A method and system for edge node active discovery and edge-edge collaborative automatic networking

Abstract

The application discloses an edge node active discovery and edge-edge cooperative automatic networking method and system, and belongs to the technical field of network communication, and comprises the following core steps: node active discovery and topology construction; trust certificate application and security distribution; multi-dimensional security verification and trusted access; automatic certificate issuance and management; minimum authority control and health management; each step is closely linked, and a closed-loop node networking and operation and maintenance system is formed. The edge node active discovery and edge-edge cooperative automatic networking method and system have simple steps, are convenient to configure, can effectively realize full-process automatic design of edge cluster control, can complete efficient and accurate control of the edge cluster without manual intervention, ensure the safety of edge cluster control, greatly reduce the manual operation and maintenance workload of the edge cluster, realize automation and intelligentization of cluster management, significantly reduce operation and maintenance cost, and have excellent application prospect and popularization value.

Description

Technical Field

[0001] This invention belongs to the field of network communication technology, specifically relating to a method and system for active discovery of edge nodes and automatic edge-to-edge collaborative networking. Background Technology

[0002] With the rapid development of IoT, 5G and edge computing technologies, edge-to-edge collaborative clusters have become the core architecture of distributed computing and are widely used in various scenarios such as industrial IoT, smart cities, and vehicle-road collaboration.

[0003] In recent years, traditional edge node management solutions have met the basic access and operation and maintenance needs of small-scale edge nodes with their centralized management and control capabilities. However, with the continuous expansion of the scale of edge nodes and the increasing complexity of deployment environments (NAT traversal, multiple network links, physical dispersion, etc.), users have placed higher demands on the efficiency and reliability of node proactive discovery, automatic networking, and secure network access.

[0004] Due to the wide distribution of edge nodes and the complexity of their network environments, traditional manual configuration methods are costly and inefficient, making it difficult to achieve rapid access and management of large-scale nodes. Furthermore, the traditional node discovery process often lacks effective identity verification and access control, making it susceptible to unauthorized device access and posing a threat to the overall security of the edge-to-edge collaborative cluster. When new nodes join the network, reliable identity verification methods are generally lacking, and excessive privileges granted after joining can easily lead to a single point of failure spreading throughout the entire cluster if the node is physically compromised or maliciously controlled. In addition, existing node networking methods often lack automated certificate issuance, verification, and rotation mechanisms, relying on manual operations that can lead to certificate expiration and leakage, failing to meet the high security and reliability requirements of edge environments and exhibiting significant application limitations. Summary of the Invention

[0005] In response to one or more of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a method and system for active discovery of edge nodes and automatic networking of edge-to-edge collaboration. It can realize the construction of a three-level process of active node detection, trusted access verification and dynamic permission control, and integrate active discovery, automatic networking and secure network access to achieve efficient and secure edge node access and networking.

[0006] To achieve the above objectives, one aspect of the present invention provides a method for proactive discovery of edge nodes and automatic edge-to-edge collaborative networking, comprising the following processes: Active node discovery and topology construction: Core nodes within the cluster initiate distributed probing tasks, discovering candidate nodes through parallel probing using multiple protocols, and constructing node topology relationships; Trust credential application and secure distribution: The core node responds to the candidate node's network access request, verifies the candidate node's identity, and distributes a one-time network access credential bound to the device characteristics to it through a secure channel; Multi-dimensional security verification and trusted access: The core node receives the network access credentials and device fingerprints returned by the candidate node, performs multi-dimensional joint verification, and confirms the node as a trusted node after the verification is passed; Automated certificate issuance and management: Automatically issue identity certificates to trusted nodes that have passed access authorization, and monitor the certificate lifecycle to trigger automatic rotation; Least privilege management and health governance: Assign initial minimum privileges to nodes that have been issued certificates, continuously collect their operating status for health assessment, and dynamically adjust node privileges or perform risk isolation based on the assessment results.

[0007] As a further improvement of the present invention, the node active discovery and topology construction includes the following sub-steps: Initialize the detection strategy and configure the detection rules, which include the range of IP network segments to be scanned, the list of target ports, and the combination of detection protocols. Perform multi-protocol parallel probing, wherein the combination of probing protocols includes at least two of UDP probing, TCP probing, and IPv6 direct connection probing; Based on the detection results, invalid nodes that are already on the network, on the blacklist, or abnormally offline are filtered out, and a list of nodes to be admitted is generated. Based on the network connectivity between nodes, a node topology graph with link weights is constructed; wherein, the link weights include network link type, latency, and packet loss rate parameters.

