A management and control system and method for heterogeneous network services

Abstract

The application discloses a management and control system and method for heterogeneous network services, and belongs to the technical field of network communication and computer. The system is deployed in a control plane and comprises: an identification mapping management and control layer, which is used for receiving and analyzing network service requests and generating unified mapping results; an authorization policy decision layer, which is used for making authorization decisions based on the unified mapping results and in combination with service types, subjects and network state attributes; and a network forwarding management and control layer, which is used for generating and issuing network forwarding control results to a data plane for execution after authorization permission. The system supports unified mapping, policy authorization and forwarding execution control of different types of network services such as identity, space and resources through a standardized request processing procedure, and solves the problems of scattered heterogeneous network service management and control architecture and disconnection between authorization and execution in the prior art.

Description

Technical Field

[0001] This invention relates to the fields of network communication and computer technology, and in particular to a management and control system and method for heterogeneous network services. Background Technology

[0002] With the rapid development of technologies such as the Internet of Things (IoT), edge computing, and network-computer collaboration, network services have evolved from traditional end-to-end communication to heterogeneous services oriented towards multiple dimensions, including identity, region, and resources. These new services, such as identity services for specific objects, space services for specific spaces, and resource services for computing and storage resources, differ significantly in terms of request content, scope, and execution methods. In this context, traditional distributed management architectures designed for single service types face the challenge of unified management: the request access methods, processing logic, and control flows of different service types are fragmented, making it difficult to achieve overall business collaboration and rapid deployment. Therefore, there is an urgent need to build an intelligent management framework that can support the unified integration and secure execution of multiple types of network services.

[0003] Currently, there are two main technical approaches to solving the problem of managing such heterogeneous services. The first is to design independent management schemes at the network layer for specific network services, such as identity-based and spatial services, building dedicated request parsing, target addressing, and forwarding execution logic for each service. The second is to draw on general access control systems, such as role-based access control and attribute-based access control, to perform permission adjudication. The former can meet the functional requirements of specific services but lacks horizontal coordination; the latter has general policy judgment capabilities but is limited to permission review and is difficult to directly link with network-side forwarding control behavior.

[0004] However, all of the aforementioned existing technologies have significant shortcomings. While independent management solutions can handle single-service scenarios, when multiple services such as identity-based, spatial, and resource-based services need to be supported simultaneously, the system presents multiple independent interfaces and processing flows, leading to redundant construction of functional modules, low resource utilization, increased maintenance complexity, and an inability to form a unified mapping, decision-making, and control feedback loop across different services. General access control solutions primarily focus on determining the access permissions of the requesting subject, making it difficult to effectively integrate the unique service semantics, geographical scope, resource status, and network load constraints of heterogeneous network service requests. This results in authorization results often remaining at the "allow / deny" level, failing to effectively drive subsequent network path selection, flow table rule distribution, data plane blocking, or regional forwarding, creating a disconnect between authorization and network execution.

[0005] In summary, current technologies have not yet formed a comprehensive solution capable of simultaneously achieving unified access, mapping, authorization, and network forwarding control for heterogeneous network services. Therefore, a systematic management and control method and architecture are needed to address the urgent requirements of diverse network service forms in terms of unified management, enhanced security, and controllable execution. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and propose a management and control system and method for heterogeneous network services. This system establishes a standardized request processing flow, incorporating different types of network services, such as identity-based, space-based, and resource-based services, into a unified management and control framework. This achieves closed-loop management from request access, parsing and mapping, authorization decisions to network forwarding control, thereby reducing system integration complexity and improving management efficiency, scalability, and security controllability.

[0007] To achieve the above objectives, the first aspect of this invention provides a management and control system for heterogeneous network services. This system is implemented based on a network architecture that separates the control plane and data plane. Its core innovation lies in constructing a unified management and control system comprising a three-layer structure to achieve unified closed-loop management and control of heterogeneous network service requests, from semantic expression and authorization judgment to network execution control. Specifically, it includes the following: A management and control system for heterogeneous network services, deployed in the control plane, is used to uniformly manage network service requests of different service types. The management and control system includes: The identifier mapping control layer is used to receive the network service request, parse the network service request and perform identifier mapping to generate a unified mapping result; The authorization strategy decision layer is communicatively connected to the identifier mapping control layer. It is used to make authorization decisions based on the unified mapping result and in combination with the preset unified authorization strategy model, and output the authorization decision result. The network forwarding control layer is communicatively connected to the authorization policy decision layer and the identifier mapping control layer, respectively. It is used to generate corresponding network forwarding control results based on the service type, the unified mapping result and the authorization decision result, and send the network forwarding control results to the data plane to control the data plane to perform corresponding network operations.

