A cross-domain network communication trusted networking system

Abstract

Embodiments of the present application provide a cross-domain network communication trusted networking system, a flow table management controller, used for acquiring historical flow tables, hardware storage information and terminal access information of an edge gateway, determining target flow table items according to the terminal access information and interaction time of each flow table item, constructing a terminal communication graph according to the communication interaction direction of each target flow table item in the case that the hardware storage information and the number of target flow table items satisfy a preset condition, determining the sending index and receiving index of each terminal according to the connection relationship of each terminal in the terminal communication graph, determining the item weight of the target flow table item according to the sending index, receiving index and interaction time of the target flow table item corresponding terminal, issuing a flow table operation instruction corresponding to the item weight to the edge gateway, and the edge gateway is used for operating the flow table item according to the flow table operation instruction. The technical scheme of the embodiments of the present application can relieve the storage pressure of the network flow table, and further reduce the network congestion caused by the storage pressure.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a trusted networking system for cross-domain network communication. Background Technology

[0002] In flexible manufacturing networks, a large number of mobile and fixed terminals are deployed in industrial settings. Due to the dynamic adjustment of production units, mobile terminals frequently move across regions, resulting in a high frequency of dynamic binding and unbinding between MAC addresses and dynamically assigned IP addresses. Because of the continuous changes in the physical location and address pool of communication nodes, edge gateways cannot rely on pre-configured static routing tables to maintain master-slave control links and must rely on the dynamic learning and aging mechanism of the flow tables in the underlying switching chips to achieve data forwarding.

[0003] However, existing flow table aging mechanisms mostly employ fixed, static timeout strategies, which are difficult to adapt to the highly dynamic topology changes of flexible production lines. Specifically, the system presets a uniform aging threshold for all flow table entries, and regardless of whether the data flow has actually terminated, it must wait for the timer to expire before deletion. The drawback of this mechanism is that in high-concurrency networking and routing scenarios, a large number of "zombie flow tables" generated by the movement of terminals across regions, although having lost their forwarding significance, remain indefinitely before reaching the aging threshold. These invalid entries not only meaninglessly occupy valuable hardware entry resources, but also significantly increase matching lookup latency and even induce flow table overflow due to the disorderly expansion of flow table size. In addition, aging flow tables that are not updated in a timely manner may cause edge gateways to misforward based on expired paths or trigger unnecessary flooding queries, further exacerbating network congestion and severely reducing the real-time delivery rate of industrial control messages. Summary of the Invention

[0004] This invention provides a trusted networking system for cross-domain network communication. Through the embodiments of this invention, "zombie flow tables" in flow tables or flow table entries can be accurately identified and corresponding control operations can be performed, which improves the processing efficiency of flow tables, saves storage resources in high-concurrency environments, and avoids network congestion.

[0005] In a first aspect, embodiments of the present invention provide a trusted networking system for cross-domain network communication, the system comprising a flow table management controller and an edge gateway: The flow table management controller is used to obtain the historical flow table, hardware storage information and terminal access information of the edge gateway. The flow table entries in the historical flow table include the communication interaction direction and interaction time between the terminals connected to the gateway. The flow table management controller is used to determine the target flow table entry based on the terminal access information and the interaction time of each flow table entry; The flow table management controller is used to construct a terminal communication graph based on the communication interaction direction of each target flow table entry when the number of hardware storage information and target flow table entries meets preset conditions, and to determine the sending index and receiving index of each terminal based on the connection relationship of each terminal in the terminal communication graph. The flow table management controller is used to determine the item weight of any target flow table item based on the sending index, receiving index and interaction time of the terminal corresponding to the target flow table item. The flow table management controller is used to issue flow table operation instructions corresponding to the item weights to the edge gateway; The edge gateway is used to operate on the target flow table entry according to the flow table operation instructions.

