Summary of the invention
The objective of the invention is to overcome the shortcoming of above-mentioned prior art, particularity at Military Application in the military communication network, the acceptance control system and the control method thereof of a kind of support policy space dynamic expansion are proposed, dynamically to adapt to the variation of network, satisfy the requirement of military communication network better, improve the fail safe and the reliability of communication service.
The object of the present invention is achieved like this:
One, term explanation
QoS:Quality Of Service, service quality.
XML:eXtended Markup Language, extend markup language.
DTD:Document Type Definition, DTD.
DES:Data Encryption Standard, data encryption standard.
Two, the acceptance control system of the support policy space dynamic expansion of the present invention's proposition comprises:
The user service information extraction module is used to distinguish the information flow of different user, and extraction and user and professional relevant information from packet;
Network information extraction module is used for from the Link State and the routing iinformation of each port reception, and in the packet queue time delay and Loss Rate information of this node, obtains network state information;
Policy library is used to store the database of admission control scheme;
Admit control module, be used to realize the dynamic generation of admission control scheme,, finish the admittance control decision of customer service according to the admission control scheme in the policy library;
The user service information extraction module is used for extracting user profile and business information according to user data packets;
There have been tactful described user and business information in described user service information extraction module and the policy library one-way interaction policy library;
There has been tactful described network state information in described network state information extraction module and the policy library one-way interaction policy library;
Described admittance control module respectively with the user service information extraction module, network state information extraction module one-way interaction upgrades user service information and latest network state information, the admission control scheme that will dynamically generate is preserved into policy library simultaneously, and the existing strategy in the usage policy storehouse is finished the judgement of admitting control.
Three, realize the acceptance controlling method of support policy of the present invention space dynamic expansion, comprise the steps:
(1) from information flow and network, extracts stream information and network operation state information respectively, wherein stream information comprises user identity, priority, demand for security, access point, access way, type of service, quality of service requirement and reliability, and network operation state information comprises the failure conditions of node and link, the intrinsic variation tendency of variation, network congestion and network of route;
(2) according to the policy space attribute, fetch strategy space attribute value from stream information and network operation state information;
(3) generate a policy space property vector automatically according to the policy space property value;
(4) from policy library, extract XML strategy and automatic generation strategy space structure;
(5) policy space property vector and policy space structure are compared, whether undefined property value and vector be consistent with the attribute in the structure in the structure of whether having living space in the inspection vector, if consistent, enter step (6), otherwise enter step (7);
(6) strategy of coupling extraction, with the condition value of policy space property value as strategy, if satisfy certain tactful condition, then carry out the operation of this policy definition, the result that output allows new stream to insert or the new stream of refusal inserts is if strategy has obtained upgrading then new policy store has been advanced policy library simultaneously;
(7) change policy space property value or change policy attribute, and check whether the policy space after the expansion conflicts, if conflict then extending space does not again have conflict up to policy space enters step (5) then with the dynamic expansion policy space.
The present invention compared with prior art has following advantage:
(1) the present invention is because stream information and the network operation state information extracted not only comprise traditional QoS information, as the failure conditions of quality of service requirement, node and link, the variation and the network congestion of route, also comprise user identity, level of security, business characteristic, the visit moment and access node security information widely.Thereby can in the military communication network, realize more reliable, safer admittance control.
(2) among the present invention owing to adopt XML language compilation strategy, utilize the strategy of distinctive cross-platform, interdepartmental system information interaction of XML and interoperability advantage definition, can be with the admittance control procedure on overall visual angle coordination heterogeneous network and the node, not only can strengthen network and realize the ability of application end, and help to promote utilization efficiency of network resources to the end target.
(3) the present invention is owing to introduced the notion of policy space, and the dynamic expansion in support policy space, promptly when the network state variation, when new user's new business occurs, policy space property vector and policy space structure are inconsistent, to change property value this moment or change policy attribute with the dynamic expansion policy space, make the user not only can revise admission control scheme according to application need within the specific limits, and can be, thereby the access of controlling call and supervising the network more neatly effectively according to external change dynamic expansion policy space.
(4) the present invention is owing to adopt the policy control mechanism of self-management, and the collision problem that brings after the resolution policy spatial spread reduces the complexity that the network manager implementation strategy is managed greatly effectively.