[0008] Specifically, the identifier mapping control layer is used for: In response to receiving the network service request, a request subject identifier is generated to identify the request initiating entity and a service request identifier is generated to identify the requested service content. Based on the service type of the network service request, the request subject identifier and the service request identifier are parsed and mapped to form the unified mapping result.

[0009] The service types include identity-based, spatial, and resource-based network services; The identifier mapping control layer is used for: If the service type is an identity-based network service, then the service request identifier is mapped to at least one of the following: target object identity, target object address, object permission level, and object reachability status. If the service type is a spatial network service, then the service request identifier is mapped to at least one of the following: target area range, set of nodes within the area, and area communication method. If the service type is a resource-based network service, then the service request identifier is mapped to at least one of the following: task type, resource requirement, candidate resource node, node load, and resource availability status. The unified mapping result includes at least the service type, request initiator information, service attribute information, request target information, and execution constraint information.

[0010] Specifically, the authorization strategy decision layer is used for: From the unified mapping result, extract the subject attribute, service attribute, and network status attribute corresponding to the network service request; The unified authorization strategy model is used to make authorization decisions based on the subject attributes, service attributes, and network status attributes.

[0011] Furthermore, the unified authorization strategy model employs a strategy expression. To describe the authorization rules, where, Indicates the service type; Represents the set of constraints on the subject's attributes; This represents the set of constraints applied to service attributes. This represents the set of constraints relating to network state attributes; This indicates the authorization decision result, with values ​​of Permit or Deny.

[0012] Furthermore, the decision-making steps of the authorization strategy decision layer include: Based on the service type of the network service request It selects a set of candidate strategies from a pre-configured authorization strategy library; The extracted subject attributes, service attributes, and network state attributes are respectively compared with each policy in the candidate policy set. 、 and Perform a match; If a match is successful, the decision will be based on the strategy for successful matching. Generate authorization decision results.

[0013] Furthermore, when multiple strategies are successfully matched and their decision results... In case of inconsistency, a deny-override conflict resolution mechanism is used to determine the final authorization decision. This mechanism works as follows: as long as there is a decision result from any matching strategy... If the answer is Deny, then the final authorization decision will be Deny.

[0014] Specifically, the network forwarding control layer generates the network forwarding control result based on the service type: If the service type is an identity-based network service, then generate unicast, multicast, or replication forwarding rules based on the target object's identity or target object address; If the service type is a spatial network service, then generate regional broadcast rules, copy-forward rules, or filtering rules based on the target area or the set of nodes within the area; If the service type is a resource-based network service, then based on the task type, resource requirements, or candidate resource nodes, generate resource node selection results, path forwarding rules, or service call instructions.

[0015] Specifically, after executing the network forwarding control result, the data plane generates state feedback information and sends it back to the control plane; The control system is configured to trigger the remapping, reauthorization, or regeneration of network forwarding control results for the network service request based on the status feedback information.

[0016] Specifically, the management and control system for heterogeneous network services is implemented based on the Software-Defined Networking Controller (SDN) architecture. The control plane is an SDN controller, the data plane is a programmable data plane device, and the network forwarding control results are sent to the data plane through the southbound interface.

[0017] Furthermore, the management and control system is a network application running on the SDN controller.

[0018] In a second aspect, based on the same inventive concept as the first aspect, the present invention also provides a management and control method for heterogeneous network services, applied to the control plane for processing network service requests, the management and control method comprising: Mapping steps: Receive network service requests, parse and identify the network service requests, and generate a unified mapping result; Authorization steps: Based on the unified mapping result, an authorization decision is made in conjunction with a preset unified authorization strategy model, and the authorization decision result is output; Forwarding control steps: When the authorization decision result is allowed, a network forwarding control result is generated based on the service type of the network service request, the unified mapping result, and the authorization decision result; Execution steps: The network forwarding control result is sent to the data plane to control the data plane to perform corresponding network operations.