[0008] As a further improvement of the present invention, the trust credential application and secure distribution includes the following sub-steps: The core node receives a network access application initiated by a candidate node, verifies whether the candidate node is in the list of nodes to be admitted, and verifies the signature of the application message; After the verification is successful, the core node generates a one-time network access token and binds the token to the preliminary hardware fingerprint of the candidate node. The one-time network access token is sent to the candidate nodes through an encrypted channel, and the generation time, validity period and bound node information of the token are recorded in the cluster middleware.

[0009] As a further improvement of the present invention, the multidimensional security verification and trusted access includes the following sub-steps: The core node receives the network access token and unique device fingerprint sent by the candidate node; wherein, the unique device fingerprint is generated by the candidate node based on its core hardware characteristics; Verify the validity of the network access token and verify the consistency between the unique device fingerprint and the initial hardware fingerprint bound to the token; The unique device fingerprint is compared with the pre-set whitelist in real time. Once all verification items pass, the candidate node is confirmed as a trusted node and granted access.

[0010] As a further improvement of the present invention, the automated certificate issuance and management includes the following sub-steps: Once a node is admitted to the cluster, it automatically sends a certificate issuance request to the cluster's built-in CA server. The CA server issues tiered certificates to nodes; wherein, the tiered certificates include a root certificate for authentication and a short-term business certificate for business communication. A preset certificate rotation trigger threshold is set; when the remaining validity period of a certificate is lower than this threshold, the renewal process is automatically triggered, a new certificate is generated and issued, and the old certificate is invalidated at the same time.

[0011] As a further improvement of the present invention, the least privilege management and health governance includes the following sub-steps: After the node completes certificate deployment, an initial least privilege policy is issued to it, restricting it to running only the basic monitoring container; Collect multidimensional health data from nodes according to a preset cycle and generate health scores; When the health score is higher than the first threshold, business load permissions are gradually unlocked; when the health score is lower than the second threshold or a serious anomaly is detected, a single point of isolation mechanism is triggered, cutting off the node's network communication, revoking its certificate, and marking it as a blacklist.

[0012] As a further improvement of the present invention, the multidimensional health data includes node resource usage, business operation status, and network connectivity.

[0013] Another aspect of the present invention provides an edge node proactive discovery and edge-to-edge collaborative automatic networking system, comprising: The node discovery module is used to perform distributed multi-protocol probing, filter invalid nodes, and generate a list of nodes to be admitted and a weighted node topology graph. The trust transfer and token distribution module is used to distribute a one-time network access token, which is initially bound to the hardware fingerprint of the candidate node, to the candidate node that initiates the request, based on the trusted identity of the already networked node. The device fingerprint and security verification module is used to collect the hardware characteristics of candidate nodes to generate a unique device fingerprint, and to perform joint verification with the network access token and the pre-configured whitelist to achieve access control. The automated certificate issuance and rotation module is used to automatically issue identity certificates to legitimate nodes that have passed verification, and to perform automatic certificate rotation and full lifecycle management. The Least Privilege and Health Assessment module is used to issue initial least privilege policies to nodes joining the network and continuously collect node operating status for health assessment in order to dynamically adjust permissions or trigger risk isolation.

[0014] As a further improvement of the present invention, the node active discovery module is specifically used for: Perform multi-protocol parallel probing, including UDP probing, TCP probing, and IPv6 direct connection probing; Based on the detection results, invalid addresses and abnormal ports are automatically cleaned up, and the list of nodes to be admitted is generated. Based on the network connectivity between nodes, a node topology graph with weighted parameters is constructed.

[0015] As a further improvement of the present invention, the one-time network access token generated by the trust transfer and token distribution module is specifically as follows: It uses AES-256 encryption and is signed by the core node; Strong binding with the initial hardware fingerprint of the node to be admitted; It is set to have a short validity period and is bound to the device fingerprint of the candidate node, limiting its use to the target candidate node.

[0016] The aforementioned improved technical features can be combined with each other as long as they do not conflict with each other.

[0017] In general, the beneficial effects of the above-described technical solutions conceived by this invention compared with the prior art mainly include: The edge node proactive discovery and edge-to-edge collaborative automatic networking method of the present invention includes the following core steps: proactive node discovery and topology construction; trust credential application and secure distribution; multi-dimensional security verification and trusted access; automated certificate issuance and management; least privilege control and health governance. Each step is interconnected, forming a closed-loop node network access and operation and maintenance system, effectively realizing the fully automated design of edge cluster management and control. It can complete efficient and accurate management and control of edge clusters without manual intervention, ensuring the security of edge cluster management and control while significantly reducing the workload of manual operation and maintenance of edge clusters, realizing the automation and intelligence of cluster management, and significantly reducing operation and maintenance costs.

