WO2021115449A1

WO2021115449A1 - Cross-domain access system, method and device, storage medium, and electronic device

Info

Publication number: WO2021115449A1
Application number: PCT/CN2020/135884
Authority: WO
Inventors: 穆志纯; 徐恪; 付松涛; 甘玉玺
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-12-13
Filing date: 2020-12-11
Publication date: 2021-06-17
Also published as: CN112995097A; CN112995097B

Abstract

A cross-domain access system, method and device, a storage medium, and an electronic device. The cross-domain access system comprises: a first user node; a first distributed controller, configured to send a cross-domain access request to a second distributed controller in response to the cross-domain access request initiated by the first user node; the second distributed controller, configured to receive the cross-domain access request; the first distributed controller and/or the second distributed controller being further configured to determine a network slice according to the cross-domain access request; and a second user node.

Description

Cross-domain access system, method and device, storage medium and electronic device

Cross-references to related applications

This application is filed based on a Chinese patent application with application number 201911285474.4 and an application date of December 13, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated into this application by reference.

Technical field

The present invention relates to the field of communications, and in particular to a cross-domain access system, method and device, storage medium and electronic device.

Background technique

At present, in some cases, when implementing cross-domain access to data, there are many implementations such as software-defined network (Software Defined Network, SDN) implementation, or edge computing resource allocation (Distributed Resource Asset and Orchestration, DRAGON) implementation. This kind of realization method; but in the above realization method, since only basic data connection channels can be provided, and middleware services such as firewalls and load balancing are not considered, it is impossible to achieve strong logical isolation between channels and provide corresponding protection capabilities . For scenarios with high privacy protection requirements, such as Internet of Things application scenarios, due to insufficient cross-domain access security performance in related technologies, it is difficult to directly apply cross-domain access technologies in related technologies.

In view of the above-mentioned problem that the security performance cannot be guaranteed during the cross-domain access process, no effective solution has been proposed yet.

Summary of the invention

The embodiments of the present invention provide a cross-domain access system, method and device, storage medium, and electronic device to at least solve one of the related technical problems to a certain extent, including the problem that security cannot be guaranteed during the cross-domain access process.

According to an embodiment of the present invention, there is provided a cross-domain access method, including: a first user node configured to initiate a cross-domain access request to request cross-domain access to a second user node; and a first distributed controller configured In response to the cross-domain access request initiated by the first user node, to send the cross-domain access request to a second distributed controller; the second distributed controller is configured to receive the cross-domain access request Access request; the first distributed controller and/or the second distributed controller are further configured to determine a network slice according to the cross-domain access request; the second user node is configured to respond to the Access by a first user node through the network slice; wherein, the first distributed controller is configured to control a first network domain, and the first user node is a node belonging to the first network domain User node; the second distributed controller is configured to control a second network domain, and the second user node is a user node belonging to the second network domain.

According to another embodiment of the present invention, there is also provided a cross-domain access method, which is applied to a first user node, and the first user node is a user node belonging to a first network domain; the method includes: initiating a cross-domain access Domain access request, and send the cross-domain access request to the second distributed controller through the first distributed controller; wherein, the cross-domain access request is used to request cross-domain access to the second user node; The second user node performs access; wherein, the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; wherein, the first distributed The type controller is set to control the first network domain; the second distributed controller is set to control a second network domain, and the second user node belongs to the second network domain The user node.

According to another embodiment of the present invention, there is also provided a cross-domain access method, which is applied to a second user node, where the second user node is a user node belonging to a second network domain; the method includes: responding to The access of the first user node through the network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; the first distributed controller is Is configured to control a first network domain; the second distributed controller is configured to control a second network domain, and the first user node is a user node belonging to the first network domain; The cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the second distributed controller through the first distributed controller.

According to another embodiment of the present invention, there is also provided a cross-domain access device, which is applied to a first user node, where the first user node is a user node belonging to a first network domain; the device includes: a request module , Is configured to initiate a cross-domain access request, and send the cross-domain access request to the second distributed controller through the first distributed controller; wherein, the cross-domain access request is used to request cross-domain access to the second user Node; an access module configured to access a second user node through a network slice; wherein the network slice is controlled by the first distributed controller and/or the second distributed controller according to the cross-domain The access request is determined; wherein the first distributed controller is configured to control the first network domain; the second distributed controller is configured to control a second network domain, and the first The second user node is a user node belonging to the second network domain.

According to another embodiment of the present invention, there is also provided a cross-domain access device, which is applied to a second user node, where the second user node is a user node belonging to a second network domain; the device includes: a response module , Configured to respond to the access by the first user node through the network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; the first A distributed controller is configured to control a first network domain; the second distributed controller is configured to control a second network domain, and the first user node belongs to the first network domain The cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the second distributed controller through the first distributed controller.

According to another embodiment of the present invention, there is also provided a computer-readable storage medium, and a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute any one of the foregoing when running. The steps in the method embodiment.

According to another embodiment of the present invention, there is also provided an electronic device, including a memory and a processor, the memory is stored with a computer program, and the processor is configured to run the computer program to execute any of the above Steps in the method embodiment.

Description of the drawings

The drawings described here are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments and descriptions of the present invention are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached picture:

Figure 1 is a system diagram (1) of a cross-domain access system according to an embodiment of the present invention;

Figure 2 is a system schematic diagram (2) of a cross-domain access system according to an embodiment of the present invention;

Fig. 3 is a system schematic diagram of a cross-domain access system according to a specific embodiment of the present invention;

FIG. 4 is a schematic diagram of a scenario of cross-domain access between domains according to a specific embodiment of the present invention;

FIG. 5 is a schematic diagram of functions inside domain A according to a specific embodiment of the present invention;

FIG. 6 is a schematic diagram of a scenario in which sensors perform cross-domain access according to a specific embodiment of the present invention;

FIG. 7 is a schematic diagram of the interaction of sensors for cross-domain access according to a specific embodiment of the present invention;

Fig. 8 is a flowchart (1) of a cross-domain access method according to an embodiment of the present invention;

Figure 9 is a flowchart (2) of a cross-domain access method provided according to an embodiment of the present invention;

Fig. 10 is a structural block diagram of a cross-domain access device according to an embodiment of the present invention (1);

Figure 11 is a structural block diagram of a cross-domain access device according to an embodiment of the present invention (2);

Fig. 12 is a schematic diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and in conjunction with the embodiments. It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other if there is no conflict.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence.