[0019] Furthermore, the mapping step includes: Generate a request subject identifier and a service request identifier for the network service request; The identifier is parsed and mapped according to the service type to form the unified mapping result.

[0020] Furthermore, the authorization step includes: Extract the subject attributes, service attributes, and network status attributes from the unified mapping result; Using policy expressions The attributes are matched to obtain the authorization decision result, wherein, For service type, For the set of principal attribute constraints, For a set of service attribute constraints, For the set of network state attribute constraints, For the decision outcome.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention addresses the pain points of heterogeneous network service management, such as fragmented architecture, disjointed logic, and insufficient fine-grained authorization. It constructs a unified three-layer management system comprising an identifier mapping management layer, an authorization policy decision layer, and a network forwarding management layer. Through standardized identifier mapping, it achieves unified access and semantic parsing for multiple types of network service requests, overcoming the limitations of traditional solutions that only design management processes for single service types. Simultaneously, it innovatively proposes a unified authorization policy model that integrates subject attributes, service attributes, and network status attributes, deeply linking authorization decisions with underlying network forwarding control. Compared to existing access control schemes based solely on subjects or resources, this achieves finer-grained security management more suited to network service scenarios. Furthermore, the layered modular design significantly reduces the complexity of multi-service integration, improves system scalability, and supports closed-loop dynamic management by combining data plane status feedback. This not only promotes the standardization of heterogeneous network service management architectures but also possesses significant economic benefits and application promotion value.

[0022] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is an overall structural diagram of a management and control system for heterogeneous network services according to an embodiment of the present invention.

[0025] Figure 2 This is a flowchart of the unified authorization decision-making process in one embodiment of the present invention.

[0026] Figure 3 This is a flowchart of a unified service request processing embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Example 1: In one embodiment, such as Figure 1 As shown, this embodiment provides a management and control system for heterogeneous network services. It adopts a layered architecture design, comprising an identifier mapping management layer, an authorization policy decision layer, and a network forwarding management layer. It relies on the data plane to complete specific packet processing and rule execution. Specifically: The identifier mapping control layer is used to receive the network service request, parse the network service request and perform identifier mapping to generate a unified mapping result; The authorization strategy decision layer is communicatively connected to the identifier mapping control layer, and is used to make authorization decisions based on the unified mapping result and in combination with the preset unified authorization strategy model, and output the authorization decision result. The network forwarding control layer is communicatively connected to the authorization policy decision layer and the identifier mapping control layer, respectively. It is used to generate corresponding network forwarding control results based on the service type, the unified mapping result and the authorization decision result, and send the network forwarding control results to the data plane to control the data plane to perform corresponding network operations.

[0029] Specifically, the identifier mapping control layer receives the request initiator information, service type, and service parameters, and outputs a unified mapping result; the authorization policy decision layer receives the unified mapping result, combines it with the authorization policy set, and outputs an authorization decision result; the network forwarding control layer receives the unified mapping result and the authorization decision result, generates a network forwarding control result, and sends it to the data plane for execution. The data plane performs operations such as packet matching, forwarding, copying, blocking, or rate limiting based on the network forwarding control result, and can feed back the execution status to the control plane.

[0030] Through the above overall design, this invention forms a unified network service request processing framework at the system level, achieves layered decoupling of identifier mapping, authorization decision-making, and forwarding control at the functional level, and retains differentiated processing capabilities for different network service types at the execution level. Therefore, this invention can both reduce the complexity of integrating multiple types of network services and improve the system's ability to expand to new network service types.

[0031] In this embodiment, the identifier mapping control layer is specifically used to: in response to receiving the network service request, generate a request subject identifier to represent the request initiating entity and a service request identifier to represent the requested service content; and parse and map the request subject identifier and the service request identifier according to the service type of the network service request to form the unified mapping result.

[0032] Furthermore, the service types include identity-based, spatial, and resource-based network services.