[0018] The edge node proactive discovery and edge-to-edge collaborative automatic networking system of this invention adopts a modular loosely coupled design, with five core modules designed independently and interfaces standardized. Core parameters (detection cycle, certificate validity period, health threshold, etc.) can be flexibly configured, adapting to different scenarios such as industrial edge, automotive edge, and smart home, as well as edge-to-edge collaborative clusters of different sizes, without modifying the core code. Furthermore, the module configuration in the modular system can be flexibly added or removed according to actual needs (e.g., adding node behavior auditing, data encryption modules, etc.), facilitating subsequent functional iterations and scenario expansion, reducing technical upgrade costs, and solving the pain points of traditional solutions such as "poor versatility and weak scalability," thus improving the practicality and feasibility of the solution. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of the steps of the edge node active discovery and edge-to-edge collaborative automatic networking method in an embodiment of the present invention; Figure 2 This is a flowchart of the sub-steps of the edge node active discovery and edge-to-edge collaborative automatic networking method in an embodiment of the present invention; Figure 3 This is a logical flowchart of the edge node active discovery and edge-to-edge collaborative automatic networking method in this embodiment of the invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0022] In the description of this invention, it should be understood that, unless otherwise expressly specified and limited, the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," "circumferential," etc., indicating the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, are only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0023] Furthermore, unless otherwise expressly defined, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise expressly and specifically defined.

[0024] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0025] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0026] Below, for reference Figures 1-3 This invention describes a method and system for proactive discovery of edge nodes and automatic edge-to-edge collaborative networking, according to a preferred embodiment of the present invention.

[0027] Example 1: As one aspect of the present invention, this embodiment provides a method for proactive discovery of edge nodes and automatic edge-to-edge collaborative networking, the main steps of which are as follows: Figure 1 As shown, the relevant detailed sub-steps are as follows: Figure 2 As shown in the diagram, the operation logic flowchart of the automatic networking method is as follows: Figure 3 As shown in the image.

[0028] Specifically, the method in the preferred embodiment includes the following process: (1) Active node discovery and topology construction: The core nodes within the cluster initiate distributed probing tasks, discovering candidate nodes through parallel probing using multiple protocols and constructing node topology relationships.

[0029] Specifically, the node active discovery and topology construction process in the preferred embodiment preferably includes the following sub-steps: S1: Initialize the detection strategy and configure the detection rules. The detection rules include the range of IP network segments to be scanned, the list of target ports, and the combination of detection protocols.

[0030] In actual operation, the core nodes (or management nodes) that have joined the network in the cluster preferentially trigger distributed probing tasks according to a preset period (configurable, such as 30 seconds), and support the configuration of probing rules for cross-network segment and multi-link scenarios, including the range of IP network segments to be scanned (e.g., 192.168.0.0 / 24), the list of target ports (e.g., the default port 8080 for edge node communication), and the combination of probing protocols (e.g., UDP broadcast probing, TCP handshake probing, IPv6 direct connection probing, etc.).

[0031] S2: Perform multi-protocol parallel probing, and the probing protocol combination includes at least two of UDP probing, TCP probing, and IPv6 direct connection probing; wherein: UDP Probe: Send a probe packet in a custom format (containing cluster identifier and probe node ID) to the target network segment, and receive a response packet returned by the node containing its own basic information (e.g., node IP, device model, network access status); TCP probe: Perform half-open connection scanning (e.g., SYN scan) on the target port to filter out invalid addresses that are not open or have no response; IPv6 Direct Connection Probe: Performs Neighbor Discovery Protocol (NDP) on IPv6 network segments to identify the MAC address and IP binding relationship of edge nodes within the link.

[0032] By utilizing the parallel detection method that combines UDP broadcasting, TCP half-connection scanning, and IPv6 NDP direct connection probing, the limitations of single-protocol detection are overcome. It can identify edge nodes within the same network segment and accurately discover neighboring nodes in cross-NAT environments, resulting in a node discovery coverage rate of over 99%.

[0033] S3: Based on the detection results, filter invalid nodes that are already on the network, blacklisted, or abnormally offline, and generate a list of nodes to be admitted.

[0034] In actual operation, the detected node information is further cleaned to filter out nodes that have been marked as "already on the network", "blacklisted" or "abnormally offline", and only candidate nodes that are "not on the network but have normal port / protocol response" are retained, and an accurate list of nodes to be admitted is generated accordingly.

[0035] By generating a list of nodes to be admitted, the pain points of "invalid node interference and missed detection of valid nodes" in traditional detection are solved, which facilitates the identification and screening of subsequent candidate nodes for network access. Node screening can be completed without manual intervention, reducing the node discovery time from hours in traditional solutions to minutes (single network segment detection time ≤30 seconds, cross network segment detection time ≤5 minutes), and greatly improving the efficiency and accuracy of node identification.

