Method, apparatus, device, medium and product for determining network identity

Abstract

The embodiments of the present disclosure disclose a network identification determination method, device, equipment, medium and product, comprising: in response to a mapping application request, analyzing the service attribute of the data identification to obtain a semantic grouping identification; generating a key derivation value by using a preset hash algorithm according to the preset information and version number of the data identification; generating a candidate network identification based on the semantic grouping identification and the key derivation value; if the preset mapping table does not include the candidate network identification, determining the candidate network identification as the network identification mapped by the data identification. The technical scheme analyzes the service attribute of the data identification to obtain the semantic grouping identification, and generates the key derivation value by hash operation according to the preset information and version number of the data identification, and then combines the two to form the candidate network identification; if the candidate network identification does not exist in the preset mapping table, it is determined as the network identification mapped by the data identification, realizing the mapping of the data identification to the network identification.

Description

Technical Field

[0001] This disclosure relates to the field of network technology, and in particular to a method, apparatus, device, medium, and product for determining a network identifier. Background Technology

[0002] Currently, with the booming development of the digital economy, massive amounts of data resources are being transmitted through networks. Current data identification standards define a data identifier as 32 to 65 characters long. Since each character corresponds to 8 bits for transmission over the network, the data identifier occupies a total of 256 to 520 bits. However, the network identifier (APN-ID) only uses 32 bits to identify the data. This makes it crucial to address how to map the hundreds of bits of data identifier to the mere 32 bits of the network identifier, and how to effectively manage the mapped network identifier. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, medium, and product for determining network identifiers, realizing the mapping from data identifiers to network identifiers.

[0004] Firstly, a method for determining a network identifier is provided, including: In response to a mapping request, the business attributes of the data identifier are parsed to obtain a semantic group identifier; Based on the preset information and version number of the data identifier, a key derivation value is generated using a preset hash algorithm; Generate candidate network identifiers based on the semantic group identifier and the key derivation value; If the preset mapping table does not include the candidate network identifier, then the candidate network identifier is determined as the network identifier after the data identifier is mapped.

[0005] Secondly, a device for determining a network identifier is provided, comprising: The parsing module is used to parse the business attributes of the data identifier to obtain the semantic group identifier in response to the mapping application request; The generation module is used to generate a key derivation value based on the preset information and version number of the data identifier using a preset hash algorithm; The candidate network identifier determination module is used to generate candidate network identifiers based on the semantic group identifier and the key derivation value; The network identifier determination module is used to determine the candidate network identifier as the network identifier mapped from the data identifier if the preset mapping table does not include the candidate network identifier.

[0006] Thirdly, an electronic device is provided, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the network identifier determination method as described in the first aspect above.

[0007] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for determining a network identifier as described in the first aspect above.

[0008] Fifthly, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the method for determining a network identifier as described in the first aspect above.

[0009] This disclosure provides a method, apparatus, device, medium, and product for determining a network identifier. The method includes: in response to a mapping request, parsing the business attributes of a data identifier to obtain a semantic block identifier; generating a key derivation value using a preset hash algorithm based on preset information and a version number of the data identifier; generating a candidate network identifier based on the semantic block identifier and the key derivation value; and determining the candidate network identifier as the network identifier mapped from the data identifier if a preset mapping table does not contain the candidate network identifier. This technical solution, in response to a mapping request, parses the business attributes of a data identifier to obtain a semantic block identifier, generates a key derivation value using a hash operation based on the preset information and version number of the data identifier, and then combines the two to form a candidate network identifier. If the candidate network identifier does not exist in the preset mapping table, it is determined as the network identifier mapped from the data identifier, thus realizing the mapping from data identifier to network identifier.

[0010] It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of this disclosure, nor is it intended to limit the scope of the embodiments of this disclosure. Other features of the embodiments of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a method for determining a network identifier provided in Embodiment 1 of this disclosure; Figure 2 This is a schematic diagram of the structure of a semantic grouping identifier provided in Embodiment 1 of this disclosure; Figure 3 This is a schematic diagram of the structure of a network identifier provided in Embodiment 1 of this disclosure; Figure 4 This is a schematic diagram illustrating the execution process of a method for determining a network identifier provided in Embodiment 1 of this disclosure; Figure 5 This is a schematic diagram of a network identifier lifecycle management process provided in Embodiment 1 of this disclosure; Figure 6 This is a schematic diagram of the structure of a network identifier determination device provided in Embodiment 2 of this disclosure; Figure 7 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of this disclosure. Detailed Implementation

[0013] To enable those skilled in the art to better understand the solutions of the embodiments of this disclosure, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the protection scope of the embodiments of this disclosure.

[0014] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0015] Example 1 Figure 1This is a flowchart of a method for determining a network identifier according to Embodiment 1 of this disclosure. This embodiment is applicable to the determination of network identifiers. The method can be executed by a network identifier determining device, which can be implemented in hardware and / or software. This network identifier determining device can be configured in an electronic device, including but not limited to computers, terminals, and servers, which are devices with data processing capabilities. Figure 1 As shown, the method includes: S110. In response to the mapping request, the business attributes of the data identifier are parsed to obtain the semantic group identifier.