[0033] Furthermore, the identifier mapping control layer is used to: if the service type is an identity-based network service, map the service request identifier to at least one of the following: target object identity, target object address, object permission level, and object reachability status; if the service type is a spatial network service, map the service request identifier to at least one of the following: target area range, set of nodes within the area, and area communication method; if the service type is a resource-based network service, map the service request identifier to at least one of the following: task type, resource requirement, candidate resource node, node load, and resource availability status; the unified mapping result includes at least the service type, request initiator information, service attribute information, request target information, and execution constraint information.

[0034] Specifically, the identifier mapping control layer is used to complete the unified access, identifier generation, identifier resolution, and mapping processing of heterogeneous network service requests. It is the prerequisite foundation for the unified control of different network services in this invention. The input of this layer includes the request initiator information, service type, and service parameters, and the output is a unified mapping result that can be used by the authorization policy decision layer and the network forwarding control layer.

[0035] During the service request generation process, the system generates a request subject identifier and a service request identifier for each network service request. The request subject identifier is used to identify the entity initiating the service request and can be generated based on one or more of the following information: user identity, device identity, organization affiliation, access location, device type, permission level, authentication result, etc. The service request identifier is used to identify the service content of the current network service request and can be generated based on one or more of the following information: service type, request target, service parameters, resource requirements, latency constraints, priority, etc.

[0036] Furthermore, this invention does not limit the specific encoding format of the request subject identifier and the service request identifier. The identifier can be represented as a string, structured field, database index, message header field, key-value pair, templated parameter set, or other forms recognizable by the system. As long as the control plane can obtain the request initiating subject, service type, request target, and service constraint information based on the identifier, it can be used as the request subject identifier or service request identifier in this invention.

[0037] During the identifier resolution and mapping process, the identifier mapping control layer selects the corresponding mapping relationship based on the service type. For identity-based network services, the system can map the service request identifier to information such as the target object's identity, target object's address, object's permission level, and object's reachability status. For spatial network services, the system can map the service request identifier to information such as the target area range, the set of nodes within the area, and the area's communication method. For resource-based network services, the system can map the service request identifier to information such as task type, resource requirements, candidate resource nodes, node load, and resource availability status.

[0038] After the above processing, the identifier mapping control layer forms a unified mapping result. This unified mapping result includes at least the service type, request initiator information, service attribute information, request target information, and execution constraint information. This unified mapping result serves as input to the authorization policy decision layer, used to generate subject attributes, service attributes, and network state attributes; and as input to the network forwarding control layer, used to generate target addressing results, forwarding rules, resource scheduling results, or other network forwarding control results.

[0039] In this embodiment, as Figure 2As shown, the authorization strategy decision layer is specifically used to: extract the subject attribute, service attribute, and network status attribute corresponding to the network service request from the unified mapping result; and make authorization decisions based on the subject attribute, service attribute, and network status attribute using the unified authorization strategy model.

[0040] Furthermore, the unified authorization strategy model employs a strategy expression. To describe the authorization rules, where, Indicates the service type; Represents the set of constraints on the subject's attributes; This represents the set of constraints applied to service attributes. This represents the set of constraints relating to network state attributes; This indicates the authorization decision result, with values ​​of Permit or Deny.

[0041] Furthermore, the decision-making steps of the authorization policy decision layer include: based on the service type of the network service request. A candidate policy set is selected from a pre-set authorization policy library; the extracted subject attributes, service attributes, and network status attributes are respectively compared with each policy in the candidate policy set. 、 and Perform a match; if a match is successful, then make a decision based on the strategy for the successful match. Generate authorization decision results.

[0042] Furthermore, when multiple strategies are successfully matched and their decision results... In case of inconsistency, a deny-override conflict resolution mechanism is used to determine the final authorization decision. This mechanism works as follows: as long as there is a decision result from any successfully matching strategy... If Deny is refused, the final authorization decision will be to refuse.

[0043] Specifically, the authorization policy decision layer is used to make a unified judgment on the access legality and execution feasibility of network service requests before they enter the network forwarding control layer. Through this layer design, although different types of network services differ in request content, target objects, and execution methods, they can all complete access control under the same authorization control framework, thereby avoiding the problems of rule dispersion and management complexity caused by building independent authorization logic for different network services.