[0036] S4: Construct a node topology graph with link weights based on the network connectivity between nodes; where link weights include network link type, latency, and packet loss rate parameters.

[0037] In detail, based on the detected network connectivity between nodes (e.g., node A can directly connect to node B, node B can access node C across NAT, etc.), a weighted node topology graph is constructed, and parameters such as the network link type (e.g., wired / wireless), latency, and packet loss rate of the nodes are labeled and synchronized to the cluster management platform.

[0038] By constructing a weighted node topology graph, precise link selection is provided for subsequent node networking, improving the networking deployment efficiency of edge-to-edge collaborative clusters by more than 60%. It is especially suitable for the characteristics of "dispersed nodes and complex network environment" in edge scenarios, and significantly reduces the labor and time costs of cluster deployment.

[0039] By utilizing the multi-protocol parallel detection and distributed topology construction in step (1), the technical pain points of traditional edge-to-edge collaborative clusters, such as "slow node discovery, difficulty in cross-network segment networking, and chaotic topology", are solved. This achieves efficient node discovery and networking, effectively improves the coverage and efficiency of node discovery, avoids the possibility of invalid nodes entering the network, and provides convenience for the automatic networking of edge nodes.

[0040] (2) Trust credential application and secure distribution: The core node responds to the candidate node's network access request, verifies the candidate node's identity, and distributes a one-time network access credential bound to the device characteristics to it through a secure channel; Specifically, the trust credential application and secure distribution process in the preferred embodiment includes the following sub-steps: S5: The core node receives the network access application initiated by the candidate node, verifies whether the candidate node is in the list of nodes to be admitted, and verifies the signature of the application message.

[0041] In actual operation, the node to be admitted (candidate node) initiates a network access application to the core node in the cluster through a probe message. The application message (i.e. the response message in S2) contains the node's own basic information (IP, hostname, node name) and carries the cluster identifier obtained in the probe phase to prove its legitimacy.

[0042] Furthermore, the core node receives the aforementioned application message and verifies the candidate node against the list of nodes to be admitted, determining whether the candidate node is within the list of nodes to be admitted.

[0043] At the same time, the signature of the application message is verified (based on the cluster's pre-configured root public key) to confirm that the message has not been tampered with; if the verification fails, the application is rejected directly and an exception log is recorded.

[0044] S6: After the verification is passed, the core node generates a one-time network access token and binds the token to the preliminary hardware fingerprint of the candidate node; For the one-time network access token in the preferred embodiment, it preferably adopts AES-256 encryption and core node signature mechanism to eliminate the risk of the token being hijacked, reused or tampered with from the source.

[0045] More specifically, for the generated one-time network access tokens, it is preferable to configure them with an expiration date, such as 10 minutes. When the core node receives an expired one-time network access token, it directly determines the candidate node as an untrusted node and blocks it from joining the network. This setting can fundamentally avoid the risk of tokens being hijacked, reused, or tampered with.

[0046] Furthermore, for the aforementioned preliminary hardware fingerprint, it is preferable to use the identity information pre-configured by the candidate node. By binding the one-time network access token with the preliminary hardware fingerprint of the candidate node, a reliable comparison basis can be provided for subsequent network access verification.

[0047] S7: The one-time network access token is issued to the candidate node through an encrypted channel, and the generation time, validity period and bound node information of the token are recorded in the cluster platform to ensure that the token is traceable throughout its entire life cycle.

[0048] (3) Multi-dimensional security verification and trusted access: The core node receives the network access credentials and device fingerprints returned by the candidate nodes, performs multi-dimensional joint verification, and confirms the node as a trusted node after the verification is passed.

[0049] Specifically, the multi-dimensional security verification and trusted access process in the preferred embodiment preferably includes the following sub-steps: S8: The core node receives the network access token and unique device fingerprint sent by the candidate node; the unique device fingerprint is generated by the candidate node based on its core hardware characteristics. Subsequently, the validity of the network access token is verified, and the consistency between the unique device fingerprint and the preliminary hardware fingerprint bound to the token is confirmed.

[0050] In detail, after receiving the one-time network access token issued through a secure channel, the candidate node collects its own core hardware characteristics (such as CPU serial number, motherboard serial number, etc.) to generate a unique device fingerprint. Subsequently, the candidate node sends the one-time network access token and the unique device fingerprint to the core node, which verifies the validity of the token (not expired, not used, and the signature is valid) and verifies the consistency between the initial hardware fingerprint bound to the token and the unique device fingerprint generated after full data collection.