[0016] In this embodiment, when data elements need to be transmitted over the network, the mapping application request can be initiated by an access connector or a data circulation platform. This request can be used to map a data identifier (DID) to a network identifier. The mapping application request can include both the data element and the data identifier. The data element can refer to the original data content that needs to be transmitted over the network. For example, data elements can include transaction records, sensor-collected data, file content, etc. The data element is the object of network transmission and does not possess the identification information required for network transmission itself. The data identifier can refer to the identity identifier of the data element, used to uniquely identify and distinguish different data elements. The data identifier typically contains attribute information of the data element, such as: data source, data type, data classification, etc.

[0017] It is known that mapping requests can carry data elements and data identifiers. Upon receiving a mapping request, the business attributes carried in the data identifier can be parsed to obtain a semantic group identifier. The business attributes refer to information carried in the data identifier that describes the business characteristics of the data element, including but not limited to management domain, service type, data classification, industry affiliation, security level, encryption method, and cross-domain flags. The semantic group identifier (APP-Group-ID) can be a 16-bit identifier generated by encoding the business attributes, used to represent the business type of the data element. The semantic group identifier can adopt a bit-field structure, compressing and encoding multiple business attributes into a fixed-length field, enabling network devices to quickly identify the business characteristics of the data element.

[0018] Specifically, upon receiving a mapping request, the business attributes carried in the data identifier can be parsed. Following preset bit-field encoding rules, business attributes such as management domain, service type, data classification, industry affiliation, security level, encryption method, and cross-domain flag are encoded into 16-bit semantic block identifiers. These semantic block identifiers carry the business semantic information of the data elements, enabling network devices to identify the required network service type for each data element based on this identifier, thus providing a foundation for the generation of subsequent association strategies.

[0019] For example, Figure 2 This is a schematic diagram of the structure of a semantic grouping identifier provided in this embodiment, such as... Figure 2 As shown, the 16 bits of the APP-Group-ID are divided into bit fields, from the most significant bit to the least significant bit: Domain (bit 15) 13 (bit 3) identifies the network management field, with a maximum of 8 fields; Svc (bit 12) 11 (bit 10) Service type field, such as 00 Low latency, 01 High bandwidth, 10 High reliability, 11 Best effort; Cls (bit 10) 9, 2 bits) data classification and grading fields, such as 00 core, 01 important, 10 general, 11 public; Ind (8 bits) 6, 3 bits) industry category field, such as government affairs, finance, industry, energy, healthcare, transportation, communications, others; Sec (5 bits) 4. (2-bit) Security level field, such as: Level 1 L1 Level 4 (L4); Cry (bits 3-2, 2 bits) encryption method field, e.g., 00 plaintext, 01 SM4 (Chinese national cryptography), 10 IPSec, 11 Quantum; XD (bit 1, 1 bit) cross-domain flag field, 0 = intra-domain, 1 = cross-domain; Rsv (bit 0, 1 bit) reserved extension bit field. The above bit fields can be expanded or redefined according to actual management needs. All nodes within the same management domain use the same bit field convention.

[0020] It should be explained that the DID consists of a type code, a main identifier code, an important functional facility code, a random code, a check code, and an optional extension code. Specifically, the DID is 32 bytes long. A string of 65 characters, with each character counted as 8 bits during transmission, corresponds to 256... A 520-bit semantic space. A typical DID structure is: Type Code (1 bit) + Main Identifier Code (18 bits) + Important Functional Facility Code (4 bits) + Random Code (8 bits) + Check Code (1 bit) + Separator (1 bit) + Extension Code (0 bits) 32 bits). Among them: the type code is used to distinguish data products (6), data resources (7), intelligent agent data (8), etc.; the subject identification code directly reuses the unified social credit code or citizen identity number to realize the anchoring of data ownership subject; the important functional facility code is used to identify the region / industry / business node where the data is located; the random code and the check code together ensure the uniqueness of the identification and the prevention of tampering; the extension code ( (32-bit) Data IDs can retain the original identifiers or business-defined fields. The semantic attributes carried by a DID include at least: data type, ownership subject, facility ownership, classification and level, security level, encryption method, and cross-domain flag.

[0021] S120. Generate a key derivation value using a preset hash algorithm based on the preset information and version number of the data identifier.

[0022] In this embodiment, the preset information can be key materials extracted from the data identifier, including but not limited to the Subject identifier, Facility identifier, Random identifier, and Ext identifier. This information collectively constitutes the core content of the data identifier, used to distinguish different data subjects and data sources. The version number can be a counter used for collision resolution, with an initial value of 0. When a generated candidate network identifier conflicts with an existing identifier, it is regenerated by incrementing the version number until a unique identifier is obtained.

