Agent-based software defined networking method and device

Abstract

The invention relates to the technical field of network communication, in particular to a software-defined networking method and device based on agency, the initiative of connection is transferred to an agency node closer to a switch, the path and time of connection establishment are shortened, the method and device are especially suitable for scenes with a large number of switches and topology dynamic changes, and the efficiency is improved. According to the method, the security genes of the master and slave control channels are inherited and lightweight adaptation is carried out, and the performance bottleneck and security shortages of the traditional SDN southbound channel are fundamentally solved through the original design of intelligent event filtering, multi-path processing and the like, so that a solid end guarantee is provided for stable and efficient operation of the whole hierarchical control architecture.

Description

A proxy-based software-defined networking method and apparatus Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a proxy-based software-defined networking method and apparatus. Background Technology

[0002] The core idea of ​​Software-Defined Networking (SDN) is to separate the network's control plane from its data forwarding plane. The control plane is managed by a centralized controller that has a global view of the network and uses this view to calculate and distribute flow tables to each switch, guiding packet forwarding. The data plane consists of distributed switches that perform simple forwarding actions based on the flow tables.

[0003] While existing technologies employ clustered controllers or multi-controller architectures to mitigate these issues, these solutions are typically complex, increasing system coupling and management difficulty. Furthermore, they still face challenges such as synchronization latency and state consistency maintenance when dealing with large-scale, dynamically changing networks. Therefore, there is an urgent need for a new approach that can fundamentally improve the robustness, scalability, and security of SDN architectures while maintaining their centralized control advantages. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a proxy-based software-defined networking method and apparatus to resolve the issues existing in the prior art.

[0005] This invention provides a proxy-based software-defined networking method, comprising the following steps: constructing a hierarchical network architecture and deploying proxy nodes; establishing a master-slave control channel between the controller and the proxy nodes; establishing a local control channel between the proxy nodes and the switches; specifically: Sa: the proxy nodes actively discover and establish communication links with the switches under their jurisdiction according to a predefined management domain; Sb: on the communication link, an improved lightweight secure communication protocol with bidirectional authentication capabilities is used to authenticate the switches and the proxy nodes; Sc: on the local control channel, a parallel processing architecture supporting multi-path and priority management is established, and a link status self-checking and fast switching mechanism is embedded; the proxy nodes perform local decision-making and caching; the controller performs global optimization and policy synchronization for the proxy nodes; high availability and fault switching of the proxy nodes are achieved by configuring backup proxy nodes; when cross-domain communication is required, the controller performs cross-domain collaboration and security isolation.

[0006] Preferably, establishing a master-slave control channel between the controller and the agent node specifically involves: initiating and establishing a communication link based on a reliable transmission protocol between the controller and the agent node; implementing a two-way authentication mechanism on the communication link to verify the legitimate identities of both communicating parties; negotiating and establishing an encrypted application layer communication tunnel based on the successfully authenticated session; defining and implementing an application layer protocol dedicated to control information interaction on top of the application layer communication tunnel; and embedding and maintaining a connection status monitoring and self-healing mechanism in the application layer protocol.

[0007] Preferably, in the step of constructing a layered network architecture and deploying proxy nodes, the layered network architecture includes a control layer, a management layer, and a forwarding layer. The control layer is composed of a central controller; the management layer is composed of proxy nodes, each of which manages a specific logical area; and the forwarding layer is composed of switches, which are used to forward data packets according to flow tables.

[0008] Preferably, the step of the proxy node actively discovering and establishing a communication link with the subordinate switch according to the predefined management domain specifically means that after initialization, each proxy node will start an automated discovery and connection process according to the set management domain.

[0009] Preferably, the improved lightweight secure communication protocol with two-way authentication capability specifically involves the following: At the beginning of establishing a communication link, the switch and the proxy node first perform a round of two-way certificate authentication or challenge-response authentication based on a pre-shared key. After successful authentication, both parties will jointly negotiate a temporary session key for the encrypted transmission of all subsequent control messages. When the initial connection is established, the proxy node issues a set of default flow table entries to its subordinate switch to handle common protocol messages. Simultaneously, the proxy node negotiates with the switch to activate an event subscription mode. In this mode, the switch performs preliminary screening of Packet-In events. Only when the reported event type matches the type pre-subscribed by the proxy node will the switch send the event's detailed information to the proxy node. Otherwise, for regular traffic that does not match the subscription rules, the switch will process it according to the locally cached default flow table or discard it directly.

