Authorization management method and system for SDN (Software Defined Network) software

Abstract

The invention provides an authorization management method and system for SDN (Software Defined Network) software. Comprising the following steps: acquiring a user authorization request of SDN software, and verifying the legality of a user identity; collecting multi-dimensional parameters, wherein the multi-dimensional parameters comprise a real-time load of an SDN controller, a slice service priority, an edge node credibility level, an edge node computing power and a slice service time delay demand; dynamically calculating an authorization resource quota, an authorization credible threshold value and authorization timeliness based on the multi-dimensional parameters; judging whether the current credible value of the edge node is not lower than the authorization credible threshold, if so, executing authorization and allocating the authorization resource quota, and setting the authorization time efficiency; and the authorization execution state is monitored in real time, and if the variable quantity of any parameter in the multi-dimensional parameters exceeds a preset threshold value, safe and stable operation of the SDN network in the key field can be guaranteed.

Description

Technical Field

[0001] This invention relates to the field of SDN software technology, and more specifically to an SDN software licensing management method and system. Background Technology

[0002] With the widespread application of software-defined networks (SDNs) in critical areas such as energy dispatching and industrial control, SDN software authorization management has become a core element in ensuring the secure allocation of network resources and the stable operation of services. Currently, existing SDN software authorization management solutions generally adopt static authorization mechanisms. Their core logic revolves around verifying the legitimacy of user identities, assigning fixed permissions through preset user roles or device IDs. The authorization process only verifies identity and does not further correlate with the dynamic operational parameters of the SDN network. However, this type of static authorization scheme has significant technical flaws: it fails to incorporate key dynamic parameters such as the real-time load of the SDN controller, the trust level of edge nodes, and the latency requirements of slice services into the authorization decision-making system. Furthermore, after the authorization command is issued, it does not monitor changes in these parameters in real time, nor can it trigger the recalculation of authorized resource quotas, trust thresholds, or timeliness based on parameter changes. This deficiency leads to frequent problems in practical applications. For example, when the SDN controller is under high load, statically allocated authorized resources can easily cause controller response delays, and even lead to the interruption of low-latency critical services such as power dispatching. When the trust level of edge nodes decreases due to environmental interference or potential attacks, the static trust threshold cannot be adjusted in time, easily resulting in security vulnerabilities where low-trust nodes occupy high-priority slice resources. Therefore, the existing static authorization mechanism is no longer suitable for the dynamic operation characteristics of SDN networks.

[0003] Based on the above problems, there is an urgent need for a technical solution that can combine network dynamic parameters to realize real-time adjustment of authorization decisions, so as to solve the problem of mismatch between static authorization and the dynamic operation requirements of SDN, and ensure the secure and stable operation of SDN networks in critical areas. Summary of the Invention

[0004] The purpose of this invention is to provide a method for licensing management of SDN software, comprising: Obtain user authorization requests from SDN software and verify the legitimacy of user identities; Collect multi-dimensional parameters, including the real-time load of the SDN controller, the priority of slice services, the trust level of edge nodes, the computing power of edge nodes, and the latency requirements of slice services; Based on the aforementioned multi-dimensional parameters, the authorized resource quota, authorized trust threshold, and authorization validity period are dynamically calculated. Determine whether the current trust value of the edge node is not lower than the authorized trust threshold. If so, execute the authorization and allocate the authorized resource quota, and set the authorization time limit. The authorization execution status is monitored in real time. If the change of any parameter among the multi-dimensional parameters exceeds a preset threshold, which is 20% of the historical average value of the parameter in the past 24 hours, the authorization resource quota, authorization trust threshold and authorization time limit are recalculated and the authorization instruction is updated.

[0005] Preferably, in the step of collecting multi-dimensional parameters, the real-time load of the SDN controller includes the controller CPU utilization and flow table distribution latency; the slice service priority includes the priority level corresponding to the slice service type and the slice service quality requirements; the slice service quality requirements include service bandwidth, latency jitter and packet loss rate requirements; the edge node trust level includes node firmware verification results, number of abnormal port accesses and electromagnetic radiation intensity; the edge node computing power includes the node basic packet forwarding rate and current packet forwarding volume; and the slice service latency requirements include the maximum allowable latency value for service transmission as specified in the slice service level agreement.

[0006] More preferably, the step of collecting multi-dimensional parameters uses a sliding window algorithm to calculate the real-time load of the SDN controller. The period of the sliding window is 10 collection cycles, and each collection cycle is 100ms. The real-time load is calculated as the sum of CPU utilization multiplied by 0.6 and the ratio of flow table delivery delay to the maximum flow table delay multiplied by 0.4. The maximum flow table delay is set to 200ms, which is determined based on the test results of the flow table delivery capability of the SDN controller when running at full load.

[0007] More preferably, the edge node trust level is calculated by setting the initial trust value to 1, which corresponds to the trust status when the edge node firmware verification is passed and there are no abnormal port access records, minus the number of abnormal port accesses multiplied by 0.2, and then minus the ratio of electromagnetic radiation intensity to radiation threshold multiplied by 0.1. When the node firmware verification result is inconsistent, the edge node trust level is directly set to 0.3, and the radiation threshold is the upper limit of electromagnetic radiation under normal working conditions of the edge node.

[0008] More preferably, the formula for dynamically calculating the authorized resource quota is: Where Q is the authorized resource quota, in Mpps; C is the basic computing power of the edge node, in Mpps; γ is the edge node computing power utilization rate, with a value range of 0 < γ ≤ 1; L is the real-time load of the SDN controller, with a value range of 0 < L ≤ 1; Lmax is the maximum load threshold of the SDN controller, fixed at 1; β is the slice priority weight, with β = 1.2 for high-priority slices, β = 1.0 for medium-priority slices, and β = 0.8 for low-priority slices; P is the slice service priority, with a value range of 1 to 10; ΔQ is the resource quota compensation amount, in Mpps, with a default value of 0.5. The historical average authorized resource quota is expressed in Mpps; Qhist is the previous authorized resource quota, also expressed in Mpps; e is the natural constant, with a value of 2.718.