[0006] Secondly, embodiments of the present invention provide a trusted networking method for cross-domain network communication, specifically applicable to the flow table management controller in a trusted networking system for cross-domain network communication, the method comprising: Obtain the historical flow table, hardware storage information and terminal access information of the edge gateway, wherein the flow table entries in the historical flow table include the communication interaction direction and interaction time between the terminals connected to the gateway; The target flow entry is determined based on the terminal access information and the interaction time of each flow entry; When the number of hardware storage information and target flow table entries meets the preset conditions, a terminal communication graph is constructed according to the communication interaction direction of each target flow table entry, and the sending index and receiving index of each terminal are determined according to the connection relationship of each terminal in the terminal communication graph. For any target flow table entry, the entry weight is determined based on the sending index, receiving index, and interaction time of the terminal corresponding to the target flow table entry. Send flow table operation instructions corresponding to the item weights to the edge gateway.

[0007] This invention provides a trusted cross-domain network communication system, comprising a flow table management controller and an edge gateway. The flow table management controller acquires historical flow tables, hardware storage information, and terminal access information from the edge gateway. The historical flow table entries include the communication interaction direction and interaction time between terminals connected to the gateway. The flow table management controller determines target flow table entries based on the terminal access information and the interaction time of each flow table entry. When the number of hardware storage information and target flow table entries meets preset conditions, the flow table management controller constructs a terminal communication graph based on the communication interaction direction of each target flow table entry, and determines the sending index and receiving index of each terminal based on the connection relationship of each terminal in the terminal communication graph. For any target flow table entry, the flow table management controller determines the item weight of the target flow table entry based on the sending index, receiving index, and interaction time of the terminal corresponding to the target flow table entry. The flow table management controller issues flow table operation instructions corresponding to the item weights to the edge gateway. The edge gateway operates on the target flow table entries according to the flow table operation instructions. Specifically, by filtering target flow entries and then performing corresponding control operations on them based on their weights, high-weight flow entries can be continuously stored, while zombie flow entries can be quickly deleted, saving storage resources and avoiding network congestion. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0009] Figure 1 This is a schematic diagram of the structure of a cross-domain network communication trusted networking system provided in an embodiment of the present invention; Figure 2 This is a flowchart of a trusted networking method for cross-domain network communication provided in an embodiment of the present invention. Detailed Implementation

[0010] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0011] Example 1 Figure 1This is a schematic diagram of a cross-domain network communication trusted networking system provided by an embodiment of the present invention. This system is specifically applicable to flow table management in edge gateways within industrial control networks, particularly suitable for high-concurrency environments or situations with insufficient storage space, where efficient flow table management is crucial. The system may include a flow table management controller and an edge gateway. The flow table management controller can be an industrial gateway controller, various servers, or computers, and is not limited thereto.

[0012] like Figure 1 As shown, the system includes a flow table management controller 110, an edge gateway 120, and a terminal 130, with communication connections between the components: The flow table management controller is used to obtain historical flow tables, hardware storage information and terminal access information of the edge gateway. The flow table entries in the historical flow table include the communication interaction direction and interaction time between the terminals connected to the gateway.

[0013] The flow table management controller is a control component for flow table management on the edge gateway side. It is used for unified management of flow table storage and is communicatively or physically connected to the edge gateway. The edge gateway is a gateway device deployed at the network edge and directly connected to terminal devices, responsible for communication forwarding and connection between terminal devices. Further, during the communication process, the terminal devices retain communication records, i.e., flow table entries, in the gateway's hardware memory. A flow table entry is a single record in the flow table, used to match packets (e.g., based on MAC / IP / port / protocol) and execute corresponding actions (forwarding, discarding, rewriting, etc.). Each flow table entry also records the communication interaction direction and interaction time between itself and the terminal connected to the gateway: the interaction direction represents the send-receive relationship between the two terminals associated with the flow, and the interaction time is the timestamp (or time window) of a single communication behavior; both together constitute the timeliness characteristic of the flow table entry. Given the limited storage space of the gateway, it is urgent to implement efficient management of flow table entries through the solution of this embodiment of the invention to ensure their reasonable storage.