[0010] Preferably, a parallel processing architecture supporting multi-path and priority management is established on the local control channel. Simultaneously, in the embedded link status self-check and fast switching mechanism step, the local control channel between the proxy node and the switch is designed to support multi-queue parallel processing. When the switch sends messages to the proxy node, it marks different types of messages with priority tags. The communication module inside the proxy node will send the messages to the corresponding high, medium, and low priority queues for processing according to these tags.

[0011] Preferably, the proxy node continuously sends heartbeat probes to the switch. At the same time, the switch also monitors the connection status with the proxy node. When either party detects a connection abnormality, both parties will immediately mark the link as interrupted locally and trigger a preset fault handling process.

[0012] Preferably, initiating and establishing a communication link based on a reliable transmission protocol between the controller and the agent node specifically involves the following steps: after the agent node completes initialization and is ready, its built-in communication client module will actively initiate a connection request to the controller address that it has pre-configured or dynamically discovered. This request is based on a connection-oriented transport layer protocol. The controller runs a corresponding communication server module, listens to the specified service port, and responds after receiving the connection request, thereby completing the establishment of a basic bidirectional communication link.

[0013] Preferably, a two-way authentication mechanism is implemented on the communication link to verify the legitimate identities of both communicating parties. Specifically, a two-way transport layer security authentication mechanism is adopted. After the basic communication link is established, an encrypted handshake process is initiated. During the encrypted handshake process, the controller presents its digital certificate to the proxy node. This certificate is issued by a trusted certificate authority and is used to prove the legitimacy of its identity. After receiving the certificate, the proxy node verifies it using a preset root key to verify its authenticity and validity. After the verification is successful, the proxy node presents its own digital certificate to the controller. The controller verifies the proxy node's certificate using its own root key. When both parties' certificates pass the other's verification, the encrypted handshake process is successfully completed.

[0014] According to another aspect of the present invention, an apparatus is provided, the apparatus including a configuration module that runs the above-described agent-based software-defined networking method.

[0015] The embodiments of this invention have the following technical effects: This embodiment decentralizes the initiative of connection to the proxy node closer to the switch, shortening the path and time for connection establishment. It is especially suitable for scenarios with a large number of switches and dynamic topology changes. It not only inherits the security genes of the master-slave control channel and adapts them in a lightweight manner, but also fundamentally solves the performance bottleneck and security shortcomings of the traditional SDN southbound channel through original designs such as intelligent event filtering and multi-path processing, providing a solid end-point guarantee for the stable and efficient operation of the entire hierarchical control architecture.

[0016] In terms of security, this embodiment transforms passive defense into active immunity, constructing a trustworthy, controllable, and auditable control plane security system. Simultaneously, in terms of reliability, this embodiment upgrades fragile point-to-point connections into robust, self-healing control trunks, ensuring the continuity of network control. Regarding performance, it transforms inefficient direct management into efficient collaborative governance, breaking through the performance bottlenecks of traditional SDN through information dimensionality reduction and batch processing, paving the way for smooth network expansion.

[0017] The two-way authentication mechanism ensures from the outset that only authorized and legitimate controllers and agent nodes can establish connections with each other, forming the first line of defense against man-in-the-middle attacks and unauthorized access. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 is a flowchart of a proxy-based software-defined networking method provided by an embodiment of the present invention; Figure 2 is a flowchart of establishing a master-slave control channel between a controller and a proxy node provided by an embodiment of the present invention; Figure 3 is a flowchart of establishing a local control channel between a proxy node and a switch provided by an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] Example 1, Figure 1 shows a flowchart of a proxy-based software-defined networking method. As shown in Figure 1, a proxy-based software-defined networking method includes the following steps: S1: Constructing a layered network architecture and deploying proxy nodes; In this step, the layered network architecture includes a control layer, a management layer, and a forwarding layer. The control layer consists of a central controller, which is responsible for overall network planning, cross-domain path calculation, global security policy formulation, and resource scheduling; the management layer consists of proxy nodes, each of which manages a specific logical area, i.e., a management domain, and is responsible for rapid response and status aggregation within its area; the forwarding layer consists of switches, which are used for high-speed forwarding of data packets according to flow tables.

