WO2022001004A1 - Secure network construction method and apparatus, device, and computer storage medium - Google Patents

Abstract

Embodiments of the present invention provide a secure network construction method and apparatus, a device, and a computer storage medium. The secure network construction method is applied to a secure network system. The system comprises: a configuration module, a network element searching module, and a network element management module. The secure network construction method comprises: the configuration module obtains configuration information of at least one network slice, the configuration information comprising a first security level parameter of the network slice; the network element searching module obtains at least one target standard network element corresponding to the first security level parameter; the network element management module generates a routing rule according to the at least one target standard network element and at least one target security network element; and a network management module determines a secure network according to the routing rule, the target standard network element, and the target security network element.

Description

Secure network construction method, apparatus, device and computer storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Chinese Patent Application No. 202010599875.3 filed in China on June 28, 2020, the entire contents of which are incorporated herein by reference.

technical field

The present disclosure belongs to the field of communication networks, and in particular, relates to a method, apparatus, device and computer storage medium for constructing a secure network.

Background technique

With the commercialization of communication networks, the mobility, reliability and security of network access will be considered in the design of communication networks. Secure communication capabilities.

However, with the continuous development of communication technology, the new generation of communication technology also has high demands in terms of security. For example, 5G networks introduce network slicing technology, so that one network can support multiple different types of business scenarios at the same time. Therefore, a security network is required to meet the security requirements of different users in all walks of life and to provide flexible security guarantees so as to realize the security of the communication network.

SUMMARY OF THE INVENTION

The embodiments of the present disclosure provide a method, apparatus, device, and computer storage medium for constructing a secure network, which can not only reduce the complexity of the network, but also reduce the construction cost in the process of constructing the secure network.

In a first aspect, embodiments of the present disclosure provide a method for constructing a secure network. The method is applied to a secure network system. The system includes: a configuration module, a network element search module, a network element management module, and a network construction module; the method for constructing a secure network includes: configuring The module obtains configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice;

The network element search module obtains at least one target standard network element corresponding to the first security level parameter;

The network element management module generates routing rules according to at least one target network element and at least one target security network element;

The network building module determines a secure network according to routing rules, target standard network elements and target security network elements.

In some implementations of the first aspect, the configuration information further includes: configuration parameters of the network slice.

In some implementations of the first aspect, the secure network system further includes a network element establishment module, and the network element establishment module includes a plurality of network elements corresponding to the first security level parameter;

The network element search module searches for the first network element that satisfies the configuration information of the network slice from the network element establishment module;

If the network element establishing module includes the first network element, and the running state of the first network element is normal, the network element searching module determines the first network element as the target standard network element.

In some implementations of the first aspect, the method further includes: if the network element establishment module does not include a first network element that satisfies the configuration information of the network slice, the network element establishment module establishes a corresponding first network element according to the configuration parameters of the network slice the second network element of the security level parameter;

The network element search module obtains the running state of the second network element;

If the running state of the second network element is normal, the network element search module determines the second network element as the target standard network element.

In some implementations of the first aspect, the secure network system further includes a network element planning module; after determining the secure network, the method further includes: the network element planning module obtains application requirement information of the secure network slice;

The network element planning module obtains the target application network elements that meet the application requirement information from the security network according to the genetic algorithm, and obtains the security network slice.

In some implementations of the first aspect, the application requirement information includes a second security level parameter required for secure network slicing;

According to the genetic algorithm, the target application network elements that meet the application requirement information are obtained from the security network, and the security network slice is obtained, including:

obtaining, according to the second security level parameter, a first set of network elements corresponding to the second security level parameter;

Perform a crossover operation and a mutation operation on the first set of network elements to obtain a second set of network elements;

Obtain a third set of network elements that meets the application requirement information from the second set of network elements;

A secure network slice is obtained according to the third set of network elements.

In some implementations of the first aspect, the first network element set includes at least one first application network element of at least one category, and each first application network element is linked to a security network element corresponding to a security level parameter;

Perform crossover and mutation operations on the first set of network elements to obtain a second set of network elements, including:

Perform a cross operation on the first application network element and the security network element of each category in the first network element set to obtain a fourth network element set;

A mutation operation is performed on the fourth set of network elements to obtain a second set of network elements.

In some implementations of the first aspect, performing a mutation operation on the fourth set of network elements to obtain the second set of network elements includes: obtaining and selecting at least one set of network elements that meets the application requirements from the fourth set of network elements according to the application requirement information The second application network element and the third application network element that does not meet the application requirement information;

According to each second application network element and each third application network element, a second network element set is obtained.

In some implementations of the first aspect, the secure network slice is obtained according to the third set of network elements, including:

If the physical resource consumption required by the third network element set satisfies the physical resource consumption condition, a secure network slice is obtained according to the third network element set.

In some implementations of the first aspect, the method further includes: if the physical resource consumption required by the third network element set does not meet the physical resource consumption condition, continuing to perform the iteration of the crossover operation and the mutation operation on the third network element set Calculation is performed until a set of network elements whose physical resource consumption meets the physical resource consumption condition is obtained, and a secure network slice is obtained.