[0023] Specifically, preset information of the data identifier can be obtained. This preset information (main identifier code, important functional facility code, random code, and extension code) is concatenated, combined with the current version number and domain key, and then cryptographically hashed using a preset hash algorithm. The first 16 bits of the result are truncated to obtain the key derivation value. The preset hash algorithm can be HMAC-SHA256, which uses the domain key as the key and the concatenation of the preset information and version number as the message input, outputting a fixed-length digest value. The domain key can be a key independently configured for each management domain and rotated periodically to ensure isolation and security between different management domains. The key derivation value (USER-Group-ID) is obtained by cryptographically hashing the preset information and truncating the first 16 bits. It should be noted that the key derivation value is unidirectional; the original preset information cannot be deduced from the key derivation value. It is also bound to the domain key to ensure that it cannot be forged or parsed across domains.

[0024] For example, the USER-Group-ID is obtained by performing a cryptographic hash operation on the DID key material. Let the key derivation value be UG, the domain key be K_dom, the DID key material be M_DID, and the version number be v, then: UG = Trunc_16(HMAC-SHA256(K_dom, M_DID)). v). Where: M_DID = Subject (Subject Identifier Code) Facility (Important Functional Facility Code) Random (random code) Ext (extended code); K_dom is a key that is managed independently by domain and rotated periodically; This indicates bitwise or byte-wise concatenation; Trunc_16 indicates truncating the first 16 bits of the digest value; v is the collision resolution version number, with an initial value of 0.

[0025] The key derivation value (UG) has the following security features: one-wayness: M_DID or DID cannot be derived from UG; key binding: different management domains use different K_dom, which cannot be forged or parsed across domains; tamper-proof: the Access Point Name (APN) header can carry security verification options (such as Galois Message Authentication Code (GMAC) / Hash-based Message Authentication Code (HMAC)) to ensure that the Access Point Name Identifier (APN-ID) is not tampered with during network transmission.

[0026] S130. Generate candidate network identifiers based on semantic group identifiers and key derivation values.

[0027] It is known that after obtaining the semantic block identifier and the key derivation value, the semantic block identifier can be used as the high 16 bits and the key derivation value as the low 16 bits, and then concatenated into a 32-bit candidate network identifier through bit operations. The candidate network identifier (APN-ID) can refer to a 32-bit identifier generated by concatenating the semantic block identifier and the key derivation value, which is used to uniquely identify the transmission identity of data elements in the network.

[0028] Figure 3 This is a schematic diagram of a network identifier structure provided in this embodiment. The technical solution uses APN-ID Type 1 defined in the APN6 architecture, which is 32 bits long and encapsulated in the IPv6 extended header (Hop-by-Hop Options Header (HBH), Destination Options Header (DOH), or Segment Routing Header (SRH, Type-Length-Value (TLV) encoded structure)). Type 1 can refer to a fixed-length identifier format with a length of 32 bits. Figure 3As shown, APN-ID Type 1 consists of two 16-bit fields: APP-Group-ID (bits 31-16) is the semantic group identifier; USER-Group-ID (bits 15-0) is the cryptographic derivation digest (key derivation value). The mapping relationship between APN-ID and DID is: APN-ID = (APP-Group-ID) / (D ... 16) |USER-Group-ID. Wherein, 16 can represent shifting the binary value of APP-Group-ID 16 bits to the left.

[0029] S140. If the preset mapping table does not include candidate network identifiers, then the candidate network identifiers will be determined as the network identifiers after the data identifier mapping.

[0030] In this embodiment, the preset mapping table can be a data structure used to record the mapping relationship between network identifiers and data identifiers. The preset mapping table can be used to detect whether a candidate network identifier has been occupied and to maintain the lifecycle status of the allocated identifiers.

[0031] Specifically, after obtaining a candidate network identifier, a pre-defined mapping table can be queried to determine if the candidate network identifier has already been used. If the candidate network identifier does not exist in the pre-defined mapping table, it means that the candidate network identifier has not been assigned and is unique. Therefore, the candidate network identifier can be determined as the network identifier mapped from the data identifier. The network identifier can be used to represent the service type of the data element (e.g., low latency, high bandwidth, high reliability service requirements) and the user identity corresponding to the data identifier (e.g., important user, ordinary user, etc.). It can be a 32-bit identifier assigned to the data identifier after collision detection confirms its uniqueness. This network identifier can be embedded in the extended header of Internet Protocol version 6 (IPv6) data packets and transmitted with the data packets in the network, allowing network devices along the way to read and execute differentiated policies. Collision detection can be understood as the process of querying the pre-defined mapping table to determine if a candidate network identifier already exists. If it already exists, it is necessary to further determine whether the corresponding data identifier is the same to determine whether to reuse the existing identifier or perform collision resolution.

[0032] This embodiment provides a method for determining a network identifier, including: in response to a mapping application request, parsing the business attributes of a data identifier to obtain a semantic group identifier; generating a key derivation value using a preset hash algorithm based on preset information and version number of the data identifier; generating a candidate network identifier based on the semantic group identifier and the key derivation value; if the preset mapping table does not include the candidate network identifier, then determining the candidate network identifier as the network identifier mapped from the data identifier, thereby realizing the mapping from data identifier to network identifier.