[0014] The hardware storage information refers to parameters characterizing the capacity and idle status of the internal hardware media (such as TCAM) of the edge gateway, used to determine whether the resource conditions for performing flow table optimization operations are met. It should be understood that flow table storage optimization aims to reduce memory space usage; therefore, hardware storage information constitutes key data for flow table optimization. For example, hardware storage information may include the current entry capacity, the maximum available entry capacity, and a preset security threshold; it may also include relevant indicators derived from the aforementioned parameters, such as the current capacity utilization rate (current entry capacity / maximum available entry capacity = current capacity utilization rate), and the preset security threshold may be 90%. This invention does not specifically limit this aspect.

[0015] Specifically, the flow table management controller queries the statistics register in the edge gateway by issuing flow statistics request commands, or reads the flow table log file in the gateway's local persistent storage (such as Flash or database) to obtain historical or current flow tables. The controller reads the memory-related OID nodes in the MIB library via the SNMP protocol, or calls the SDK interface provided by the chip manufacturer to obtain data such as the total number of table entries, the number of occupied table entries, and the remaining percentage; it obtains the list of online terminals by parsing the ARP (Address Resolution Protocol) table and MAC address forwarding table (FDB) reported by the gateway, or by listening to DHCP ACK packets, and further obtains the topology and access information of directly connected devices.

[0016] For example, during initial system startup or when an edge gateway first connects to the control network, a read request is first sent to each edge gateway. The system uses the Standard Simple Network Management Protocol (SNMP) to exchange and parse request and response messages, obtaining the device's factory registration information. From the parsed hardware factory registration information, the system extracts the legitimate Media Access Control (MAC) address pool under that edge gateway and simultaneously reads the absolute value representing the carrying capacity of the device's underlying storage chip, recording it as the maximum available table entry capacity. The system persistently stores the legitimate MAC address pool and preset security thresholds in the local configuration library. These preset parameters serve as the core benchmark for triggering the circuit breaker protection mechanism. Furthermore, due to the influence of production line cycles in industrial settings, the communication status of devices exhibits high-frequency fluctuations. To avoid network layer logical relationship misalignment caused by sampling timing deviations, the system sets a fixed time window (e.g., 10 seconds) as the status polling cycle. When the clock reaches the start of the cycle, the system immediately broadcasts a global statistical read request to all edge gateways within the control domain. After reading the flow table, the system determines the terminal identifier, interaction direction, and most recent interaction time data through field parsing.

[0017] The flow table management controller is used to determine the target flow table entry based on the terminal access information and the interaction time of each flow table entry.

[0018] The target flow table entries are a subset of flow table entries selected by the flow table management controller after verifying the validity of terminal access information and determining the activity level based on the interaction time. They serve as the benchmark objects for subsequent weight calculations. It is understood that the target flow table entries may be zombie flow tables that need to be cleaned up. However, due to memory limitations and cleanup efficiency, it is necessary to determine the cleanup priority of each target flow table entry. The specific method is described in the following content of this invention.

[0019] Specifically, the flow table management controller is used for: If the terminal access information indicates that the current access terminal does not match the preset secure terminal list, the flow table entry corresponding to the terminal is determined as the first flow table entry; if the most recent interaction time represented by the flow table entry meets the preset duration condition, the flow table entry is determined as the second flow table entry; the first flow table entry and the second flow table entry are determined as the target flow table entry.