Example 1

This embodiment provides a cross-domain access system. Fig. 1 is a system schematic diagram (1) of the cross-domain access system according to an embodiment of the present invention. As shown in Fig. 1, the cross-domain access system in this embodiment includes:

The first user node 102 is configured to initiate a cross-domain access request to request cross-domain access to the second user node;

The first distributed controller 104 is configured to respond to the cross-domain access request initiated by the first user node 102 to send the cross-domain access request to the second distributed controller 106;

The second distributed controller 106 is configured to receive a cross-domain access request; the first distributed controller 104 and/or the second distributed controller 106 are further configured to determine a network slice according to the cross-domain access request;

The second user node 108 is configured to respond to the access by the first user node 102 through the network slicing;

Among them, the first distributed controller 104 is configured to control the first network domain, and the first user node 102 is a user node belonging to the first network domain; the second distributed controller 106 is configured to control the second network domain. The domain performs control, and the second user node 108 is a user node belonging to the second network domain.

It should be further explained that, in this embodiment, the cross-domain access referred to in this embodiment is a process in which the first user node belonging to the first network domain requests access to the second visiting node; The two network domains are respectively used to indicate physical network domains with different domain names, where the first network domain is uniformly controlled by the first distributed controller, and the second network domain is uniformly controlled by the second distributed controller.

Through the cross-domain access system in this embodiment, since the first user node belonging to the first network domain requests cross-domain access to the second user node belonging to the second network domain, it can be used to access the first user node. The first distributed controller that controls the network domain responds to the cross-domain access request initiated by the first user node to send the cross-domain access request to the second distributed controller for controlling the second network domain; second After the distributed controller receives the cross-domain access request, it further determines the network slice according to the cross-domain access request through the first distributed controller and/or the second distributed controller; in this way, the second user node can respond to The first user node accesses through network slicing; therefore, the cross-domain access system in this embodiment can solve the problem of the inability to ensure security performance in the cross-domain access process in related technologies, so as to effectively ensure the cross-domain access process The effect of safety performance.

Specifically, on the one hand, the cross-domain access system in this embodiment adopts a hierarchical design of user nodes and distributed controllers in the first network domain and the second network domain in the architectural design, so as to pass the first distribution The integrated controller and the second distributed controller implement cross-domain access processing, and thus can achieve data isolation during cross-domain access between the first user node and the second user node, so as to significantly improve the security performance of cross-domain access. On this basis, since the first network domain and the second network domain are all controlled by the distributed controller, the system architecture in this embodiment can also improve the expansion performance of the system.

In an embodiment, FIG. 2 is a system schematic diagram (2) of a cross-domain access system according to an embodiment of the present invention. As shown in FIG. 2, the system in this embodiment further includes:

The first gateway 110 is connected to the first user node 102 through the first switch 112; the first gateway 110 is configured to obtain the cross-domain access request initiated by the first user node 102, and forward the cross-domain access request to the first distributed Controller 104;

The second gateway 114 is connected to the second user node 108 through the second switch 116; the second gateway 114 is configured to obtain the cross-domain access command sent by the second distributed controller 106, and send the cross-domain access command to the first user according to the cross-domain access command. The node 102 performs authentication; wherein, the cross-domain access command is generated by the second distributed controller 106 according to the cross-domain access information.

It should be further explained that, in the above-mentioned embodiment, in the first network domain, a first gateway is provided between the first user node and the first distributed controller, and the first gateway may be specifically connected to the first user through the first switch. A node, that is, a layered structure of the first distributed controller, the first gateway, the first switch, and the first user node is formed in the first network domain. Similarly, in the second network domain, a second gateway is provided between the second user node and the second distributed controller. The second gateway can be specifically connected to the second user node through the second switch, that is, in the second network domain. A layered structure of the second distributed controller, the second gateway, the second switch and the second user node is formed in the.

The first gateway and the first distributed controller jointly constitute the control layer in the first network domain to carry out information interaction in the first network domain and the invocation of related resources; the second gateway and the second distributed control The devices together constitute the control layer in the second network domain to perform operations such as information interaction in the second network domain and invocation of related resources.

During the cross-domain access process, the first gateway may specifically forward the cross-domain access request generated by the first user node to the first distributed controller, so that the first distributed controller further sends the cross-domain access request to the second distributed controller. Distributed controller. After the second distributed controller receives the cross-domain access request, it can generate a cross-domain access command based on the cross-domain access information, and issue the cross-domain access command to the second gateway, so that the second gateway can access Command to authenticate the first user node.

Based on this, in the above embodiment, the first gateway and the second gateway in the first network domain and the second network domain are set to realize a further hierarchical structure in different network domains, so as to enable the cross-domain access system in this embodiment The scalability is further improved; and the above-mentioned settings of the first gateway and the second gateway can realize the invocation of related resources, so that resources in different network domains can be used cooperatively, thereby realizing the remarkable efficiency of resource utilization in the system of this embodiment Improve, in this way, can save the cost of IoT infrastructure construction, and improve the effectiveness and reliability of cross-domain access to IoT nodes.

In an embodiment, the above-mentioned second gateway 114 authenticates the first user node 102 according to the cross-domain access command, and may be further configured to call the identity authentication server to perform identity authentication on the first user node according to the cross-domain access command. And, calling the authorization mapping server to authenticate the access authority of the first user node.

It should be further explained that, in the above-mentioned embodiment, the identity authentication server is used to authenticate the identity of the first user node to identify whether the first user node is an authenticated user; the above-mentioned authorization mapping server is used to authenticate the first user node Authority to determine whether the first user node has authority to access the corresponding service.

It should be further explained that, in the foregoing embodiment, the second gateway may call the identity authentication server and the authorization mapping server at the same time or in a preset order, which is not limited in the present invention.

After the identity authentication server and/or the authorization mapping server complete the corresponding authentication, if the authentication is passed, it can return a receipt to execute an authentication process or perform subsequent operations; if any of the authentication fails, the authentication can be suspended and Cross-domain access processing. In addition, the above-mentioned identity authentication server and authorization mapping server may be servers set in the second network domain, or other network domains, such as servers set in the first network domain. The identity authentication server and the authorization mapping server can be called to realize the cooperative utilization of resources in the cross-domain access system in this embodiment.

In an embodiment, the above-mentioned first gateway 110 is further configured to call the first key agreement server, so that the first key agreement server and the second key agreement server perform key agreement according to the cross-domain access request, so as to obtain the cross-domain access request. Domain access key;

Wherein, the cross-domain access key is used for the encryption and/or decryption processing in cross-domain access between the first user node and the second user node; the first key agreement server is a key agreement server belonging to the first network domain, The second key agreement server is a key agreement server belonging to the second network domain.

It should be further explained that, in the above embodiment, the first gateway invokes the first key agreement server and the second gateway completes the corresponding authentication of the first user node. If the second gateway confirms that the first user node is authenticated, that is, The first gateway may invoke the first key agreement server after receiving the corresponding confirmation message that the first user node is authenticated.

In the above-mentioned embodiment, the first key agreement server belonging to the first network domain and the second key agreement server belonging to the second network domain perform key agreement according to the cross-domain access request. The key of the node and the second user node in the process of cross-domain access, using this key for encryption and decryption, can effectively ensure data isolation and information security during the process of cross-domain access by the first user node.