[0009] More preferably, the formula for dynamically calculating the authorized trust threshold is: Where T is the authorized trust threshold, with a value range of 0 < T ≤ 1.5; K is the trust level of the edge node, with a value range of 0 < K ≤ 1; δ is the trust decay coefficient, with a value range of 0.8 < δ < 0.99; t is the online duration of the edge node, in hours; ε is the quota security weight, with a value range of 0.7 < ε < 1.0; Q is the authorized resource quota, in Mpps; ζ is the security requirement coefficient, with high security requirement ζ = 1.5, medium security requirement ζ = 1.0, and low security requirement ζ = 0.8; S is the slice security requirement level, with a value range of 1 to 5; P is the slice service priority, with a value range of 1 to 10; P min The lowest slice service priority is fixed at 1; log 10 It is a logarithmic function with base 10.

[0010] More preferably, the formula for dynamically calculating the authorization period is: ; Among them, T val The authorization validity period is expressed in hours (h); T is the authorization trust threshold, with a value range of 0 < T ≤ 1.5; T max The maximum authorized trusted threshold is fixed at 1.5; η is the timeliness adjustment coefficient, with a default value of 24, in hours (h); θ is the load latency weight, with a value range of 0.6 < θ < 0.8; L is the real-time load of the SDN controller, with a value range of 0 < L ≤ 1; λ is the latency requirement coefficient, with a value range of 0.3 < λ < 0.5; D is the latency requirement of the slice service, in milliseconds (ms); T min The minimum authorized validity period is fixed at 1, and the unit is h; γ is the edge node computing power utilization rate, and the value range is 0 < γ ≤ 1.

[0011] A system for implementing the authorization management method of SDN software as described in claim 1, applied to the authorization management method of SDN software as described in any one of the above claims, includes: a user authentication module, a parameter acquisition module, a dynamic calculation module, an authorization execution module, and a feedback adjustment module. The parameter acquisition module includes a load acquisition unit, a priority resolution unit, a trust assessment unit, a computing power awareness unit, and a latency resolution unit. The load acquisition unit is connected to the SDN controller via an SPI bus and is used to acquire the CPU utilization and flow table distribution latency of the SDN controller. The priority resolution unit is connected to the SDN slice management system via Ethernet and is used to obtain the slice service type and slice service quality requirements. The trust assessment unit performs hash value calculation on the binary file of the edge node firmware and compares it with a preset hash value, while simultaneously counting the number of abnormal port accesses per unit time. The computing power awareness unit is connected to the edge node and is used to read the node's basic packet forwarding rate and current packet forwarding volume. The latency resolution unit extracts the maximum allowable latency value for slice service transmission by reading the slice service level protocol document.

[0012] Preferably, the dynamic computing module employs a multi-core processor, specifically a Hygon C86-7380. The first core of this processor runs an authorized resource quota calculation program, the second core runs an authorized trust threshold calculation program, the third core runs an authorized validity period calculation program, and the fourth core coordinates the calculation results of the three cores and generates authorization decision instructions. The dynamic computing module also connects to DDR4 memory via a DDR4 memory slot, with a memory capacity of at least 16GB. This capacity is determined based on the amount of multi-dimensional parameter data required for a single calculation and the caching requirements of intermediate results during the calculation process, and is used for temporary storage of multi-dimensional parameters and calculation process data. The dynamic computing module also integrates a gigabit Ethernet interface for data interaction with the parameter acquisition module and the authorization execution module.

[0013] Further preferably, the feedback adjustment module includes a status monitoring unit and a parameter optimization unit. The status monitoring unit is used to collect authorization execution status data, which includes SDN controller load changes, edge node trust level changes, and slice service latency requirement adjustments. The parameter optimization unit reads historical authorization data every morning, which includes authorization success rate, resource utilization rate, and number of security events, including unauthorized access attempts by edge nodes and abnormal occupation of authorized resources. The parameter optimization unit adjusts the priority weight β in the authorization resource quota calculation formula and the security requirement coefficient ζ in the authorization trust threshold calculation formula based on the historical authorization data. When the high-priority slice authorization success rate is lower than 95%, the priority weight β is increased by 0.1. When the number of security events exceeds 3 times per month, the security requirement coefficient ζ is increased by 0.2.

[0014] Compared with the prior art, the present invention has the following advantages: This invention dynamically calculates authorized resource quotas, trust thresholds, and expiration times by collecting multi-dimensional dynamic parameters such as real-time load of the SDN controller and trust level of edge nodes, and monitors parameter changes in real time to update authorizations. This technology precisely addresses the core problem in the background technology where static SDN authorization does not incorporate dynamic parameters and cannot be adjusted in real time. It avoids service interruptions and security vulnerabilities of low-trust nodes when the controller is under high load, ensuring the stability of critical services and improving the accuracy and security of authorization management. Attached Figure Description

[0015] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0016] Figure 1 This is a flowchart of the licensing management method for the SDN software of the present invention; Figure 2 This is a connection block diagram of the license management system of the SDN software of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] The concepts involved in this application will first be described with reference to the accompanying drawings. It should be noted that the following descriptions of various concepts are only for the purpose of making the content of this application easier to understand and do not constitute a limitation on the scope of protection of this application; furthermore, the embodiments and features in the embodiments of this application can be combined with each other unless otherwise specified. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] Traditional SDN software authorization management only verifies the legitimacy of user identity, without collecting multi-dimensional parameters such as controller load and slice priority. After authorization, changes in parameters do not trigger recalculation, leading to unreasonable resource allocation, high security risks, or business interruption.