In a second aspect, the present disclosure provides an apparatus for constructing a secure network, the apparatus comprising: a configuration module configured to acquire configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice;

a network element search module, configured to obtain at least one target standard network element and at least one target security network element corresponding to the first security level parameter;

a network element management module, configured to generate routing rules according to at least one target network element and at least one target security network element;

A network building module for determining a secure network based on routing rules, target standard network elements, and target security network elements.

In a third aspect, the present disclosure provides a device for constructing a secure network, the device comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the first aspect or any implementation manner of the first aspect is implemented. The security network construction method.

In a fourth aspect, the present disclosure provides a computer-readable storage medium, where computer program instructions are stored thereon, and when the computer program instructions are executed by a processor, the first aspect or any implementation manner of the first aspect is implemented. The security network construction method described above.

In the method for constructing a secure network according to the embodiment of the present disclosure, since the configuration information for constructing a secure network includes required network slices and required security levels, when constructing a secure network, the target network element and the corresponding required security level are The secure network element link enables the secure network to meet the construction and application of network slicing requirements of different security levels, provides flexible and customizable differentiated security guarantees for the applications and needs of industry users, and at the same time, can reduce the complexity of the network. degree, and reduce construction costs.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present disclosure more clearly, the accompanying drawings required in the embodiments of the present disclosure will be briefly introduced below. For those of ordinary skill in the art, under the premise of no creative work, the Additional drawings can be obtained from these drawings.

1 is a schematic diagram of a network construction framework with multiple security levels based on NFV MANO provided by an embodiment of the present disclosure;

2 is a functional schematic diagram of an NFV MANO provided by an embodiment of the present disclosure;

3 is a schematic diagram of a network system with multiple security levels of NFV MANO provided by an embodiment of the present disclosure;

4 is a schematic flowchart of a method for constructing a secure network provided by an embodiment of the present disclosure;

5 is a schematic flowchart of another method for constructing a secure network provided by an embodiment of the present disclosure;

6 is a schematic flowchart of a method for obtaining a secure network slice provided by an embodiment of the present disclosure;

7 is a schematic structural diagram of a security network construction device provided by an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of a device for constructing a secure network provided by an embodiment of the present disclosure.

detailed description

The features and exemplary embodiments of various aspects of the present disclosure will be described in detail below. In order to make the purpose, technical solutions and advantages of the present disclosure more clear, the present disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present disclosure, and not to limit the present disclosure. It will be apparent to those skilled in the art that the present disclosure may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present disclosure by illustrating examples of the present disclosure.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element defined by the phrase "comprises" does not preclude the presence of additional identical elements in a process, method, article, or device that includes the element.

The term "and/or" in this article is only an association relationship to describe the associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, A and B exist at the same time, and A and B exist independently B these three cases.

With the continuous development of communication technology, the new generation of communication technology also has high demands in terms of security. For example, a fifth-generation mobile communication technology (5th-Generation, 5G) network introduces a network slicing technology, so that one network can support multiple different types of service scenarios at the same time.

Now, more and more enterprises are improving the security and performance of enterprise network by deploying various network-capable devices. With the growth of the enterprise scale, the number of network function devices deployed in the enterprise network has increased significantly, and there will be problems such as high cost of deploying network function devices, difficult management of network function devices, and high failure rate of network function devices. Network Function Virtualization (NFV), deploying traditional Communication Technology (CT) services on the cloud platform to realize software and hardware decoupling, dynamic creation of network elements and provision of virtual resources, and application of virtualization technology It abstracts physical resources to form virtual resources for upper-layer applications, realizes the virtualization of network functions, and reduces operators' investment costs and service development and deployment cycles.

In the commercialization of communication networks, the mobility, reliability and security of network access will be considered, for example, through identification, authentication and authorization, channel and bearer encryption, access control, etc., to provide secure communication capabilities.

At present, the construction of multi-level security network based on 5G private network mainly relies on the technology of network slicing, but the security threats faced by network slicing include the security isolation guarantee of slicing, the security guarantee of terminal access slicing, the security management guarantee of slicing, etc. , the terminal access slice is during the slice selection process of the terminal, the data may be tampered with or forged, which may lead to incorrect slice selection, so that the terminal cannot obtain services from the correct slice or the terminal that has not subscribed to the service is connected to the slice.

The private information used by users in the network slice selection process may be intercepted or monitored. If the terminal access slice lacks authentication and authorization, unauthorized terminals may enter the network slice to consume slice resources. The lack of a proper authorization mechanism can lead to different types of attacks. If the terminal access process is not protected, an attacker who eavesdrops on the access link may obtain some sensitive service permissions, and even obtain relevant information and hijack the ongoing session to inject its own data packets. The attacker can also eavesdrop by replaying The received packets will cause unnecessary overloading of the system, affecting system availability and service quality.