In an embodiment, the above-mentioned first gateway 110 is further configured to send authentication confirmation information to the first distributed controller; the second gateway 114 is further configured to send authentication confirmation information to the second distributed controller;

The first distributed controller and/or the second distributed controller are further configured to establish a connection between the first distributed controller and the second distributed controller according to the authentication confirmation information.

In an embodiment, the above-mentioned first distributed controller 104 is further configured to write a first access control list (Access Control Lists, ACL) rule to the firewall through Network Functions Virtualization (NFV), where: The first ACL rule is used to instruct the firewall to allow the first user node to send cross-domain access information to the second user node;

The second distributed controller 106 is further configured to write a second ACL rule to the firewall through NFV, where the second ACL rule is used to instruct the firewall to allow cross-domain access information to enter the second network domain.

It should be further explained that, in the above-mentioned embodiment, both the first distributed controller and the second distributed controller can write corresponding ACL rules to the firewall through NFV, so that during the cross-domain access process, NFV provides flexible orchestration of middleware services to further improve the efficiency of system access through the support of NFV in the Internet of Things scenario where the capabilities of user nodes are limited.

In an embodiment, the above-mentioned first distributed controller 104 is further configured to encrypt the cross-domain access information sent by the first user node, and send the encrypted cross-domain access information to the second distributed controller ; The second distributed processor 106 is also configured to decrypt the encrypted cross-domain access information, and send the decrypted cross-domain access information to the second user node to achieve cross-domain access of the first user node.

It should be further explained that the encryption process performed by the first distributed controller and the decryption process performed by the second distributed controller can be implemented using the key in the foregoing embodiment, or can be implemented according to a preset Encryption and decryption methods are realized.

In an embodiment, the aforementioned cross-domain access request includes: a first cross-domain access request, and a second cross-domain access request;

The first user node is further configured to initiate a first cross-domain access request to request cross-domain access to the second user node;

The first distributed controller is further configured to generate a second cross-domain access request in response to the first cross-domain access request initiated by the first user node, and send the second cross-domain access request to the second distributed controller;

Wherein, the first cross-domain access request includes at least one of the following: domain name information of the second user node, service type information, and service quality requirement information;

The second cross-domain access request includes at least one of the following: second user node address information, first user node address information, service type information, and service quality requirement information.

It should be further explained that, in the above embodiment, the first cross-domain access information is the cross-domain access request generated by the first user node, and the above-mentioned second cross-domain access information is the cross-domain access request received by the second distributed controller. Access request; specifically, after the first distributed controller obtains the first cross-domain access information generated by the first user node, the first cross-domain access information is processed accordingly to generate the second cross-domain access Information and send the second cross-domain access information to the second distributed controller; in the foregoing processing, the first distributed controller replaces the second user node domain name information in the first cross-domain access request with the second User node address information, and on the basis of the first cross-domain request information, the first user node address information is added.

In an embodiment, the above-mentioned first distributed controller 104 and/or second distributed controller 106 are further configured to:

Determine the network slice according to the quality of service requirements in the cross-domain access request.

It should be further explained that, in the foregoing embodiment, the network slice is determined according to the quality of service requirements in the cross-domain access request, and specifically, the corresponding network slice can be determined according to, for example, delay requirements.

The routing information is determined according to the quality of service requirements in the cross-domain access request, where the routing information is used to indicate the transmission path of the access information within the first network domain or the second network domain, and between the first network domain and the second network domain The transmission path.

It should be further explained that, in the above-mentioned embodiment, the routing information is determined according to the quality of service requirements in the cross-domain access request, and the corresponding routing information can be determined according to, for example, delay requirements and bandwidth requirements.

In an embodiment, the system in this embodiment further includes:

The consortium chain is set between the first distributed controller and the second distributed controller; the consortium chain is configured to maintain cross-domain access records; wherein, the cross-domain access records are managed by the first gateway and/or the second gateway The first user node obtains the second user node after finishing the cross-domain access; the cross-domain access record includes: the cross-domain access event, the occurrence and end time of the cross-domain access event.

It should be further explained that, in the above-mentioned embodiment, the setting of the alliance chain can form a non-repudiation top-level access record between the first distributed controller and the second distributed controller, so that the records of each cross-domain access are equal. It can be traced back to further ensure the safety guarantee during the operation of the cross-domain access system in this embodiment.

In an embodiment, the above alliance chain is further configured to record abnormal access records, where the abnormal access records are used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access record is controlled by the first gateway and/or the second user node. Second, the gateway reports.

It should be further explained that, in the above embodiment, the abnormal access record in the cross-domain access process is recorded through the alliance chain, which can ensure that the abnormal access record can be traced on the one hand, and on the other hand, it can be used in the subsequent During the process of cross-domain access, abnormal problems or objects are dealt with accordingly to further improve the efficiency and security of the access.

The structure and working principle of the cross-domain access system in this embodiment are further described below by means of specific embodiments.

Figure 3 is a system schematic diagram of a cross-domain access system according to a specific embodiment of the present invention. As shown in Figure 3, each domain includes several IoT nodes through access points or directly connected to home switches, and several home switches are connected Incoming tandem switch, that is, gateway, several gateways connect to a distributed controller to form a domain, and configure identity authentication, authorized access, key agreement server, and firewall, encryption and decryption and other middleware services in the domain; the above-mentioned distributed control The server, gateway and authentication/authorization/key agreement server, middleware service are directly connected or indirectly connected through a switch.

Fig. 4 is a schematic diagram of a scenario for cross-domain access between domains according to a specific embodiment of the present invention. As shown in Fig. 4, domain A and domain B perform cross-domain access. Taking domain A as an example, the above-mentioned distributed controller is configured as follows Module: Intra-domain information exchange module, which exchanges control information with intra-domain gateways, and receives requests sent by the gateway; domain name resolution module, which establishes the mapping relationship between domain names and addresses; inter-domain information exchange module, which exchanges control information with other domain controllers; policy formulation Module, according to the requirements of access rules and QoS, make corresponding network slices; routing information module, plan the optimal transmission path, and transmit the flow table to the switch on the transmission path. Inter-domain abnormal access record module, which receives abnormal user access records reported by gateways in each domain.

The above-mentioned gateway includes: a service acceptance module, which is responsible for accepting service requests and sending them to distributed controllers in the domain; an authentication and authorization module, which completes cross-domain access identity authentication, authorization management, and communication keys by calling the identity authentication/authorization mapping/key agreement server Negotiation; Intra-domain access log recording module, which records user access logs for easy access record tracing; Abnormal access reporting module, which judges the current access abnormal situation, and reports to the distributed controller in a timely manner. FIG. 5 is a schematic diagram of functions inside domain A according to a specific embodiment of the present invention. The configuration of the distributed controller and gateway in domain A is shown in FIG. 5.