Embodiment:
Be described in detail below in conjunction with the background technology of drawings and Examples content of the present invention and institute's foundation thereof:
One, tactful acceptance control system
With reference to Fig. 1, acceptance control system of the present invention comprises: user service information extraction module 11, network information extraction module 12, policy library 13 and admittance control module 14.Wherein user service information extraction module 11 and network information extraction module 12 be all with policy library 13 with admit 14 unidirectional connections of control module, and policy library 13 and admittance 14 two-way connections of control module.
Described user service information extraction module 11 is extraction and user and professional relevant information from packet, comprise user identity, priority, demand for security, access point, access way, type of service, quality of service requirement and reliability, and from policy library 13, obtain the user service information association attributes, filter out useful property value according to attribute then and pass to admittance control module 14.
Link State and routing iinformation that described network information extraction module 12 receives from each port, and in the packet queue time delay and Loss Rate information of this node, obtain network state information, comprise the failure conditions of node and link, the intrinsic variation tendency of variation, network congestion and network of route, and from policy library 13, obtain network information attribute, filter out useful property value according to attribute then and pass to admittance control module 14.
Described policy library 13 is preserved admission control scheme, and with admit control module 14 two-way interactives, and respectively customer service association attributes and network information attribute are passed to user service information extraction module 11 and network information extraction module 12 during initialization.
Described admittance control module 14 is extracted the XML strategy from policy library 13, the generation strategy space structure, simultaneously according to the automatic generation strategy space attribute of receiving of property value, whether comparative structure and attribute consistent needing to determine whether the dynamic expansion policy space, and the admission control scheme that will dynamically generate is preserved into policy library 13 simultaneously.Afterwards, finish the admittance control decision of customer service according to the result of matching strategy.The concrete structure of this module as shown in Figure 2, it comprises that policy library access submodule 251, strategy matching submodule 252, policy space expansion submodule 253, policy conflict check submodule 254 and admit output sub-module 255 as a result.Wherein: policy library access submodule 251 extracts the XML strategy from policy library 13, and automatic generation strategy space structure also passes to strategy matching submodule 252; Strategy matching submodule 252 is according to the automatic generation strategy space attribute of the state attribute value vector of user service information extraction module 11 and 12 transmission of network information extraction module, and with the policy space structure relatively, if unanimity then will admit the control result to pass to admit as a result output sub-module 255 to allow new stream to insert or the new stream of refusal inserts the result with output, if it is inconsistent then strategy is passed to policy space expansion submodule 253 with the dynamic expansion policy space, and the strategy that will expand after upgrading passes to policy library access submodule 251, and policy library access submodule 251 is stored into policy library 13 to updating strategy again; Strategy after policy space expansion submodule 253 dynamic expansion policy spaces also will be expanded passes to policy conflict and checks submodule 254, policy conflict checks whether the policy space after the submodule 254 inspection expansions conflicts, if conflict prompting policy space expansion submodule 253 is the expanding policy space again, pass to strategy matching submodule 252 until the strategy that the space inspection after the expansion is errorless after will upgrading again.
Two, tactful acceptance controlling method
With reference to Fig. 3, strategy of the present invention admits controlled step as follows:
Step 1 is extracted stream information and network operation state information respectively from information flow and network.
Stream information comprises: user identity, priority, demand for security, access point, access way, type of service, quality of service requirement and reliability; Network operation state information comprises: the failure conditions of node and link, the variation of route, network congestion and the intrinsic variation tendency of network.
Stream information and the network operation state information that can see extraction thus not only comprise traditional QoS information, also comprise user identity, level of security, business characteristic, the visit moment and access node security information widely, therefore can in the military communication network, realize more reliable, safer admittance control.
Step 2, according to the policy space attribute, fetch strategy space attribute value from stream information and network operation state information.
So-called strategy is meant the set of a series of rules according to the definition of IETF.When network environment satisfies the condition of rule, the corresponding operating of executing rule definition then.The rule condition of strategy specifically is to be made of policy attribute, and according to user class, two attributes of role are formulated such as a strategy, and another strategy is then formulated according to the access time attribute.Strategy file generally comprises a lot of bar strategies, so the union of the attribute of all strategies has constituted the attribute of strategy file in the strategy file.If strategy file only comprises above-mentioned two strategies, then the attribute of this strategy file just comprises three attributes: user class, role and access time.