[0022] S2: Establish a master-slave control channel between the controller and the agent node; in this step, TLS over TCP is used as the transport layer protocol to realize data transmission between the controller and the agent node; at the same time, an out-of-band management network is established between the controller and the agent node for the transmission of system management and control commands, which is completely isolated from the business network carrying user data. Even if the business network is paralyzed due to DDoS attack, the system has extremely strong resilience.

[0023] More specifically, as shown in Figure 2, S2 specifically involves: S2.1: Initiating and establishing a communication link based on a reliable transmission protocol between the controller and the agent node; after the agent node completes initialization and is ready, its built-in communication client module will proactively initiate a connection request to its pre-configured or dynamically discovered controller address. This request is based on a connection-oriented transport layer protocol to ensure the reliability and orderliness of data transmission. The controller runs a corresponding communication server module, listens to the designated service port, and responds upon receiving the connection request, thereby establishing a basic bidirectional communication link. This communication link constitutes the physical and transmission foundation of the master-slave control channel.

[0024] S2.2: Implement a two-way authentication mechanism on the communication link to verify the legitimate identities of both communicating parties. To ensure the absolute security of the control channel and prevent the access and impersonation of unauthorized nodes, a two-way transport layer security authentication mechanism is adopted in this step. After the basic communication link is established, an encrypted handshake process is immediately initiated. During the encrypted handshake process, the controller presents its digital certificate to the proxy node. This certificate is issued by a trusted certificate authority to prove the legitimacy of its identity. After receiving the certificate, the proxy node uses a preset root key to verify its authenticity and validity.

[0025] After successful verification, the proxy node presents its own digital certificate to the controller. The controller uses its own root key to verify the proxy node's certificate. When both certificates pass the other's verification, the encrypted handshake process is successfully completed.

[0026] In this step, the two-way authentication mechanism ensures from the outset that only authorized and legitimate controllers and agent nodes can establish connections with each other, forming the first line of defense against man-in-the-middle attacks and unauthorized access.

[0027] S2.3: Based on the successfully authenticated session, negotiate and establish an encrypted application-layer communication tunnel. With successful two-way authentication, both parties negotiate a temporary, symmetric session key. Subsequently, all application-layer data transmitted over the basic communication link will be encrypted using this session key. This step ensures the confidentiality and integrity of the data during transmission, preventing it from being deciphered or tampered with even if intercepted by a third party. Through these steps, a secure and reliable encrypted tunnel is established, and the security layer of the master-slave control channel is built.

[0028] S2.4: Above the application layer communication tunnel, a dedicated application layer protocol for control information interaction is defined and implemented. After the secure tunnel is established, the controller and the agent node need to transmit specific control information through an agreed format and semantics. To this end, this method defines a dedicated application layer protocol. This protocol specifies multiple message types to implement different control functions.

[0029] The downlink messages sent from the controller to the agent nodes mainly include: instructions for issuing global network policies, instructions for updating the configuration of the agent nodes themselves, and high-level commands for triggering network-wide topology discovery or policy recalculation. The uplink messages sent from the agent nodes to the controller mainly include: periodic heartbeat reports representing the health status of the agent node and its assigned region, aggregated network statistics summaries, and asynchronous event notifications requiring controller intervention. For example, this includes notifications when a new type of network attack is detected or a large-scale state change occurs in the assigned switch cluster.

[0030] S2.5: Embed and maintain connection status monitoring and self-healing mechanisms in the application layer protocol; to prevent unexpected interruptions of the control channel due to network jitter or temporary node failures, this step incorporates connection keep-alive and fault self-healing mechanisms during the operation of the master-slave control channel. Specifically, both communicating parties send lightweight heartbeat probe signals to each other at preset time intervals. If no response is received from the other party within several consecutive cycles, the sender will determine that the current connection has become abnormal.

[0031] After determining that the connection is abnormal, the communication client module will automatically start the reconnection logic. The reconnection logic adopts a progressive delayed retry strategy to avoid exacerbating congestion due to frequent retries during network failures. The proxy node continues to try to reconnect to the controller until the connection is successfully restored.

[0032] This mechanism ensures that the master-slave control channel has high robustness and self-healing capabilities, and can maintain the continuity of the control plane to the greatest extent possible when facing unstable network environments.