[0020] Based on this, please refer to Figure 1 This embodiment provides a method for licensing management of SDN software, including: S1: Obtain user authorization requests from SDN software and verify the legitimacy of user identity; S2: Collect multi-dimensional parameters, including the real-time load of the SDN controller, the priority of slice services, the trust level of edge nodes, the computing power of edge nodes, and the latency requirements of slice services; S3: Based on the aforementioned multi-dimensional parameters, dynamically calculate the authorized resource quota, authorized trust threshold, and authorized validity period; S4: Determine whether the current trust value of the edge node is not lower than the authorized trust threshold. If so, execute the authorization and allocate the authorized resource quota, and set the authorization time limit. S5: Monitor the authorization execution status in real time. If the change of any parameter in the multi-dimensional parameters exceeds the preset threshold, which is 20% of the historical average value of the parameter in the past 24 hours, then recalculate the authorization resource quota, authorization trust threshold and authorization validity period and update the authorization instruction.

[0021] The technical solution revolves around dynamic authorization driven by multi-dimensional parameters. First, it clarifies the specific categories of these parameters, covering controller operating status, business attributes, and node status to ensure coverage of core influencing factors in authorization decisions. After parameter collection, permissions are not statically assigned; instead, three decision indicators—authorization resource quota, authorization trust threshold, and authorization timeliness—are dynamically calculated to form the foundational logic for data collection, calculation, and decision-making.

[0022] During the authorization execution phase, a trust value judgment mechanism is introduced, and authorization is only executed when the current trust value of the node meets the standard, thus ensuring security. At the same time, a real-time monitoring and update mechanism is designed, with a preset threshold set at 20% of the historical average value of the parameter over the past 24 hours. This setting avoids frequent recalculation due to small fluctuations in the parameter, while also responding promptly to significant changes, ensuring that the authorization status is always adapted to the current system environment.

[0023] This solution breaks away from the traditional static authorization model, achieving both precision and flexibility in authorization through parameter linkage and dynamic adjustment. The technical benefits include dynamically adapting to system changes, avoiding resource waste and security vulnerabilities, ensuring the stable operation of SDN services, and improving the accuracy and security of authorization management.

[0024] In the current SDN licensing parameter collection process, key parameters such as slice QoS requirements, SLA latency, and node trust level composition are vaguely defined, resulting in a lack of reliable data support for subsequent licensing calculations and affecting the accuracy of decision-making.

[0025] Based on this, in the step of collecting multi-dimensional parameters, the real-time load of the SDN controller includes the controller CPU utilization and flow table distribution latency; the slice service priority includes the priority level corresponding to the slice service type and the slice service quality requirements; the slice service quality requirements include service bandwidth, latency jitter and packet loss rate requirements; the edge node trust level includes node firmware verification results, number of abnormal port accesses and electromagnetic radiation intensity; the edge node computing power includes the node basic packet forwarding rate and current packet forwarding volume; and the slice service latency requirements include the maximum allowable latency value for service transmission as specified in the slice service level agreement.

[0026] The technical solution focuses on the refinement and clarification of parameter collection. For the multi-dimensional parameters mentioned in the above embodiments, each parameter is broken down and its specific composition is defined, resolving the issue of parameter ambiguity. For the real-time load of the SDN controller, it is clearly defined as CPU utilization and flow table distribution latency, which together constitute the core indicators of the controller's operating status. For slice service priorities, it not only includes level classification but also supplements slice service quality requirements, refining QoS requirements into service bandwidth, latency jitter, and packet loss rate, covering the key performance requirements for service operation. Regarding the trust level of edge nodes, it is clearly defined as consisting of three parts: node firmware verification results, number of abnormal port accesses, and electromagnetic radiation intensity, assessing node trustworthiness from three dimensions: hardware integrity, access security, and environmental adaptability. Edge node computing power is defined as the basic packet forwarding rate and the current packet forwarding volume; the difference between the two can be used to calculate idle computing power, providing a basis for resource quota allocation. Slice service latency requirements are directly related to the slice service level protocol, clearly defined as the maximum allowable latency value for service transmission, ensuring that latency requirements meet the agreed service standards. By clearly defining the specific composition and definition of each parameter, accurate and reliable data input is provided for subsequent dynamic calculations, avoiding calculation deviations caused by parameter ambiguity. The technical effect is to achieve accurate collection of multi-dimensional parameters, provide reliable data support for authorization decisions, reduce authorization deviations caused by parameter ambiguity, and improve the accuracy of authorization calculations.

[0027] Existing SDN controllers use a single load calculation method, do not employ a sliding window algorithm, and have unreasonable data collection cycles and load calculation weights. This results in load values ​​failing to accurately reflect the controller's true operating status and affecting the accuracy of authorized resource quota calculations.

[0028] Based on this, the step of collecting multi-dimensional parameters adopts a sliding window algorithm to calculate the real-time load of the SDN controller. The period of the sliding window is 10 collection cycles, and each collection cycle is 100ms. The real-time load is calculated by multiplying the CPU utilization by 0.6 and the ratio of the flow table delivery delay to the maximum flow table delay by 0.4. The maximum flow table delay is set to 200ms, which is determined based on the test results of the SDN controller's flow table delivery capability when running at full load.

[0029] The technical solution revolves around the design of accurate real-time load calculation for the controller, with the core employing a sliding window algorithm to improve the stability and accuracy of load calculation. First, the specific parameters of the sliding window are defined: the period is set to 10 acquisition cycles, each acquisition cycle is 100ms, and the total window duration is 1s. This setting ensures real-time performance while smoothing out instantaneous fluctuations through multiple periods of data.

