Method for intelligent addressing and route optimization of multi-network convergence based on IPv6

Abstract

The application provides an IPv6-based multi-network fusion intelligent addressing and routing optimization method, relates to the technical field of network, and comprises the following steps: constructing a time-sequenced path characteristic sequence of a destination prefix based on a topology state and link quality, normalizing and dimensionally reducing the time-sequenced path characteristic sequence to generate a path quality vector; screening a candidate path, calculating a score, and performing hop-by-hop reachability verification to generate a routing and forwarding strategy; setting a routing extension header for a message crossing a multi-domain network, and specifying a verified intermediate forwarding node; and synchronizing a path selection result to a same-domain edge router.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, and particularly relates to a multi-network fusion intelligent addressing and routing optimization method based on IPv6. BACKGROUND

[0002] With the rapid development of Internet technology, the large-scale deployment of IPv6 has brought great changes to network communication. IPv6 has become the basic protocol of the next generation Internet with its broad address space, simplified header structure and good support for mobility. Currently, various heterogeneous networks are gradually converging, including traditional wired networks, wireless access networks, low-power Internet of Things, etc., forming a complex multi-domain network environment. In this environment, how to achieve efficient path selection and routing optimization has become a key technical challenge. Traditional IPv6 routing mainly relies on static configuration and single path strategy, which is difficult to adapt to dynamic changes in network conditions and diversified quality of service requirements.

[0003] The traditional IPv6 routing mechanism lacks dynamic perception ability of path characteristics and cannot make intelligent decisions based on time-sequenced link state changes, making it difficult to select the optimal path in the case of network congestion or link quality fluctuations. There is a problem of insufficient path reachability verification in the cross-domain routing selection process, and it is difficult to ensure the real availability of end-to-end paths relying only on the information exchanged by the routing protocol, especially in the multi-network fusion scenario, the routing cooperation mechanism between different network domains lacks effective connection. The existing IPv6 network lacks a path optimization mechanism without breaking the protocol compatibility, and it is difficult to achieve fine-grained routing control while keeping the standard IPv6 header structure unchanged, which seriously limits the ability to provide differentiated quality of service in complex network environments.

[0004] These technical challenges make it particularly important to achieve efficient and reliable IPv6 intelligent addressing and routing optimization in a multi-network fusion environment, and innovative technical solutions are needed to solve these problems. SUMMARY

[0005] The embodiment of the present application provides a multi-network fusion intelligent addressing and routing optimization method based on IPv6, which can solve the problems in the prior art.

[0006] In a first aspect, the embodiment of the present application provides a multi-network fusion intelligent addressing and routing optimization method based on IPv6, comprising:

[0007] Constructing a time-sequenced path characteristic sequence oriented to the destination prefix based on the acquired topology state information and link quality measurement data;

[0008] The time-sequenced path feature sequence is normalized and dimensionally reduced without changing the IPv6 header structure, and a comparable path quality vector is generated with the destination prefix as an index; candidate path screening is performed based on the path quality vector, path scores are calculated, and hop-by-hop reachability verification is performed on the top N candidate paths in terms of scores, which is achieved by sending survival probe packets and neighbor reachability confirmation packets; if any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in, and a routing and forwarding strategy corresponding to the destination prefix is generated;

[0009] The destination address reachability enhancement processing is performed on the end-to-end path crossing the multi-domain network, the route expansion header of a limited length is set for the target packet within the scope of conforming to the IPv6 expansion header semantics, and the verified intermediate forwarding node is specified to obtain the path selection result;

[0010] The path selection result is synchronized to the edge router in the same management domain through a secure channel.

[0011] The topology state information includes the IPv6 prefix, the link layer identifier, and the hop count of the forwarding path of each access network; and the link quality measurement data includes the round-trip delay, the instantaneous bandwidth, the packet loss rate, and the path instability event count.

[0012] The candidate path screening is performed based on the path quality vector, the path scores are calculated, and the hop-by-hop reachability verification is performed on the top N candidate paths in terms of scores, which includes:

[0013] For each candidate path corresponding to the same destination prefix, a dimensionless sub-score is calculated according to the path quality vector, and a comprehensive path score is formed by taking the reachability historical stability as a weighting factor; wherein the reachability historical stability is calculated by the round-trip time fluctuation range of the survival probe packet and the neighbor reachability confirmation success rate in a plurality of consecutive detection periods;

[0014] When the hop-by-hop reachability verification is performed on the top N candidate paths in terms of comprehensive path scores, a layered scheduling mechanism of probe packets is adopted, the survival probe packet for link activity detection is sent first, and then the neighbor reachability confirmation packet for adjacency state confirmation is sent after the corresponding response is successfully received;

[0015] When any intermediate forwarding node does not return a correct response within a preset response time, or returns a response but its time delay increases by more than a preset jitter threshold compared with the previous detection period, the candidate path is marked as unstable and removed, and the next candidate path corresponding to the destination prefix is sequentially filled in to fill the vacancy until the number constraint of the path is met.

[0016] The routing and forwarding strategy corresponding to the destination prefix is generated, which includes:

[0017] For each candidate path verified by hop-by-hop reachability, an atomized rule is generated, which only contains a determined match item and a determined action item, the determined match item is composed of ingress interface identifier, destination prefix, field value corresponding to traffic classification condition and priority tag, the determined action item is composed of egress interface selection, forwarding table item index and queuing queue identifier;

[0018] When there are multiple atomized rules related to the same destination prefix, linearization of rules is performed according to the numerical order of policy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that only a single atomized rule is hit when any input packet arrives;

[0019] For each atomized rule, a coverage check fingerprint is calculated and compared with the current effective fingerprint, when overlap or action conflict is detected, rule rollback is performed in order of priority from low to high until the conflict is eliminated;

[0020] For each atomized rule corresponding to the destination prefix, a minimum effective time window and a maximum migration frequency are set, when the minimum effective time window is not reached, priority change is prohibited, and when the maximum migration frequency is reached, subsequent priority adjustment is delayed to the next detection period.

[0021] Linearization of rules is performed according to the numerical order of policy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that only a single atomized rule is hit when any input packet arrives, including:

[0022] A rule sequence is established according to the numerical order of policy priority from high to low, the intersection of the matching fields of adjacent two rules in the rule sequence is calculated, when the intersection is not empty, the matching fields of the rule with priority lower than the preset screening threshold are cut according to the intersection boundary, only the remaining intervals that do not overlap with each other are retained, and the matching items of the rule with priority lower than the preset screening threshold are rewritten with the remaining intervals, completing the interval de-overlapping processing;

[0023] In each detection period, the ingress interface identifier of the randomly selected arriving packet is matched twice independently, the first time is matched according to the linearization order, and the second time is verified by mathematical intersection using the normalized interval set, when the results of the two times of matching are inconsistent, the effectiveness of the rule with priority lower than the preset screening threshold is suspended, and the interval de-overlapping processing is re-executed.

[0024] Within the scope of conforming to the semantics of IPv6 extension header, a route extension header with limited length is set for the target packet, which specifies the verified intermediate forwarding nodes to obtain path selection results, including:

[0025] The limited length is composed of the first several nodes selected in the order of low to high end-to-end delay from the set of verified intermediate forwarding nodes corresponding to the destination prefix, to ensure that the forwarding path is explicitly constrained in the cross-domain segment;

[0026] The topology consistency confirmation is used for verifying that the links between the intermediate forwarding node and its adjacent nodes are in a reachable state, and the policy conflict detection is used for comparing whether the actions of the atomized rules for the same destination prefix conflict with the order requirement of the route expansion header; when the action conflict is detected, the corresponding atomized rule is suspended according to the order from low to high priority until the conflict is eliminated, and a path selection result is obtained.