[0033] As an optional implementation of this embodiment, the method for determining the network identifier provided in this embodiment further includes: 1) If the preset mapping table includes the candidate network identifier, and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier, then update the lifetime of the preset mapping table.

[0034] In this embodiment, the Time To Live (TTL) can be a preset duration for which a mapping table remains valid from the time of its creation or update. The TTL can be used to control the lifespan of mapping relationships, preventing invalid mappings from occupying resources for extended periods. When the TTL expires and is not renewed, the mapping relationship can enter the recycling phase.

[0035] Specifically, if the preset mapping table finds that a candidate network identifier already exists, it is necessary to further determine whether the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the current data identifier. If they are the same, it means that the data identifier has previously applied for a network identifier and the mapping relationship is still valid. In this case, there is no need to reallocate a new network identifier; instead, a renewal operation is performed on the existing mapping table entry, i.e., the lifetime of the preset mapping table is updated. This avoids repeatedly allocating network identifiers for the same data element, realizes network identifier reuse, reduces identifier space consumption, and ensures that the same data identifier always uses a consistent network identifier during network transmission, facilitating continuous identification and execution of unified differentiated strategies by network devices. Updating the lifetime ensures that the mapping relationship remains active during the continuous transmission of data elements, preventing data transmission interruption due to mapping failure caused by lifetime expiration.

[0036] For example, updating the lifetime of a preset mapping table can be done by resetting the lifetime countdown of the preset mapping table to its initial value, causing the mapping relationship to recalculate its validity period from the current moment. Updating the lifetime, also known as a renewal operation, is used to maintain the continued validity of active mapping relationships. 2) If the preset mapping table includes the candidate network identifier, but the data identifier corresponding to the candidate network identifier in the preset mapping table is different from the data identifier, then update the version number.

[0037] Specifically, if a query of the preset mapping table finds that a candidate network identifier already exists, but the data identifier corresponding to that identifier is different from the currently requested data identifier, it indicates a hash collision, meaning that two different data identifiers have generated the same candidate network identifier. In this case, the candidate network identifier cannot be assigned to the current data identifier; otherwise, different data elements will share the same network identifier, causing chaos in the execution of network policies.

[0038] As described above, the version number can be updated by increasing the current version number by a preset step size (e.g., 1), allowing subsequent key derivation values ​​to be generated based on different input parameters, thus producing different candidate network identifiers. This technical solution, by introducing a version number, provides a controllable iterative mechanism for hash collision resolution, ensuring that a unique network identifier is eventually obtained through multiple attempts within a limited identifier space, while simultaneously guaranteeing the cryptographic security and unpredictability of the key derivation value.

[0039] 3) Re-execute the steps of generating key derivation value and generating candidate network identifier based on the updated version number until the preset mapping table does not include the candidate network identifier, or the preset mapping table includes the candidate network identifier and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier.

[0040] It is known that after updating the version number, the key derivation value generation operation (generating the key derivation value using a preset hash algorithm based on the preset information and version number of the data identifier) ​​and the candidate network identifier concatenation operation (generating the candidate network identifier based on the semantic group identifier and the key derivation value) can be re-executed to obtain a new candidate network identifier. The preset mapping table is then queried again to see if the newly generated candidate network identifier is included (collision detection). If the new candidate network identifier still fails the collision detection, the version number is incremented and the process is re-executed, forming a loop iteration process. This loop continues until one of two termination conditions is met: first, the newly generated candidate network identifier does not exist in the preset mapping table, indicating that a unique and usable network identifier has been obtained and can be assigned to the current data identifier; second, the newly generated candidate network identifier already exists in the preset mapping table, and the corresponding data identifier is the same as the currently requested data identifier, indicating that after iteration, the mapping relationship previously established for the same data identifier has been returned, at which point a lease renewal operation can be performed. This iterative mechanism ensures that, within a limited 16-bit key derivation value space, a unique network identifier is ultimately assigned to each data identifier through controlled multiple attempts, while guaranteeing the determinism and finality of the allocation process.

[0041] As an optional implementation of this embodiment, the method for determining network identifiers provided in this embodiment, after determining the candidate network identifier as the network identifier mapped from the data identifier, further includes: The network identifier is stored in the preset mapping table, and the time-to-live of the preset mapping table is set.

[0042] Specifically, after determining the network identifier corresponding to the data identifier, the network identifier and its corresponding network identifier can be written into a preset mapping table, and the lifespan of the preset mapping table can be set to start the lifespan countdown mechanism of the preset mapping table to prevent the mapping relationship from being invalidated for a long time due to the end of data stream transmission or abnormal interruption.

[0043] As an optional implementation of this embodiment, the method for determining the network identifier provided in this embodiment further includes: 1) Parse the semantic group identifier of the network identifier to obtain the association strategy corresponding to the network identifier.

