the network state information to match an optimal scheme that satisfies the business requirement; and converting the optimal scheme into a specific configuration command that can be executed by the forwarding layer device.

[0040] In the optional implementation manner, when matching, the target in the business requirement is matched with the real condition in the network state to match the network. For example, the business requirement is "to create a 1Gbps path from A to B". The controller will check the network state: what available paths are there between A and B? Whether the current residual bandwidth of the paths satisfies 1Gbps? Whether there is a congested link?

[0041] Based on the comparison result, the best solution that meets the requirement is determined. For example, if the direct path bandwidth is insufficient, the controller calculates a detour path through other nodes. If a certain type of traffic needs to be processed preferentially, the controller calculates how much bandwidth resource needs to be allocated and sets the priority mark. Conflict resolution: if the new security policy conflicts with the existing policy, the controller calculates the new rule combination to solve the conflict.

[0042] The calculated best solution is translated into specific configuration commands that the forwarding layer device can understand and execute, which is a key step to "land" the abstract intent. For example: Abstract requirement: "Ensure video traffic priority" → Specific command: ovs-vsctl set port vm-video qos=@newqos (create a QoS queue policy) and set_field 46->ip_dscp (mark the DSCP of video traffic as EF, indicating accelerated forwarding).

[0043] As an optional implementation of the embodiment, generating the network policy includes generating a routing policy: constructing an access control rule based on a logical switch port, the rule containing a source port matching condition, a protocol type field matching condition, and an action instruction, wherein the action instruction includes allowing related connections, allowing specific port traffic, or discarding traffic

[0044] The "policy formulation and delivery" module of the controller layer receives the requirements from the application layer (converted through the adaptation layer), such as: "Allow all IP outbound traffic from port ls1-vm1 on logical switch ls1 and its return packets, but prohibit all unauthorized access to ls1-vm1, and only open its SSH port (22)". At the same time, this module continuously obtains the latest network topology and other information from the "network state management" module.

[0045] Construct and generate access control rules (concretization of policy rules): the controller translates and generates three specific access control list (ACL) rules based on the above requirements, which together constitute a secure routing policy that implements the requirements:

[0046] Rule 1 (allow outbound and related return packets): source port matching condition: inport==="ls1-vm1"; protocol type field matching condition: ip; action instruction: allow-related; OVN-NBCTL command example: ovn-nbctl acl-add ls1 from-lport 1000 "inport==\"ls1-vm1\" && ip" allow-related.

[0047] Rule 2 (Allow access to SSH service): Source port match condition: none (traffic is defined by destination port); protocol type field match condition: tcp.dst==22 (destination port is 22); action instruction: allow-related; OVN-NBCTL; command example: ovn-nbctl acl-add ls1 to-lport 999 "outport== "ls1-vm1" && tcp.dst==22" allow-related.

[0048] Rule 3 (Default deny all other access): Source port match condition: none; protocol type field match condition: ip; action instruction: drop; OVN-NBCTL command example: ovn-nbctl acl-add ls1 to-lport 998 "outport== "ls1-vm1" && ip" drop.

[0049] After the above rules are generated, the controller sends these ACL rules to the corresponding logical switch in the "soft SDN forwarding layer" through the southbound interface (OVN SouthDB). After the forwarding layer device (such as Open vSwitch) receives and loads these rules, its forwarding processing behavior for data packets is guided by these policies, thereby achieving the established security routing goal.

[0050] As an optional implementation of the embodiment, the scheduling and optimized allocation of network traffic based on the network state information comprises: classifying data packets based on pre-defined conditions through a logical traffic classifier; setting QoS marks for the classified traffic; and sending the marked traffic policy to the forwarding layer device through the southbound interface.

[0051] In this optional implementation, the process starts with the "policy formulation and delivery" module of the controller formulating an abstract QoS policy intention according to application requirements and global network state. Then, the "traffic scheduling and optimization" module, as an execution engine, is responsible for converting the abstract intention into specific actions, including the following steps:

[0052] Step 1: After receiving the policy intention, the "traffic scheduling and optimization" module will perform intelligent calculations based on the global real-time network state (such as topology, link utilization, delay, etc.) it has mastered, and make three key decisions:

[0053] 1. Traffic classification: define which traffic needs to be specially processed. For example, identify data packets from specific virtual machines or specific applications.

[0054] 2. Traffic marking: decide how to label the classified traffic with priority tags for network devices to identify and process.

[0055] 3. Rate limiting: To ensure fairness, decide whether to set a bandwidth cap for some non-critical traffic.

[0056] Step 2: Instruction generation and delivery, after intelligent decision-making, this module will be converted into specific configuration commands that forwarding layer devices (OpenvSwitch, OVS) can understand and execute:

[0057] Example command 1 (marking traffic): ovs-vsctl set port vm-video qos = @newqos and set_field:46->ip_dscp. Effect: Set the DSCP value of the IP header of all data packets from port vm-video to 46 (representing accelerated forwarding EF), telling all devices in the network that this is high-priority traffic.

[0058] Example command 2 (rate limiting): ovn-nbctl set port vm-download options:qos_max_rate = 1000000000. Effect: Limit the maximum rate of port vm-download to 1Gbps, prevent it from occupying too much bandwidth and affecting other critical applications.

[0059] Step 3: Execution and feedback (closed loop):

[0060] When executing, OVS receives instructions and updates its flow table to actually mark, shape and schedule data packets.

[0061] When feeding back, the "network state management" module will continuously monitor the network state (such as whether the video stream is smooth, whether the download rate is limited), and feed these information back to the "traffic scheduling and optimization" module in real time.