[0027] Synchronizing the path selection result to the edge routers in the same management domain through a secure channel comprises:

[0028] Based on the path selection result, the synchronization messages are sequentially distributed through the secure channel according to the time of arrival order and the version number, and the receiving end edge router performs integrity verification and version arbitration after receiving the synchronization message, the version arbitration is based on the secondary order of the version number and the timestamp, and when an old version or a repeated version is detected, the synchronization message is discarded.

[0029] In a second aspect of the embodiment of the application, an IPv6-based multi-network fusion intelligent addressing and routing optimization system is provided, comprising:

[0030] A first unit is configured to construct a time-sequenced path feature sequence based on the acquired topology state information and link quality measurement data.

[0031] A second unit is configured to perform normalization and dimensionality reduction processing on the time-sequenced path feature sequence without changing the IPv6 header structure, and generate a comparable path quality vector indexed by the destination prefix; based on the path quality vector, candidate paths are screened, path scores are calculated, and the top N candidate paths with the highest scores are subjected to hop-by-hop reachability verification, the hop-by-hop reachability verification is achieved by sending a survival probe message and a neighbor reachability confirmation message, and if any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in, thereby generating a route forwarding strategy corresponding to the destination prefix.

[0032] A third unit is configured to perform destination address reachability enhancement processing on an end-to-end path traversing a multi-domain network, set a route expansion header with a limited length for the target message within the scope of conforming to the IPv6 expansion header semantics, and specify the verified intermediate forwarding node to obtain a path selection result.

[0033] A fourth unit is configured to synchronize the path selection result to the edge routers in the same management domain through a secure channel.

[0034] In a third aspect of the embodiment of the application,

[0035] An electronic device is provided, comprising:

[0036] a processor;

[0037] a memory for storing processor-executable instructions;

[0038] wherein the processor is configured to invoke the instructions stored by the memory to perform the method as described above.

[0039] A fourth aspect of the embodiments of the present application,

[0040] A computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method as described above.

[0041] The beneficial effects of the present application are as follows:

[0042] The method for intelligent addressing and routing optimization based on multi-network fusion of IPv6 provided by the present application realizes efficient path quality evaluation and candidate path screening by constructing a time-sequenced path feature sequence oriented to a destination prefix and performing normalization and dimension reduction processing on the same, and effectively improves the accuracy of routing decision.

[0043] The present application adopts a hop-by-hop reachability verification mechanism without changing the IPv6 header structure, ensures the reliability of the selected path, and at the same time, through setting a route extension header of limited length, enhances the destination address reachability, and solves the problem of route breakage in cross-domain networks.

[0044] The present application synchronizes the path selection result to the edge router in the same management domain through a secure channel, realizes the rapid deployment and consistency maintenance of the routing strategy, greatly improves the overall performance and availability of the network, and is suitable for intelligent addressing and routing optimization in a complex multi-network fusion environment. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart of the method for intelligent addressing and routing optimization based on multi-network fusion of IPv6 according to the embodiments of the present application is shown.

[0046] Figure 2 A flowchart of the priority linearization and interval de-overlapping according to the embodiments of the present application is shown. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described clearly and completely below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0048] The technical solutions of the present application are described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes can not be described in some examples.

[0049] Figure 1 The flowchart of the IPv6-based multi-network fusion intelligent addressing and routing optimization method of the embodiments of the present application is shown in FIG. 1, which includes the following steps: Figure 1

[0050] Based on the acquired topology state information and link quality measurement data, a time-sequenced path feature sequence is constructed for the destination prefix.

[0051] Without changing the IPv6 header structure, the time-sequenced path feature sequence is normalized and reduced in dimension, and a comparable path quality vector is generated with the destination prefix as the index. Based on the path quality vector, candidate paths are screened, path scores are calculated, and the top N ranked candidate paths are verified for hop-by-hop reachability. The hop-by-hop reachability verification is achieved by sending survival probe packets and neighbor reachability confirmation packets. If any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in, and a routing forwarding strategy corresponding to the destination prefix is generated.

[0052] The end-to-end path across the multi-domain network is subjected to destination address reachability enhancement processing. Within the scope of the IPv6 extension header semantics, a route extension header of limited length is set for the target packet, and the verified intermediate forwarding nodes are specified to obtain the path selection result.

[0053] The path selection result is synchronized to the edge router within the same management domain through a secure channel.

[0054] In an optional implementation, the topology state information includes the IPv6 prefix, link layer identifier, and hop count of the forwarding path of each access network; and the link quality measurement data includes round-trip delay, instantaneous bandwidth, packet loss rate, and path instability event count.

[0055] ​The IPv6 prefix information of each access network is collected. The IPv6 prefix refers to the network part of the IPv6 address, which is used to identify the network. For example, 2001:0db8:85a3:: / 64 represents an IPv6 prefix with the first 64 bits as the network identifier. The system maintains a list of IPv6 prefixes for each access point, which can be used to identify the source network and target network of the data packet. The system updates these information in real time, and when a new access network joins, its IPv6 prefix is automatically added to the topology database. In practical applications, the system collects multiple prefix information such as 2001:0db8:: / 32 and 2001:0db9:: / 32, which are stored in the topology information table for use in routing decisions.

[0056] The collection of link layer identifiers is achieved by obtaining the MAC address or other link layer unique identifiers of each access network. For example, for Ethernet connections, the system records the 48-bit MAC address, such as 00:1A:2B:3C:4D:5E; for wireless networks, the BSSID information is recorded. These identifiers are used to accurately identify devices at the link layer, ensuring that data packets can be correctly transmitted at the physical layer. The system periodically scans connected devices and updates the link layer identifier information table to adapt to changes in network topology.

[0057] The hop count information of the forwarding path is obtained by active probing. Specific probe packets are sent to the target node, and these probe packets have a time-to-live (TTL) field. By gradually increasing the TTL value and analyzing the returned ICMP timeout messages, the number of hops to reach the target node can be determined. For example, the system determines that the path to reach a certain edge server requires 3 hops, while the path to reach another server requires 5 hops. The hop count information is crucial for evaluating the efficiency of the path, and generally the fewer the number of hops, the more optimal the path. The system maintains a hop count mapping table that records the hop count information for all destinations. This information is updated every 300 seconds to ensure the timeliness of the data.

[0058] Round-trip delay measurement is achieved by sending probe packets with timestamps. When sending a probe packet, the sending time T1 is recorded, and when receiving a response, the receiving time T2 is recorded. The round-trip delay is calculated as the difference between T2 and T1. To improve measurement accuracy, the system sends 10 consecutive probe packets, and takes the average value as the round-trip delay value. For example, in a certain measurement, the round-trip delays of 10 probe packets are 18 milliseconds, 20 milliseconds, 19 milliseconds, 21 milliseconds, 17 milliseconds, 19 milliseconds, 18 milliseconds, 20 milliseconds, 19 milliseconds, and 18 milliseconds, with an average round-trip delay of 18.9 milliseconds. These data are updated every 60 seconds and stored in the delay history database for subsequent network performance analysis.

[0059] The instantaneous bandwidth measurement employs a packet pair technique, where two closely connected data packets (packet pair) are sent in succession, the first packet is 64 bytes in size, and the second packet is 1500 bytes in size. By measuring the time difference of the arrival of the two packets at the destination, and combining the size difference of the two packets, the instantaneous bandwidth can be calculated. To increase accuracy, the system sends 5 sets of packet pairs for each measurement, and takes the average as the final result. For example, in one measurement, the bandwidth calculated by the 5 sets of packet pairs are 95 Mbps, 93 Mbps, 94 Mbps, 96 Mbps and 92 Mbps, the average is 94 Mbps, which is the instantaneous bandwidth of the link. The bandwidth information is updated every 180 seconds, and for links with large bandwidth fluctuations, the update frequency can be increased to every 60 seconds.