Therefore, there is a need for a security network system to meet the security requirements of different users in all walks of life, and to provide flexible security guarantees to realize the security of the communication network and the quality of service of the communication network.

In order to avoid the threat of slicing network, the present application proposes a security network system suitable for a security network construction method. Network construction, in which NFV MANO can include the integration of security module (Security Module, SM) resource management and network function virtualization (Network Function Virtualization, NFV) resource management, in the Virtualized Infrastructure Manager (Virtualized infrastructure Manager, VIM) ) to enhance the management and arrangement of containers to meet the needs of different security levels, as well as meet the security needs of different users in all walks of life, provide flexible security guarantees, realize the security of communication networks, and ensure that different user resources and data are distributed in Security in individual virtual network slices.

Before introducing the specific embodiments of the present disclosure, first introduce the network construction framework of multiple security levels based on NFV MANO applied by the embodiments of the present disclosure, as shown in FIG. 1 .

The multi-level security network construction framework based on NFV MANO can include: network function virtualization orchestration (NFV Orchestrator, NFVO), security module orchestration (Security Module Orchestrator, SMO), virtualized network function management (VNF Manager, VNFM), security module Manager (Security Module Manager, SMM) and Virtualization Facilities Manager (VIM).

Among them, NFVO and SMO are mainly responsible for the scheduling and resource orchestration of the business process of the system. The orchestration management layer receives application requests from Operation Support Systems (OSS). NFVO and SMO use Application Programming Interface (APIs) ) interacts with its corresponding virtual manager to implement functions such as traffic steering, instantiation of VNF and Session Management Function (SMF). In some embodiments, the operation support system can also be integrated as a business support system (BSS), or the operation support system and the business support system are integrated at the same time, for example, a business operation support system (BOSS) .

VNFM and SMM are mainly responsible for the full life cycle management of all virtual network elements such as virtual routers, switches, network elements, and security components, as well as dynamic adjustment of resource usage.

VIM is mainly responsible for the life cycle management of physical resources (such as: servers, storage, network, security, etc.), virtual resources (such as: virtual machines) and software resources (such as: management, supervision), through the application program interface, to other management systems Expose physical and virtual resources.

In some embodiments, the instantiation and management of VNFs, SMFs can be handled by NFVO and SMO, where VNFs, SMFs contain descriptor type, name, interface, memory size, disk size, vendor name, security level attributes, etc., NFVO And SMO can add security attributes to VNFs and SMFs without security level attributes. For example, the security levels can be divided into multiple security levels according to the needs of users in different industries. For example, the security levels can be divided into low, medium and high. 3 security levels.

Among them, the setting of the security level can be based on a variety of enhanced modules of different security levels of the Unified Data Management (UDM) as the division credentials, for example, according to the security level, the virtualized network function (VNF) and session management Functions (SMF) are distinguished to form network element sets with multiple security levels. Exemplarily, when there are three security levels of low, medium, and high, three security levels of low, medium, and high can be formed according to low, medium, and high. A collection of network elements of a level.

SMM and VNFM are divided according to the types in the managed network element set, wherein, SMM is mainly responsible for network element management (for example: primary authentication or secondary authentication), resource management, and link management related to security. The VNFM is responsible for resource management and network element management such as standard network elements and User Plane Function (UPF).

In some embodiments, standard network elements may include, for example: Network Slice Selection Function (NSSF), Network Exposure Function (NEF), Network Repository Function (NRF), Authentication Server Function (AUSF), Session Management Function (SMF), Access and Mobility Management Function (AMF), etc.

In the embodiment of the present disclosure, the standard network element is only used to distinguish it from the security network element, but is not used to limit the standard conditions that the network element meets.

In practical application, first, the standard network elements are prepared by the VNFM management system, and then the network element sets of different security levels are linked by the SMM, and finally sliced networks of different security levels are formed.

It should be noted that, in the embodiment of the present disclosure, the standard network element is only used to distinguish it from the security network element, but is not used to limit the standard conditions that the network element meets.

Different from the network orchestration method in the related art, by adding SMO, the unified collaborative orchestration of standard network elements involved in NFVO and security network elements controlled by SMO is realized, and a network with multiple security levels is realized.

NFV MANO can be jointly deployed relying on a combination of open source management and network orchestration (Open Source Mano, OSM), open source cloud computing management platform (OpenStack), etc. Standardized interfaces for evaluating all resources in the NFV infrastructure.

OSM can act as a network service orchestrator and manager, and provide on-demand creation of network services and return the identity document (ID) of the service object, which can model and automate real carrier-class services.

In the security network system described in the embodiments of the present disclosure, a network element planning module may also be used. The network element planning module can implement functions such as element management, life cycle management, security level rules and management, and resource management.

Exemplarily, in conjunction with the functional schematic diagram of the NFV MANO shown in Figure 2, the element management refers to the management of the VNF configuration information and software image to ensure that the VNF can be parsed normally.

Life cycle management refers to the scheduling of security network services at the core of the system, including functions such as creation, deployment, termination, deletion, and viewing of security network services.