[0020] The preset secure terminal list is a pre-configured set of trusted terminal identifiers, used as a basis for verifying the legitimacy of terminal access identities. For example, this list is stored locally on the edge gateway or controller and includes the MAC address, IP address, or physical address of authenticated terminals. When an identifier in the terminal access information does not match this list, the terminal is determined to be an illegal or unauthorized device. The first flow entry is a subset of specific flow entries filtered by the flow table management controller based on security policies, used to characterize communication behavior involving insecure terminals. The preset duration condition is a pre-set time threshold rule used to evaluate the activity or staleness of flow entries to determine whether communication behavior has expired. For example, if the last message interaction of a flow entry occurred 5 minutes ago, it is determined to meet the preset duration condition and is considered an inactive or aging flow. It should be noted that in a flexible manufacturing environment, when terminals such as automated guided vehicles cross different production areas, their wireless signals may leave the coverage area of ​​the original edge gateway, causing the flow tables remaining at the bottom layer of the original gateway to become absolutely obsolete junk entries. This sub-step aims to eliminate such absolutely invalid entries by comparing physical and network locations, and further filter active entries to reduce the subsequent computing burden.

[0021] The flow table management controller is used to construct a terminal communication graph based on the communication interaction direction of each target flow table entry, provided that the number of hardware storage information and target flow table entries meets preset conditions, and to determine the sending index and receiving index of each terminal based on the connection relationship of each terminal in the terminal communication graph.

[0022] Specifically, the flow table management controller is used for: When the hardware storage information indicates that the current capacity occupancy rate is greater than a preset security threshold and the number of target flow entries is greater than a preset quantity threshold, a terminal communication graph is constructed based on the communication interaction direction between terminals in each target flow entry.

[0023] Furthermore, the source and destination identifiers in each target flow table entry are determined, and the uniquely identified terminals are used as nodes, and the communication interaction direction of the flow table entry is used as a directed edge; based on the nodes and directed edges, a terminal communication graph is generated.

[0024] The triggering conditions for constructing the terminal communication graph (i.e., the current capacity occupancy rate is greater than a preset security threshold and the number of target flow table entries is greater than a preset quantity threshold) are pre-defined logical judgment rules for triggering subsequent processing flows. These rules involve the numerical relationship between hardware storage capacity and the number of target flow table entries, ensuring the feasibility of the execution environment. It is understandable that if the hardware storage capacity is too large, there is no need for flow table deletion management; similarly, if the number of target flow table entries is 0, deletion management cannot be performed. The terminal communication graph is a topology structure constructed with terminals as nodes and the communication interaction directions of target flow table entries as directed edges, representing the communication connection relationships between managed terminals. The sending index is a quantitative value calculated based on the out-degree or out-edge weight of the terminal in the terminal communication graph, representing the activity level of the terminal as a communication initiator; the receiving index is a quantitative value calculated based on the in-degree or in-edge weight of the terminal in the terminal communication graph, representing the activity level of the terminal as a communication receiver.

[0025] Specifically, the initial reception index and initial transmission index of each terminal are preset; For any current terminal in any current round, the receiving index of the current terminal in the current round is determined based on the sending index of each upstream terminal pointing to the current terminal in the previous round; the sending index of the current terminal in the current round is determined based on the receiving index of the current terminal sent to each downstream terminal in the current round. For each terminal in the terminal communication diagram, multiple rounds of iterative calculations are performed until a preset termination condition is met.

[0026] In this context, upstream terminals are the set of terminals in the terminal communication graph where directed edges point to the "current terminal"; downstream terminals are the set of terminals in the terminal communication graph where directed edges sent by the current terminal point to them. For example, if the graph contains B→A and B→C, then for the current terminal B, the downstream terminals are {A, C}. The preset termination condition is a rule for terminating multiple iterations, used to avoid infinite computation and ensure output convergence or controllability. This can be the maximum number of iterations, such as 50 rounds, or the absolute value of the error between the normalized receive and transmit indices of each terminal in adjacent rounds being less than a preset value, such as 0.0001.

[0027] Specifically, the receiving index of the current terminal in this round is the sum of the sending indices of the upstream terminals in the previous round, and the sending index of the current terminal in this round is the sum of the receiving indices of the downstream terminals in this round.

[0028] For example, if the terminal communication diagram is: A → B, A → C, B → C, the initial reception index (R) and initial transmission index (S) (i.e., round 0) of each terminal are both 1.

[0029] Round 1: ; , , ; Round 2: ; ; ; ; In this context, the subscript in the lower right corner of the parameter indicates the node, and the subscript in the upper right corner indicates the number of rounds.