[0060] The packet loss rate measurement is achieved by sending serialized probe packets, 100 UDP probe packets with sequence numbers are sent to the target node, the target node records the sequence numbers of the received packets, and returns the reception situation. The system calculates the packet loss rate according to the number of sent and received packets. For example, if 100 packets are sent and only 97 responses are received, the packet loss rate is 3%. To avoid errors caused by network fluctuations, the system performs a complete packet loss rate test every 5 minutes, and saves the packet loss rate history data for nearly 24 hours, in order to identify the long-term trend of network quality.

[0061] The path instability event count is achieved by monitoring topology changes and link state fluctuations, when detecting path changes (such as hop count changes, next hop changes) or significant fluctuations in link parameters (such as a sudden increase in round-trip time of more than 50%), an instability event is recorded. The system accumulates these events within a fixed time window (such as 1 hour). For example, if the system detects 5 path changes and 3 significant fluctuations in link parameters in the past 1 hour, the path instability event count is 8. This indicator reflects the stability of the network, the higher the count, the more unstable the network, which requires more attention and optimization.

[0062] The above topology state information and link quality measurement data are integrated into a unified network state database, which provides a comprehensive view of network conditions for upper layer applications. The system implements intelligent routing decisions based on these data, for example, when detecting that the packet loss rate of a path exceeds 5% or the round-trip time exceeds 50 milliseconds, it can automatically switch to a backup path. At the same time, these data are also used for network performance prediction and anomaly detection, such as when the bandwidth of a link decreases by more than 30% in a short period of time, the system will trigger an alarm mechanism to alert the network administrator of the existing network problem.

[0063] In an alternative embodiment, the candidate path screening based on the path quality vector, the path score calculation, and the hop-by-hop reachability verification of the top N ranked candidate paths include:

[0064] For each candidate path corresponding to the same destination prefix, a dimensionless sub-score is calculated according to the path quality vector, and a comprehensive path score is formed by taking the reachability history stability as a weighting factor; wherein the reachability history stability is calculated by the round-trip time fluctuation amplitude of the survival probe packet and the neighbor reachability confirmation success rate in a plurality of consecutive detection periods;

[0065] In the process of performing hop-by-hop reachability verification on the top N candidate paths according to the comprehensive path score, a layered scheduling mechanism of probe packets is adopted, survival probe packets for link activity detection are sent first, and then neighbor reachability confirmation packets for adjacency state confirmation are sent after successfully receiving the corresponding responses;

[0066] When any intermediate forwarding node does not return a correct response within a preset response time, or returns a response with a time delay that increases by more than a preset jitter threshold compared with the previous detection period, the candidate path is marked as unstable and removed, and the next candidate path corresponding to the destination prefix is filled in order to fill the vacancy until the number constraint of the path is met.

[0067] The path quality vector processing module extracts the multi-dimensional quality parameters of each path from the candidate path set, and the quality vector contains dimensions such as delay, bandwidth, packet loss rate, hop count, and link utilization rate, each dimension is represented by a floating-point number. The delay parameter is obtained by measuring the round-trip time of end-to-end probe packets, the bandwidth parameter is calculated from the link capacity and current traffic statistics, and the packet loss rate is obtained by sending a sequence of test packets and counting the proportion of received acknowledgments.

[0068] The dimensionless processing adopts a maximum-minimum normalization method to eliminate the dimensional differences of different dimension parameters. The normalization module maintains historical maximum and minimum statistical information of each quality dimension, subtracts the minimum value from the original parameter value and divides it by the difference between the maximum and minimum values to obtain a normalized value between 0 and 1. For negative indicators such as delay and packet loss rate, the normalized result is converted to a positive indicator by subtracting 1, ensuring that the larger the value, the better the quality.

[0069] The sub-score calculation module performs weighted summation on the normalized dimension parameters, and the weight coefficients are pre-configured according to network service types and quality of service requirements. The delay dimension weight is increased for delay-sensitive services, and the bandwidth dimension weight is increased for bandwidth-sensitive services. The weighted summation process multiplies the normalized value of each dimension by the corresponding weight coefficient, and then adds the weighted results of all dimensions to obtain the dimensionless sub-score.

[0070] The reachability history stability calculation is based on the probe data of a plurality of continuous detection periods. The stability calculation module maintains a history probe record of each candidate path, which contains a time stamp, a round-trip time and a neighbor confirmation state. The round-trip time fluctuation amplitude is obtained by calculating the standard deviation of the round-trip time in the continuous detection period. The smaller the standard deviation, the better the delay stability. The neighbor reachability confirmation success rate is calculated by counting the ratio of the number of successful confirmations to the total number of probes. The higher the success rate, the better the path stability.

[0071] The stability comprehensive evaluation synthesizes the round-trip time fluctuation amplitude and the neighbor confirmation success rate after normalization and weighting. The fluctuation amplitude is normalized by using inverse transformation, and the inverse of the standard deviation is taken as the stability index. The success rate is directly taken as a positive index for calculation. The stability calculation module performs weighted average on the two indexes according to the preset weight, and obtains a reachability history stability value between 0 and 1.

[0072] The comprehensive path score generation is realized by multiplying the dimensionless sub-score and the reachability history stability. The score calculation module takes the sub-score as the basic evaluation and the stability as the adjustment factor. The path with poor stability will be reduced in score even if the quality parameter is good. The calculation result is kept as a floating point number format, and the precision is kept to three decimal places, ensuring the accuracy of the score comparison.

[0073] The candidate path sorting module arranges the paths from high to low according to the comprehensive path score. The sorting adopts the quicksort algorithm, and when the scores of two paths are the same, the secondary sorting is performed according to the path identifier to ensure the result certainty. The sorting result is stored in an ordered array, and the array index corresponds to the ranking position of the path. The selection of the top N paths is realized by array slicing operation, and the value of N is set by configuration parameter, and the typical value is between 3 and 8.

[0074] The probe packet layered scheduling mechanism adopts a two-stage verification strategy to ensure path reachability. The scheduling module creates independent verification tasks for each of the top N candidate paths, and the tasks contain path identifier, intermediate node list and verification state information. The verification process is performed in sequence according to the node order in the path, and the verification of each node includes two steps of link activity detection and adjacency state confirmation.

[0075] The survival probe packet is generated in the format of ICMP Echo Request, which contains a unique identifier, a sending time stamp and path information. The packet identifier uses a 32-bit sequence number, which is combined with the path identifier and the node identifier to ensure that the probe packets of different paths and nodes can be distinguished. The sending time stamp uses a high-precision system clock with a precision of microseconds, which is used to calculate the round-trip time. The path information is contained in the data part of the ICMP packet, which records the target node and the return path of the probe.

[0076] Link activity detection is achieved by sending a keep-alive probe packet to the target node and waiting for an ICMP Echo Reply response. The detection module sets a response timeout, typically 1 to 3 seconds. When a correct Echo Reply response is received, the module calculates the round-trip time and records the probe success. When no response or an incorrect response is received within the timeout, the node link is marked as unreachable.

[0077] The neighbor reachability confirmation packet adopts the ICMPv6 Neighbor Solicitation format, and the packet contains a query request for the link layer address of the target node. The confirmation packet is sent after the keep-alive probe is successful, ensuring that the basic connectivity has been established. The packet contains the link layer address information of the source node, and the target node responds through a Neighbor Advertisement packet, which contains the link layer address and reachability status flag of the target node.