[0044] The authorization policy decision layer takes the unified mapping result output by the identifier mapping control layer as input. Based on this mapping result, the system extracts the subject attributes, service attributes, and network status attributes corresponding to the current network service request. The subject attributes describe the identity information, organization affiliation, device type, or permission level of the request initiator; the service attributes describe the service category, request target, access scope, resource requirements, or priority corresponding to the current network service request; and the network status attributes describe the current network environment and resource operating status, such as link status, network load, latency level, resource availability, or time window.

[0045] To achieve consistent authorization for different types of network service requests, this invention designs a unified authorization strategy model. This model uses subject attributes, service attributes, and network state attributes as inputs for authorization decisions, and employs a unified strategy expression. To describe the authorization rules, where, Indicates the service type; Represents the set of constraints on the subject's attributes; This represents the set of constraints applied to service attributes. This represents the set of constraints relating to network state attributes; This indicates the authorization decision result, with values ​​of Permit or Deny.

[0046] During the authorization decision-making process, the authorization strategy decision layer first filters the corresponding candidate strategy set based on the service type (ST) in the network service request. Then, it matches the subject attribute, service attribute, and network state attribute of the current request with the CS, CR, and CE attributes in the candidate strategies, respectively. If all attributes of the current request meet the constraints in the corresponding strategy, then the strategy is considered to match the current request.

[0047] If one or more policies match the current network service request, the authorization policy decision layer reads the decision result D from the matching policies. If no policy is matched, an authorization result is generated according to the system's preset default processing rules. In a preferred embodiment, the system adopts a default rejection principle, that is, when no matching policy exists, the current network service request is determined to be unauthorized.

[0048] When multiple matching strategies exist in the set, and the decision results of different strategies are inconsistent, the authorization strategy decision layer performs conflict resolution processing. In a preferred embodiment, the system adopts a deny-override conflict resolution mechanism, that is, if the decision result of any matching strategy is Deny, the final authorization result is Deny; only when all matching strategies are Permit will the final authorization result be Permit. In addition to the deny-override method, in other embodiments, conflict resolution can also be performed based on factors such as strategy priority, strategy weight, strategy update time, or strategy applicability scope.

[0049] The authorization policy decision layer ultimately outputs the authorization decision result. The authorization decision result can include allow, deny, and corresponding execution constraint information. When the authorization result is deny, the system prevents the current network service request from entering the subsequent network forwarding control process; when the authorization result is allow, the system passes the authorization result and necessary execution constraints to the network forwarding control layer to guide subsequent network-side execution behaviors such as path selection, forwarding rule distribution, data plane blocking, regional forwarding, or resource scheduling.

[0050] In this embodiment, the network forwarding control layer generates the network forwarding control result based on the service type: if the service type is an identity-based network service, then unicast, multicast, or replication forwarding rules are generated based on the target object's identity or target object address; if the service type is a spatial network service, then regional broadcast rules, replication forwarding rules, or filtering rules are generated based on the target area or the set of nodes within the area; if the service type is a resource-based network service, then resource node selection results, path forwarding rules, or service invocation instructions are generated based on the task type, resource requirements, or candidate resource nodes.

[0051] Furthermore, the management and control system for heterogeneous network services provided by the present invention also involves: after the data plane executes the network forwarding control result, it generates status feedback information and sends it back to the control plane; the management and control system is configured to trigger the remapping, reauthorization, or regeneration of the network service request based on the status feedback information.

[0052] Specifically, the network forwarding control layer generates corresponding network forwarding control results based on service type, unified mapping results, and authorization results, and then sends these results to the data plane for execution. This layer, located after the authorization policy decision layer, only performs subsequent forwarding control processing on authorized network service requests. For unauthorized network service requests, the system can directly return a rejection result or block related packets at the entry point to prevent unauthorized requests from entering the subsequent service execution stage.

[0053] In one implementation, after receiving the authorization result output by the authorization policy decision layer and the unified mapping result output by the identifier mapping control layer, the network forwarding control layer first determines the service type to which the current network service request belongs, and then generates corresponding network forwarding control results based on different service types. The network forwarding control results may include target addressing results, path selection results, flow table distribution rules, replication and forwarding rules, area broadcast rules, service instance invocation instructions, resource scheduling instructions, or other control content related to network service execution.