Security level rule and request policy management refers to the deployment strategy algorithm for multiple security levels in the management system, including functions such as policy creation, deletion, and query.

Resource management refers to the management of virtual resources and physical resources. Resource management supports interaction with VIM, and is responsible for obtaining monitoring information of physical resources and virtual resources, and can display monitoring data in the form of graphs.

Corresponding to the above functional description of NFV MANO, based on the multi-security level network construction framework of NFV MANO and the functions of NFV MANO described in the embodiments of the present disclosure, the multi-security level network system of NFV MANO can be divided into 5 layers, as shown in Figure 3 As shown, a schematic diagram of a network system with multiple security levels of NFV MANO, which can include BOSS application layer, OSM layer, Software Defined Network (SDN) management, VIM management layer, and physical resource layer.

Among them, the BOSS application layer mainly implements web interface services to provide users with a network slicing operation interface with multiple security levels. For example, operators can create and deploy network services with multiple security levels through the application layer. Elements, network parameter data and other information are sent to the OSM layer for service scheduling, resource scheduling, and monitoring functions.

The OSM orchestration layer issues configuration commands to manage SDN and VIM resources, deploy and implement virtualized infrastructure, implement virtualized security facilities, guide user plane data traffic forwarding, and finally control physical resources to realize network slicing.

The service orchestration layer in the service orchestration module instantiates each virtualized network function in the application layer request into the physical network in order to form a service function chain with a specific order, and this service function chain with a specific order includes virtual It is formed by linking the network elements corresponding to the virtualized infrastructure and the virtualized security facilities, which can be realized by linking the standard network elements with different security network elements by SMO and SMM.

The security level rule and request policy management module provides policies as a service function chain of multiple security levels, and links virtual standard network elements and multiple security network elements through the routing rule module of the control virtual unit, and deploys them to the VIM and SDN manager. middle. When implementing this strategy, all standard network elements and security network elements are divided into security levels, respectively forming network element sets with different security levels, which provides a basis for obtaining an optimized network with multiple security levels.

In conjunction with the secure network system of the multi-security level network construction framework of NFV MANO, a secure network construction method provided by the embodiments of the present disclosure will be introduced below. FIG. 4 shows a schematic flowchart of a method for constructing a secure network provided by an embodiment of the present disclosure, which includes: a configuration module, a network element search module, and a network element management module. As shown in FIG. 4 , the method may include the following steps:

S410. The configuration module acquires configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice.

The configuration module may be used to implement functions such as OSS. In some embodiments, the security network may include multiple network elements, and the network elements constitute network slices. Configuration information of at least one network slice required by the security network to be generated can be acquired by the configuration module, and the configuration module sends the configuration information to the network element search module.

The first security level parameter may include requirements for network elements with different levels of security, for example, including requirements for network elements with high security levels, requirements for network elements with medium security levels, and the like.

Optionally, in some embodiments, the configuration information may further include configuration parameters of the network slice.

S420. The network element search module acquires at least one target standard network element corresponding to the first security level parameter.

The network element search module can be used to implement functions such as SMO. The secure network system may further include a network element establishment module. In some embodiments, the network element establishment module includes: standard network elements with different functions, such as NSSF, NEF, NRF, AUSF, SMF, AMF, etc., each standard network element corresponds to The security level of its required connection. That is to say, in the network element establishment module, each security level corresponds to multiple network elements.

Optionally, the network element establishment module may be used to implement functions such as NFVO. The acquisition by the network element search module of at least one target standard network element and at least one target security network element corresponding to the first security level parameter may be specifically implemented as follows: the network element search module searches the network element establishment module for a first network element that satisfies the configuration information of the network slice. The network element, if the network element establishment module includes the first network element, and the running state of the first network element is normal, the network element search module determines the first network element as the target standard network element.

The target standard network element is a standard network element that satisfies the configuration information of the network slice.

In the embodiment of the present disclosure, the standard network element is only used to distinguish it from the security network element, but is not used to limit the standard conditions that the network element meets.

In some embodiments, corresponding to the first security level parameter, if the network element search module finds a standard network element that satisfies the configuration parameter from the network element sets of different security levels in the network element establishment module, it searches for the standard network element of the standard network element. Operating status.

The network element search module receives the operation state of the network element fed back by the network element establishment module, and if the operation state of the standard network element is normal, the standard network element (the first network element) is determined as the target standard network element.

It can be understood that when the first security level parameter includes the requirements for network elements of different security levels, the network element search module searches for the required security levels in the standard network element sets of different security levels according to the required security levels. the first network element.

In some embodiments, optionally, if the network element establishment module does not include the first network element that satisfies the configuration information of the network slice, the network element establishment module establishes the first network element corresponding to the first security level parameter according to the configuration parameters of the network slice. Two network elements, the network element search module obtains the running state of the second network element; if the running state of the second network element is normal, the network element search module determines the second network element as the target standard network element.