[0078] The adjacency state confirmation process verifies the neighbor table state and forwarding capability of the target node, and the confirmation module parses the Neighbor Advertisement response packet to check the state flag bit and address information in the response. When the Router flag bit in the response packet is set and the address information is correct, the adjacency state is confirmed to be normal. When the response packet is missing, has a format error, or the state flag is abnormal, the adjacency state is marked as unstable.

[0079] The preset response time monitoring mechanism sets an independent timeout threshold for each verification step, and the time monitoring module maintains the probe start timestamp, and calculates the difference between the used time and the preset threshold in real time. The response time threshold of the keep-alive probe is usually set to 2 to 3 times the network round-trip time, and the response time threshold of the neighbor confirmation is set to the upper limit value of the link layer processing time. When any step exceeds the corresponding threshold, the monitoring module triggers the timeout processing flow.

[0080] Delay jitter detection is achieved by comparing the current probe result with historical data. The jitter detection module extracts the round-trip time value of the previous detection period from the historical records, and calculates the difference with the current measurement value. When the difference exceeds the preset jitter threshold, it is determined that the path delay is unstable. The jitter threshold is set according to the network type and business requirements, and is usually set to a few milliseconds in a local area network environment and a few tens of milliseconds in a wide area network environment.

[0081] The path elimination and replacement mechanism performs automatic adjustment when an unstable path is detected. The elimination module marks the verification failed path state as unavailable and removes it from the top N list. The replacement module selects the next available path from the sorted candidate path list to fill in, and the filling process is repeated to perform hop-by-hop reachability verification to ensure the availability of the new path.

[0082] The quantity constraint check ensures that the final selected available paths meet the system requirement. The constraint check module counts the total number of paths that pass the verification. When the number is lower than the minimum requirement, additional candidate path screening is triggered. The checking process continues until the number of available paths reaches the preset target value or the candidate path pool is exhausted. The final path set serves as the basis data for subsequent routing decisions and load balancing.

[0083] In an optional implementation, generating the route forwarding policy corresponding to the destination prefix comprises:

[0084] For each candidate path that passes the hop-by-hop reachability verification, an atomized rule is generated, which only contains a determined match item and a determined action item. The determined match item is composed of the ingress interface identifier, the field value corresponding to the traffic classification condition of the destination prefix, and the priority label. The determined action item is composed of the egress interface selection, the forwarding table item index, and the queuing queue identifier.

[0085] When there are multiple atomized rules related to the same destination prefix, linearization of the rules is performed according to the numerical order of the policy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that only a single atomized rule is hit when any input packet arrives.

[0086] For each atomized rule, a coverage check fingerprint is calculated and compared with the current effective fingerprint. When overlap or action conflict is detected, rule rollback is performed in order from low to high priority until the conflict is eliminated.

[0087] For each atomized rule corresponding to the destination prefix, a minimum effective time window and a maximum migration frequency are set. When the minimum effective time window is not reached, priority change is prohibited. When the maximum migration frequency is reached, subsequent priority adjustment is delayed to the next detection period.

[0088] The atomized rule generation module extracts route information from the set of candidate paths that pass the hop-by-hop reachability verification. Each candidate path contains a complete sequence of forwarding nodes, path quality parameters, and verification state markers. The rule generation process creates an independent atomized rule entry for each path. The rule entry is stored in a fixed-length data structure, which contains a match item field group and an action item field group.

[0089] The key identification information corresponding to the path extraction of the matching item construction process is determined, the ingress interface identifier is obtained by querying the interface mapping table of the first hop node of the path, and a 32-bit unsigned integer is used to represent the physical or logical interface number. The destination prefix is directly extracted from the target network information of the candidate path, and the standard format of the IPv6 prefix is maintained, including a 128-bit network address and a prefix length. The traffic classification condition field value is determined according to the service type carried by the path, and includes parameters such as protocol type, quality of service mark and traffic priority. The priority label is calculated through path quality scoring and policy weight, and a 16-bit value is used to represent the priority, and the smaller the value, the higher the priority.

[0090] The forwarding operation instruction corresponding to the path generated by the action item construction process is determined, the egress interface is selected by querying the adjacency information of the last hop node of the path, and the selection result includes the egress interface number and the next hop address. The forwarding table item index points to a specific entry in the router forwarding information base, and the index value is obtained by hashing the destination prefix to ensure that messages with the same prefix use consistent forwarding table items. The queuing queue identifier is allocated according to the quality of service requirement of the path, and different priority traffic is allocated to different hardware queues, and the queue identifier is represented by an 8-bit value.

[0091] The rule linearization process performs a sorting operation on multiple atomized rules associated with the same destination prefix, the linearization module extracts all rules with the same destination prefix, and sorts them according to the value of the priority label from small to large. The sorting process uses the merge sorting algorithm to ensure the stability of the time complexity of the sorting operation. When multiple rules have the same priority label, secondary sorting is performed according to the rule generation timestamp to ensure the determinacy and reproducibility of the sorting result.

[0092] The matching domain interval de-overlapping processing is implemented through multi-dimensional overlap detection and segmentation, and the processing module converts the matching item of each rule into an interval representation in a multi-dimensional space. The ingress interface identifier is used as a discrete value dimension, the destination prefix is converted into an address range dimension, and the traffic classification condition is converted into a parameter range dimension. The overlap detection algorithm compares the matching domains of adjacent rules pair by pair, and when it detects any dimension overlap, the rule with lower priority is split. The splitting process splits the matching domain of the low-priority rule according to the overlap boundary to generate multiple non-overlapping sub-intervals, and each sub-interval corresponds to a new atomized rule.

[0093] The coverage verification fingerprint calculation uses a hash digest algorithm to digitally sign the matching domain and the action domain of the rule. The fingerprint calculation module connects all the matching item fields of the rule into a byte sequence in a fixed order, calculates a 128-bit digest value as the matching domain fingerprint using the SHA-256 hash algorithm. The action domain fingerprint is calculated by the same way. The complete coverage verification fingerprint is formed by combining the matching domain fingerprint and the action domain fingerprint, and the total length is 256 bits.

[0094] The fingerprint comparison module maintains a current active fingerprint database, storing the coverage verification fingerprints of all active rules. The comparison process compares the newly generated rule fingerprints with the existing fingerprints in the database one by one. The coverage overlap detection is achieved by comparing the similarity of matching field fingerprints, and when the Hamming distance of two matching field fingerprints is less than a preset threshold, it is determined that there is coverage overlap. The action conflict detection is achieved by comparing different action field fingerprints corresponding to the same matching field fingerprint, and when there are multiple different actions corresponding to the same matching condition, it is determined that there is action conflict.

[0095] The rule rollback mechanism performs conflict resolution operations when coverage overlap or action conflict is detected. The rollback module identifies all rules involved in the conflict and sorts them from high to low according to the priority label. The rollback process starts with the rule with the lowest priority and checks whether removing the rule can eliminate the conflict. The removal operation marks the rule state as inactive and deletes the corresponding coverage verification fingerprint from the fingerprint database. The rollback process continues until all coverage overlaps and action conflicts are completely eliminated.

[0096] The minimum effective time window setting mechanism assigns a time constraint parameter to each atomized rule. The time window setting module determines the minimum effective time according to the importance and stability requirements of the rule. The minimum effective time of critical path rules is set to a longer value, and the minimum effective time of temporary path rules is set to a shorter value. The time window parameter is stored in the extended field of the rule entry, including the effective start timestamp and the minimum duration. The priority change check module calculates the difference between the current time and the effective start time when receiving a rule modification request, and rejects the change request when the difference is less than the minimum duration.