The above-mentioned domain B has the same composition as domain A, so it will not be repeated here; the distributed controllers between domains are directly connected or indirectly connected through a switch.

In this specific embodiment, a scenario in which the sensor of the user located in the domain A detects that the user's heartbeat data is abnormal to request the corresponding service from the hospital located in the domain D is specifically described. In this specific embodiment, the sensor constitutes the first user node in the above embodiment, and the server or diagnostic equipment of the hospital constitutes the second user node in the above embodiment.

FIG. 6 is a schematic diagram of a scenario in which sensors perform cross-domain access according to a specific embodiment of the present invention. As shown in FIG. 6, in the cross-domain access system of this specific embodiment, domain A constitutes the first network domain in this embodiment. , The corresponding distributed controllers, gateways, etc. in domain A are the first distributed controllers and first gateways in this embodiment; similarly, domain D constitutes the second network domain in this embodiment, domain D The corresponding distributed controllers, gateways, etc. in this embodiment are the second distributed controllers and second gateways in this embodiment.

In this specific embodiment, the IP address of the user's sensor node is FF00::1109, the address of the gateway where the user is located is FF00::1103, and the address of the distributed controller where the user is located is FF00::1101. When a sensor node requests a diagnosis from the hospital under certain circumstances (such as a heart rate lower than a certain threshold), the hospital combines the user's historical data and the case database to give a diagnosis, and returns the result to the sensor node. Fig. 7 is a schematic diagram of the interaction of a sensor for cross-domain access according to a specific embodiment of the present invention. As shown in Fig. 7, the process of the above-mentioned sensor for cross-domain access is as follows:

Sl, a user domain access node sends to the sensor S is domain A domain access gateway request R _i, to the access point hospital diagnosis automatically access the server, the visited domain D _i to node server_1.beijing.hos.chinese, QoS result of accessing the feedback delay requirements include LR _i = 1s, the middleware processing delay requirements M _i = 30ms, transmission delay LT _i = 50ms, the bandwidth B _i = 1Mbps, P _i = advanced privacy level.

S2. After receiving the cross-domain access request, the service acceptance module parses out (D _i , LR _i , M _i , LT _i , B _i , P _i ) in the cross-domain access request, and distributes the information in the domain to the controller The interaction module sends; the intra-domain information interaction module first performs the out-of-domain access number for cross-domain access

The number is the hash value HASH (2019-08-07 22:45 00server_1.beijing.hos.chinese) after the merged text of the accessed server domain name and the current timestamp (set to 2019-08-07 22:45 00) = 122e207244c368a098112ea1dd2572df47d5045c2b569beb64922ba13598f150 , Query the domain name resolution module for the IP address ADDRESS _{des of the} visited node, get FF03::110F, and get the domain D distributed controller address ADDRESS _{des_ctr} where the visited node is located as FF03::1101.

S3: In the distributed controller where the visited node is located, the intra-domain information exchange module sends the information of the distributed controller where the visited node is located to the inter-domain information exchange module, and the inter-domain information exchange module queries the routing information module to find the visited domain Distributed controller routing information

If you need to pass through two distributed controllers, domain B and domain C, whose addresses are FF01::1101 and FF02::1101, the routing information passed is (FF00::1101,FF01::1101,FF02::1101, FF03::1101), the sequence of switches passed is

The inter-domain information interaction module sends an access request to the inter-domain information interaction module of the distributed controller where the visited node is located

which is

S4: After receiving the access request, the inter-domain information interaction module of the distributed controller where the visited node is located, parses out the ADDRESS _des of the visited node as FF01::110F, and assigns a number for this domain access

The number is obtained by adding the hash value of the access node address and the current timestamp text, that is

Inquire the gateway of the visited node from the routing information module, the address is FF03::1103 through the switch sequence (S ₀ , S ₁ , S ₂ ……S _n ), and send cross-domain access to the gateway where the visited node is located command.

S5, the visited node determines the server that invokes the identity authentication, authorization and key agreement process to select LR _{iden_i} , LR _{auth_i} , and LR _{key_i} according to the feedback delay request LR _i to ensure that LR _{iden_i} +LR _{auth_i} +LR _{key_i} ≤LR _i , set LR _{iden_i} , LR _{auth_i} , and LR _{key_i} are 300ms respectively, which meets the requirement of less than 1s. The gateway calls the identity authentication server service, the identity authentication server recognizes the identity of the visiting user, and sends a receipt indicating whether the identity authentication is passed or not

Set the return value to TRUE (indicating pass); after receiving the pass receipt, the gateway calls the authorization mapping authorization server service, and the authorization mapping authorization server checks whether the accessing user has the authority to access the corresponding service according to the requested business, and whether it is authorized to access is generated after passing 'S receipt

The sensor node address is consistent with the IP address reserved by the user database, and TRUE is returned. After the gateway receives the authorization receipt, it sends authentication feedback to the information interaction module in the distributed controller domain in the domain

S6, the accessed distributed controller FF03::1101 sends the authentication result to the distributed controller FF01::1101 where the access node is located, and the distributed controller FF01::1101 where the access node is located sends the authentication result to the access node gateway FF00 through the information exchange module in the domain. ::1103 sends the authentication pass and prepares the key agreement message, the privacy level P _{i is} required to be a high level, the gateway FF00::1103 calls the key agreement server FF00::1112, and the key called by the accessed node gateway FF03::1103 The negotiation server FF03::1112 obtains the communication key (K _sour , K _des ) through negotiation.

S7, the gateway of the visited node sends an authentication process completion message to the distributed controller of the visited node, and the gateway of the visited node sends an authentication process completion message to the distributed controller of the visited node. The distributed controller FF03::1101 in the domain establishes a connection, and negotiates to determine the network slice required for this service according to the service QoS requirements, including calling the firewall by NFV, dynamically writing ACL rules; encryption and decryption and other middleware resources, set this time The virtual functions required by the service are

Represents firewall and encryption and decryption services respectively. According to the middleware processing delay requirement M _i is 30ms, the processing delay in the domain where the access node is found

Processing delay for 10ms and within the domain of the visited node

It is 10ms, which meets the requirements. And according to the transmission delay LT _i of 50 ms and the bandwidth B _i of 1 Mbps, the routing information module plans network resources such as the optimal transmission path between the domains and the domains. The inter-domain routing includes the distributed controller sequence (FF00::1101,FF01). ::1101,FF02::1101,FF03::1101 meets the requirements. At this time, the sequence of switches passed by each intra-domain route is: within domain A

Within domain B

In domain C

In domain D

S8, the access node gateway FF00::1103 sends the access feedback result to the access node FF00::1109, and the visited node gateway FF03::1103 sends the access feedback result to the visited node FF03::110F. The sensor FF00::1109 sends the data recorded by the sensor to the hospital server FF03::110F. The access node dynamically writes ACL rules to the NFV firewall in the domain to allow cross-domain access to the information transmitted from FF00::1109 to FF03::110F, and the information is encrypted and transmitted through the encryption server; the accessed node is in the domain through NFV to The firewall dynamically writes ACL rules to allow FF00::1109 to be transmitted to FF03::110F to enter the domain and complete the decryption operation through the server; the reverse data also goes through the firewall, encryption and decryption operations to establish a two-way connection to achieve strong logical isolation across Domain access.