In some embodiments, if the network element establishment module does not include the first network element that satisfies the configuration information of the network slice, it means that the standard network element of the required security level is not deployed in the network element establishment module. Therefore, the network element establishes The module may establish and deploy standard network elements of a corresponding security level according to the network slice configuration parameters sent by the network element search module to obtain a second network element, wherein the network slice configuration parameters sent by the network element search module may include specific standard network elements. Element parameters, and the security level corresponding to standard NEs.

After the standard network element corresponding to the security level is deployed, the network element establishment module may feed back information on the successful establishment of the standard network element and the running status of the standard network element (second network element) to the network element search module.

In some embodiments, the information about the successful establishment of the standard network element may be an identifier of the successful establishment, which is not specifically limited herein.

In some embodiments, when the network element search module receives that the running state of the standard network element (the second network element) is normal, the network element search module uses the second network element as the target standard network element.

After the target standard network element is deployed, the network element search module uses the security level as a distinction to send the network element information related to the security class to the network element management module for processing.

S430. The network element management module generates a routing rule according to at least one target network element and at least one target security network element.

The network element management module may implement functions such as SMM.

Specifically, the network element management module determines the category of each target standard network element, and according to the security level corresponding to each target standard network element, the network element management module assigns the target security network corresponding to the security level of each target standard network element Element activation, that is, instantiating a security network element of the corresponding security level.

The routing rule refers to a target security network element that can communicate with the target standard network element.

S440. The network management module determines the secure network according to the routing rule, the target standard network element and the target security network element.

Specifically, the network management module determines the network communication connection between each target standard network element and the target security network element corresponding to its security level according to the routing rule, and finally obtains all target standard network elements and the target security network element corresponding to its security level. link, that is, to obtain a secure network that can meet the requirements of different security levels.

In the method for constructing a secure network according to the embodiment of the present disclosure, since the configuration information for constructing a secure network includes required network slices and required security levels, when constructing a secure network, the target network element and the corresponding required security level are The secure network element link enables the secure network to meet the construction and application of network slicing requirements of different security levels, provides flexible and customizable differentiated security guarantees for the applications and needs of industry users, and at the same time, can reduce the complexity of the network. Spend. Compared with adding a security module (Secure Element, SE) at each terminal, it also reduces the construction cost of the security network.

In order to describe the embodiments of the present disclosure more clearly, the method for constructing a secure network described in the embodiments of the present disclosure will be further described below with reference to a specific example, which is shown in conjunction with FIG. 5 .

The OSS sends configuration information of at least one network slice required for establishing a secure network to the SMO, where the configuration information at least includes the required first security level parameters and the required network slice configuration parameters. After receiving the configuration information, the SMO queries whether the standard network elements have been deployed in the standard network element sets of different security levels of NFVO, and in some embodiments, also includes querying whether the user plane function (UPF) is ready.

If the standard network element of the corresponding security level has been deployed in the NFVO, the running state of the standard network element of the corresponding security level is determined.

If the standard network elements of the corresponding security level are not deployed in NFVO, the standard network elements of the corresponding security level are instantiated in NFVO, that is, the standard network elements of the corresponding security level are deployed. After the standard network elements of the corresponding security level are deployed, The NFVO feeds back to the SMO the identifier of the successful creation, and the operating status of the deployed standard network elements of the corresponding security level.

After the SMO learns that the standard network element deployment of the corresponding security level has been completed and the operating status is normal, it initiates the security network element deployment process, that is, sends instruction information to the SMM, such as: the required first security level parameters, and Information about the security network elements that satisfy the configuration parameters is sent to the SMM. The SMM generates routing rules according to the received instruction information, and based on the routing rules, completes the network communication connection between each target standard network element and the target security network element corresponding to its security level to obtain a secure network.

Due to the security level division of all standard network elements and security network elements, network element sets of different security levels are formed respectively, and network communication connections between standard network elements and security network elements of the corresponding level of standard network elements are established. , thus providing a basis for obtaining an optimal network with multiple security levels.

The network element planning module included in the security network system described in the embodiment of the present disclosure; after the security network is determined, the security network construction method may further include the following steps:

First, the network element planning module obtains the application requirement information of the secure network slice, and then the network element planning module obtains the target application network element that meets the application requirement information from the secure network according to the genetic algorithm, and obtains the secure network slice.

After the security network is constructed, the standard network included in the security network can be selected to form a security network slice to provide users with the deployment of network services. For the convenience of description, in the process of selecting standard network elements, the standard The network element is called an application network element, and it can be understood that the application network element is linked with the security network element corresponding to the security level parameter. The application requirement information is, for example, requirements that need to be met during network service deployment, such as link delay requirements, service quality requirements, and bandwidth requirements, which are not specifically limited here.

The application requirement information includes second security level parameters required for secure network slicing.

The second security level parameter may be, for example, a security level requirement required by an enterprise user when deploying a network service, and the second security level parameter may include multiple security levels required by the network service.