[0097] The maximum migration frequency control mechanism limits the adjustment frequency of rule priority. The frequency control module maintains a migration counter and a time window parameter for each rule. The migration counter records the number of priority changes of the rule within the current time window, which is usually set to a minute or hour interval. When the migration counter of the rule reaches the preset maximum migration frequency threshold, the frequency control module adds the subsequent priority adjustment request to the delay queue and waits for the next detection period to process it again.

[0098] The detection period management module maintains a global rule adjustment schedule. The detection period is set to a fixed time interval, typically 30 seconds to 300 seconds. The management module resets the migration counter of all rules at the beginning of each detection period, clears the pending requests in the delay queue, and performs accumulated priority adjustment operations. The period management process ensures the timing and controllability of rule adjustment, avoiding the impact of frequent changes on network forwarding performance.

[0099] The rule validation mechanism verifies the correctness and integrity of the generated atomic rules, and the rule checking module checks whether the matching item and action item fields of each rule are completely filled, and verifies the validity and consistency of the field values. The matching item verification includes the existence check of the interface identifier, the legality check of the prefix format, and the range check of the traffic classification condition. The action item verification includes the reachability check of the egress interface, the validity check of the forwarding table item index, and the availability check of the queuing queue.

[0100] The forwarding policy deployment module loads the atomic rules that pass the verification to the hardware forwarding plane of the router. The deployment process converts the rule information into hardware table item formats, including ternary content addressable memory entries and action instruction sequences. The hardware table items are arranged in priority order to ensure the correctness of the packet matching process. The deployment module also updates the forwarding information base and adjacency table of the router to keep the state of the software control plane and the hardware forwarding plane synchronized.

[0101] The policy enforcement monitoring module tracks the running state and performance indicators of the deployed rules, and the monitoring process collects statistical information such as the number of matches, the success rate of forwarding, and the average processing delay of each rule. The monitoring data is used to evaluate the effectiveness of the rules and the quality of the path, providing decision-making basis for subsequent rule optimization and adjustment. The abnormality detection mechanism identifies abnormal situations in the rule running process, including matching failures, forwarding errors, and performance degradation, triggering corresponding fault handling and recovery processes.

[0102] In an optional implementation, the rules are linearized according to the numerical order of the policy priorities, and the interval de-overlapping processing is performed on the matching domains of adjacent rules to ensure that any incoming packet is hit by only a single atomic rule, including:

[0103] The rule sequence is established according to the numerical value of the policy priority from high to low, the intersection of the matching domains of two adjacent rules in the rule sequence is calculated, when the intersection is not empty, the matching domain of the rule with a priority lower than a preset filtering threshold is cut according to the intersection boundary, only the remaining intervals that do not overlap with each other are retained, and the matching item of the rule with a priority lower than the preset filtering threshold is rewritten with the remaining intervals, and the interval de-overlapping processing is completed.

[0104] In each detection period, the ingress interface identifier of the randomly extracted incoming packet is matched twice independently, the first time is matched according to the linearization order, and the second time is verified by mathematical intersection using the normalized interval set, when the results of the two times of matching are inconsistent, the enforcement of the rule with a priority lower than the preset filtering threshold is suspended, and the interval de-overlapping processing is re-executed.

[0105] As shown in Figure 2 , the method comprises:

[0106] The policy rule linearization process starts with data reading from the router policy rule base. The policy rule base is stored in the non-volatile memory of the router, and each rule contains a priority value represented by a 32-bit unsigned integer, a multi-dimensional match field structure, and an execution action enumeration value. The match field structure contains a destination IPv6 address prefix field, a source IPv6 address prefix field, an 8-bit protocol type field, a 16-bit destination port range, and a 16-bit source port range. The rule reading module extracts all the rule entries marked as active by traversing the linked list structure of the rule base.

[0107] The rule sequence construction adopts a priority value-based sorting algorithm. The sorting module arranges the read rules in ascending order of priority values, with smaller values indicating higher priority. When two rules have the same priority value, the sorting module performs secondary sorting according to the line number of the rule in the configuration file to ensure the determinacy of the sorting result. The sorting process uses the quicksort algorithm and stores the rule pointers in a dynamic array to generate a linear sequence containing rule references and index information.

[0108] The adjacent rule match field intersection calculation module processes adjacent rules in the linear sequence pair by pair. The intersection calculation converts the fields of each match field into interval representation. The IPv6 address prefix is calculated to obtain the start address and end address through prefix length, and the port range is directly represented as a numerical interval from the minimum value to the maximum value. When calculating the address interval, the 128-bit IPv6 address is extracted according to the prefix length to calculate the address range covered by the prefix. The protocol type field is treated as a single-point value, and the same protocol type is considered to have an intersection in this dimension.

[0109] The interval overlap detection algorithm judges each dimension independently. The overlap detection of the address dimension is achieved by comparing the start value and end value of two address intervals. When the start value of the first interval is less than or equal to the end value of the second interval, and the end value of the first interval is greater than or equal to the start value of the second interval, it is determined that there is an overlap in this dimension. The same numerical comparison logic is used for the port dimension. The protocol type dimension is judged by value equality. When all dimensions have overlaps, it is determined that the match fields of the two rules have intersections.

[0110] The intersection boundary determination module calculates the precise boundary coordinates of the overlapping interval. The start boundary of the address dimension intersection takes the larger of the start values of the two address intervals, and the end boundary takes the smaller of the end values of the two address intervals. The intersection boundary of the port dimension is calculated in the same way. The intersection of the protocol type dimension is the common protocol value. The boundary calculation results are stored in the intersection description structure, which contains the intersection start point and end point information of each dimension.

[0111] The preset screening threshold comparison module judges the split object in the adjacent rules, and the screening threshold is set through the router configuration parameter. Usually, the value of the medium priority is set, for example, when the priority range is 0 to 1000, the threshold is set to 500. The comparison module checks the priority value of the adjacent two rules. When the priority value of a rule is greater than the preset screening threshold, the rule is marked as a split target. The rule whose priority value is less than or equal to the threshold remains unchanged.

[0112] The matching field split module performs interval division operation on the marked rule. The split process divides the original matching field into multiple non-intersecting sub-intervals according to the intersection boundary. The address dimension split is achieved by adjusting the start address and prefix length of the IPv6 prefix, generating a new prefix set that does not contain the intersection part. When splitting, the original prefix range is reduced by the intersection range, resulting in zero, one or more discontinuous address segments. The port dimension split is achieved by modifying the upper and lower boundaries of the port range, dividing the original port range into multiple port segments that do not overlap with the intersection.

[0113] The rule rewriting module creates a corresponding new rule entry for each sub-interval generated by the split. The new rule entry inherits the execution action and priority value of the original rule, and only updates the matching field to the corresponding sub-interval value. The rewriting process ensures that the union of the matching fields of all new rule entries covers all parts of the original rule matching field except the intersection, avoiding matching omissions. When the split result of a certain dimension is an empty set, the rule entry corresponding to the sub-interval will not be created.

[0114] The policy rule library update operation adopts a transactional processing mechanism. The update module marks the original rule to be split as inactive, and adds all newly generated rule entries to the rule library. The update process uses read-write locks to protect the consistency of the rule library, ensuring that other modules cannot modify the rule library content during the update. After the update is completed, the module reconstructs the linear sequence to provide the latest rule ordering for subsequent processing.

[0115] The random extraction module selects the arriving packet for double matching verification within a fixed detection period. The detection period is set through the configuration parameter, and the typical value is 10 to 60 seconds. The extraction module maintains a linear congruential pseudo-random number generator, which uses the microsecond part of the current system time as the random seed. When a packet arrives, the generator generates a random number and compares it with the preset extraction threshold to determine whether to select the packet for verification. The extraction ratio is usually set to between 0.1% and 1%.