[0030] In terms of load calculation, a weighted summation logic is adopted, with CPU utilization weighted at 0.6 and flow table delivery latency weighted at 0.4. This weight allocation is based on the controller's operating characteristics—CPU utilization directly reflects the consumption of computing resources and has a greater impact on authorization processing speed, hence it is given a higher weight; the flow table delivery latency ratio is calculated by the ratio of flow table delivery latency to the maximum flow table latency, where the maximum flow table latency is set to 200ms. This value is not arbitrarily set, but is derived from flow table delivery capability tests under full load operation of the SDN controller, ensuring that the ratio can truly reflect the busy level of flow table forwarding.

[0031] For example, when the flow table distribution latency is 100ms, the proportion is 0.5, corresponding to a contribution value of 0.2 under a weight of 0.4. Together with CPU utilization, this constitutes a total load of 0.8, accurately reflecting the controller's operational status in both computation and forwarding dimensions. The entire calculation process has clearly defined parameters and logical flow, ensuring that the real-time load value accurately maps to the controller's true load level.

[0032] The technical effect is to accurately calculate the real-time load of the controller, smooth out instantaneous fluctuations, and truly reflect the operating status of the controller, providing an accurate basis for the calculation of authorized resource quotas and improving the rationality of quota allocation.

[0033] The existing edge node trust level calculation lacks clear initial values ​​and anomaly handling rules, and the radiation threshold is undefined, resulting in inconsistent trust level assessment standards, inaccurate results, and an inability to effectively distinguish the trust status of nodes.

[0034] Based on this, the edge node trust level is calculated by setting the initial trust value to 1, which corresponds to the trust status when the edge node firmware verification is passed and there are no abnormal port access records. Then, the number of abnormal port accesses is subtracted by 0.2, and the ratio of electromagnetic radiation intensity to radiation threshold is subtracted by 0.1. When the node firmware verification result is inconsistent, the edge node trust level is directly set to 0.3. The radiation threshold is the upper limit of electromagnetic radiation under normal working conditions of the edge node.

[0035] The technical solution revolves around the quantification and accurate assessment of the trust level of edge nodes, constructing a complete trust level calculation system. First, an initial trust value of 1 is set, clearly defining the applicable scenario for this value—edge node firmware verification is passed and there are no abnormal port access records, providing a benchmark reference for the trust level. In terms of level decay logic, a multi-factor deduction method is adopted: for each additional abnormal port access, the trust level is deducted by 0.2. This deduction magnitude is based on the risk level of abnormal port access—a single abnormal access already poses a security risk, hence it is given a larger deduction weight. Electromagnetic radiation intensity is deducted by the ratio to a radiation threshold; for every increase of 1 in the ratio, 0.1 is deducted. The radiation threshold is defined as the upper limit of electromagnetic radiation under normal operating conditions of the edge node, ensuring that the ratio reflects the impact of environmental interference on node stability.

[0036] Meanwhile, for severe abnormal scenarios, a mandatory trust level of 0.3 is set. This value is lower than the threshold required for normal authorization, ensuring that such high-risk nodes cannot obtain high quota authorization.

[0037] The entire calculation process has clear rules and well-defined anomaly handling, enabling quantitative assessment of the reliability level and risk classification.

[0038] The technical effect is to quantify the trust level of edge nodes, clarify the rules for handling anomalies, unify the evaluation standards, accurately distinguish the trust status of nodes, and provide a reliable basis for determining the authorized trust threshold.

[0039] The existing authorized resource quota calculation does not link edge node computing power, controller load, and slice priority, and there is no historical deviation compensation mechanism, resulting in a mismatch between quotas and actual needs, leading to either resource waste or insufficient business resources.

[0040] Based on this, the formula for dynamically calculating authorized resource quotas is: ; Where Q is the authorized resource quota, in Mpps; C is the basic computing power of the edge node, in Mpps, which is the maximum packet processing rate of the edge node when there is no load; γ is the edge node computing power utilization rate, with a value range of 0 < γ ≤ 1, which is the ratio of the node's idle computing power to its basic computing power; L is the real-time load of the SDN controller, with a value range of 0 < L ≤ 1, which is calculated by weighting the CPU utilization rate and the flow table issuance delay; L maxβ is the maximum load threshold for the SDN controller, fixed at 1, corresponding to the controller's full-load operation state; β is the slice priority weight, with high-priority slices β=1.2, medium-priority slices β=1.0, and low-priority slices β=0.8, set based on the slice service's sensitivity to latency; P is the slice service priority, ranging from 1 to 10, with larger values ​​indicating higher service importance; ΔQ is the resource quota compensation amount, in Mpps, with a default value of 0.5, used to correct the deviation between historical quotas and actual demand; The historical average authorized resource quota, in Mpps, represents the arithmetic average of the authorized resource quota over the past 7 days; Q hist The last authorized resource quota is expressed in Mpps; e is a natural constant with a value of approximately 2.718.

[0041] This embodiment calculates authorized resource quotas through multi-factor linkage, with the formula logic progressing layer by layer, covering four core influencing factors: computing power, load, priority, and historical deviation.

[0042] Formula Part 1 The idle computing power of edge nodes is calculated, where C is the node's maximum processing capacity and γ is the idle percentage. The product of the two directly reflects the amount of basic resources that the node can allocate.

[0043] Part Two This is the controller load adjustment factor. When the controller load L increases, this factor decreases. It amplifies the impact of the load on the quota through a square relationship, avoiding over-allocation of resources under high load. Part Three The slice priority adjustment factor is β, which is set according to the service latency sensitivity, and P is the service importance. The square root of the product of the two is then used. This allows for a reasonable enhancement of quotas based on priority, ensuring that high-priority services receive more resources.

[0044] Formula Part 4 This is the historical deviation compensation term, with ΔQ as the basic compensation amount and the exponential part being the deviation attenuation factor. When the historical average quota... Compared to the previous quota Q hist When the deviation is small, such as 5 / 80 = 0.0625, the factor is close to 1, and the compensation amount is close to 0.47 Mpps, correcting historical deviations. When the deviation is large, the factor decreases to avoid overcompensation. The entire formula achieves accurate matching between quotas and node capabilities, system load, business needs, and historical data through multi-factor collaboration.