[0030] The flow table management controller is used to determine the item weight of any target flow table item based on the sending index, receiving index, and interaction time of the terminal corresponding to the target flow table item.

[0031] The item weight is a comprehensive evaluation value calculated for a single target flow table item. It is derived from the sending index, receiving index, and interaction time of the terminal corresponding to the flow table item and is used to measure the retention priority of the flow table item. It should be noted that the specific calculation formula can be found below.

[0032] Specifically, for any target flow table entry, an interaction index is determined based on the receiving index of the receiving terminal and the sending index of the sending terminal corresponding to the target flow table entry; a time decay factor is determined based on preset scaling parameters and interaction time; and the item weight of the target flow table entry is determined based on the time decay factor and the interaction index.

[0033] Specifically, the target flow table entry can be determined using the following formula. Item weight W: ; in, Source IP address The corresponding main dimension activity index is calculated by normalizing or weighting the sending index of the sending terminal, and is used to characterize the activity level of the communication initiator. destination IP address The corresponding activity index is calculated by normalizing or weighting the "reception index" of the receiving terminal. This is a preset scaling parameter, with the unit being the reciprocal of the time unit. For example, its value can be set to 10 to the power of -5. The idle time of the target flow table entry can be characterized by the interaction time. Therefore, the interaction index is the numerator of the above formula, which represents the interaction importance of the target flow table entry, and the denominator is the time decay factor, which represents the time decay trend of the target flow table entry. The specific value can be controlled by the preset scaling parameter.

[0034] As a supplementary explanation, in the target round, based on the sending index Calculate the main dimension activity index The method is as follows: ; ; Among them, target rounds The main dimension of the terminal device i is the activity index. Let C be the transmission index of terminal device i in the target round; N be the number of terminals. Further, when the normalized index C or... When it is 0, Set to 0. The method for calculating the activity index from the dimension by receiving the index is similar to that described above, and will not be repeated here.

[0035] Suppose that the main dimension activity index of a certain stream is 0.2, the secondary dimension activity index is 0.3, and the idle time is 10 seconds; based on the above parameters, if the preset scaling parameter... Set as Substituting these values ​​into the formula, the item weight W of the target flow table entry is approximately 0.4999. Specifically, if the flow's idle time is extended to 100,000 seconds, the item weight W decreases to 0.25. Finally, the above item weight W is used as the final sorting criterion. As the idle time increases, the flow table entry occupies a lower position in the sorting sequence, making it more likely to trigger the deletion mechanism.

[0036] Specifically, when the denominator is at a similar decay rate, the numerator (control node links with strong network aggregation and radiation capabilities) has a proportionally higher data retention weight priority compared to edge unidirectional communication terminals. Meanwhile, even for core links of central nodes that once bore heavy concurrency responsibilities, as their non-communication time (idle time) infinitely increases and the denominator accumulates, their final retention priority weight will eventually follow an exponential decline over time and be removed from the queue, allowing the expensive and scarce gateway memory area to return to a dynamic flow balance.

[0037] The flow table management controller is used to issue flow table operation instructions corresponding to the item weights to the edge gateway.

[0038] Among them, the flow table operation command is a signaling generated by the flow table management controller to control the edge gateway to perform operations such as adding, deleting or modifying the priority of flow table entries. Its generation logic is mapped to the item weight.

[0039] Specifically, the flow table management controller is also used for: Based on the item weight of each target flow table item, sort the target flow table items to obtain the flow table item sequence; According to the order of each target flow table entry in the flow table entry sequence, flow table deletion instructions are sent sequentially to the edge gateway that stores the corresponding target flow table entry, and the hardware storage information is updated until the hardware storage information meets the preset capacity condition or the deletion instructions corresponding to each target flow table entry in the flow table entry sequence have been sent.