[0116] The linearization sequential matching module extracts the key field information of the selected packet, including the IPv6 source address, the IPv6 destination address, the protocol number, the source port number and the destination port number. The matching process checks each rule in turn according to the order of the linearization sequence. The address matching is realized by comparing the network part of the packet address with the rule prefix after a bitwise AND operation. The port matching judges whether the packet port number falls within the port range specified by the rule. The protocol matching directly compares the packet protocol number with the rule protocol type. When all fields of the packet meet the matching conditions of a rule, the matching process ends and returns the unique identifier of the rule.

[0117] The normalized interval set construction module converts the matching fields of all active rules into a standardized multi-dimensional interval representation. Each dimension constructs an independent interval tree data structure, and the internal nodes of the tree store interval split points, and the leaf nodes store the list of all rule identifiers containing the point. The interval tree of the address dimension is constructed in the order of the address value, and the interval tree of the port dimension is constructed in the order of the port number value. The interval tree supports efficient point query and range query operations.

[0118] The mathematical intersection verification module converts the five-tuple information of the packet into a point query request in the multi-dimensional space, and the verification process finds all intervals containing the field values of the packet in the interval tree of each dimension, and uses the binary search algorithm to quickly locate the target interval. The query result is the set of rule identifiers containing the query point in each dimension. The verification module calculates the intersection of all dimension query results to obtain the rule set that completely matches the packet, and selects the rule with the highest priority as the matching result according to the priority value.

[0119] The matching result consistency check module compares the output results of the linearization sequential matching and the mathematical intersection verification, and the checking process compares the rule identifiers returned by the two modules. When the identifiers are the same, it is determined that the matching is consistent, and when the identifiers are different or one of the modules returns a matching failure, it is determined that the matching is inconsistent. Inconsistent cases are caused by incomplete interval de-overlapping processing, timing problems in the rule update process, or data structure synchronization delay.

[0120] The rule suspension processing module performs a protective operation when it detects a matching inconsistency. The suspension module identifies the relevant rule range that causes the inconsistency by analyzing the difference between the two matches. For rules involved in the priority value greater than the preset screening threshold, the suspension module marks their active state as suspended, preventing these rules from participating in the subsequent packet matching process. The suspension operation also records the suspension timestamp, suspension reason description and identifier information of the related rules.

[0121] The re-execution trigger module clears the current interval de-intersection processing result and restarts the complete processing flow. The trigger module re-invokes all processing steps of rule reading, linearization sorting, intersection calculation, split rewriting, and rule base updating until the double match verification passes the consistency check. Suspended rules are excluded in the re-execution process to ensure the correctness and stability of the processing result.

[0122] In an optional implementation, within the scope of IPv6 extension header semantics, a route extension header of limited length is set for the target packet to specify the verified intermediate forwarding nodes to obtain the path selection result, including:

[0123] The limited length is composed of the first several nodes in the verified intermediate forwarding node set corresponding to the destination prefix, selected in the order of low to high end-to-end delay, to ensure that the forwarding path is explicitly constrained in the inter-domain segment;

[0124] Topology consistency confirmation and policy conflict detection are performed in sequence for the verified intermediate forwarding nodes. The topology consistency confirmation is used to verify that the link between the intermediate forwarding node and its adjacent nodes before and after it is in a reachable state. The policy conflict detection is used to compare whether the actions of the atomized rules for the same destination prefix conflict with the order requirement of the route extension header. When an action conflict is detected, the corresponding atomized rule is suspended according to the order of low to high priority until the conflict is eliminated, and the path selection result is obtained.

[0125] The route optimization implementation of the IPv6 extension header adopts a route extension header setting mechanism of limited length. This mechanism introduces a route extension header processing module in the IPv6 basic protocol stack. The module is located in the header parsing stage of the network layer packet processing flow. When the router receives a packet that needs to be intelligently routed, the route extension header processing module queries the locally maintained verified intermediate forwarding node set according to the destination address prefix.

[0126] The construction of the verified intermediate forwarding node set is based on the end-to-end delay measurement result for sorting selection. The router maintains an intermediate node candidate pool for each destination prefix. The candidate pool contains all intermediate forwarding nodes that pass the reachability verification and their corresponding end-to-end delay values. The delay value is obtained by periodically sending a timestamp probe packet. The probe packet carries a sending timestamp, and the target node returns a response packet containing the receiving timestamp and the sending timestamp immediately after receiving it. The router that initiates the probe calculates the round-trip time and divides it by two to obtain the one-way delay estimation value.

[0127] The restricted length determination process considers the maximum length limit of IPv6 extension header, the length field of IPv6 extension header is 8 bits, which represents the length of the extension header in 8 bytes, so the maximum length of a single extension header is 2048 bytes. Each intermediate node address in the routing extension header occupies 16 bytes, and after deducting the fixed overhead of the extension header of 8 bytes, a single routing extension header can accommodate up to 127 intermediate node addresses. Considering network transmission efficiency in practical applications, the restricted length is usually set to 8 to 16 nodes.

[0128] The node selection algorithm sorts the verified intermediate forwarding node set from low to high in terms of delay, and selects the first N nodes to form the node list of the routing extension header. During the selection process, it is necessary to ensure that the selected nodes can form an end-to-end connected path. The algorithm uses a greedy strategy, starting from the source node, and selecting the intermediate node with the smallest delay to the next hop node and reaching the target network. After selecting a node, the current position is updated and the selection process is repeated until the target network is reached or the upper limit of the restricted length is reached.

[0129] The topology consistency verification mechanism verifies the link connectivity between the selected intermediate forwarding node and its adjacent nodes. This mechanism is realized through the extension of the neighbor discovery protocol, and the intermediate forwarding node periodically sends a neighbor advertisement message to its directly connected neighbor, which contains node identification and link state information. After receiving the neighbor advertisement message, the adjacent nodes update the local neighbor table and send a neighbor confirmation message. The confirmation message contains link quality indicators such as link utilization, packet loss rate, and delay jitter.

[0130] The link state detection adopts a bidirectional verification mechanism, in which intermediate forwarding node A sends a link state query message to adjacent node B, and node B returns a response message containing the link state of A to B and B to A directions. The message format includes source address, destination address, link identifier, state flag bit, and quality parameter field. The state flag bit uses a bitmap to represent the reachability, congestion state, and error state of the link. When the link is detected to be unreachable, the corresponding intermediate forwarding node is removed from the routing extension header, and the node reselection process is triggered.

[0131] The policy conflict detection mechanism compares the forwarding order specified in the routing extension header with the consistency of the local routing policy rules. The router maintains an atomic rule base, each rule containing matching conditions, actions, and priorities. The matching conditions are defined based on destination prefix, source prefix, protocol type, and port range fields. Actions include forwarding, discarding, redirecting, and traffic shaping operations. The priority is represented by a numerical value, and the smaller the value, the higher the priority.

[0132] The conflict detection algorithm traverses all the atomized rules matching the current destination prefix, and extracts the next hop address or egress interface information specified by each rule. The extracted forwarding information is compared with the node sequence specified by the routing extension header, and it is checked whether there is inconsistency in the forwarding path. The coverage of the rules is considered during the comparison, and when the matching condition of a certain atomized rule covers the current packet and the specified forwarding action does not match the requirement of the routing extension header, it is determined that there is a policy conflict.

[0133] The conflict resolution mechanism adopts a priority preemption manner, and when a policy conflict is detected, the priority of the conflict rule is compared with the priority of the routing extension header processing. The priority of the routing extension header processing is set by a configuration parameter, and is usually set to a medium priority to balance flexibility and stability. For the conflict rule with a priority lower than the routing extension header processing priority, it is marked as a suspended state and the suspension reason is recorded. The rule in the suspended state does not participate in the forwarding decision, but is retained in the rule library for subsequent recovery.