Among them, according to the genetic algorithm, the target application network element that meets the application requirement information is obtained from the safety network, and the safety network slice is obtained. As shown in Figure 6, obtaining the safety network slice may include the following steps:

S610. Acquire a first network element set corresponding to the second security level parameter according to the second security level parameter.

S620. Perform a crossover operation and a mutation operation on the first set of network elements to obtain a second set of network elements.

In some embodiments, the first set of network elements includes at least one first application network element of at least one category, and each first application network element is linked to a security network element corresponding to a security level parameter.

Therefore, optionally, performing a crossover operation and a mutation operation on the first network element set to obtain a second network element set may specifically include: performing a first application network element and a security network element of each category in the first network element set Perform a crossover operation to obtain a fourth set of network elements; perform a mutation operation on the fourth set of network elements to obtain a second set of network elements.

In some embodiments, the function of the application network element is used as the classification, and the function of the application network element may, for example, include network elements with functions such as NSSF, NEF, NRF, AUSF, SMF, and AMF.

In some embodiments, since each first network element set includes first application network elements of the same security level, when performing the crossover operation, the first application network element and the security network element are crossed as a whole, which can effectively reduce the processing difficulty. At the same time, during the crossover operation, the network link can be repaired according to the actual situation of the individual after the crossover, or the application network element and the security network element can be regenerated.

By crossing application network elements and security network elements of the same security level, especially the application network elements that meet the application requirement information and the application network elements that do not meet the application requirements, the application network elements that meet the application requirement information can be linked. More secure network elements can be linked to the security network elements of new application network elements, which improves the applicability of application network elements of the same security level.

In some embodiments, optionally, performing a mutation operation on the fourth set of network elements to obtain the second set of network elements may specifically include: obtaining and selecting from the fourth set of network elements, according to the application requirement information, at least one network element that meets the application requirements. A second application network element and a third application network element that does not meet the application requirement information; and a second network element set is obtained according to each second application network element and each third application network element.

S630. Acquire a third set of network elements that meets the application requirement information from the second set of network elements.

S640. Obtain a secure network slice according to the third network element set.

In some embodiments, obtaining the secure network slice according to the third network element set includes: if the physical resource consumption required by the third network element set meets the physical resource consumption condition, obtaining the secure network slice according to the third network element set.

The physical resource consumption may be the consumption of physical resources such as memory and a central processing unit (CPU) by the network element, and the physical resource consumption condition may be set as the minimum physical resource consumption consumed by the network element when it is used.

In some embodiments, optionally, according to the physical resource consumption required by the third network element set meeting the physical resource consumption condition, as a judgment condition for whether to continue the iterative calculation, if the physical resource consumption required by the third network element set If the physical resource consumption condition is not met, the iterative calculation of the crossover operation and the mutation operation is continued on the third network element set until a network element set whose physical resource consumption meets the physical resource consumption condition is obtained, and a secure network slice is obtained.

Selecting all application network elements in the third network element set that meet the application requirement information. In some embodiments, each application network element may be evaluated according to the fitness function to obtain the fitness of each application network element. According to the fitness The application network elements are sorted, and the network elements with poor fitness are excluded from all network elements, and the network elements with better fitness are obtained.

In the embodiment of the present disclosure, by imitating the mechanism of survival of the fittest in biological evolution, secure network slices are obtained according to the third network element set, and individuals with good fitness are selected from them to ensure the quality of the overall application network elements. For the target security slice, the individuals with poor fitness are excluded, and the iterative calculation is continued for the application network elements in the third network element set, and finally the network element set that meets the physical resource consumption conditions is obtained. Network Slicing.

Through the security network construction method of the embodiment of the present disclosure, the 5G network slicing technology can be oriented to users in different vertical industries, meet the differentiated security requirements of different applications, and can make corresponding adjustments and changes to the security protection mechanism of virtual network slicing with different business functions. , to ensure that industry users and applications are provided with flexible and customizable differentiated security mechanisms on demand to ensure the legitimate use of information.

FIG. 7 is a schematic structural diagram of an apparatus for constructing a secure network provided by an embodiment of the present disclosure. As shown in FIG. 7 , the apparatus for constructing a secure network may include: a configuration module 710 , a network element search module 720 , and a network element management module 730 .

The configuration module 710 is configured to acquire configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice.

The network element search module 720 is configured to acquire at least one target standard network element corresponding to the first security level parameter.

The network element management module 730 is configured to generate routing rules according to at least one target standard network element and at least one target security network element.

The network management module 740 is configured to determine the secure network according to the routing rule, the target standard network element and the target security network element.

In some embodiments, the configuration information further includes: configuration parameters of the network slice.

In some embodiments, the secure network system further includes a network element establishment module, and the network element establishment module includes a plurality of network elements corresponding to the first security level parameter;

The network element search module searches for the first network element that satisfies the configuration information of the network slice from the network element establishment module; if the network element establishment module includes the first network element, and the running state of the first network element is normal, the network element search module The first network element is determined as the target standard network element.