[0051] S9: The unique device fingerprint is compared with the pre-set whitelist in real time. After all verification items pass, the candidate node is confirmed as a trusted node and granted access.

[0052] By comparing the unique device fingerprint of a candidate node with the cloud / local pre-configured edge node whitelist in real time, it is confirmed whether the candidate node is a pre-authorized legitimate node.

[0053] Once the admission node passes the above verification, the core node sends an "admission passed" instruction and the access address for subsequent network access procedures to the candidate node, making the candidate node a trusted node. If any verification item fails, the network access process is immediately terminated, the node is added to the list of abnormal nodes, and an alarm is triggered.

[0054] In a preferred embodiment, a one-time network access token, generated through core node signature, encryption, and secure distribution, is strongly bound to the preliminary hardware fingerprint of the node to be admitted. This enables the core node to endorse the candidate node and provides a basis for subsequent node verification. Simultaneously, the generation of the candidate node's unique device fingerprint, and its comparison with the preliminary hardware fingerprint and a pre-set whitelist, fully ensures the reliability of node verification, guaranteeing that only pre-authorized legitimate node devices can pass the admission verification, achieving a 100% interception rate for illegal nodes.

[0055] In the preferred embodiment, a three-tiered protection system of "trust credentials - identity verification - access control" is constructed by integrating trust transfer, device fingerprint verification, and zero-trust security mechanisms. Multiple verification steps, such as application message signature verification and token validity verification, are added during the access verification process, realizing full-process security control of edge node network access. This forms a security closed loop of "pre-interception, in-process verification, and post-event traceability," effectively solving the security risks of "weak identity verification, easy impersonation of illegal nodes, and easy hijacking of tokens" in traditional edge networking. It completely eliminates the risk of illegal nodes impersonating legitimate nodes to access the cluster, stealing data, or launching malicious attacks, ensuring the network security and data security of the edge-to-edge collaborative cluster.

[0056] (4) Automated certificate issuance and management: It automatically issues identity certificates to trusted nodes that grant access and monitors the certificate lifecycle to trigger automatic rotation.

[0057] Specifically, the automated certificate issuance and management process in the preferred embodiment preferably includes the following sub-steps: S10: After a node passes the admission test, it automatically sends a certificate issuance request to the CA server built into the cluster. In actual operation, trusted nodes that have obtained access permission send a certificate issuance request to the CA (Certificate Authority) server built into the cluster. The request message includes the device fingerprint, node ID, access permission certificate, etc., and is preferably transmitted via TLS 1.3 encryption.

[0058] S11: The CA server issues hierarchical certificates to nodes; among which, the hierarchical certificates include root certificates for authentication and short-term business certificates for business communication; Specifically, after the CA server verifies the legitimacy of the request, it issues two levels of certificates to the node: L1 Root Certificate: Cluster-level root certificate used to verify the legitimacy of node identities, with a preferred validity period of 1 year; L2 Business Certificate: A short-term business certificate that contains only the minimum identity fields required by the node (such as device fingerprint, node ID, and permission identifier). It is used for encryption of inter-node communication and authorization of business operations, and its validity period is configurable (e.g., 7 days).

[0059] It is understandable that the validity periods of the aforementioned root certificates and business certificates can be configured according to the actual situation. The validity period of the root certificate can be configured at the initial stage of system networking, and the short-term validity period of the business certificate can be dynamically configured during the certificate issuance process, which will not be elaborated here.

[0060] S12: Preset certificate rotation trigger threshold; when the remaining validity period of a certificate is lower than this threshold, the renewal process is automatically triggered, a new certificate is generated and issued, and the old certificate is invalidated at the same time.

[0061] In actual operation, it is preferable to configure a certificate rotation trigger threshold for the issued certificates (e.g., certificate remaining validity period < 24 hours).

[0062] Taking the rotation of business certificates as an example, when the remaining validity period after issuance reaches a threshold, the certificate renewal process is automatically triggered. The node initiates a renewal request to the CA server, and the renewal request message preferably carries the old certificate, the current device fingerprint, and the node's health status. Accordingly, after the CA server verifies that the node's status is normal, it generates a new L2 business certificate and issues it, while simultaneously invalidating the old certificate. If the node renewal fails (e.g., due to fingerprint change or abnormal status), the certificate is immediately marked as "invalid" and an alarm is triggered.

[0063] By establishing the aforementioned automated certificate issuance and rotation management mechanism, the problems of low efficiency in manual issuance, easy expiration and invalidation of certificates, and lack of traceability throughout the entire process that exist in traditional edge node certificate management are effectively solved. It achieves automated management of the entire lifecycle of certificates, from issuance, rotation, renewal to invalidation, significantly improving the compliance and reliability of node identity authentication. Moreover, the construction of this automated certificate management mechanism increases certificate issuance efficiency by more than 80% and effectively avoids node disconnection due to certificate expiration.