Tactful notion is expanded the notion that can arrive policy space.Attribute is with regard to the one dimension in relative strategy space in the strategy file.Equally, the number correspondence of attribute the dimension of policy space.Suppose that strategy file has n attribute, then the set of the point determined of this n attribute variable is exactly a n dimension policy space.Wherein every strategy can be regarded a subclass of policy space as, and each dimension is an attribute of policy space.
Strategy of the present invention is write by XML.Utilize the strategy of distinctive cross-platform, interdepartmental system information interaction of XML language and interoperability advantage definition, can be with the admittance control procedure on overall visual angle coordination heterogeneous network and the node, not only can strengthen network and realize the ability of application end, and help to promote utilization efficiency of network resources to the end target.
The policy space attribute comprises customer service attribute and network operation status attribute.The customer service attribute more is reflection user and business information, such as user role, and user gradation, type of service etc., and network operation status attribute more is the running status of reflection network, and such as congested, bandwidth etc.
Step 3 generates a policy space property vector automatically according to the policy space property value.
The occurrence of policy space attribute is the policy space property value, as the height of user role, in, low, 1,2,3 of user gradation is respectively the property value of user role attribute and user gradation attribute.
Policy space property vector here is the vector that is made of policy space all properties value, with K1, K2 ..., Kn ... } expression, wherein Kn represents n bar property value.
Step 4 is extracted XML strategy and automatic generation strategy space structure from policy library.
Admit control module to extract wherein tactful can the analysis automatically and obtain policy space structure as shown in table 1 by the access strategy storehouse.
Table 1 policy space structure
Policy space is described |
Attribute 1 (K1) |
Attribute 2 (K2) |
... |
Attribute n (Kn) |
... |
Strategy 1 |
K1(1) |
K2(1) |
... |
Kn(1) |
... |
Strategy 2 |
K1(2) |
K2(2) |
... |
Kn(2) |
... |
... |
... |
... |
... |
... |
... |
Strategy m |
K1(m) |
K2(m) |
... |
Kn(m) |
... |
... |
... |
... |
... |
... |
... |
As seen from Table 1, every strategy be the corresponding policy space property vector of each row K1 (m), K2 (m) ..., Kn (m) ... }, n property value of Kn (m) expression m bar strategy wherein.
Step 5 compares policy space property vector and policy space structure, and whether undefined property value and vector be consistent with the attribute in the structure in the structure of whether having living space in the inspection vector, if consistent, enter step 6, otherwise enter step 7.
Policy space property vector and policy space structure are compared, whether the property value in the inspection policy space attribute vector all defined in the policy space structure, and also whether the attribute in the inspection policy space attribute vector is consistent with the attribute that defines in the policy space structure.
When not having new user's new business appearance or network state not to change, the policy space property vector is consistent with the policy space structure, and enter step 6 this moment, otherwise enter step 7.
Step 6, the strategy that coupling is extracted, with the condition value of policy space property value as strategy, if this property value satisfies certain tactful condition, then carry out the operation of this policy definition, the result that output allows new stream to insert or the new stream of refusal inserts is if strategy has obtained upgrading then new policy store has been advanced policy library simultaneously.
Step 7 changes the policy space property value or changes the policy space attribute with the dynamic expansion policy space, and checks whether the policy space after the expansion conflicts, if conflict then extending space again enters step 5 after policy space does not have conflict.
When a new stream bursts arrived, user service information extraction module and network information extraction module may find that this stream is not running into before and defining, so store its correlation behavior information.Because only the arrival of a stream is not enough to determine new all information of stream, user service information extraction module and network information extraction module extract correlation attribute value according to the local policy attribute.The policy space structure of admitting control module to receive that property value generation property vector and access strategy storehouse generate compares, this moment is because all changes of the local user traffic attribute of user service information extraction module and network information extraction module and local network running status attribute, comparative result is consistent certainly, will mate according to former strategy.