[0033] In this step, regarding the security dimension, the solution in this embodiment changes from passive defense to active immunity, constructing a trustworthy, controllable, and auditable control plane security system. At the same time, in terms of reliability, this embodiment upgrades the fragile point-to-point connection to a robust and self-healing control backbone, ensuring the continuity of network control. In terms of performance, it transforms inefficient direct management and control into efficient collaborative governance. Through information dimensionality reduction and batch processing, it breaks through the performance bottleneck of traditional SDN, paving the way for the smooth expansion of the network.

[0034] S3: Establish a local control channel between the agent node and the switch; as shown in Figure 3, S3 specifically involves: S3.1: The agent node actively discovers and establishes a communication link with the switch under its jurisdiction according to the predefined management domain; after initialization, each agent node will initiate an automated discovery and connection process according to the management domain set in step S1. This process can be implemented in various ways. For example, the agent node can actively send discovery probe packets within its managed IP address range, or listen to the presence information actively reported by the switch through the Link Layer Discovery Protocol (LLDP). Once a switch belonging to its management domain is identified, the agent node will attempt to establish a direct communication link based on a reliable transmission protocol with the southbound interface service port of that switch.

[0035] Compared to existing technologies where switches passively wait for the controller to discover and connect, this method decentralizes the initiative of connection to agent nodes closer to the switch, shortening the path and time for connection establishment. It is especially suitable for scenarios with a large number of switches and dynamic topology changes.

[0036] S3.2: On the communication link, an improved lightweight secure communication protocol with two-way authentication capability is used to authenticate the switch and the proxy node. In the traditional SDN architecture, the southbound channel between the switch and the controller often lacks effective two-way authentication, or only relies on simple one-way authentication of the switch by the controller. This mode has security risks, as the switch cannot effectively verify the legitimacy of the controller's commands and is vulnerable to forged controller attacks.

[0037] To address the aforementioned shortcomings, this step proposes an improved authentication and session management method with bidirectional authentication capabilities. Specifically, at the beginning of establishing a communication link, the switch and the proxy node first perform a simplified bidirectional certificate authentication or a challenge-response authentication based on a pre-shared key. This authentication process is designed to be lightweight to avoid placing an excessive computational burden on resource-constrained switches. After successful authentication, both parties will jointly negotiate a temporary session key for the encrypted transmission of all subsequent control messages.

[0038] When an agent node establishes an initial connection, it sends a set of default flow table entries to the switches under its jurisdiction to handle common protocol packets. At the same time, the agent node negotiates with the switch to activate the event subscription mode. In this mode, the switch no longer blindly reports all Packet-In events. Instead, the switch performs a preliminary screening of Packet-In events. Only when the reported event type matches the type pre-subscribed by the agent node will the switch send the detailed information of the event to the agent node. Otherwise, for regular traffic that does not match the subscription rules, the switch will process it according to the default flow table cached locally or discard it directly.

[0039] By performing intelligent filtering at the reporting source (switch), the number of packet-in messages sent to the proxy node is significantly reduced, especially low-value-density noise traffic. This reserves valuable bandwidth and control resources for complex traffic that truly requires in-depth processing. Simultaneously, the proxy node can dynamically adjust its subscription preferences for different types of events based on real-time network conditions and policy requirements. For example, when a suspected DDoS attack is detected, it can proactively subscribe to all traffic events from a specific source for granular monitoring.

[0040] S3.3: On the local control channel, establish a parallel processing architecture that supports multi-path and priority management, and embed a link status self-check and fast switching mechanism; in this step, the local control channel between the proxy node and the switch is designed to support multi-queue parallel processing. For example, independent processing queues and thread pools can be allocated for high-priority configuration instructions, low-latency Packet-In events, and ordinary status reports.

[0041] When sending messages to proxy nodes, the switch can assign priority tags to different message types. The communication module inside the proxy node will then use these tags to send the messages to the corresponding high, medium, or low priority queues for processing. This architecture ensures that critical control commands and low-latency service flow decision requests receive the fastest possible response, without being blocked by processing large amounts of background statistical information.

[0042] Meanwhile, to ensure high availability of local control, the proxy node will continuously send heartbeat probes to the switch. At the same time, the switch will also monitor the connection status with the proxy node. Once either party detects a connection abnormality, both parties will immediately mark this link as interrupted locally and trigger a preset fault handling process.

[0043] For switches, if multiple agent nodes are configured, after detecting that the primary agent node is disconnected, it will automatically attempt to connect to the backup agent node to achieve seamless switching. This mechanism ensures that even if a single point of failure occurs in an agent node, the switch under its jurisdiction can quickly find a new manager, thus maximizing the local stability of the network.