[0134] The rule suspension process maintains a suspended rule list, which records the identification, suspension time and associated routing extension header information of each suspended rule. When the forwarding path specified by the routing extension header changes or the related routing extension header is removed, it is checked whether there is a rule that can be recovered in the suspended rule list. The recovery conditions include conflict elimination and suspension time exceeding a preset threshold. The recovery process reactivates the suspended rule and updates its state to an active state.

[0135] The path selection result generation comprehensively considers the output of the limited length node selection, topology consistency confirmation and policy conflict detection. The generation process creates a routing extension header data structure containing the list of finally selected intermediate forwarding nodes. The data structure includes an extension header type field, a length field, a segment remaining field and a node address list. The segment remaining field indicates the current processing position, and the initial value is equal to the length of the node list, which is decremented by 1 after passing through each intermediate node. The node address list is arranged in the forwarding order, and each address occupies a 16-byte storage space.

[0136] The encapsulation process of the routing extension header inserts the routing extension header between the fixed header and the payload of the original IPv6 data packet. The insertion operation needs to adjust the next header field in the IPv6 fixed header, modify its value to the protocol number 43 of the routing extension header, and fill the protocol type of the original payload in the next header field of the routing extension header. After the encapsulation is completed, the payload length field of the IPv6 fixed header is updated, and the length value of the routing extension header is added. The processed data packet is forwarded according to the path specified by the routing extension header, and each intermediate forwarding node determines the next hop forwarding target according to the segment remaining field and the node address list.

[0137] In an alternative embodiment, synchronizing the path selection result to edge routers within the same administrative domain via a secure channel comprises:

[0138] sequentially distributing the synchronization message based on the path selection result according to the time of arrival order and version number via a secure channel, and performing integrity verification and version arbitration at the receiving end edge router after receiving the synchronization message, with the version arbitration being based on the secondary order of version number and timestamp, and discarding the synchronization message when an old version or duplicate version is detected.

[0139] In a network management system, edge routers are responsible for connecting different networks and processing packet forwarding, and when the path selection result in the network needs to be synchronized between multiple edge routers within the same administrative domain, the security, order and consistency of the synchronization process need to be ensured. The present embodiment provides a path selection result synchronization mechanism based on a secure channel, which combines the time of arrival order and version number for sequential distribution of the synchronization message, and implements integrity verification and version arbitration at the receiving end.

[0140] In the present embodiment, the path selection result synchronization system includes a sending end edge router and multiple receiving end edge routers. The sending end edge router calculates the optimal path selection result based on network topology information and traffic conditions, and synchronizes the result to other edge routers within the same administrative domain.

[0141] The process of synchronizing the path selection result via a secure channel is as follows: the sending end edge router first digitally signs the path selection result and constructs a synchronization message containing a version number and a timestamp. The version number starts from 1 and increments by 1 each time the path selection result is updated. The timestamp uses UTC time format with millisecond precision, for example "2023-05-20T15:30:25.123Z".

[0142] The data structure of the synchronization message includes: message header (containing sender identifier, receiver identifier, message type identifier), version number field (4-byte integer), timestamp field (8-byte time value), path selection result data (variable length field containing selected path information), digital signature field (used to verify message integrity and authenticity).

[0143] For example, a synchronization message contains the following data: the sender identifier is "ER-A001", the receiver identifier is "ER-B002", the message type is "PATH_SYNC", the version number is 25, the timestamp is "2023-05-20T15:30:25.123Z", the path selection result data contains the optimal path from the source network 172.16.0.0 / 16 to the target network 192.168.0.0 / 16 as passing through nodes 10.0.0.1, 10.0.0.5, 10.0.0.9, and the digital signature is the signature result of the above content by the sender's private key.

[0144] The sending end edge router sends synchronization messages to other edge routers within the same administrative domain using a pre-configured secure channel, such as an IPsec VPN channel or a TLS encrypted connection. The establishment of the secure channel adopts a two-way authentication mechanism to ensure the authenticity of the identities of both parties. The encryption strength of the secure channel is not less than AES-256, ensuring the confidentiality of data transmission.

[0145] To achieve orderly distribution, the sending end edge router maintains a sending queue, which arranges messages in chronological order according to the generation time of the synchronization messages. The messages in the queue are sent in turn according to the FIFO (First-In-First-Out) principle. When the network is congested or temporarily disconnected, the sending end will retransmit the failed messages, with a maximum of 3 retransmissions and retransmission intervals of 1 second, 2 seconds and 4 seconds respectively.

[0146] Upon receiving the synchronization message, the receiving end edge router first performs integrity verification to verify the validity of the digital signature of the message. The integrity verification includes: verifying the digital signature using the sender's public key, checking whether the message content has been tampered with, and confirming whether the message comes from a trusted sender. If the integrity verification fails, the receiving end will immediately discard the message and record a security alert log.

[0147] After the integrity verification is passed, the receiving end performs version arbitration. The version arbitration adopts a two-level sorting mechanism of version number and timestamp: first, compare the version numbers, and the message with a higher version number has higher priority; when the version numbers are the same, compare the timestamps, and the message with a newer timestamp has higher priority. The receiving end maintains a current highest version number and the corresponding timestamp.

[0148] When a new synchronization message is received, the receiving end compares the version number of the message with the current highest version number recorded. If the version number of the new message is higher, the message is accepted and the recorded highest version number and timestamp are updated; if the version number of the new message is the same but the timestamp is updated, the message is also accepted and the recorded timestamp is updated; if the version number of the new message is lower than the current highest version number recorded, or the version numbers are the same but the timestamp is earlier, it is determined as an old version or a repeated version, and the message is discarded directly.

[0149] For example, the highest version number currently recorded by the receiving end is 25, and the corresponding timestamp is "2023-05-20T15:30:25.123Z". If a message with version number 26 and timestamp "2023-05-20T15:31:00.456Z" is received, the message is accepted; if a message with version number 25 and timestamp "2023-05-20T15:30:30.789Z" is received, the message is accepted and the timestamp is updated; if a message with version number 24 or version number 25 but with an earlier timestamp than the currently recorded message is received, the message is discarded.

[0150] After accepting the new synchronization message, the receiving end extracts the path selection result data therein and updates the local routing table. The update operation is performed in an atomic manner to ensure the consistency of the routing table. After the update is completed, the receiving end returns an acknowledgement message to the sending end, including the received version number and timestamp, so that the sending end can confirm the synchronization status.

[0151] To improve system reliability, the receiving end also implements a timeout detection mechanism. If a new synchronization message from a specific sending end is not received within a predefined time window (default 60 seconds), the receiving end sends a status query message to the sending end to request the latest path selection result. This helps to quickly synchronize the latest status after temporary network failure recovery.

[0152] Through the above mechanisms, the edge routers within the same management domain can safely and orderly synchronize the path selection results, ensuring the consistency and reliability of network routing, and improving network performance and stability.

[0153] The second aspect of the embodiment of the application provides an IPv6-based multi-network fusion intelligent addressing and routing optimization system, comprising:

[0154] The first unit is configured to construct a time-sequenced path feature sequence based on the acquired topology state information and link quality measurement data.

[0155] The second unit is configured to perform normalization and dimensionality reduction processing on the time-sequenced path feature sequence without changing the IPv6 header structure, and generate a comparable path quality vector indexed by the destination prefix; perform candidate path screening based on the path quality vector, calculate path scores, and perform hop-by-hop reachability verification on the top N candidate paths according to the scores, wherein the hop-by-hop reachability verification is achieved by sending a survival probe message and a neighbor reachability confirmation message, and if any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in, thereby generating a routing and forwarding strategy corresponding to the destination prefix.