[0064] Furthermore, the certificate is strongly bound to the device fingerprint. If a node experiences fingerprint changes or abnormal status, the module can immediately revoke the certificate and mark it as invalid, further enhancing the security of identity authentication and avoiding security risks caused by certificate misuse. At the same time, the entire process of certificate issuance, updating, and invalidation is recorded and synchronized to the cluster audit system, enabling traceable and auditable certificate management and meeting compliance control requirements in edge collaboration scenarios.

[0065] (5) Least privilege management and health governance: Assign initial minimum permissions to nodes that have been issued certificates, continuously collect their operational status for health assessment, and dynamically adjust node permissions or perform risk isolation based on the assessment results.

[0066] Specifically, after certificate issuance and deployment, the least privilege control and health governance process preferably includes the following sub-steps: S13: After the node completes certificate deployment, issue an initial least privilege policy to it, restricting it to running only the basic monitoring container.

[0067] The initial least privilege policy prioritizes allowing nodes to run basic monitoring containers (such as resource collection and heartbeat reporting), restricting nodes' access to cluster storage, network, and other nodes, and prohibiting the running of core business loads. This avoids the impact of illegal operations or abnormal nodes on the core resources and business of the cluster, solves the problems of "coarse permission allocation, difficulty in managing abnormal nodes, and easy spread of risks" in traditional edge clusters, and achieves stable operation and controllable risks of the cluster.

[0068] S14: Collect multidimensional health data of nodes according to a preset cycle and generate a health score.

[0069] More specifically, the aforementioned multidimensional health data preferably includes node resource usage, business operation status, and network connectivity.

[0070] S15: When the health score is higher than the first threshold, gradually unlock business load permissions; when the health score is lower than the second threshold or a serious anomaly is detected, trigger the single point isolation mechanism, cut off the node's network communication, revoke its certificate and mark it as blacklisted.

[0071] By leveraging a multi-dimensional health assessment mechanism (e.g., resource status, business status, network status), real-time node operation data is collected, forming a control strategy of "initial least privilege + dynamic unlocking + anomaly recovery." This ensures the normal operation of legitimate nodes while promptly identifying and managing abnormal nodes. Furthermore, health scoring-based assessments ensure the stability of nodes in the initial stage and reduce adverse impacts on the cluster. The tiered unlocking of load balancing permissions provides sufficient buffer time for dynamic node control, enhancing cluster control flexibility. On the other hand, an innovative single-point isolation mechanism allows for rapid isolation of risky nodes when serious anomalies occur. This includes cutting off network communication between the node and the cluster, revoking certificates, and blacklisting, preventing the anomaly from spreading to the entire cluster. This approach ensures both the secure and stable operation of the cluster and meets the needs of normal business operations, effectively adapting to the challenging node maintenance characteristics of edge computing scenarios.

[0072] In practical applications, this mechanism can reduce the failure rate of cluster nodes by more than 70% and shorten the response time for handling abnormal nodes to within 1 minute, effectively ensuring the stable operation of the edge-to-edge collaborative cluster. It is especially suitable for the characteristics of "high difficulty in node operation and maintenance and untimely fault diagnosis" in edge scenarios.

[0073] Based on the aforementioned method and process settings in Example 1, a fully automated design for edge cluster management can be achieved, forming an automated networking process that includes node discovery, token distribution, certificate issuance and rotation, health assessment, and access control. This process can be completed without manual intervention, significantly reducing the workload of manual operation and maintenance of edge clusters, realizing automation and intelligence in cluster management, and significantly reducing operation and maintenance costs. Simultaneously, by utilizing the full lifecycle management of certificates and node health management, not only is self-iterative optimization of cluster management achieved, but conditions are also provided for the formation of anomaly handling mechanisms. This allows the cluster management process to automatically handle common issues such as detection anomalies, token anomalies, and certificate anomalies, ensuring that manual intervention is triggered only in cases of major anomalies. This reduces the workload of operation and maintenance personnel by more than 80%, further improving operation and maintenance efficiency and reducing operation and maintenance costs.