[0044] This step not only inherits the security features of the master-slave control channel and adapts them in a lightweight manner, but also fundamentally solves the performance bottlenecks and security shortcomings of the traditional SDN southbound channel through original designs such as intelligent event filtering and multi-path processing, providing a solid end-point guarantee for the stable and efficient operation of the entire hierarchical control architecture.

[0045] S4: The proxy node performs local decision-making and caching. When the switch receives a data packet that cannot match any local flow table entry, it encapsulates the packet into a Packet-In message and sends it to its proxy node. Upon receiving the message, the proxy node does not immediately forward it to the remote controller, but first performs a match in a fast decision cache in its local memory. This cache stores the five-tuple characteristics of recent high-frequency traffic and their corresponding flow table actions. If a match is successful, the proxy node immediately generates a temporary flow table entry and sends it to the switch, then directly discards or forwards the data packet. Simultaneously, this decision event is placed in an asynchronous reporting queue. If the local cache misses, the proxy node forwards the Packet-In message to the controller through the master-slave control channel. This mechanism ensures that the processing latency of the vast majority of regular traffic is kept at an extremely low level.

[0046] S5: The controller performs global optimization and policy synchronization on the proxy nodes. The controller actively polls each proxy node at a low frequency or receives reports via an event-driven approach. After collecting the status information of the entire network, the controller utilizes its powerful computing capabilities to run complex network applications. For example, when the controller detects congestion on a link, it calculates a new optimal path and generates an incremental flow table policy containing the new path information. Then, instead of sending instructions to each relevant switch individually, the controller pushes this policy in batches to all proxy nodes responsible for that path segment through the master-slave control channel. After receiving the global policy, the proxy nodes merge and optimize it with their local caches and policies before precisely applying it to the specific switches under their jurisdiction. This approach avoids "broadcast storm" style policy distribution, improving efficiency.

[0047] S6: High availability and failover of agent nodes are achieved by configuring backup agent nodes. For each primary agent node A, the system configures one or two backup agent nodes B and C. The primary agent node A periodically synchronizes its critical status information to a shared persistent storage. When backup agent node B detects a heartbeat interruption with the primary agent node A, it determines that A has failed. B then announces to the controller and other agent nodes that it has taken over A's role. Then, B reads A's latest status from the shared storage and quickly re-establishes local control channels with all switches under A's control. Since switches typically support multiple controller / agent connections, this switching process is transparent to the switches, causing at most a brief connection interruption, with almost no impact on service traffic.

[0048] S7: When cross-domain communication is required, the controller performs cross-domain collaboration and security isolation.

[0049] When a data packet needs to be sent from a host in domain X to domain Y, its forwarding within domain X is controlled by A_X. When the packet arrives at the edge switch in domain X, the flow table entry on that switch instructs it to forward the packet to A_Y. At this point, A_X and A_Y communicate directly through a pre-established peer-to-peer control channel. A_X sends a cross-domain forwarding request to A_Y, containing source / destination information and the required security policy identifier. Upon receiving A_Y's relay, the controller C_Y verifies the validity of the request and generates a flow table policy applicable within domain Y, which is then distributed by A_Y to the edge switch in domain Y. Throughout this process, the network policies and internal topology information of the two domains are isolated by their respective proxy nodes. Controller C_X cannot directly control C_Y's devices, achieving a balance between security and collaboration.

[0050] Example 2: The present invention also provides that the device includes a configuration module, which runs a proxy-based software-defined networking method as described in Example 1.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A proxy-based software-defined networking method, characterized in that, Includes the following steps: Construct a layered network architecture and deploy proxy nodes; establish a master-slave control channel between the controller and the proxy nodes; establish a local control channel between the proxy nodes and the switches; specifically: Sa: The proxy nodes actively discover and establish communication links with the switches under their jurisdiction according to a predefined management domain; Sb: On the communication link, an improved lightweight secure communication protocol with bidirectional authentication capabilities is used to authenticate the switches and the proxy nodes. Sc: On the local control channel, a parallel processing architecture supporting multi-path and priority management is established, and a link status self-checking and fast switching mechanism is embedded; the proxy node performs local decision-making and caching; the controller performs global optimization and policy synchronization for the proxy node; high availability and fault switching of the proxy node are achieved by configuring backup proxy nodes; when cross-domain communication is required, the controller performs cross-domain collaboration and security isolation.