[0040] Specifically, you can prioritize deleting target flow table entries with lower weights to ensure the orderly release of memory space. It should be noted that a soft counting mechanism can be used to control the number of entries released during the release process. If the memory recovers to a safe threshold after releasing a certain number of flow table entries, the deletion operation can be terminated.

[0041] Optionally, if the current capacity occupancy rate represented by the hardware storage information is less than a preset security threshold, the sending of deletion instructions is stopped. Here, current capacity occupancy rate = current entry capacity / maximum available entry capacity, and the preset security threshold can be 90%. Specifically, if the current capacity occupancy rate is less than the preset security threshold, it indicates sufficient memory space, and no further deletion of flow entries is necessary. Specifically, after ending the sending of deletion instructions, a data retention instruction is sent to the edge gateway where the target flow entry corresponding to the one for which no deletion instruction was sent is located.

[0042] Furthermore, if the target flow table entry still exists in the flow table entry sequence after the deletion command is sent, it indicates that the remaining target flow table entry is an important flow table, and a data retention command can be sent to the edge gateway where the target flow table entry is located.

[0043] The edge gateway is used to operate on the target flow table entry according to the flow table operation instructions.

[0044] Specifically, when the edge gateway receives a data retention instruction for a target flow table entry, it modifies the status field associated with the target flow table entry to a preset value, wherein different values ​​of the status field are used to control the retention time of the target flow table entry.

[0045] For example, setting the preset field to 0 will permanently retain the target flow table entry.

[0046] This invention provides a trusted cross-domain network communication system, comprising a flow table management controller and an edge gateway. The flow table management controller acquires historical flow tables, hardware storage information, and terminal access information from the edge gateway. The historical flow table entries include the communication interaction direction and interaction time between terminals connected to the gateway. The flow table management controller determines target flow table entries based on the terminal access information and the interaction time of each flow table entry. When the number of hardware storage information and target flow table entries meets preset conditions, the flow table management controller constructs a terminal communication graph based on the communication interaction direction of each target flow table entry, and determines the sending index and receiving index of each terminal based on the connection relationship of each terminal in the terminal communication graph. For any target flow table entry, the flow table management controller determines the item weight of the target flow table entry based on the sending index, receiving index, and interaction time of the terminal corresponding to the target flow table entry. The flow table management controller issues flow table operation instructions corresponding to the item weights to the edge gateway. The edge gateway operates on the target flow table entries according to the flow table operation instructions. Specifically, by filtering target flow entries and then performing corresponding control operations on them based on their weights, high-weight flow entries can be continuously stored, while zombie flow entries can be quickly deleted, saving storage resources and avoiding network congestion.

[0047] Example 2 Figure 2 A flowchart of a trusted networking method for cross-domain network communication provided in this embodiment of the invention is specifically configured in the flow table management controller of the trusted networking system for cross-domain network communication. The method includes: Step 210: Obtain the historical flow table, hardware storage information and terminal access information of the edge gateway, wherein the flow table entries in the historical flow table include the communication interaction direction and interaction time between the terminals connected to the gateway.

[0048] Step 220: Determine the target flow table entry based on the terminal access information and the interaction time of each flow table entry.

[0049] Step 230: When the number of hardware storage information and target flow table entries meets the preset conditions, construct a terminal communication graph according to the communication interaction direction of each target flow table entry, and determine the sending index and receiving index of each terminal according to the connection relationship of each terminal in the terminal communication graph.

[0050] Step 240: For any target flow table entry, determine the entry weight of the target flow table entry based on the sending index, receiving index, and interaction time of the terminal corresponding to the target flow table entry.

[0051] Step 250: Send flow table operation instructions corresponding to the item weights to the edge gateway.

[0052] It should be noted that the method steps in this embodiment may specifically include any method steps and technical features executed by the flow table management controller in the above embodiments, and have the same beneficial effects, which will not be elaborated here.