[0044] It is known that after obtaining the network identifier, the semantic packet identifier portion of the network identifier can be parsed according to preset bit field partitioning rules to obtain the association policy corresponding to the network identifier. The association policy can be a set of rules determined by the values ​​of each field in the semantic packet identifier, used to guide network devices to perform differentiated processing on data packets. Association policies include, but are not limited to, IPv6-based segment routing over IPv6 (SRv6) path selection policies, network slice allocation policies, geofencing control policies, quality of service scheduling policies, and security encryption policies. Each policy has a preset mapping relationship with the corresponding fields in the semantic packet identifier.

[0045] For example, the 16-bit data of the semantic group identifier can be split into segments of fixed length, and the values ​​of the management domain field, service type field, data classification and grading field, industry affiliation field, security level field, encryption method field, cross-domain flag field, and reserved extension bit field can be read separately. Based on the value of each field, a preset policy mapping table is queried to obtain the policy rules corresponding to each field. The policy rules corresponding to each field are combined into a complete set of associated policies, so that the associated policy corresponds to the network identifier.

[0046] 2) Forward the network identifier and the association policy to each network device in the target network, so that each network device stores the corresponding association policy and network identifier according to preset rules.

[0047] It is understood that after obtaining the association policy, the network identifier and association policy can be forwarded to each network device in the target network. Upon receiving the network identifier and association policy, each network device, according to preset rules, extracts a subset of policies corresponding to its own role from the complete set of association policies and stores it. These preset rules can be pre-configured rules that guide network devices in determining the subset of association policies they should store. These rules can be set based on factors such as the network device's role type, functional positioning, and processing capabilities, ensuring that different network devices only store the portion of the association policies they need to execute, rather than the complete set of association policies. Each network device then writes the extracted policy subset along with the network identifier into its local policy table, forming a local mapping relationship between "network identifier and policy subset."

[0048] The target network can refer to the IPv6 or SRv6 network into which data elements are to be transmitted. It consists of multiple interconnected network devices that provide an end-to-end transmission path for data packets. Network devices can be physical devices deployed in the target network that participate in data packet reception, processing, and forwarding, including but not limited to source customer front-end devices, access gateways, head-node provider edge devices, intermediate forwarding routers, and tail-node provider edge devices. Each network device plays a different role and has different functions within the network, responsible for executing differentiated processing strategies that match its role.

[0049] As an optional implementation of this embodiment, the method for determining the network identifier provided in this embodiment further includes: 1) Receive data packets including the network identifier.

[0050] In this embodiment, a data packet can be a network transmission unit formed by encapsulating data elements according to the IPv6 protocol specification. The data packet may include an IPv6 basic header, an extended header, and a payload. For example, the network identifier can be embedded in the IPv6 extended header and transmitted along with the data packet in the network.

[0051] Specifically, after forwarding the network identifier and association policy to each network device in the target network, the data transmission phase can begin, during which data packets containing the network identifier can be received.

[0052] 2) Send the data packet to the target network so that the network device storing the network identifier forwards the data packet according to the association policy corresponding to the network identifier.

[0053] It is understood that after receiving a data packet, it can be sent to the target network so that the data packet, after entering the network, reaches each network device hop by hop along the transmission path. When the data packet arrives at any network device in the target network, if the network device stores the network identifier, it forwards the data packet according to the association policy corresponding to the target network identifier. That is, when each network device receives a data packet, it can read the network identifier in the data packet's extended header and check whether the association policy corresponding to that network identifier is stored in its local policy table. If the association policy for that network identifier exists in the local policy table, the network device performs differentiated forwarding processing on the data packet according to that association policy.

[0054] It should be explained that if there is no associated policy for this network identifier in the local policy table, the network device will forward the data packet in the default manner. After each network device completes its own differentiated processing, it will continue to send the data packet to the next hop until the data packet reaches the destination node.

[0055] As an optional implementation of this embodiment, the method for determining the network identifier provided in this embodiment further includes: 1) If the lifetime of the preset mapping table meets the first preset condition, and a refresh message is received or there is an incomplete data packet associated with the network identifier, then the lifetime of the preset mapping table is updated.

[0056] In this embodiment, the first preset condition can be that the lifetime of the preset mapping table is less than or equal to the first preset threshold. It can be understood that the first preset condition is used to determine the state condition that the lifetime of the preset mapping table is about to expire but has not yet expired. That is, the remaining lifetime is close to zero but there is still time left. The mapping relationship is still in the active period, but the active period is about to end but needs to be renewed to maintain its validity.

[0057] It is understood that during data packet transmission, specifically during the valid phase of the mapping relationship in the preset mapping table, the lifetime of the preset mapping table can be continuously monitored. If the lifetime of the preset mapping table meets a first preset condition, it can be determined whether a refresh message has been received or whether there are incompletely transmitted data packets associated with the network identifier. The refresh message can be a control plane message used to notify that the mapping relationship of the network identifier still needs to be maintained. For example, the refresh message can be actively sent by the source device or the network device. The refresh message can carry the network identifier to be renewed, so that the renewal request for the mapping relationship can still be obtained even if no continuous data flow is detected. Incompletely transmitted data packets can be data packets carrying a specific network identifier that have entered the network transmission path but have not yet reached the destination node. If there are incompletely transmitted data packets associated with a network identifier, it can be considered that the data flow is still in transmission.