2. The agent-based software-defined networking method according to claim 1, characterized in that: Establishing a master-slave control channel between the controller and the agent node specifically involves: initiating and establishing a communication link based on a reliable transmission protocol between the controller and the agent node; and implementing a two-way authentication mechanism on the communication link to verify the legitimate identities of both parties. Based on the successfully authenticated session, negotiate and establish an encrypted application layer communication tunnel; Above the application layer communication tunnel, an application layer protocol dedicated to controlling information interaction is defined and implemented; a connection status monitoring and self-healing mechanism is embedded and maintained in the application layer protocol.

3. The agent-based software-defined networking method according to claim 1, characterized in that: In the step of constructing a layered network architecture and deploying proxy nodes, the layered network architecture includes a control layer, a management layer, and a forwarding layer. The control layer is composed of a central controller; the management layer is composed of proxy nodes, each of which manages a specific logical area; and the forwarding layer is composed of switches, which are used to forward data packets according to flow tables.

4. The agent-based software-defined networking method according to claim 1, characterized in that: The process of the agent node actively discovering and establishing a communication link with the switch under its jurisdiction according to the predefined management domain is specifically as follows: After initialization, each agent node will start an automated discovery and connection process according to the set management domain.

5. The agent-based software-defined networking method according to claim 4, characterized in that: The improved lightweight secure communication protocol with two-way authentication capability is as follows: At the beginning of establishing a communication link, the switch and the proxy node first perform a round of two-way certificate authentication or challenge-response authentication based on a pre-shared key. After successful authentication, both parties will jointly negotiate a temporary session key for the encrypted transmission of all subsequent control messages. When the initial connection is established, the proxy node issues a set of default flow table entries to its subordinate switch to handle common protocol messages. Simultaneously, the proxy node negotiates with the switch to activate an event subscription mode. In this mode, the switch performs preliminary screening of Packet-In events. Only when the reported event type matches the type pre-subscribed by the proxy node will the switch send the event's detailed information to the proxy node. Otherwise, for regular traffic that does not match the subscription rules, the switch will process it according to the locally cached default flow table or discard it directly.

6. The agent-based software-defined networking method according to claim 5, characterized in that: On the local control channel, a parallel processing architecture supporting multi-path and priority management is established. Simultaneously, in the embedded link status self-check and fast switching mechanism steps, the local control channel between the proxy node and the switch is designed to support multi-queue parallel processing. When the switch sends messages to the proxy node, it marks different types of messages with priority tags. The communication module inside the proxy node will send the messages to the corresponding high, medium, and low priority queues for processing according to these tags.

7. The agent-based software-defined networking method according to claim 6, characterized in that: The proxy node continuously sends heartbeat probes to the switch. At the same time, the switch also monitors the connection status with the proxy node. When either party detects a connection abnormality, both parties will immediately mark the link as interrupted locally and trigger a preset fault handling process.

8. The agent-based software-defined networking method according to claim 2, characterized in that: The process of initiating and establishing a communication link based on a reliable transmission protocol between the controller and the agent node is as follows: After the agent node completes initialization and is ready, its built-in communication client module will actively initiate a connection request to the controller address that it has pre-configured or dynamically discovered. This request is based on a connection-oriented transport layer protocol. The controller runs a corresponding communication server module, listens to the specified service port, and responds after receiving the connection request, thereby completing the establishment of a basic bidirectional communication link.

9. The agent-based software-defined networking method according to claim 2, characterized in that: Implementing a two-way authentication mechanism on the communication link to verify the legitimate identities of both communicating parties involves the following steps: A two-way transport layer security authentication mechanism is adopted. After the basic communication link is established, an encrypted handshake process is initiated. During this process, the controller presents its digital certificate to the proxy node. This certificate, issued by a trusted certificate authority, proves the legitimacy of its identity. Upon receiving the certificate, the proxy node verifies its authenticity and validity using a pre-set root key. After successful verification, the proxy node presents its own digital certificate to the controller. The controller then verifies the proxy node's certificate using its own root key. When both certificates pass the other's verification, the encrypted handshake process is successfully completed.

10. An apparatus, characterized in that, The apparatus includes a configuration module that runs a proxy-based software-defined networking method according to any one of claims 1-9.

Images