In some embodiments, if the network element establishment module does not include a first network element that satisfies the configuration information of the network slice, the network element establishment module establishes a second network element corresponding to the first security level parameter according to the configuration parameters of the network slice; The network element search module obtains the running state of the second network element; if the running state of the second network element is normal, the network element search module determines the second network element as the target standard network element.

In some embodiments, the secure network system further includes a network element planning module; after determining the secure network, the method further includes: the network element planning module obtains application requirement information of the secure network slice; Obtain target application network elements in the network that meet the application requirement information, and obtain secure network slices.

In some embodiments, the application requirement information includes a second security level parameter required for the secure network slice; the network element planning module obtains the target application network element that meets the application requirement information from the secure network according to a genetic algorithm, and obtains the secure network slice ,include:

The network element planning module obtains a first network element set corresponding to the second security level parameter according to the second security level parameter; performs a crossover operation and a mutation operation on the first network element set to obtain a second network element set; from the second network element The set acquires a third network element set that meets the application requirement information; and obtains a secure network slice according to the third network element set.

In some embodiments, the first network element set includes at least one first application network element of at least one category, and each first application network element is linked to a security network element corresponding to a security level parameter; Perform a crossover operation and a mutation operation on the element set to obtain a second network element set, including: performing crossover operations on the first application network element and the security network element of each category in the first network element set to obtain a fourth network element set; The fourth network element set performs a mutation operation to obtain a second network element set.

In some embodiments, performing a mutation operation on the fourth network element set to obtain the second network element set includes: the network element planning module, according to the application requirement information, obtains and selects at least one first network element set that meets the application requirement from the fourth network element set 2. An application network element and a third application network element that does not meet the application requirement information; a second network element set is obtained according to each second application network element and each third application network element.

In some embodiments, the network element planning module obtains the security network slice according to the third network element set, including: if the physical resource consumption required by the third network element set meets the physical resource consumption condition, obtaining the security network slice according to the third network element set Network Slicing.

In some embodiments, if the physical resource consumption required by the third network element set does not meet the physical resource consumption condition, the network element planning module continues to perform iterative calculation of the crossover operation and the mutation operation on the third network element set until the physical resource consumption is obtained. The set of network elements whose resource consumption satisfies the condition of physical resource consumption obtains a secure network slice.

It can be understood that the device for constructing a secure network in the embodiment of the present disclosure may correspond to the execution body of the method for constructing a secure network described in the embodiment of the present disclosure, and the specific details of the operations and/or functions of each module/unit of the device for constructing a secure network. Reference may be made to the description of the corresponding part in the method for constructing a secure network described in the above embodiments of the present disclosure, which is not repeated here for brevity.

In the device for constructing a secure network according to the embodiment of the present disclosure, since the configuration information for constructing a secure network includes required network slices and required security levels, when constructing a secure network, the target network element and the corresponding required security level are set. The secure network element link enables the secure network to meet the construction and application of network slices that meet the requirements of different security levels, and provides flexible and customizable differentiated security guarantees for industry users and applications. Complexity, secure network reduces construction cost.

FIG. 8 is a schematic diagram of a hardware structure of a device for constructing a secure network provided by an embodiment of the present disclosure.

As shown in FIG. 8 , the secure network construction device 800 in this embodiment includes an input device 801 , an input interface 802 , a central processing unit 803 , a memory 804 , an output interface 805 , and an output device 806 . Among them, the input interface 802, the central processing unit 803, the memory 804, and the output interface 805 are connected to each other through the bus 810, and the input device 801 and the output device 806 are connected to the bus 810 through the input interface 802 and the output interface 805, respectively, and are further constructed with the safety network. Other components of device 800 are connected.

Specifically, the input device 801 receives input information from the outside, and transmits the input information to the central processing unit 803 through the input interface 802; the central processing unit 803 processes the input information based on the computer-executable instructions stored in the memory 804 to generate output information, temporarily or permanently store the output information in the memory 804, and then transmit the output information to the output device 806 through the output interface 805;

That is to say, the secure network construction device shown in FIG. 8 can also be implemented to include: a memory storing computer-executable instructions; and a processor, which, when executing the computer-executable instructions, can implement embodiments in conjunction with the present disclosure The secure network construction method described in .

In one embodiment, the secure network construction device 800 shown in FIG. 8 includes: a memory 804 for storing a program; a processor 803 for running the program stored in the memory to execute the secure network construction provided by the embodiments of the present disclosure method.

Embodiments of the present disclosure further provide a computer-readable storage medium, where computer program instructions are stored thereon; when the computer program instructions are executed by a processor, the secure network construction method provided by the embodiments of the present disclosure is implemented.

It is to be understood that the present disclosure is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above-described embodiments, several specific steps are described and shown as examples. However, the method process of the present disclosure is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the sequence of steps after understanding the spirit of the present disclosure .

The functional blocks shown in the above-described structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, and the like. When implemented in software, elements of the present disclosure are programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted over a transmission medium or communication link by a data signal carried in a carrier wave. A "machine-readable medium" may include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (Radio Frequency, RF) link, etc. The code segments may be downloaded via a computer network such as the Internet, an intranet, or the like.