[0058] As described above, when the lifetime of the preset mapping table meets the first preset condition, and a refresh message is received or there is an incompletely transmitted data packet associated with the network identifier, the lifetime of the preset mapping table can be updated, for example, by resetting the lifetime countdown of the mapping table entry to its initial value. After the update, the mapping relationship is recalculated from the current moment to maintain its active state, ensuring that the mapping relationship will not become invalid due to the expiration of its lifetime during the continuous data stream transmission. It also avoids the invalid long-term occupation of the mapping relationship when there is no data transmission, thus achieving fine-grained control over the mapping lifecycle.

[0059] 2) If the transmission of the data packet associated with the network identifier ends or the lifetime of the preset mapping table meets the second preset condition, then the table status of the preset mapping table is updated and the network identifier is stored in a preset storage location; wherein, the network identifier in the preset storage location is used for reuse based on a preset management strategy.

[0060] In this embodiment, the second preset condition can be that the lifetime of the preset mapping table is 0. It can be considered that when the lifetime of the preset mapping table meets the second preset condition, the lifetime of the preset mapping table has been completely exhausted.

[0061] Specifically, if the transmission of the data packet associated with the network identifier ends or the lifespan of the preset mapping table meets the second preset condition, the table status of the preset mapping table can be updated. The table status can be the current status flag of each entry in the preset mapping table, used to characterize the lifecycle stage of the mapping relationship. Table status includes, but is not limited to, active status and released status, with different statuses determining the subsequent processing method for the mapping entries. For example, if the lifespan of the preset mapping table meets the second preset condition, the table status of the preset mapping table can be updated to the released status.

[0062] Following the above description, network identifiers can also be stored in a preset storage location. This preset storage location can be a data structure for storing released network identifiers, also known as a recycling pool. This storage location is separate from the preset mapping table and is used to temporarily store network identifiers to be reused, realizing the recycling of identifier space. Network identifiers in the preset storage location are reused based on a preset management policy. The preset management policy can be a set of rules to guide when and how released network identifiers are reallocated. The preset management policy can include an immediate reuse policy and a cooldown period reuse policy. The immediate reuse policy allows network identifiers to be reused by new mappings immediately after release, while the cooldown period reuse policy requires network identifiers to undergo a preset cooling-off period before they can be reused. Reuse can be understood as the process of reallocating released network identifiers in the preset storage location to new data identifier mapping applications, realizing the recycling of the 32-bit network identifier space and improving the utilization efficiency of identifier resources.

[0063] Figure 4 This is a schematic diagram illustrating the execution process of a method for determining a network identifier provided in this embodiment, as shown below. Figure 4 As shown, step 1: Parse the DID metadata, extract the type, subject, facility, classification level, industry, security level, encryption method, cross-domain flag, and obtain the semantic group identifier APP-Group-ID by bit field encoding.

[0064] Step 2: Using the initial version number v=0, modify the preset information M_DID v performs HMAC-SHA256 operation and truncates the first 16 bits to obtain the key derivation value USER-Group-ID; it is combined with APP-Group-ID to form the candidate network identifier APN-ID.

[0065] Step 3: Query the preset mapping table (active set): If the candidate APN-ID is not matched, assign the APN-ID to the DID, write it into the mapping table and set the time-to-live (TTL) to 300s. At the same time, send it to the access gateway and forwarding device, and the algorithm ends. If the candidate APN-ID is matched and the corresponding DID is the same as the current DID, renew the lease (renew TTL) for the entry and keep it active. The algorithm ends. If the candidate APN-ID is matched but the corresponding DID is different from the current DID, a collision is determined. Let v = v + 1, return to step 2 to re-derive until an unused APN-ID is found.

[0066] Since the USER-Group-ID space is 2 16 = 65,536. The probability of a collision between different DIDs during the first derivation is approximately 1 / 65,536, so v=0 can resolve most scenarios. Even if a collision occurs, the version number increment mechanism can resolve it within a finite number of steps.

[0067] Once the network identifier APN-ID is determined, in order to avoid the APN-ID being occupied for a long time and thus exhausting the available space, and to ensure the uniqueness of the APN-ID transmitted on the network, this solution establishes full lifecycle management for each APN-ID. Figure 5 This embodiment provides a schematic diagram of a network identifier lifecycle management process, such as... Figure 5 As shown, the lifecycle includes the following seven stages: 1) Mapping application: When data elements need to be transmitted over the network, a mapping application is triggered by the access connector or data circulation platform.

[0068] 2) Derivation + Collision Detection: Perform the step of mapping data identifiers to network identifiers, generate candidate APN-IDs and query the active table (preset mapping table), complete collision detection and resolution, and determine the network identifier APN-ID.