[0045] The technical effect is to dynamically generate authorized resource quotas that match actual needs, avoiding resource waste and insufficient business resources, and improving SDN resource utilization and business operation stability.

[0046] The existing authorized trust threshold settings are not associated with authorized resource quotas, node online duration, and slice security requirements, resulting in a mismatch between the threshold and security risks. Low-trust nodes may obtain high quota authorizations, posing a security risk.

[0047] Based on this, the formula for dynamically calculating the authorized trust threshold is: ; Wherein, T is the authorized trust threshold, ranging from 0 to 1.5, with a larger value indicating a higher trust level required for authorization; K is the edge node trust level, ranging from 0 to 1, determined by the node firmware integrity, port access status, and environmental interference; δ is the trust decay coefficient, ranging from 0.8 to 0.99, with a larger value indicating a slower decay of the trust level with online duration; t is the edge node online duration, in hours; ε is the quota security weight, ranging from 0.7 to 1.0, with a larger weight for higher authorized resource quotas; Q is the authorized resource quota, in Mpps; ζ is the security requirement coefficient, with high security requirement ζ=1.5, medium security requirement ζ=1.0, and low security requirement ζ=0.8, set based on the confidentiality of slice business data; S is the slice security requirement level, ranging from 1 to 5, with a larger value indicating higher security protection requirements; P is the slice business priority, ranging from 1 to 10, consistent with the definition in claim 5; P min The lowest slice service priority is fixed at 1; log 10 It is a logarithmic function with base 10.

[0048] The technical solution constructs a security risk-driven authorized trust threshold calculation system through an original formula. The formula is divided into two parts, which are respectively related to node status and business security requirements.

[0049] Part One Focusing on the security relationship between nodes and quotas: K represents the current trust level of the node, which is the basis for threshold calculation; Let be the reliable attenuation factor, t be the online duration, and when δ = 0.95, the factor is: This demonstrates that the longer a node remains online, the more significant the decay in its trust level becomes. As the quota safety factor, ε increases with increasing Q. For example, when Q = 82.3 Mpps, ε = 0.9. The cube root of the product of Q and Q is also considered. By using a cubic relationship, the impact of quotas on thresholds is mitigated, thus preventing small changes in quotas from causing drastic fluctuations in thresholds.

[0050] Part Two Focusing on business security requirements: ζ is set according to data confidentiality, with high confidentiality ζ=1.5, S being the security level, P being the priority, and log... 10 (1 + 10 / 1) = log10 11≈1.04, the product of the three, 1.5×5×1.04=7.8, reflects the enhancing effect of business security requirements on the threshold.

[0051] The two parts are added together to obtain the final threshold T, which achieves a precise match between the threshold and the node's trust status, quota risk, and business security.

[0052] The technical effect is to accurately match the threshold with the security risk, prevent low-trust nodes from obtaining high quota authorization, reduce security risks, and improve the security and rationality of SDN authorization.

[0053] The current authorization validity period is set statically and is not associated with authorization trust thresholds, controller load, or slice latency requirements. This results in security risks if the validity period is too long, and resource consumption due to frequent re-authorization if the validity period is too short.

[0054] Based on this, the formula for dynamically calculating the authorization validity period is: ; Among them, T val The authorization validity period is expressed in hours (h); T is the authorization trust threshold, with a value range of 0 < T ≤ 1.5; T max The maximum authorized trust threshold is fixed at 1.5, corresponding to the highest security level authorization requirements; η is the timeliness adjustment coefficient, with a default value of 24, in hours, used to control the basic range of authorization timeliness; θ is the load delay weight, with a value range of 0.6 < θ < 0.8, reflecting the degree of influence of controller load on authorization timeliness; L is the real-time load of the SDN controller, with a value range of 0 < L ≤ 1; λ is the delay requirement coefficient, with a value range of 0.3 < λ < 0.5, the larger the coefficient is for more stringent delay requirements of slice services; D is the delay requirement of slice services, in milliseconds; T min The minimum authorization validity period is fixed at 1, with the unit being h, to avoid resource consumption caused by frequent re-issuance of authorizations; γ is the edge node computing power utilization rate, with a value range of 0 < γ ≤ 1.

[0055] The technical solution uses an original formula to achieve authorization timeliness calculation that is adaptable to multiple scenarios. The formula logic revolves around the balance between security and efficiency, and is divided into two parts: basic timeliness calculation and minimum timeliness compensation.

[0056] Part One Based on the time limit: This is a confidence threshold adjustment factor. The higher the value of T, the closer this factor is to 1, reflecting that high-confidence nodes can achieve a longer base time. The denominator is... For load and latency demand adjustment, it contributes 0.42 when θ=0.7 and L=0.6, and 0.5×(1 / 50)=0.01 when λ=0.5 and D=50ms. The total denominator is 0.43. When η=24, this part is 0.88×(24 / 0.43)≈0.88×55.81≈49.11h. This means that when the controller is under high load or the service latency is severe, the denominator increases and the basic timeliness is shortened.

[0057] Part Two To minimize time-sensitive compensation, When =1h and γ=0.8, the compensated result is: 1 × (1 + 0.4) = 1.4 h, ensuring that even if the base time limit is too short, the time limit will not be less than 1 hour, avoiding frequent re-authorization that consumes resources. The two parts are added together to obtain the final time limit. This achieves a balance between timeliness and security, efficiency, and business needs. The technical effect is to adapt timeliness to security, load, and business requirements, avoid security risks and resource consumption, and balance authorization security with SDN system operating efficiency.

[0058] The existing SDN licensing system modules lack specific hardware implementation solutions, and the connection methods and functional implementations between modules are vague, making it impossible to implement the system and resulting in low reliability of parameter acquisition.