It should also be noted that the exemplary embodiments mentioned in the present disclosure describe some methods or systems based on a series of steps or devices. However, the present disclosure is not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiment, or may be different from the order in the embodiment, or several steps may be performed simultaneously.

The above are only specific implementations of the present disclosure, and those skilled in the art can clearly understand that, for the convenience and brevity of the description, for the specific working process of the above-described systems, modules and units, reference may be made to the foregoing method embodiments The corresponding process in , will not be repeated here. It should be understood that the protection scope of the present disclosure is not limited to this, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present disclosure, and these modifications or replacements should all cover within the scope of protection of the present disclosure.

Claims (13)

1. A method for constructing a secure network, applied to a secure network system, the system includes: a configuration module, a network element search module and a network element management module; the method includes:

   The configuration module acquires configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice;

   The network element search module acquires at least one target standard network element corresponding to the first security level parameter;

   The network element management module generates a routing rule according to the at least one target standard network element and the at least one target security network element;

   The network management module determines a secure network according to the routing rule, the target standard network element and the target security network element.
2. The method of claim 1, wherein the configuration information further comprises: configuration parameters of the network slice.
3. The method according to claim 2, wherein the secure network system further comprises a network element establishment module, wherein the network element establishment module includes a plurality of network elements corresponding to the first security level parameter;

   The network element search module searches for a first network element that satisfies the configuration information of the network slice from the network element establishment module;

   If the network element establishment module includes the first network element, and the running state of the first network element is normal, the network element search module determines the first network element as the target standard network element .
4. The method of claim 3, further comprising:

   If the network element establishment module does not include a first network element that satisfies the configuration information of the network slice, the network element establishment module establishes a second network element corresponding to the first security level parameter according to the configuration parameters of the network slice Yuan;

   The network element search module obtains the running state of the second network element;

   If the running state of the second network element is normal, the network element searching module determines the second network element as the target standard network element.
5. The method according to claim 1, wherein the secure network system further comprises a network element planning module; after the secure network is determined, the method further comprises:

   The network element planning module obtains the application requirement information of the secure network slice;

   The network element planning module acquires the target application network element that meets the application requirement information from the security network according to the genetic algorithm, and obtains a security network slice.
6. The method of claim 5, wherein the application requirement information includes a second security level parameter required by the secure network slice;

   According to the genetic algorithm, the target application network element that meets the application requirement information is obtained from the security network, and the security network slice is obtained, including:

   obtaining, according to the second security level parameter, a first set of network elements corresponding to the second security level parameter;

   performing a crossover operation and a mutation operation on the first set of network elements to obtain a second set of network elements;

   acquiring a third set of network elements that meets the application requirement information from the second set of network elements;

   The secure network slice is obtained according to the third set of network elements.
7. The method according to claim 6, wherein the first set of network elements includes at least one first application network element of at least one category, and each of the first application network elements is linked to a security network element corresponding to a security level parameter ;

   The performing crossover operation and mutation operation on the first set of network elements to obtain a second set of network elements, including:

   Perform a cross operation on the first application network element of each category in the first network element set and the security network element to obtain the fourth network element set;

   A mutation operation is performed on the fourth set of network elements to obtain the second set of network elements.
8. The method according to claim 7, wherein the performing a mutation operation on the fourth set of network elements to obtain the second set of network elements comprises:

   According to the application requirement information, obtain and select at least one second application network element that meets the application requirement and a third application network element that does not meet the application requirement information from the fourth network element set;

   A second set of network elements is obtained according to each of the second application network elements and each of the third application network elements.
9. The method according to claim 6 or 7, wherein the obtaining the secure network slice according to the third network element set comprises:

   If the physical resource consumption required by the third network element set satisfies the physical resource consumption condition, the secure network slice is obtained according to the third network element set.
10. The method of claim 8, further comprising:

    If the physical resource consumption required by the third network element set does not meet the physical resource consumption condition, continue to perform the iterative calculation of the crossover operation and the mutation operation on the third network element set until the physical resource consumption is obtained that satisfies the physical resource consumption condition. A set of network elements for resource consumption conditions to obtain the secure network slice.
11. A safety network construction device, comprising:

    a configuration module, configured to acquire configuration information of at least one network slice, where the configuration information includes a first security level parameter of the network slice;

    a network element search module, configured to obtain at least one target standard network element corresponding to the first security level parameter;

    a network element management module, configured to generate routing rules according to the at least one target standard network element and the at least one target security network element;

    A network management module, configured to determine a secure network according to the routing rule, the target standard network element and the target security network element.
12. A secure network construction device, comprising: a processor, and a memory storing computer program instructions;

    The processor reads and executes the computer program instructions to implement the method for constructing a secure network according to any one of claims 1-10.
13. A computer storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, implement the method for constructing a secure network according to any one of claims 1-10.

Images