[0054] For identity-based network services, the network forwarding control layer can generate unicast, multicast, or replication forwarding rules based on information such as the target object's identity, address, and reachability. For spatial network services, the network forwarding control layer can generate regional broadcast rules, replication forwarding rules, or filtering rules based on the target area, the set of nodes within the area, and the regional communication method. For resource-based network services, the network forwarding control layer can generate resource node selection results, path forwarding rules, or service invocation instructions based on information such as task type, resource requirements, candidate resource nodes, node load, and resource availability.

[0055] Meanwhile, the network forwarding control layer can also perform closed-loop control based on status feedback results. During service execution, the system can continuously monitor rule effectiveness, link status, resource usage, node reachability, and abnormal events. When network load changes, link anomalies, resource shortages, service failures, or changes in authorization conditions occur, the system can trigger remapping, reauthorization, reselection of forwarding paths, or reissue of forwarding control rules based on the feedback results, thereby forming a closed-loop process between heterogeneous network service request processing and network forwarding control.

[0056] Example 2: In one embodiment, a unified management process for heterogeneous network service requests is incorporated, such as... Figure 3 The specific embodiments of the present invention are described below. This embodiment illustrates how the present invention enables unified access, identifier mapping, authorization decision-making, and forwarding control for identity-based network services, spatial network services, resource network services, and other scalable network services within the same network system.

[0057] In this embodiment, the management and control functions for heterogeneous network services are deployed in the control plane. The data plane is responsible for receiving network service requests and performing operations such as packet matching, forwarding, duplication, rate limiting, or dropping based on the network forwarding control results issued by the control plane. The control plane can be implemented using a centralized controller, a distributed controller, or other control platforms with policy management, path calculation, and rule issuance capabilities; the data plane can be implemented using ordinary network forwarding devices, programmable switching devices, or other devices capable of performing network forwarding control. In an optional embodiment, the control plane can be implemented based on an SDN controller, and the data plane can be implemented based on a programmable data plane device, with the two interacting through a southbound interface or control protocol.

[0058] During system initialization, the control plane loads management and control applications for heterogeneous network services and completes the initialization of service types, service parameter templates, identifier mapping relationships, authorization policy sets, authorization judgment rules, and data plane control interfaces. Simultaneously, the data plane pre-configures basic matching rules to identify new network service requests that need to be sent to the control plane for processing.

[0059] During the service request generation phase, users select the target network service type and fill in the corresponding service parameters through a front-end interface, structured forms, command templates, or other request submission methods. The system generates a request subject identifier based on the request initiator information and a service request identifier based on the service type and service parameters. Subsequently, the request subject identifier and the service request identifier are encapsulated together into a network service request, enabling it to enter the subsequent unified management process.

[0060] During the access request phase, network service requests first reach the data plane. The data plane performs basic matching based on existing matching rules. For requests with corresponding network forwarding control rules, the data plane can directly execute the processing according to the rules; for new requests that do not match existing rules, the data plane sends the request or its key information to the control plane for subsequent processing. In this way, the system can ensure the rapid processing of existing network service requests while also ensuring that new network service requests are uniformly included in the control plane's management process.

[0061] During the identifier resolution and mapping phase, the control plane parses the request subject identifier and service request identifier in the network service request, extracting information such as the request initiator, service type, request target, service parameters, and execution constraints. Based on the service type, it selects the corresponding mapping relationship for processing. For identity-based network services, the system can generate mapping results such as target object identity, target object address, object permission level, and object reachability. For spatial network services, the system can generate mapping results such as target area range, set of nodes within the area, and area communication method. For resource-based network services, the system can generate mapping results such as task type, resource requirements, candidate resource nodes, node load, and resource availability status. After the above processing, the system generates a unified mapping result and transmits it to the authorization policy decision layer.

[0062] During the authorization decision phase, the control plane extracts subject attributes, service attributes, and network state attributes based on the unified mapping results, and calls the corresponding authorization policy for matching and judgment. If the authorization result is denial, the control plane rejects the current network service request and may return a denial message to the request initiator, or issue blocking rules to the data plane to drop the relevant request at the entry point. If the authorization result is permission, the control plane passes the authorization result and necessary execution constraints to the network forwarding control layer.