S9: After the visit is over, the gateway where the visited node is located records the visit and the end time of the visit

which is

Consortium chain maintenance is established by gateways in domain D to ensure traceability of access records. After this visit, the hospital server deducts the corresponding fees, and the whole process is normal, so there is no need to report abnormal situations. If the sensor node reports invalid data multiple times, or fails to pay the agreed fee within a certain period of time, the visit will be regarded as abnormal Access: Report abnormal access records and abnormal reasons to distributed controllers through the gateway, and the abnormal access records are maintained by the alliance chain maintained between the distributed controllers.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is Better implementation. Based on this understanding, the technical solution of the present invention essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes a number of instructions to enable a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the method described in each embodiment of the present invention.

Example 2

This embodiment provides a cross-domain access method, which is applied to a first user node, and the first user node is a user node belonging to the first network domain; FIG. 8 is a flow chart of the cross-domain access method according to an embodiment of the present invention Figure (1), as shown in Figure 8, the cross-domain access method in this embodiment includes:

S202: Initiate a cross-domain access request, and send the cross-domain access request to the second distributed controller through the first distributed controller; wherein the cross-domain access request is used to request cross-domain access to the second user node;

S204: Access the second user node through the network slice; where the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request;

Wherein, the first distributed controller is set to control the first network domain; the second distributed controller is set to control the second network domain, and the second user node is a user node belonging to the second network domain .

The remaining embodiments and technical effects of the cross-domain access method in this embodiment all correspond to the cross-domain access system in Embodiment 1, and therefore will not be repeated here.

In an embodiment, before sending the cross-domain access request to the second distributed controller through the first distributed controller, the method includes:

Send a cross-domain access request to the first gateway, and send the cross-domain access request to the first distributed controller through the first gateway; wherein the first gateway is connected to the first user node through the first switch.

In an embodiment, the foregoing sending the cross-domain access request to the second distributed controller through the first distributed controller includes:

Sending a cross-domain access request to the second distributed controller through the first distributed controller, so that the second distributed controller generates a cross-domain access command according to the cross-domain access information, and forwards the cross-domain access command to the second gateway;

The second gateway is connected to the second user node through the second switch; the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command.

In an embodiment, the above-mentioned cross-domain access command to instruct the second gateway to authenticate the first user node according to the cross-domain access command includes:

The cross-domain access command is used to instruct the second gateway to call the identity authentication server to perform identity authentication authentication on the first user node according to the cross-domain access command, and to call the authorization mapping server to perform access authority authentication on the first user node.

In an embodiment, after the above-mentioned cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command, the method further includes:

Invoking the first key agreement server through the first gateway, so that the first key agreement server and the second key agreement server perform key agreement according to the cross-domain access request, so as to obtain the cross-domain access key;

In an embodiment, after obtaining the cross-domain access key, the method further includes:

Send authentication confirmation information to the first distributed controller through the first gateway, and send authentication confirmation information to the second distributed controller through the second gateway, so that the first distributed controller and/or the second distributed controller A connection is established between the first distributed controller and the second distributed controller according to the authentication confirmation information.

In an embodiment, the above method further includes:

Write a first access control list ACL rule to the firewall via the network function virtualization NFV through the first distributed controller, where the first ACL rule is used to instruct the firewall to allow the first user node to send cross-domain access to the second user node information;

The second distributed controller is used to write a second ACL rule to the firewall via NFV, where the second ACL rule is used to instruct the firewall to allow cross-domain access information to enter the second network domain.

In an embodiment, the above method further includes:

Encrypting the cross-domain access information sent by the first user node through the first distribution, and sending the encrypted cross-domain access information to the second distributed controller;

The encrypted cross-domain access information is decrypted by the second distributed processor, and the decrypted cross-domain access information is sent to the second user node to realize the cross-domain access of the first user node.

Initiating a cross-domain access request and sending the cross-domain access request to the second distributed controller through the first distributed controller includes:

Initiate a first cross-domain access request to request cross-domain access to the second user node;

Responding to the first cross-domain access request initiated by the first user node through the first distributed controller to generate a second cross-domain access request, and send the second cross-domain access request to the second distributed controller;

In an embodiment, before the foregoing access to the second user node through network slicing, the method further includes:

The first distributed controller and/or the second distributed controller are used to determine the network slice according to the quality of service requirements in the cross-domain access request.

The routing information is determined by the first distributed controller and/or the second distributed controller according to the quality of service requirements in the cross-domain access request, where the routing information is used to indicate that the access information is in the first network domain or the second network domain The internal transmission path, and the transmission path between the first network domain and the second network domain.

In an embodiment, the above method further includes:

Obtaining the cross-domain access record after the first user node ends the cross-domain access to the second user node through the first gateway and/or the second gateway;

Set up and maintain a consortium chain between the first distributed controller and the second distributed controller, and maintain cross-domain access records through the consortium chain; among them, cross-domain access records include: cross-domain access events, cross-domain access The occurrence and end time of the event.

In an embodiment, the above-mentioned maintaining the cross-domain access record through the alliance chain further includes:

Record the abnormal access record, where the abnormal access record is used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access record is reported by the first gateway and/or the second gateway.

Example 3

This embodiment provides a cross-domain access method, which is applied to a second user node, and the first user node is a user node belonging to the second network domain; FIG. 9 is a flow chart of the cross-domain access method according to an embodiment of the present invention Figure (2), as shown in Figure 9, the method in this embodiment includes:

S302. Respond to the access by the first user node through the network slice; where the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; the first distributed controller is Set to control the first network domain; the second distributed controller is set to control the second network domain, and the first user node is a user node belonging to the first network domain;

The cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the second distributed controller through the first distributed controller.

The remaining embodiments and technical effects of the cross-domain access method in this embodiment all correspond to the cross-domain access system in Embodiment 1, so they will not be repeated here.

In an embodiment, the aforementioned cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the first gateway, so as to send the cross-domain access request to the first distributed controller through the first gateway; wherein, The first gateway is connected to the first user node through the first switch.