[0059] Based on this, please refer to Figure 2 This embodiment provides a system for SDN software authorization management, including a user authentication module, a parameter acquisition module, a dynamic calculation module, an authorization execution module, and a feedback adjustment module. The parameter acquisition module includes a load acquisition unit, a priority resolution unit, a trust assessment unit, a computing power perception unit, and a latency resolution unit. The load acquisition unit uses an FPGA-based signal acquisition chip, model XC7K325T, which is connected to the SDN controller via an SPI bus to acquire the CPU utilization and flow table distribution latency of the SDN controller. The priority resolution unit communicates with the SDN slice management system via Ethernet to obtain the slice service type and slice service quality requirements. The trust assessment unit has a built-in SHA256 hash verification circuit, which calculates the hash value of the binary file of the edge node firmware and compares it with a preset hash value, while also counting the number of abnormal port accesses per unit time. The computing power perception unit is connected to the edge node via a PCIe 3.0 bus to read the node's basic packet forwarding rate and current packet forwarding volume. The basic packet forwarding rate is the maximum packet processing rate of the edge node when there is no load. The latency resolution unit extracts the maximum allowable latency value for slice service transmission by reading the slice service level agreement document.

[0060] The technical solution focuses on the hardware implementation of the system and the precise realization of module functions. With the parameter acquisition module as the core, it clarifies the hardware selection, connection method and functional implementation details of each unit to ensure that the system can be implemented and the data acquisition is reliable.

[0061] The load acquisition unit uses the XC7K325T FPGA chip, which has high-speed signal processing capabilities and is suitable for acquiring the CPU utilization of the controller and the latency of flow table distribution. It connects to the controller via the SPI bus, and the synchronous serial communication characteristics of the SPI bus ensure the real-time performance and stability of data transmission. The priority resolution unit uses Ethernet to connect to the SDN slice management system. The high bandwidth and versatility of Ethernet meet the transmission requirements of slice service types and QoS requirements, ensuring timely acquisition of service parameters. The trust assessment unit has a built-in SHA256 hash verification circuit, which realizes firmware hash value calculation through hardware, compares it with the preset hash value to determine firmware integrity, and counts the number of anomalies per unit time through port access logs to achieve hardware-level trust assessment. The computing power perception unit connects to the edge node via the PCIe 3.0 bus. The high transmission rate of PCIe 3.0 ensures that the basic packet forwarding rate and current packet forwarding volume of the node can be read quickly, providing accurate data for computing power utilization calculation. The latency resolution unit extracts the maximum allowable latency by reading the SLA document, clarifying the source and standard of latency requirements. The hardware selection of each unit is adapted to the functional requirements, and the connection method ensures reliable data transmission. Together, they realize the hardware-based and accurate acquisition of parameters, providing a stable data input foundation for the entire authorization system.

[0062] The technical benefits include a clear and feasible system hardware solution, reliable and accurate parameter collection, stable data input for authorization decisions, and improved feasibility and reliability of the SDN authorization system.

[0063] The existing dynamic computing module lacks specific processor selection, core division of labor, and memory configuration, resulting in low computing efficiency, poor data interaction, and inability to meet the real-time requirements of authorized computing.

[0064] Based on this, the dynamic computing module adopts a multi-core processor, model Hygon C86-7380. The first core of the multi-core processor runs the authorized resource quota calculation program, the second core runs the authorized trust threshold calculation program, the third core runs the authorized timeliness calculation program, and the fourth core coordinates the calculation results of the three cores and generates authorization decision instructions. The dynamic computing module also connects to DDR4 memory through a DDR4 memory slot, with a memory capacity of not less than 16GB. This capacity is determined based on the amount of multi-dimensional parameter data to be stored for a single calculation and the caching requirements of intermediate results during the calculation process, and is used for temporary storage of multi-dimensional parameters and calculation process data. The dynamic computing module also integrates a gigabit Ethernet interface for data interaction with the parameter acquisition module and the authorization execution module.

[0065] The technical solution revolves around the efficient and collaborative design of the dynamic computing module, ensuring real-time computing and smooth data interaction from four aspects: processor selection, core division of labor, memory configuration, and interface design.

[0066] The processor used is the Hygon C86-7380 multi-core processor, which features multi-core parallel processing capabilities, suitable for the multi-task parallel requirements in licensed computing. The cores have clearly defined roles: the first to third cores run the calculation programs for licensed resource quotas, trust thresholds, and timeliness, respectively, enabling parallel execution of these three core computing tasks. Compared to single-core serial computing, efficiency is improved by more than three times. The fourth core is specifically responsible for coordinating the calculation results, such as verifying the logical consistency of the three results and generating licensed decision instructions, avoiding task conflicts between cores and improving computational synergy. The memory configuration uses DDR4 memory with a capacity of no less than 16GB. This capacity is set based on actual computing needs. A single calculation requires storing multi-dimensional parameters, such as the trust level and computing power data of 100 nodes (approximately 50MB), and intermediate results during the calculation process, such as factor values ​​and intermediate products in formula calculations (approximately 100MB). 16GB of capacity can meet the caching needs of multiple rounds of calculation, avoiding computational interruptions due to insufficient memory. The memory is connected via DDR4 memory slots, ensuring convenient installation and expansion. The interface design integrates a gigabit Ethernet interface, whose transmission rate meets the data interaction requirements of the parameter acquisition module and the authorization execution module, ensuring that the data transmission latency is less than 10ms, which meets the real-time requirements of SDN authorization.

[0067] The entire module design adapts to computing needs through hardware selection, improves parallel efficiency through core division of labor, and ensures data storage and interaction through memory and interfaces, thereby achieving efficient, real-time, and stable dynamic computing.

[0068] The technical benefits include improving authorization computing efficiency and data interaction speed, meeting the real-time requirements of SDN authorization, ensuring rapid generation and execution of authorization decisions, and improving system operating efficiency.