[0156] The third unit is configured to perform destination address reachability enhancement processing on the end-to-end path crossing the multi-domain network, set a route expansion header of a limited length for the target packet within the scope of IPv6 expansion header semantics, and specify a verified intermediate forwarding node to obtain a path selection result.

[0157] The fourth unit is configured to synchronize the path selection result to edge routers in the same administrative domain through a secure channel.

[0158] In a third aspect, the present application provides an electronic device, comprising:

[0159] a processor;

[0160] a memory for storing processor-executable instructions;

[0161] The processor is configured to invoke the instructions stored in the memory to perform the method described above.

[0162] In a fourth aspect, the present application provides a computer-readable storage medium having stored thereon computer program instructions, which, when executed by a processor, implement the method described above.

[0163] The present application can be a method, apparatus, system and / or computer program product. The computer program product can include a computer-readable storage medium having stored thereon computer-readable program instructions that, when executed by a computer, cause the computer to carry out various aspects of the present application.

[0164] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for intelligent addressing and route optimization in multi-network convergence based on IPv6, characterized in that, The method comprises the following steps: Based on the acquired topology state information and link quality measurement data, a time-sequenced path feature sequence oriented to a destination prefix is constructed, which comprises: The topology state information comprises IPv6 prefixes, link layer identifiers, and hop counts of forwarding paths of each access network; and the link quality measurement data comprises round-trip delay, instantaneous bandwidth, packet loss rate, and path instability event count; Without changing the IPv6 header structure, the time-sequenced path feature sequence is normalized and dimensionally reduced, and a comparable path quality vector is generated with the destination prefix as an index; based on the path quality vector, candidate paths are screened, path scores are calculated, and the candidate paths with top N scores are subjected to hop-by-hop reachability verification, which comprises: For each candidate path corresponding to the same destination prefix, a dimensionless sub-score is calculated according to the path quality vector, and a comprehensive path score is formed by taking the reachability historical stability as a weighting factor; wherein the reachability historical stability is calculated by the round-trip time fluctuation range of the survival probe packet and the neighbor reachability confirmation success rate in a plurality of continuous detection periods; In the hop-by-hop reachability verification of the candidate paths with top N comprehensive path scores, a probe packet hierarchical scheduling mechanism is adopted, survival probe packets for link activity detection are sent first, and then, after successfully receiving the corresponding responses, neighbor reachability confirmation packets for adjacency state confirmation are sent; When any intermediate forwarding node does not return a correct response within a preset response time, or returns a response with a time delay that increases by more than a preset jitter threshold compared with the previous detection period, the candidate path is marked as unstable and removed, and the next candidate path corresponding to the destination prefix is sequentially filled in the vacancy until the quantity constraint of the path is met; The hop-by-hop reachability verification is implemented by sending survival probe packets and neighbor reachability confirmation packets, and if any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in the vacancy, thereby generating a routing and forwarding strategy corresponding to the destination prefix; The destination address reachability enhancement processing is performed on an end-to-end path crossing a multi-domain network, within the scope of conforming to the semantics of the IPv6 extension header, a route extension header with a limited length is set for the target packet, and the verified intermediate forwarding nodes are specified to obtain the path selection result; The path selection result is synchronized to the edge routers in the same management domain through a secure channel.

2. The method of claim 1, wherein, The method for generating a routing and forwarding strategy corresponding to the destination prefix comprises: For each candidate path that passes the hop-by-hop reachability verification, an atomized rule containing only a determined matching item and a determined action item is generated, the determined matching item is composed of an entry interface identifier, field values corresponding to a destination prefix and a traffic classification condition, and a priority label, and the determined action item is composed of an exit interface selection, a forwarding table item index, and a queuing queue identifier; When there are multiple atomized rules related to the same destination prefix, linearization of the rules is performed according to the numerical order of the strategy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that any input packet is hit by only a single atomized rule. The coverage verification fingerprint is calculated for each atomized rule and compared with the current effective fingerprint, and when overlap in coverage or action conflict is detected, the rules are retreated in order from low to high priority until the conflict is eliminated; For each atomized rule corresponding to the destination prefix, a minimum effective time window and a maximum migration frequency are set, and when the minimum effective time window is not reached, priority change is prohibited, and when the maximum migration frequency is reached, subsequent priority adjustment is delayed to the next detection period.

3. The method of claim 2, wherein, The rules are linearized according to the numerical order of the policy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that only a single atomized rule is hit when any input packet arrives, including: The rules are linearized according to the numerical order of the policy priority, and interval de-overlapping processing is performed on the matching fields of adjacent rules to ensure that only a single atomized rule is hit when any input packet arrives, including: In each detection period, the ingress interface identifier of the randomly selected arriving packet is matched twice independently, the first time is matched in linear order, and the second time is verified by mathematical intersection using the normalized interval set, and when the results of the two matches are inconsistent, the rules with priority lower than the preset filtering threshold are suspended, and the interval de-overlapping processing is re-executed.

4. The method of claim 1, wherein, Within the scope of conforming to the semantics of the IPv6 extension header, a route extension header with a limited length is set for the target packet, and the verified intermediate forwarding nodes are specified to obtain the path selection result, including: The limited length is composed of the first several nodes selected in order from low to high end-to-end delay in the set of verified intermediate forwarding nodes corresponding to the destination prefix, ensuring that the forwarding path is explicitly constrained in the cross-domain segment; Topology consistency confirmation and policy conflict detection are performed in turn for the verified intermediate forwarding nodes, the topology consistency confirmation is used to verify that the link between the intermediate forwarding node and its adjacent nodes before and after it is in a reachable state, and the policy conflict detection is used to compare whether the actions of the atomized rules for the same destination prefix conflict with the order requirement of the route extension header; when an action conflict is detected, the effectiveness of the corresponding atomized rule is suspended in order from low to high priority until the conflict is eliminated, and the path selection result is obtained.

5. The method of claim 1, wherein, Synchronizing the path selection result to the edge routers in the same management domain through a secure channel includes: Based on the path selection result, the synchronization messages are sequentially distributed through the secure channel according to the arrival time order and version number, and the receiving end edge router performs integrity verification and version arbitration after receiving the synchronization message, the version arbitration is based on the secondary sorting of version number and timestamp, and when an old version or a repeated version is detected, the synchronization message is discarded.

6. An IPv6-based multi-network converged intelligent addressing and routing optimization system for implementing the method of any one of claims 1-5, characterized in that, It includes: A first unit configured to construct a time-ordered path feature sequence for a destination prefix based on the acquired topology state information and link quality measurement data; A second unit configured to perform a path selection on the time-ordered path feature sequence to obtain a path selection result. The second unit is configured to normalize and reduce the dimension of the time-sequenced path characteristic sequence without changing the IPv6 header structure, and generate a comparable path quality vector indexed by a destination prefix; perform candidate path screening based on the path quality vector, calculate a path score, and perform hop-by-hop reachability verification on candidate paths with top N scores, wherein the hop-by-hop reachability verification is achieved by sending a survival probe packet and a neighbor reachability confirmation packet, and if any hop is unreachable, the corresponding candidate path is removed and the next path is selected to fill in, thereby generating a routing and forwarding strategy corresponding to the destination prefix. The third unit is configured to perform destination address reachability enhancement processing on an end-to-end path crossing a multi-domain network, set a route extension header with a limited length for a target packet within the scope of an IPv6 extension header semantic, and specify a verified intermediate forwarding node to obtain a path selection result. The fourth unit is configured to synchronize the path selection result to edge routers in the same management domain through a secure channel.

7. An electronic device, comprising: The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 5. The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 5. ​ ​ 8. A computer-readable storage medium having stored thereon computer program instructions, wherein, ​

Images