[0074] Example 2: In this embodiment, based on the aforementioned edge node proactive discovery and edge-to-edge collaborative automatic networking method, a further edge node proactive discovery and edge-to-edge collaborative automatic networking system is provided, which preferably includes: The node discovery module is used to perform distributed multi-protocol probing, filter invalid nodes, and generate a list of nodes to be admitted and a weighted node topology graph. The trust transfer and token distribution module is used to distribute a one-time network access token, which is initially bound to the hardware fingerprint of the candidate node, to the candidate node that initiates the request, based on the trusted identity of the already networked node. The device fingerprint and security verification module is used to collect the hardware characteristics of candidate nodes to generate a unique device fingerprint, and to perform joint verification with the network access token and the pre-configured whitelist to achieve access control. The automated certificate issuance and rotation module is used to automatically issue identity certificates to legitimate nodes that have passed verification, and to perform automatic certificate rotation and full lifecycle management. The Least Privilege and Health Assessment module is used to issue initial least privilege policies to nodes joining the network and continuously collect node operating status for health assessment in order to dynamically adjust permissions or trigger risk isolation.

[0075] More preferably, for the node active discovery module in the preferred embodiment, its configuration function is preferably specifically used for: Perform multi-protocol parallel probing, including UDP broadcast probing, TCP half-open connection scanning, and IPv6 NDP direct connection probing; Based on the detection results, invalid addresses and abnormal ports are automatically cleaned up, and a list of nodes to be admitted is generated. Based on the network connectivity between nodes, a node topology graph with weighted parameters is constructed.

[0076] During the active node discovery process, by using multi-protocol parallel detection and illegal node filtering, invalid addresses and abnormal ports can be accurately filtered out, leaving only legally accessible nodes. This provides a basic node list (i.e., a list of nodes to be admitted) for subsequent automatic networking, forming the foundation and prerequisite for system operation.

[0077] More specifically, for the one-time network access token generated by the trust transfer and token distribution module in the preferred embodiment, it preferably has the following configuration details: It uses AES-256 encryption and is signed by the core node; Strong binding with the initial hardware fingerprint of the node to be admitted; It is set to have a short validity period and is bound to the device fingerprint of the candidate node, limiting its use to the target candidate node.

[0078] Based on the aforementioned configuration settings, it is ensured that the one-time network access token can obtain the trust endorsement of the core node, and the controllability of the network access certificate is fully enhanced to avoid the abuse and theft of the network access certificate, and to ensure that the network access process of candidate nodes is safe and controllable.

[0079] By leveraging the aforementioned edge node proactive discovery and edge-to-edge collaborative automatic networking system, a modular, loosely coupled design is adopted. Five core modules are designed independently with standardized interfaces. Core parameters (probe cycle, certificate validity period, health threshold, etc.) are flexibly configurable, allowing adaptation to various scenarios such as industrial edge, automotive edge, and smart home, as well as edge-to-edge collaborative clusters of different sizes, without modifying the core code. Furthermore, the modular system allows for flexible addition or removal of modules based on actual needs (e.g., adding node behavior auditing, data encryption modules, etc.), facilitating subsequent functional iterations and scenario expansion, reducing technical upgrade costs, and addressing the pain points of traditional solutions such as "poor versatility and weak scalability," thus improving the practicality and feasibility of the solution.

[0080] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for proactive discovery of edge nodes and automatic edge-to-edge collaborative networking, characterized in that, The process includes the following: Active node discovery and topology construction: Core nodes within the cluster initiate distributed probe tasks; initialize probe strategies and configure probe rules, which include the range of IP network segments to be scanned, a list of target ports, and a combination of probe protocols; execute parallel multi-protocol probes, where the combination of probe protocols includes at least two of UDP probes, TCP probes, and IPv6 direct connection probes; based on the probe results, filter invalid nodes that are already on the network, blacklisted, or abnormally offline, and generate a list of nodes to be admitted. Based on the network connectivity between nodes, a node topology graph with link weights is constructed; wherein, the link weights include network link type, latency, and packet loss rate parameters; Trust credential application and secure distribution: The core node responds to the candidate node's network access request and verifies the candidate node's identity; the core node generates a one-time network access token and binds the one-time network access token to the candidate node's preliminary hardware fingerprint, and distributes the one-time network access token to the candidate node through an encrypted channel; wherein: the preliminary hardware fingerprint is the candidate node's pre-configured identity information; Multi-dimensional security verification and trusted access: The core node receives a one-time network access token and a unique device fingerprint sent by the candidate node; wherein, the unique device fingerprint is generated by the candidate node based on its core hardware characteristics; the validity of the one-time network access token is verified, and the consistency between the unique device fingerprint and the preliminary hardware fingerprint is verified; the unique device fingerprint is compared with a pre-set whitelist in real time, and after all verification items pass, the candidate node is confirmed as a trusted node and granted access; Automated certificate issuance and management: Automatically issue identity certificates to trusted nodes that have passed access authorization, and monitor the certificate lifecycle to trigger automatic rotation; Least privilege control and health governance: After the node completes certificate deployment, an initial least privilege policy is issued to it, limiting it to running only basic monitoring containers; multi-dimensional health data of the node is collected at preset intervals and a health score is generated; when the health score is higher than the first threshold, business load permissions are gradually unlocked; when the health score is lower than the second threshold, a single point isolation mechanism is triggered, cutting off the node's network communication, revoking its certificate, and marking it as a blacklist.