[0069] The existing feedback adjustment module lacks specific collection cycles, historical data types, and parameter optimization rules, resulting in blind feedback adjustments and an inability to optimize authorization parameters based on system operating status, leading to poor authorization stability.

[0070] Based on this, the feedback adjustment module includes a status monitoring unit and a parameter optimization unit. The status monitoring unit collects authorization execution status data every hour. The collection period is determined based on the statistical characteristics of SDN controller load fluctuations. These statistical characteristics are obtained by analyzing controller load change data over the past 30 days. The authorization execution status data includes changes in SDN controller load, changes in edge node trust level, and adjustments to slice service latency requirements. The parameter optimization unit reads historical authorization data every morning. The historical authorization data includes authorization success rate, resource utilization rate, and the number of security events. The security events include unauthorized access attempts at edge nodes and abnormal occupation of authorized resources. The parameter optimization unit adjusts the priority weight β in the authorization resource quota calculation formula and the security requirement coefficient ζ in the authorization trust threshold calculation formula based on the historical authorization data. When the authorization success rate of high-priority slices is below 95%, the priority weight β is increased by 0.1. When the number of security events exceeds 3 times per month, the security requirement coefficient ζ is increased by 0.2.

[0071] The technical solution focuses on the precision and standardization of the feedback adjustment module. By clearly defining the collection cycle, data types, and optimization rules, it achieves dynamic optimization of authorization parameters and improves authorization stability. The collection cycle of the status monitoring unit is set to every 1 hour. This cycle is determined based on the statistical characteristics of SDN controller load fluctuations—analysis of the load data over the past 30 days revealed that significant changes in load fluctuations mostly occur within a period of more than 1 hour. A 1-hour collection cycle can promptly capture changes in load, trust level, and latency requirements while reducing resource consumption caused by excessively high collection frequencies. The data types collected are clearly defined as controller load changes, node trust level changes, and slice latency requirement adjustments, providing comprehensive status data for parameter optimization.

[0072] The parameter optimization unit performs optimizations daily in the early morning hours when SDN service load is low, ensuring that optimization operations do not affect service operation. Historical data includes authorization success rate, resource utilization, and security events. Security events are specifically defined as unauthorized access attempts and abnormal resource usage, ensuring accurate risk assessment. The optimization rules are specific: for the β parameter in the authorized resource quota formula, it is increased by 0.1 when the authorization success rate of high-priority slices is low, enhancing the impact of priority on quotas and improving the success rate; for the ζ parameter in the authorized trust threshold formula, it is increased by 0.2 when there are many security events, enhancing the impact of business security requirements on the threshold and improving security.

[0073] The entire feedback adjustment process is data-driven, with clear rules, achieving closed-loop optimization of authorization parameters.

[0074] The technical benefits include closed-loop optimization of authorization parameters, improved authorization adaptability and security, reduced authorization failures and security incidents, and ensured long-term stable operation of the SDN authorization system.

[0075] The embodiments and / or implementation methods described above are merely preferred embodiments and / or implementation methods for implementing the technology of the present invention, and are not intended to limit the implementation methods of the technology of the present invention in any way. Any person skilled in the art can make some modifications or alterations to other equivalent embodiments without departing from the scope of the technical means disclosed in the content of the present invention, but they should still be regarded as the technology or embodiments that are substantially the same as the present invention.

[0076] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. The above descriptions are only preferred embodiments of this application. It should be noted that due to the limitations of written expression, while there are objectively infinite specific structures, those skilled in the art can make several improvements, modifications, or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner. These improvements, modifications, changes, or combinations, or the direct application of the inventive concept and technical solution to other situations without modification, should all be considered within the scope of protection of this application.

Claims

1. A license management method of SDN software, characterized by, The application relates to a method for dynamically calculating and updating an authorized resource quota of an SDN (Software Defined Network) edge node. The method comprises the following steps: acquiring a user authorization request of SDN software, verifying the legitimacy of the user identity; collecting multi-dimensional parameters, wherein the multi-dimensional parameters comprise real-time load of an SDN controller, slice service priority, edge node trust level, edge node computing power and slice service delay requirement; dynamically calculating an authorized resource quota, an authorized trust threshold and an authorized time limit based on the multi-dimensional parameters; judging whether the current trust value of the edge node is not lower than the authorized trust threshold, and if yes, performing authorization and allocating the authorized resource quota, and setting the authorized time limit; and real-time monitoring of the authorization execution state, and if the change amount of any parameter in the multi-dimensional parameters exceeds a preset threshold, which is 20% of the historical average value of the parameter in the last 24 hours, the authorized resource quota, the authorized trust threshold and the authorized time limit are recalculated and the authorization instruction is updated. In the step of collecting multi-dimensional parameters, the real-time load of the SDN controller comprises controller CPU utilization rate and flow table issuing delay, the slice service priority comprises priority level corresponding to the slice service type and slice service quality requirement, the slice service quality requirement comprises service bandwidth, delay jitter and packet loss rate requirement, the edge node trust level comprises node firmware verification result, port abnormal access frequency and electromagnetic radiation intensity, the edge node computing power comprises node basic packet forwarding rate and current packet forwarding amount, and the slice service delay requirement comprises maximum allowed service transmission delay value in the slice service level agreement. In the step of collecting multi-dimensional parameters, the real-time load of the SDN controller is calculated by using a sliding window algorithm, the period of the sliding window is 10 collection periods, each collection period is 100 ms, the calculation mode of the real-time load is the sum of CPU utilization rate multiplied by 0.6 and the proportion of flow table issuing delay in the maximum flow table delay value multiplied by 0.4, the maximum flow table delay value is set as 200 ms, and the value is determined based on the flow table issuing capacity test result of the SDN controller under full load operation. The calculation mode of the edge node trust level is that an initial trust value is set as 1, which corresponds to the trust state of the edge node when the firmware verification is passed and there is no port abnormal access record, the initial trust value is reduced by the product of the port abnormal access frequency and 0.2, and then reduced by the product of the ratio of the electromagnetic radiation intensity to the radiation threshold value and 0.1, when the node firmware verification result is inconsistent, the edge node trust level is directly set as 0.3, and the radiation threshold value is the upper limit value of electromagnetic radiation under the normal working environment of the edge node. The formula for dynamically calculating the authorized resource quota is as follows: 2.The method of claim 1, wherein, The formula for dynamically calculating the authorized trust threshold is as follows: 3.The method of claim 1, wherein, The formula for dynamically calculating the authorized time limit is as follows: 4.The method of claim 1, wherein, ​ 5. The license management method of the SDN software according to claim 1, wherein, ​ ； Wherein, Q is the authorized resource quota, the unit is Mpps; C is the edge node basic computing power, the unit is Mpps; Gamma is the edge node computing power utilization rate, the value range is 0 < gamma <= 1; L is the real-time load of SDN controller, the value range is 0 < L <= 1; L max Is the maximum load threshold of SDN controller, fixed as 1; Beta is the slice priority weight, high priority slice beta = 1.2, medium priority slice beta = 1.0, low priority slice beta = 0.8; P is the slice service priority, the value range is 1 ~ 10; Delta Q is the resource quota compensation, the unit is Mpps, the default value is 0.5; Is the historical average authorized resource quota, the unit is Mpps; Q hist Is the last authorized resource quota, the unit is Mpps; E is the natural constant, the value is 2.