In an embodiment, the aforementioned cross-domain access request sends the cross-domain access request to the second distributed controller through the first distributed controller, so that the second distributed controller generates the cross-domain access command according to the cross-domain access information, And forward the cross-domain access command to the second gateway;

In an embodiment, the above method further includes:

In an embodiment, before the above response to the access by the first user node through the network slicing, the method further includes:

In an embodiment, the above method further includes:

Example 4

This embodiment provides a cross-domain access device, which is applied to a first user node, and the first user node is a user node belonging to the first network domain; the device is used to implement the above-mentioned embodiment and some other implementation manners, and has been implemented I won’t go into details that have been explained. As used below, the term "module" can implement a combination of software and/or hardware with predetermined functions. Although the devices described in the following embodiments are preferably implemented by software, implementation by hardware or a combination of software and hardware is also possible and conceived. Fig. 10 is a structural block diagram (1) of a cross-domain access device according to an embodiment of the present invention. As shown in Fig. 10, the cross-domain access device in this embodiment includes:

The request module 402 is configured to initiate a cross-domain access request and send the cross-domain access request to the second distributed controller through the first distributed controller; wherein the cross-domain access request is used to request cross-domain access to the second user node ；

The access module 404 is configured to access the second user node through a network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request;

The remaining embodiments and technical effects of the cross-domain access apparatus in this embodiment all correspond to the cross-domain access method in Embodiment 2, and therefore will not be repeated here.

In an embodiment, the above method further includes:

It should be noted that each of the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following manner, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination. The forms are located in different processors.

Example 5

This embodiment provides a cross-domain access device, which is applied to a second user node, and the first user node is a user node belonging to the second network domain; the device is used to implement the above-mentioned embodiments and some other implementation manners, and has been implemented I won’t go into details that have been explained. As used below, the term "module" can implement a combination of software and/or hardware with predetermined functions. Although the devices described in the following embodiments are preferably implemented by software, implementation by hardware or a combination of software and hardware is also possible and conceived. Fig. 11 is a structural block diagram (2) of a cross-domain access device according to an embodiment of the present invention. As shown in Fig. 11, the cross-domain access device in this embodiment includes:

The response module 502 is configured to respond to the access by the first user node through the network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; first The distributed controller is set to control the first network domain; the second distributed controller is set to control the second network domain, and the first user node is a user node belonging to the first network domain;

The remaining embodiments and technical effects of the cross-domain access device in this embodiment all correspond to the cross-domain access method in Embodiment 3, so they will not be repeated here.

In an embodiment, the above method further includes:

In an embodiment, before the above-mentioned response to the access by the first user node through the network slicing, the method further includes:

In an embodiment, the above method further includes:

Set up and maintain a consortium chain between the first distributed controller and the second distributed controller, and maintain cross-domain access records through the consortium chain; among them, cross-domain access records include: cross-domain access events, cross-domain access The occurrence and ending time of the event.

Record abnormal access records, where the abnormal access records are used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access records are reported by the first gateway and/or the second gateway.

Example 6

The embodiment of the present invention also provides a computer-readable storage medium, and a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute any of the foregoing method embodiments when running. step.

In some examples of this embodiment, the foregoing computer-readable storage medium may be configured to store a computer program for executing the method steps recorded in the foregoing embodiment:

In some instances of this embodiment, the foregoing computer-readable storage medium may include, but is not limited to: U disk, Read-Only Memory (Read-Only Memory, ROM for short), Random Access Memory (Random Access Memory, for short) Various media that can store computer programs such as RAM), mobile hard disks, magnetic disks, or optical disks.

Example 7

12, the embodiment of the present invention also provides an electronic device, including a memory 1201 and a processor 1202, the memory 1201 stores a computer program, the processor 1202 is configured to run the computer program to perform any of the above Steps in the method embodiment.

In some examples, the above-mentioned electronic device may further include a transmission device and an input-output device, wherein the transmission device is connected to the aforementioned processor, and the input-output device is connected to the aforementioned processor.

In some examples of this embodiment, the above-mentioned processor may be configured to execute the method steps recorded in the above-mentioned embodiment through a computer program.

For specific examples in this embodiment, reference may be made to the examples described in the above-mentioned embodiments and alternative implementations, and this embodiment will not be repeated here.

According to the embodiment of the present invention, since the first user node belonging to the first network domain requests cross-domain access to the second user node belonging to the second network domain, it can be configured to perform operations on the first network domain. The controlled first distributed controller responds to the cross-domain access request initiated by the first user node to send the cross-domain access request to the second distributed controller that is set to control the second network domain; the second distributed After the controller receives the cross-domain access request, it further determines the network slice according to the cross-domain access request through the first distributed controller and/or the second distributed controller; in this way, the second user node can respond to the first The user node accesses through network slicing; therefore, the embodiment of the present invention is configured to solve the problem of being unable to ensure security performance during cross-domain access in some cases at least to a certain extent, so as to achieve cross-domain access during cross-domain access. Effectively ensure the effect of safety performance.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general computing device, and they can be concentrated on a single computing device or distributed in a network composed of multiple computing devices. Above, alternatively, they can be implemented with program codes executable by the computing device, so that they can be stored in the storage device for execution by the computing device, and in some cases, can be executed in a different order than here. Perform the steps shown or described, or fabricate them into individual integrated circuit modules respectively, or fabricate multiple modules or steps of them into a single integrated circuit module for implementation. In this way, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only some embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, the present invention can have various modifications and changes. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

A cross-domain access system, including:

The first user node is configured to initiate a cross-domain access request to request cross-domain access to the second user node;

The first distributed controller is configured to respond to the cross-domain access request initiated by the first user node to send the cross-domain access request to the second distributed controller;

The second distributed controller is configured to receive the cross-domain access request; the first distributed controller and/or the second distributed controller is further configured to determine according to the cross-domain access request Network slicing

The second user node is configured to respond to the access by the first user node through the network slice;

Wherein, the first distributed controller is used to control a first network domain, the first user node is a user node belonging to the first network domain; the second distributed controller is used to control a second The network domain performs control, and the second user node is a user node belonging to the second network domain.
The system according to claim 1, further comprising:

A first gateway is connected to the first user node through a first switch; the first gateway is configured to obtain the cross-domain access request initiated by the first user node, and forward the cross-domain access request To the first distributed controller;

The second gateway is connected to the second user node through a second switch; the second gateway is configured to obtain a cross-domain access command sent by the second distributed controller, and pair according to the cross-domain access command The first user node performs authentication; wherein the cross-domain access command is generated by the second distributed controller according to the cross-domain access information.
The system according to claim 2, wherein the second gateway is further configured to:

According to the cross-domain access command, the identity authentication server is invoked to perform identity recognition authentication on the first user node, and the authorization mapping server is invoked to perform access authority authentication on the first user node.
The method according to claim 2, wherein the first gateway is further configured to:

Invoking the first key agreement server, so that the first key agreement server and the second key agreement server perform key agreement according to the cross-domain access request to obtain a cross-domain access key;