[0062] When optimizing, if the monitoring finds that the strategy does not meet the expectations (such as the video still lags after marking high priority), the controller will dynamically adjust the strategy (such as trying to select another better path), forming a continuous optimization closed loop.

[0063] This embodiment overcomes the traditional network, network policy (such as security policy, routing policy) formulation and traffic scheduling (such as QoS optimization) are usually two independent processes, by different management system responsible. This fragmentation leads to the policy is difficult to efficiently, consistently executed, and unable to dynamically adjust the strategy according to the real-time traffic state. By integrating "policy formulation and delivery" and "traffic scheduling and optimization" modules in the same controller layer, it realizes the close cooperation and closed loop control of policy decision and traffic execution.

[0064] The traditional network adopts distributed configuration, and network administrators lack a unified global view. This easily leads to policy conflicts and makes it difficult to schedule traffic and allocate resources from the perspective of the entire network, making it difficult to avoid congestion and achieve optimal resource utilization.

[0065] The "network state management" module of the controller layer maintains a unified global network view, enabling policy formulation and traffic scheduling based on the real-time status of the entire network, thereby achieving true global optimization.

[0066] Since the policy is centrally formulated and uniformly issued, policy conflicts and omissions that may occur in distributed configuration are avoided, ensuring that security policies (such as ACL rules) can be consistently and accurately executed within the entire network.

[0067] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0068] According to an embodiment of the present application, a computer program product is also provided.

[0069] According to an embodiment of the present application, the present application also provides an electronic device, comprising: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to implement the method described in any of the above embodiments.

[0070] According to an embodiment of the present application, the present application also provides a readable storage medium storing computer instructions for enabling a computer to implement the method described in any of the above embodiments when the computer executes the computer instructions.

[0071] According to an embodiment of the present application, the present application also provides a computer program product, which, when executed by a processor, can implement the method described in any of the above embodiments.

[0072] Figure 2 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices.

[0073] AsFigure 2 As shown, the electronic device 300 includes a computing unit 301 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 302 or a computer program loaded into a random access memory (RAM) 303 from a storage unit 308. Various programs and data required for the operation of the electronic device 300 can also be stored in the RAM 303. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0074] Various components in the electronic device 300 are connected to the I / O interface 305, including an input unit 306, such as a keyboard, a mouse, and the like; an output unit 307, such as various types of displays, speakers, and the like; a storage unit 308, such as a magnetic disk, an optical disk, and the like; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0075] The computing unit 301 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, and the like. The computing unit 301 performs various methods and processes described above, such as the object matching method. For example, in some embodiments, the object matching method can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 308. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the methods described above can be performed.

[0076] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a load programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0077] Program code for carrying out methods of the present application can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / acts specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, or entirely on a remote machine or server.

[0078] In the context of the present application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include one or more lines of electrical wire, portable computer diskette, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing.

Claims

1. A network control method, characterized in that, The method is executed at the SDN controller layer and includes: Network status information of forwarding layer devices is collected and maintained through the southbound interface; Based on the application layer requirements and combined with the network status information, a network policy is generated and then distributed to the forwarding layer device through the southbound interface. Network status information is obtained from the forwarding layer, and network traffic is scheduled and optimized based on the network status information.

2. The network control method according to claim 1, characterized in that, Based on application layer requirements and in conjunction with the aforementioned network state information, network strategies are formulated, including: The objectives in the business requirements are compared with the actual conditions in the network status information to find the optimal solution that meets the business requirements. The optimal solution is then converted into specific configuration commands that can be executed by the forwarding layer device.

3. The network control method according to claim 2, characterized in that, Network policy generation includes routing policy generation: Construct access control rules based on logical switch ports. The rules include source port matching conditions, protocol type field matching conditions, and action instructions, wherein the action instructions include allowing related connections, allowing traffic on specific ports, or dropping traffic.

4. The network control method according to claim 1, characterized in that, Scheduling and optimizing network traffic allocation based on the aforementioned network status information includes: Packets are classified based on predefined conditions using a logical traffic classifier; Set QoS tags for the categorized traffic; The tagged traffic policy is distributed to the forwarding layer device via the southbound interface.

5. A network control system, characterized in that, The SDN control layer includes: The network status information acquisition unit is used to collect and maintain the network status information of the forwarding layer devices through the southbound interface; The network policy generation and forwarding unit is used to generate network policies based on the application layer requirements and the network status information, and to send the network policies to the forwarding layer devices through the southbound interface. The network traffic scheduling and optimization unit is used to obtain network status information from the forwarding layer and to schedule and optimize the allocation of network traffic based on the network status information.

6. The network control system according to claim 5, characterized in that, Based on application layer requirements and in conjunction with the aforementioned network state information, network strategies are formulated, including: The objectives in the business requirements are compared with the actual conditions in the network status information to find the optimal solution that meets the business requirements. The optimal solution is then converted into specific configuration commands that can be executed by the forwarding layer device.

7. The network control system according to claim 6, characterized in that, Network policy generation includes routing policy generation: Construct access control rules based on logical switch ports. The rules include source port matching conditions, protocol type field matching conditions, and action instructions, wherein the action instructions include allowing related connections, allowing traffic on specific ports, or dropping traffic.

8. The network control system according to claim 5, characterized in that, Scheduling and optimizing network traffic allocation based on the aforementioned network status information includes: Packets are classified based on predefined conditions using a logical traffic classifier; Set QoS tags for the categorized traffic; The tagged traffic policy is distributed to the forwarding layer device via the southbound interface.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the method according to any one of claims 1-4.

10. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the at least one processor to perform the method according to any one of claims 1-4.

Images