718.

6. The license management method of SDN software according to claim 1, wherein, ​ ； Wherein, T is the authorized trust threshold, the value range is 0 min T≤1.5; K is the edge node trust level, the value range is 0 min K≤1; δ is the trust attenuation coefficient, the value range is 0.8 min < δ < 0.99; t is the online duration of the edge node, the unit is h; ε is the quota security weight, the value range is 0.7 min < ε < 1.0; Q is the authorized resource quota, the unit is Mpps; ζ is the security demand coefficient, high security demand ζ = 1.5, medium security demand ζ = 1.0, low security demand ζ = 0.8; S is the slice security demand level, the value range is 1 ~ 5; P is the slice service priority, the value range is 1 ~ 10; P min is the lowest slice service priority, fixed as 1; log 10 is the logarithmic function with base 10.

7. The license management method of SDN software according to claim 1, wherein, ​ ； wherein, T val is the authorization time, with a unit of h; T is the authorization trust threshold, with a value range of 0 < T ≤ 1.5; T max is the maximum authorization trust threshold, fixed as 1.5; η is the time adjustment coefficient, with a default value of 24, with a unit of h; θ is the load delay weight, with a value range of 0.6 < θ < 0.8; L is the real-time load of the SDN controller, with a value range of 0 < L ≤ 1; λ is the delay demand coefficient, with a value range of 0.3 < λ < 0.5; D is the delay demand of the slice service, with a unit of ms; T min is the minimum authorization time, fixed as 1, with a unit of h; γ is the edge node computing power utilization rate, with a value range of 0 < γ ≤ 1.

8. A license management system of SDN software, applied to the license management method of SDN software according to any one of claims 1-7, comprising: The user identity authentication module, the parameter collection module, the dynamic calculation module, the authorized execution module and the feedback adjustment module are characterized in that the parameter collection module comprises a load collection unit, a priority analysis unit, a trust evaluation unit, a computing power sensing unit and a time delay analysis unit, the load collection unit is connected with the SDN controller through an SPI bus and is used to collect the CPU utilization rate and the flow table issuing time delay of the SDN controller; the priority analysis unit is in communication connection with the SDN slice management system through Ethernet and is used to obtain the slice service type and the slice service quality requirement; the trust evaluation unit internally calculates the hash value of the binary file of the edge node firmware and compares it with the preset hash value, and simultaneously counts the number of port abnormal access times in a unit time; the computing power sensing unit is connected with the edge node and is used to read the node basic packet forwarding rate and the current packet forwarding amount; the time delay analysis unit extracts the maximum allowed time delay value of the slice service transmission by reading the slice service level protocol document.

9. The license management system of claim 8, wherein, The dynamic calculation module adopts a multi-core processor, a first core of the multi-core processor runs an authorized resource quota calculation program, a second core runs an authorized trust threshold calculation program, a third core runs an authorized time limit calculation program, and a fourth core coordinates the calculation results of the three cores and generates an authorized decision instruction; The dynamic calculation module is also connected with a DDR4 memory through a DDR4 memory slot, the memory capacity is not less than 16 GB, the capacity is determined based on the multi-dimensional parameter data amount required for single calculation and the cache requirement of the intermediate results in the calculation process, and is used for temporarily storing multi-dimensional parameters and calculation process data; the dynamic calculation module is also integrated with a gigabit Ethernet interface, which is used for data interaction with the parameter collection module and the authorized execution module.

10. The license management system of claim 8, wherein, The feedback adjustment module comprises a state monitoring unit and a parameter optimization unit, the state monitoring unit is used to collect authorized execution state data, the authorized execution state data comprises the SDN controller load change amount, the edge node trust level change amount and the slice service time delay demand adjustment amount; the parameter optimization unit reads historical authorization data every morning, the historical authorization data comprises the authorization success rate, the resource utilization rate and the number of security events, the security events comprise unauthorized access attempts of the edge node and unauthorized resource abnormal occupation; The parameter optimization unit adjusts the priority weight β in the authorized resource quota calculation formula and the security demand coefficient ζ in the authorized trust threshold calculation formula according to the historical authorization data, when the authorization success rate of the high-priority slice is lower than 95%, the priority weight β is increased by 0.1, and when the number of security events is more than 3 times per month, the security demand coefficient ζ is increased by 0.2.

Images