[0069] 3) Allocation and Distribution: Write the unique APN-ID and associated policies (SRv6 path, slice, fence, QoS, etc.) into the mapping table and distribute them to network devices such as source CPE, access gateway, head node PE, forwarding router, and tail node PE.

[0070] 4) Active transmission: Data packets carrying APN-ID are forwarded in the IPv6 / SRv6 network, and network nodes execute differentiated policies based on APN-ID.

[0071] 5) Renewal: During the TTL validity period, the data stream continues to send or actively sends refresh messages to reset the TTL and maintain an active state; if the TTL expires without being refreshed, it will enter the recycling phase.

[0072] 6) Recycling: After the session ends or the TTL expires, the mapping table entry status is updated to RELEASED, and the APN-ID enters the recycling pool.

[0073] 7) Reuse: The recycled APN-ID can be used for new DID mapping after a cooling-off period or immediately, thus achieving space reuse.

[0074] The renewal cycle mechanism ensures that the APN-ID is not reclaimed during the continuous activity of the data flow, thereby maintaining the continuity of network policies; the reclamation mechanism avoids the indefinite occupation of the APN-ID and improves space utilization.

[0075] The technical solution provided in this application proposes: 1) A semantic + cryptographic dual-segment mapping mechanism. The DID, ranging from 256 to 520 bits in length, is compressed into a 32-bit APN-ID, while retaining two types of information: the APP-Group-ID carries business semantics (type, level, industry, security, encryption, cross-domain), and the USER-Group-ID is derived through HMAC to ensure uniqueness and irreversibility. Technical effects: Network nodes can identify data element categories and execute policies without deep parsing of the DID, achieving native network awareness of data elements; simultaneously, it avoids exposing the DID in plaintext in network packets, protecting data privacy.

[0076] 2) Collision resolution mechanism with version number increment. Addressing the significant difference between the DID space and the APN-ID space, a collision detection method is used before allocation by querying a mapping table. The USER-Group-ID is then re-derived by incrementing the version number v until an unused APN-ID is found or the same DID is confirmed to already exist. Technical effect: A high-probability conflict-free mapping is achieved within a 32-bit limited space. The probability of the first collision is approximately 1 / 65536, and v=0 resolves most scenarios. Even if a collision occurs, it can be resolved within a finite number of steps, ensuring uniqueness within the allocation time domain.

[0077] 3) Network Identifier Lifecycle Management Based on TTL and Renewal. A TTL lease is set for each APN-ID, and dynamic management is achieved through renewal, reclamation, and reuse mechanisms. Currently used APN-IDs are maintained only within the "active set." Technical benefits: Prevents APN-IDs from being occupied for extended periods, improving the utilization of 32-bit space; automatic reclamation upon TTL timeout and lease renewal ensure that the APN-ID transmitted on the network at any given time is unique within its management domain, while also providing an automatic cleanup mechanism for abnormal interruptions or silent sessions.

[0078] Example 2 Figure 6 This is a schematic diagram of the structure of a network identifier determination device provided in Embodiment 2 of this disclosure; as shown... Figure 6 As shown, the device includes: a parsing module 210, a generation module 220, a candidate network identifier determination module 230, and a network identifier determination module 240.

[0079] Among them, the parsing module 210 is used to parse the business attributes of the data identifier to obtain the semantic group identifier in response to the mapping application request; The generation module 220 is used to generate a key derivation value using a preset hash algorithm based on the preset information and version number of the data identifier; The candidate network identifier determination module 230 is used to generate a candidate network identifier based on the semantic group identifier and the key derivation value; The network identifier determination module 240 is used to determine the candidate network identifier as the network identifier mapped from the data identifier if the preset mapping table does not include the candidate network identifier.

[0080] Embodiment 2 of this disclosure provides a device for determining network identifiers, which realizes the mapping from data identifiers to network identifiers.

[0081] Furthermore, the device also includes: The first update module is used to update the lifetime of the preset mapping table if the preset mapping table includes the candidate network identifier and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier. The second update module is used to update the version number if the preset mapping table includes the candidate network identifier, but the data identifier corresponding to the candidate network identifier in the preset mapping table is different from the data identifier. The third update module is used to re-execute the steps of generating key derivation values ​​and generating candidate network identifiers based on the updated version number, until the preset mapping table does not include the candidate network identifier, or the preset mapping table includes the candidate network identifier and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier.

[0082] Furthermore, the device also includes: A storage module is used to store the network identifier into the preset mapping table and set the time-to-live of the preset mapping table.

[0083] Furthermore, the device also includes: The association strategy determination module is used to parse the semantic group identifier of the network identifier to obtain the association strategy corresponding to the network identifier; The forwarding module is used to forward the network identifier and the association policy to each network device in the target network, so that each network device stores the corresponding association policy and network identifier according to preset rules.