[0063] During the forwarding control phase, the control plane generates corresponding network forwarding control results based on the service type, unified mapping results, and authorization results. For identity-based network services, the system can generate unicast, multicast, or replication forwarding rules oriented towards the target object; for spatial network services, the system can generate area broadcast rules, replication forwarding rules, or filtering rules oriented towards a specified area; for resource-based network services, the system can generate resource node selection results, path forwarding rules, or service invocation instructions by combining resource status and network status. The control plane then distributes these network forwarding control results to the data plane, which performs packet processing and network-side execution control according to the rules.

[0064] During the status feedback phase, the system collects data on network service request execution status, rule effectiveness, link status, node reachability, resource usage, and abnormal events, and returns the feedback results to the control plane or the request initiator. When link anomalies, network load changes, resource insufficiency, service failures, or changes in authorization conditions are detected, the control plane can trigger remapping, reauthorization, reselection of forwarding paths, or reissue of network forwarding control rules based on the feedback results, thereby forming a closed-loop management process between heterogeneous network service request processing and network forwarding control.

[0065] Through the above implementation methods, this invention enables unified processing of heterogeneous network service requests, such as identity-based, space-based, and resource-based requests, within a single control framework. Although different network services differ in service parameters, mapping relationships, and forwarding control results, they all operate according to a unified process of service access, identifier mapping, authorization decision-making, forwarding control, and status feedback. Compared to constructing independent processing flows for different network services, this invention reduces the complexity of multi-service integration, improves system scalability, and enhances the security and controllability of heterogeneous network service access and execution processes through a unified authorization strategy model.

[0066] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

[0067] Example 3: In one embodiment, a management and control method for heterogeneous network services is provided, applied to the control plane, for processing network service requests. The management and control method includes: Mapping steps: Receive network service requests, parse and identify the network service requests, and generate a unified mapping result; Authorization steps: Based on the unified mapping result, an authorization decision is made in conjunction with a preset unified authorization strategy model, and the authorization decision result is output; Forwarding control steps: When the authorization decision result is allowed, a network forwarding control result is generated based on the service type of the network service request, the unified mapping result, and the authorization decision result; Execution steps: The network forwarding control result is sent to the data plane to control the data plane to perform corresponding network operations.

[0068] Furthermore, the mapping step includes: generating a request subject identifier and a service request identifier for the network service request; parsing and mapping the identifier according to the service type to form the unified mapping result.

[0069] Furthermore, the authorization step includes: extracting subject attributes, service attributes, and network state attributes from the unified mapping result; and utilizing policy expressions. The attributes are matched to obtain the authorization decision result, wherein, For service type, For the set of principal attribute constraints, For a set of service attribute constraints, For the set of network state attribute constraints, For the decision outcome.

[0070] This embodiment of the method summarizes the management and control process for heterogeneous network services into four standardized steps: "mapping-authorization-control-execution," integrating the processing of various types of network services, such as identity, space, and resources, within a single control logic flow. This method effectively realizes a complete link for request parsing and mapping, comprehensive authorization judgment, and closed-loop network control within a unified framework, significantly improving the system efficiency and security controllability of integrating different types of network services.

Claims

1. A management and control system for heterogeneous network services, characterized in that, Deployed in the control plane, the system is used for unified management and control of network service requests of different service types. The system includes: The identifier mapping control layer is used to receive the network service request, parse the network service request and perform identifier mapping to generate a unified mapping result; The authorization strategy decision layer is communicatively connected to the identifier mapping control layer. It is used to make authorization decisions based on the unified mapping result and in combination with the preset unified authorization strategy model, and output the authorization decision result. The network forwarding control layer is communicatively connected to the authorization policy decision layer and the identifier mapping control layer, respectively. It is used to generate corresponding network forwarding control results based on the service type, the unified mapping result and the authorization decision result, and send the network forwarding control results to the data plane to control the data plane to perform corresponding network operations.

2. The control system as described in claim 1, characterized in that, The identifier mapping control layer is specifically used for: In response to receiving the network service request, a request subject identifier is generated to identify the request initiating entity and a service request identifier is generated to identify the requested service content. Based on the service type of the network service request, the request subject identifier and the service request identifier are parsed and mapped to form the unified mapping result.