[0053] The flow table management controller of embodiments of the present invention is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The flow table management controller can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

Claims

1. A cross-domain network communication trusted networking system, characterized in that, The system includes a flow table management controller and an edge gateway: The flow table management controller is used to obtain the historical flow table, hardware storage information and terminal access information of the edge gateway. The flow table entries in the historical flow table include the communication interaction direction and interaction time between the terminals connected to the gateway. The flow table management controller is used to determine the target flow table entry based on the terminal access information and the interaction time of each flow table entry; The flow table management controller is used to construct a terminal communication graph based on the communication interaction direction of each target flow table entry when the number of hardware storage information and target flow table entries meets preset conditions, and to determine the sending index and receiving index of each terminal based on the connection relationship of each terminal in the terminal communication graph. The flow table management controller is used to determine the item weight of any target flow table item based on the sending index, receiving index and interaction time of the terminal corresponding to the target flow table item. The flow table management controller is used to issue flow table operation instructions corresponding to the item weights to the edge gateway; The edge gateway is used to operate on the target flow table entry according to the flow table operation instructions.

2. The system according to claim 1, characterized in that, The flow table management controller is specifically used for: If the terminal access information indicates that the current access terminal does not match the preset secure terminal list, the flow table entry corresponding to the terminal is determined as the first flow table entry. If the most recent interaction time represented by the flow table entry meets a preset duration condition, then the flow table entry is determined as the second flow table entry; The first flow table entry and the second flow table entry are identified as target flow table entries.

3. The system according to claim 1, characterized in that, The flow table management controller is specifically used for: When the hardware storage information indicates that the current capacity occupancy rate is greater than a preset security threshold and the number of target flow entries is greater than a preset quantity threshold, a terminal communication graph is constructed based on the communication interaction direction between terminals in each target flow entry.

4. The system according to claim 3, characterized in that, The flow table management controller is specifically used for: Determine the source and destination identifiers in each target flow table entry, treat the uniquely identified terminal as a node, and treat the communication interaction direction of the flow table entry as a directed edge; Based on the nodes and directed edges, a terminal communication graph is generated.

5. The system according to claim 1, characterized in that, The flow table management controller is specifically used for: Preset the initial reception index and initial transmission index for each terminal; For any current terminal in any current round, the receiving index of the current terminal in the current round is determined based on the sending index of each upstream terminal pointing to the current terminal in the previous round. Based on the receiving index corresponding to the current round sent by the current terminal to each downstream terminal, the sending index of the current terminal in the current round is determined; For each terminal in the terminal communication diagram, multiple rounds of iterative calculations are performed until a preset termination condition is met.

6. The system according to claim 1, characterized in that, The flow table management controller is specifically used for: For any target flow table entry, the interaction index is determined based on the receiving index of the receiving terminal and the sending index of the sending terminal corresponding to the target flow table entry; the time decay factor is determined based on the preset scaling parameters and the interaction time. The item weight of the target flow table item is determined based on the time decay factor and the interaction index.

7. The system according to claim 1, characterized in that, The flow table management controller is also used for: Based on the item weight of each target flow table item, sort the target flow table items to obtain the flow table item sequence; According to the order of each target flow table entry in the flow table entry sequence, flow table deletion instructions are sent sequentially to the edge gateway that stores the corresponding target flow table entry, and the hardware storage information is updated until the hardware storage information meets the preset capacity condition or the deletion instructions corresponding to each target flow table entry in the flow table entry sequence have been sent.

8. The system according to claim 7, characterized in that, The flow table management controller is also used for: After the deletion command is sent, a data retention command is sent to the edge gateway where the target flow table entry corresponding to the deletion command was not sent.

9. The system according to claim 7, characterized in that, The flow table management controller is specifically used for: If the current capacity occupancy rate represented by the hardware storage information is less than a preset security threshold, then the sending of the deletion command will be stopped.

10. The system according to claim 8, characterized in that, The edge gateway is specifically used for: When the edge gateway receives a data retention instruction for a target flow table entry, it modifies the status field associated with the target flow table entry to a preset value, wherein different values ​​of the status field are used to control the retention time of the target flow table entry.

Images