Wherein, the cross-domain access key is used for the encryption and/or decryption processing in the cross-domain access between the first user node and the second user node; the first key agreement server belongs to the The key agreement server of the first network domain, and the second key agreement server is a key agreement server belonging to the second network domain.
The system according to claim 2, wherein the first gateway is further configured to send authentication confirmation information to the first distributed controller; and the second gateway is further configured to send authentication confirmation information to the Second distributed controller;

The first distributed controller and/or the second distributed controller are further configured to, according to the authentication confirmation information, between the first distributed controller and the second distributed controller establish connection.
The system according to claim 2, wherein the first distributed controller is further configured to write a first access control list ACL rule to the firewall through network function virtualization NFV, wherein the first ACL The rule is used to instruct the firewall to allow the first user node to send cross-domain access information to the second user node;

The second distributed controller is further configured to write a second ACL rule to the firewall through the NFV, where the second ACL rule is used to instruct the firewall to allow the cross-domain access information to enter the The second domain.
The system according to claim 6, wherein the first distributed controller is further configured to perform encryption processing on the cross-domain access information sent by the first user node, and perform encryption processing on the encrypted all Sending the cross-domain access information to the second distributed controller;

The second distributed processor is further configured to decrypt the encrypted cross-domain access information, and send the decrypted cross-domain access information to the second user node to implement Cross-domain access of the first user node.
The system according to claim 7, wherein the cross-domain access request comprises: a first cross-domain access request and a second cross-domain access request;

The first user node is further configured to initiate a first cross-domain access request to request cross-domain access to the second user node;

The first distributed controller is further configured to generate a second cross-domain access request in response to the first cross-domain access request initiated by the first user node, and send the second cross-domain access request to The second distributed controller;

Wherein, the first cross-domain access request includes at least one of the following: domain name information of the second user node, service type information, and service quality requirement information;

The second cross-domain access request includes at least one of the following: second user node address information, first user node address information, the service type information, and the service quality requirement information.
The system according to claim 8, wherein the first distributed controller and/or the second distributed controller are further configured to,

The network slice is determined according to the service quality requirement in the cross-domain access request.
The system according to claim 8, wherein the first distributed controller and/or the second distributed controller are further configured to,

Determining routing information according to the quality of service requirement in the cross-domain access request, where the routing information is used to indicate a transmission path of the access information within the first network domain or the second network domain, And the transmission path between the first network domain and the second network domain.
The system according to any one of claims 2 to 10, further comprising:

The alliance chain is set between the first distributed controller and the second distributed controller; the alliance chain is configured to maintain cross-domain access records; wherein, the cross-domain access records are controlled by the The first gateway and/or the second gateway obtain the second user node after the first user node ends the cross-domain access to the second user node;

The cross-domain access record includes: a cross-domain access event, the occurrence and end time of the cross-domain access event.
The system according to claim 11, wherein the alliance chain is further configured to:

Record abnormal access records, where the abnormal access record is used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access record is controlled by the first gateway and/or the second user node Reported by the gateway.
A cross-domain access method applied to a first user node, wherein the first user node is a user node belonging to a first network domain; the method includes:

Initiating a cross-domain access request, and sending the cross-domain access request to the second distributed controller through the first distributed controller; wherein the cross-domain access request is used to request cross-domain access to the second user node;

Access to the second user node through a network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request;

Wherein, the first distributed controller is used to control the first network domain; the second distributed controller is used to control a second network domain, and the second user node belongs to the first network domain. User node of the second domain.
The method according to claim 13, before the step of sending the cross-domain access request to the second distributed controller through the first distributed controller, the method comprises:

Send the cross-domain access request to a first gateway, and send the cross-domain access request to a first distributed controller through the first gateway; wherein the first gateway is connected to the first distributed controller through a first switch The first user node.
The method according to claim 14, wherein the sending the cross-domain access request to the second distributed controller through the first distributed controller comprises:

The first distributed controller sends the cross-domain access request to the second distributed controller, so that the second distributed controller generates a cross-domain access command according to the cross-domain access information, and The cross-domain access command is forwarded to the second gateway;

The second gateway is connected to the second user node through a second switch; the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command .
The method according to claim 15, wherein the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command, comprising:

The cross-domain access command is used to instruct the second gateway to call an identity authentication server to perform identity authentication on the first user node according to the cross-domain access command, and to call an authorization mapping server to perform identity verification on the first user. The node performs access authorization authentication.
The method according to claim 15, after the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command, the method further comprises:

Invoking a first key agreement server through the first gateway, so that the first key agreement server and the second key agreement server perform key agreement according to the cross-domain access request, so as to obtain a cross-domain access key;

Wherein, the cross-domain access key is used for the encryption and/or decryption processing in the cross-domain access between the first user node and the second user node; the first key agreement server belongs to the The key agreement server of the first network domain, and the second key agreement server is a key agreement server belonging to the second network domain.
The method according to claim 17, after the step of obtaining the cross-domain access key, further comprising:

Send authentication confirmation information to the first distributed controller through the first gateway, and send authentication confirmation information to the second distributed controller through the second gateway, so that the first distributed control And/or the second distributed controller establishes a connection between the first distributed controller and the second distributed controller according to the authentication confirmation information.
The method of claim 18, further comprising:

Write a first access control list ACL rule to the firewall via the network function virtualization NFV through the first distributed controller, where the first ACL rule is used to instruct the firewall to allow the first user The node sends cross-domain access information to the second user node;

The second distributed controller is used to write a second ACL rule to the firewall via the NFV, where the second ACL rule is used to instruct the firewall to allow the cross-domain access information to enter the first Two domains.
The method of claim 19, further comprising:

Encrypting the cross-domain access information sent by the first user node through the first distribution, and send the encrypted cross-domain access information to the second distributed controller;

The encrypted cross-domain access information is decrypted by the second distributed processor, and the decrypted cross-domain access information is sent to the second user node to realize the first Cross-domain access of a user node.
The method according to claim 13, wherein the cross-domain access request comprises: a first cross-domain access request and a second cross-domain access request;

The initiating a cross-domain access request and sending the cross-domain access request to the second distributed controller through the first distributed controller includes:

Initiating a first cross-domain access request to request cross-domain access to the second user node;

The first distributed controller responds to the first cross-domain access request initiated by the first user node to generate a second cross-domain access request, and sends the second cross-domain access request to the first user node. Two distributed controller;

Wherein, the first cross-domain access request includes at least one of the following: domain name information of the second user node, service type information, and service quality requirement information;

The second cross-domain access request includes at least one of the following: second user node address information, first user node address information, the service type information, and the service quality requirement information.
The method according to claim 21, before the step of accessing the second user node through network slicing, the method further comprises:

The first distributed controller and/or the second distributed controller are used to determine the network slice according to the service quality requirement in the cross-domain access request.
The method according to claim 21, before the step of accessing the second user node through network slicing, the method further comprises:

The first distributed controller and/or the second distributed controller are used to determine routing information according to the quality of service requirements in the cross-domain access request, where the routing information is used to indicate the A transmission path of access information within the first network domain or the second network domain, and a transmission path between the first network domain and the second network domain.
The method according to any one of claims 15 to 23, further comprising:

Acquiring, through the first gateway and/or the second gateway, a cross-domain access record after the first user node ends the cross-domain access to the second user node;

An alliance chain is set up and maintained between the first distributed controller and the second distributed controller, and cross-domain access records are maintained through the alliance chain; wherein, the cross-domain access records include: A cross-domain access event, the occurrence and end time of the cross-domain access event.
The method according to claim 24, wherein the maintaining the cross-domain access record through the alliance chain further comprises:

Record abnormal access records, where the abnormal access record is used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access record is controlled by the first gateway and/or the second user node Reported by the gateway.
A cross-domain access method applied to a second user node, wherein the second user node is a user node belonging to a second network domain; the method includes:

In response to the access by the first user node through the network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; the first distributed control The device is used to control a first network domain; the second distributed controller is used to control a second network domain, and the first user node is a user node belonging to the first network domain;

The cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the second distributed controller through the first distributed controller.
The method according to claim 26, wherein the cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to a first gateway, so as to transfer the cross-domain access request through the first gateway. The domain access request is sent to the first distributed controller; wherein, the first gateway is connected to the first user node through a first switch.
The method according to claim 27, wherein the cross-domain access request is sent to the second distributed controller through the first distributed controller, so that the second distributed controller The mode controller generates a cross-domain access command according to the cross-domain access information, and forwards the cross-domain access command to the second gateway;

The second gateway is connected to the second user node through a second switch; the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command .
The method according to claim 28, wherein the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command, comprising:

The cross-domain access command is used to instruct the second gateway to call an identity authentication server to perform identity authentication on the first user node according to the cross-domain access command, and to call an authorization mapping server to perform identity verification on the first user. The node performs access authorization authentication.
The method according to claim 28, after the cross-domain access command is used to instruct the second gateway to authenticate the first user node according to the cross-domain access command, the method further comprises:

Invoking a first key agreement server through the first gateway, so that the first key agreement server and the second key agreement server perform key agreement according to the cross-domain access request, so as to obtain a cross-domain access key;

Wherein, the cross-domain access key is used for the encryption and/or decryption processing in the cross-domain access between the first user node and the second user node; the first key agreement server belongs to the The key agreement server of the first network domain, and the second key agreement server is a key agreement server belonging to the second network domain.
The method according to claim 30, after the step of obtaining the cross-domain access key, further comprising:

Send authentication confirmation information to the first distributed controller through the first gateway, and send authentication confirmation information to the second distributed controller through the second gateway, so that the first distributed control And/or the second distributed controller establishes a connection between the first distributed controller and the second distributed controller according to the authentication confirmation information.
The method of claim 31, further comprising:

Write a first access control list ACL rule to the firewall via the network function virtualization NFV through the first distributed controller, where the first ACL rule is used to instruct the firewall to allow the first user The node sends cross-domain access information to the second user node;

The second distributed controller is used to write a second ACL rule to the firewall via the NFV, where the second ACL rule is used to instruct the firewall to allow the cross-domain access information to enter the first Two domains.
The method of claim 32, further comprising:

Encrypting the cross-domain access information sent by the first user node through the first distribution, and send the encrypted cross-domain access information to the second distributed controller;

The encrypted cross-domain access information is decrypted by the second distributed processor, and the decrypted cross-domain access information is sent to the second user node to realize the first Cross-domain access of a user node.
The method according to claim 26, wherein the cross-domain access request comprises: a first cross-domain access request and a second cross-domain access request;

The initiating a cross-domain access request and sending the cross-domain access request to the second distributed controller through the first distributed controller includes:

Initiating a first cross-domain access request to request cross-domain access to the second user node;

The first distributed controller responds to the first cross-domain access request initiated by the first user node to generate a second cross-domain access request, and sends the second cross-domain access request to the first user node. Two distributed controller;

Wherein, the first cross-domain access request includes at least one of the following: domain name information of the second user node, service type information, and service quality requirement information;

The second cross-domain access request includes at least one of the following: second user node address information, first user node address information, the service type information, and the service quality requirement information.
The method according to claim 34, before the step of responding to the access by the first user node through the network slicing, further comprising:

The first distributed controller and/or the second distributed controller are used to determine the network slice according to the service quality requirement in the cross-domain access request.
The method according to claim 34, characterized in that, before the step of responding to the access by the first user node through the network slicing, the method further comprises:

The first distributed controller and/or the second distributed controller are used to determine routing information according to the quality of service requirements in the cross-domain access request, where the routing information is used to indicate the A transmission path of access information within the first network domain or the second network domain, and a transmission path between the first network domain and the second network domain.
The method according to any one of claims 28 to 36, further comprising:

Acquiring, through the first gateway and/or the second gateway, a cross-domain access record after the first user node ends the cross-domain access to the second user node;

An alliance chain is set up and maintained between the first distributed controller and the second distributed controller, and cross-domain access records are maintained through the alliance chain; wherein, the cross-domain access records include: A cross-domain access event, the occurrence and end time of the cross-domain access event.
The method according to claim 37, wherein the maintaining the cross-domain access record through the alliance chain further comprises:

Record abnormal access records, where the abnormal access record is used to indicate that the first user node cross-domain access to the second user node is abnormal; the abnormal access record is controlled by the first gateway and/or the second user node Reported by the gateway.
A cross-domain access device applied to a first user node, wherein the first user node is a user node belonging to a first network domain; the device includes:

The request module is configured to initiate a cross-domain access request, and send the cross-domain access request to the second distributed controller through the first distributed controller; wherein, the cross-domain access request is used to request cross-domain access to the first Two user nodes;

The access module is configured to access the second user node through a network slice; wherein, the network slice is controlled by the first distributed controller and/or the second distributed controller according to the cross-domain access request Make sure

Wherein, the first distributed controller is configured to control the first network domain; the second distributed controller is configured to control a second network domain, and the second user node is attribution A user node in the second network domain.
A cross-domain access device applied to a second user node, wherein the second user node is a user node belonging to a second network domain; the device includes:

The response module is configured to respond to the access by the first user node through the network slice; wherein the network slice is determined by the first distributed controller and/or the second distributed controller according to the cross-domain access request; The first distributed controller is configured to control a first network domain; the second distributed controller is configured to control a second network domain, and the first user node is attributable to the first User node of the domain;

The cross-domain access request is initiated by the first user node, and the cross-domain access request is sent to the second distributed controller through the first distributed controller.
A computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the method described in any one of claims 13 to 25 and claims 26 to 38 when running.
An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any of claims 13 to 25 and claims 26 to 38 The method described in one item.