3. The control system as described in claim 2, characterized in that, The service types include identity-based, spatial, and resource-based network services; The identifier mapping control layer is used for: If the service type is an identity-based network service, then the service request identifier is mapped to at least one of the following: target object identity, target object address, object permission level, and object reachability status. If the service type is a spatial network service, then the service request identifier is mapped to at least one of the following: target area range, set of nodes within the area, and area communication method. If the service type is a resource-based network service, then the service request identifier is mapped to at least one of the following: task type, resource requirement, candidate resource node, node load, and resource availability status. The unified mapping result includes at least the service type, request initiator information, service attribute information, request target information, and execution constraint information.

4. The control system as described in claim 1, characterized in that, The authorization strategy decision layer is specifically used for: From the unified mapping result, extract the subject attribute, service attribute, and network status attribute corresponding to the network service request; The unified authorization strategy model is used to make authorization decisions based on the subject attributes, service attributes, and network status attributes.

5. The control system as described in claim 4, characterized in that: The unified authorization strategy model uses strategy expressions. To describe the authorization rules, where, Indicates the service type; Represents the set of constraints on the subject's attributes; This represents the set of constraints applied to service attributes. This represents the set of constraints relating to network state attributes; This indicates the authorization decision result, with values ​​of Permit or Deny.

6. The control system as described in claim 5, characterized in that, The steps for the authorization strategy decision-making layer to make decisions include: Based on the service type of the network service request It selects a set of candidate strategies from a pre-configured authorization strategy library; The extracted subject attributes, service attributes, and network state attributes are respectively compared with each policy in the candidate policy set. 、 and Perform a match; If a match is successful, the decision will be based on the strategy for successful matching. Generate authorization decision results.

7. The control system as described in claim 6, characterized in that: When multiple strategies are successfully matched and their decision results In case of inconsistency, a deny-override conflict resolution mechanism is used to determine the final authorization decision. This mechanism works as follows: as long as there is a decision result from any successfully matching strategy... If Deny is refused, the final authorization decision will be to refuse.

8. The control system as described in any one of claims 1 to 7, characterized in that, The network forwarding control layer generates the network forwarding control result based on the service type: If the service type is an identity-based network service, then generate unicast, multicast, or replication forwarding rules based on the target object's identity or target object address; If the service type is a spatial network service, then generate regional broadcast rules, copy-forward rules, or filtering rules based on the target area or the set of nodes within the area; If the service type is a resource-based network service, then based on the task type, resource requirements, or candidate resource nodes, generate resource node selection results, path forwarding rules, or service call instructions.

9. The control system as described in any one of claims 1 to 7, characterized in that: After executing the network forwarding control result, the data plane generates state feedback information and sends it back to the control plane; The control system is configured to trigger the remapping, reauthorization, or regeneration of network forwarding control results for the network service request based on the status feedback information.

10. The control system as described in claim 1, characterized in that: The management and control system is implemented based on the software-defined networking (SDN) architecture. The control plane is an SDN controller, the data plane is a programmable data plane device, and the network forwarding control results are sent to the data plane through the southbound interface.

11. The control system as described in claim 10, characterized in that: The management and control system is a network application running on the SDN controller.

12. A management and control method for heterogeneous network services, characterized in that, Applied to the control plane for processing network service requests, the method includes: Receive network service requests, parse and map the network service requests to generate a unified mapping result; Based on the unified mapping result, an authorization decision is made in conjunction with a preset unified authorization strategy model, and the authorization decision result is output. When the authorization decision result is allowed, a network forwarding control result is generated based on the service type of the network service request, the unified mapping result, and the authorization decision result; The network forwarding control results are sent to the data plane to control the data plane to perform corresponding network operations.

13. The control method as described in claim 12, characterized in that, The mapping step includes: Generate a request subject identifier and a service request identifier for the network service request; The identifier is parsed and mapped according to the service type to form the unified mapping result.

14. The control method as described in claim 13, characterized in that, The authorization steps include: Extract the subject attributes, service attributes, and network status attributes from the unified mapping result; Using policy expressions The attributes are matched to obtain the authorization decision result, wherein, For service type, For the set of principal attribute constraints, For a set of service attribute constraints, For the set of network state attribute constraints, For the decision outcome.

Images