[0084] Furthermore, the device also includes: The receiving module is used to receive data packets including the network identifier; The sending module is configured to send the data packet to the target network, so that the network device storing the network identifier forwards the data packet according to the association policy corresponding to the network identifier. Furthermore, the device also includes: The first determination module is used to update the lifespan of the preset mapping table if the lifespan of the preset mapping table meets the first preset condition, and a refresh message is received or there is an incomplete data packet associated with the network identifier. The second determination module is used to update the table status of the preset mapping table and store the network identifier in a preset storage location if the transmission of the data packet associated with the network identifier ends or the lifetime of the preset mapping table meets the second preset condition. The network identifier in the preset storage location is used for reuse based on a preset management strategy.

[0085] The network identifier determination device provided in this disclosure can execute the network identifier determination method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the method execution.

[0086] Example 3 Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the embodiments of the present disclosure described and / or claimed herein.

[0087] like Figure 7 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random-access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0088] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0089] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microprocessor, etc. Processor 11 performs the various methods and processes described above, such as the method for determining network identifiers.

[0090] In some embodiments, the method for determining a network identifier may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for determining a network identifier described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the method for determining a network identifier by any other suitable means (e.g., by means of firmware).

[0091] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0092] Computer programs for implementing the methods of embodiments of this disclosure may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0093] In the context of embodiments of this disclosure, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0094] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD)) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0095] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0096] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and Virtual Private Server (VPS) services, such as high management difficulty and weak business scalability.

[0097] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the embodiments of this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of the embodiments of this disclosure can be achieved, and this document does not impose any limitations.

[0098] The specific embodiments described above do not constitute a limitation on the scope of protection of the embodiments disclosed herein. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the embodiments disclosed herein should be included within the scope of protection of the embodiments disclosed herein.

[0099] This disclosure also provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the method for determining a network identifier as provided in any embodiment of this application.

[0100] In implementing a computer program product, computer program code for performing the operations of the embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0101] Note that the above are merely preferred embodiments and the technical principles applied in this disclosure. Those skilled in the art will understand that this disclosure is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the protection scope of this disclosure. Therefore, although the embodiments of this disclosure have been described in detail above, this disclosure is not limited to the above embodiments. More other equivalent embodiments may be included without departing from the concept of this disclosure, and the scope of this disclosure is determined by the scope of the appended claims.

[0102] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the relevant content of the solution.

Claims

1. A method for determining a network identifier, characterized in that, The method includes: In response to a mapping request, the business attributes of the data identifier are parsed to obtain a semantic group identifier; Based on the preset information and version number of the data identifier, a key derivation value is generated using a preset hash algorithm; Generate candidate network identifiers based on the semantic group identifier and the key derivation value; If the preset mapping table does not include the candidate network identifier, then the candidate network identifier is determined as the network identifier after the data identifier is mapped.

2. The method according to claim 1, characterized in that, The method further includes: If the preset mapping table includes the candidate network identifier, and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier, then the lifetime of the preset mapping table is updated. If the preset mapping table includes the candidate network identifier, but the data identifier corresponding to the candidate network identifier in the preset mapping table is different from the data identifier, then the version number is updated; The steps of generating key derivation values ​​and generating candidate network identifiers are re-executed based on the updated version number until the preset mapping table does not include the candidate network identifier, or the preset mapping table includes the candidate network identifier and the data identifier corresponding to the candidate network identifier in the preset mapping table is the same as the data identifier.

3. The method according to claim 1, characterized in that, After determining the candidate network identifier as the network identifier mapped from the data identifier, the method further includes: The network identifier is stored in the preset mapping table, and the time-to-live of the preset mapping table is set.

4. The method according to claim 1, characterized in that, The method further includes: The semantic group identifier of the network identifier is parsed to obtain the association strategy corresponding to the network identifier; The network identifier and the association policy are forwarded to each network device in the target network, so that each network device stores the corresponding association policy and network identifier according to preset rules.

5. The method according to claim 4, characterized in that, The method further includes: Receive data packets including the network identifier; The data packet is sent to the target network so that the network device storing the network identifier forwards the data packet according to the association policy corresponding to the network identifier.

6. The method according to claim 5, characterized in that, The method further includes: If the lifetime of the preset mapping table meets the first preset condition, and a refresh message is received or there is an incomplete data packet associated with the network identifier, then the lifetime of the preset mapping table is updated. If the transmission of the data packet associated with the network identifier ends or the lifetime of the preset mapping table meets the second preset condition, then the table status of the preset mapping table is updated and the network identifier is stored in the preset storage location. The network identifier in the preset storage location is used for reuse based on a preset management strategy.

7. A device for determining a network identifier, characterized in that, include: The parsing module is used to parse the business attributes of the data identifier to obtain the semantic group identifier in response to the mapping application request; The generation module is used to generate a key derivation value based on the preset information and version number of the data identifier using a preset hash algorithm; The candidate network identifier determination module is used to generate candidate network identifiers based on the semantic group identifier and the key derivation value; The network identifier determination module is used to determine the candidate network identifier as the network identifier mapped from the data identifier if the preset mapping table does not include the candidate network identifier.

8. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method for determining a network identifier as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the method for determining the network identifier as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method for determining a network identifier as described in any one of claims 1-6.

Images