2. The edge node active discovery and edge-to-edge collaborative automatic networking method according to claim 1, characterized in that, The trust credential request and secure distribution includes the following sub-steps: The core node receives a network access application initiated by a candidate node, verifies whether the candidate node is in the list of nodes to be admitted, and verifies the signature of the application message; After the verification is successful, the core node generates a one-time network access token and binds the one-time network access token to the preliminary hardware fingerprint of the candidate node; The one-time network access token is sent to the candidate nodes through an encrypted channel, and the generation time, validity period and bound node information of the one-time network access token are recorded in the cluster middleware.

3. The edge node active discovery and edge-to-edge collaborative automatic networking method according to claim 1, characterized in that, The automated certificate issuance and management includes the following sub-steps: Once a node is admitted to the cluster, it automatically sends a certificate issuance request to the cluster's built-in CA server. The CA server issues tiered certificates to nodes; wherein, the tiered certificates include a root certificate for authentication and a short-term business certificate for business communication. A preset certificate rotation trigger threshold is set; when the remaining validity period of a certificate is lower than this threshold, the renewal process is automatically triggered, a new certificate is generated and issued, and the old certificate is invalidated at the same time.

4. The method for active discovery of edge nodes and automatic edge-to-edge collaborative networking according to any one of claims 1 to 3, characterized in that, The multidimensional health data includes node resource usage, business operation status, and network connectivity.

5. An edge node proactive discovery and edge-to-edge collaborative automatic networking system, characterized in that, include: The node discovery module is used to perform the following process: initiating a distributed probing task through the core nodes within the cluster; Initialize the detection strategy and configure the detection rules, which include the range of IP network segments to be scanned, the list of target ports, and the combination of detection protocols; perform multi-protocol parallel detection, and the combination of detection protocols includes at least two of UDP detection, TCP detection, and IPv6 direct connection detection; based on the detection results, filter invalid nodes that are already on the network, blacklisted, or abnormally offline, and generate a list of nodes to be admitted. Based on the network connectivity between nodes, a node topology graph with link weights is constructed; wherein, the link weights include network link type, latency, and packet loss rate parameters; The trust transfer and token distribution module is used to perform the following process: the core node responds to the candidate node's network access request and verifies the candidate node's identity; the core node generates a one-time network access token and binds the one-time network access token to the candidate node's preliminary hardware fingerprint, and distributes the one-time network access token to the candidate node through an encrypted channel; wherein: the preliminary hardware fingerprint is the candidate node's pre-configured identity information; The device fingerprint and security verification module is used to perform the following process: the control core node receives a one-time network access token and a unique device fingerprint sent by the candidate node; the unique device fingerprint is generated by the candidate node based on its core hardware characteristics; the validity of the one-time network access token is verified, and the consistency between the unique device fingerprint and the preliminary hardware fingerprint is verified; the unique device fingerprint is compared with a pre-set whitelist in real time, and after all verification items pass, the candidate node is confirmed as a trusted node and granted access; The automated certificate issuance and rotation module is used to automatically issue identity certificates to legitimate nodes that have passed verification, and to perform automatic certificate rotation and full lifecycle management. The Least Privilege and Health Assessment module is used to issue an initial least privilege policy to nodes after certificate deployment, limiting them to running only basic monitoring containers; collect multi-dimensional health data of nodes at preset intervals and generate health scores; when the health score is higher than the first threshold, gradually unlock business load permissions; when the health score is lower than the second threshold, trigger a single point isolation mechanism to cut off the node's network communication, revoke its certificate and mark it as blacklisted.

6. The edge node active discovery and edge-to-edge collaborative automatic networking system according to claim 5, characterized in that, The node active discovery module is specifically used for: Perform multi-protocol parallel probing, including UDP probing, TCP probing, and IPv6 direct connection probing; Based on the detection results, invalid addresses and abnormal ports are automatically cleaned up, and the list of nodes to be admitted is generated. Based on the network connectivity between nodes, a node topology graph with weighted parameters is constructed.

7. The edge node active discovery and edge-to-edge collaborative automatic networking system according to claim 5 or 6, characterized in that, The one-time network access token generated by the trust transfer and token distribution module is specifically: It uses AES-256 encryption and is signed by the core node; It is set to have a short validity period and is bound to the initial hardware fingerprint of the candidate node, limiting its use to the target candidate node only.

Images