But,,, obviously can not adapt to the variation requirement if also admit control according to old strategy when this is similar when newly flowing to get more and more.At this moment, along with similar new stream increases, user service information extraction module and network information extraction module can be determined new stream information gradually, automatically increase or revise the local policy attribute and obtain its value according to the new stream information of determining, pass to then and admit control module and the new policy space property vector of generation automatically.Policy space structure and the property vector of admitting control module access strategy storehouse to obtain compare, obviously because the still old strategy of storing in the policy library, therefore the policy space structure that forms also is old, and the two is inconsistent relatively certainly, and this just impels the dynamic expansion of policy space.
Above-mentioned analysis as can be known, whether policy space needs expansion to depend on property vector and policy space structure relatively property value and attribute, consequently unanimity not.
The policy space dynamic expansion can be divided into strategy expansion and spatial spread.If the property value that has in the policy space property vector did not define in the policy space structure, then needing to increase property value also dynamically increases or the modification strategy, is strategy and expands.The strategy expansion is the expansion of low degree, and only revise strategy and get final product this moment; If the attribute that defines in attribute in the discovery strategy space attribute vector and the policy space structure is inconsistent, then needing to increase the policy space attribute also dynamically increases or the modification strategy, is spatial spread.Spatial spread is the expansion of high level, needs to change the policy space dimension this moment.
When expansion strategy, at first user service information extraction module and the analysis of network information extraction module and determined new stream increases or changes the local policy property value then automatically.Admit control module to receive the policy space structure comparison that property value generates property vector automatically and obtains with the access strategy storehouse, find that some property value in the vector does not define in policy space, only need in table 1, to increase automatically delegation this moment, promptly increase a strategy, and value that should the strategy attribute is new value.Afterwards, the policy space structure has obtained renewal, and strategy has also obtained upgrading and returning to policy library.Now property vector is consistent with policy space structure after the dynamic expansion, admits control again.
During spatial spread, at first user service information extraction module and the analysis of network information extraction module and determined new stream increases or changes the local policy attribute then automatically.Admit control module to receive the policy space structure comparison that property value generates property vector automatically and obtains with the access strategy storehouse, find that some attribute in the vector does not define in policy space, only needing this moment increases by row automatically in table 1, promptly increased an attribute.Afterwards, the policy space structure has obtained renewal, and strategy has also obtained upgrading and returning to policy library.Now property vector is consistent with policy space structure after the dynamic expansion, admits control again.
As seen the strategy expansion is whether need to change policy space attribute, i.e. space dimensionality with the main distinction of spatial spread.
After the policy space dynamic expansion, will admit control, and the control result is admitted in output with the strategy after upgrading.But may cause the conflict between each the bar strategy in the policy space after the policy space expansion,, the present invention proposes policy space self-management controlling mechanism,, comprise syntax check and semantic test as Fig. 4 for fear of this situation, wherein:
Syntax check detects, and is to check whether symbol or other syntax error that can not discern is arranged, if check out syntax error, then policy space is expanded again and carried out syntax check again, otherwise enters next step semantic test;
Semantic test is that other strategy in each bar strategy and the strategy file is compared, and specifically comprises following content:
1. bound inspection, within the range of permission whether the value of checking some attribute.
2. relation is checked, checks whether the value of any two attributes satisfies the relation that is determined by particular technology.Such as, two parameters of certain bar policing rule are respectively to adopt cryptographic algorithm and corresponding key length, if the former is DES, then the latter can only be one of 64 or 128 liang of numerical value.
3. consistency check guarantees that any two strategies do not clash in the system.For fear of the conflict between policing rule, policing rule can have priority, and when two strategies satisfy condition simultaneously, the strategy that priority is high will mate execution.
4. mastery inspection, whether have " unreachable " strategy, promptly because the definition of other strategies causes it to be performed never if checking.Consider the checked strategy of certain bar, it is a subclass in the policy space, is a zone of marking in the multidimensional policy space.Investigate other strategies then successively, overlapping and priority is higher than checked strategy if other certain bar strategies and checked strategy are at the multidimensional policy space, just deducts overlapping areas from be examined the corresponding area of space of strategy.Checking at last to finish, is that sky just illustrates that checked strategy carries out never if be examined the corresponding area of space of strategy, can delete.
By semantic test, if wrong, then policy space is expanded again and is entered the syntax check step, otherwise policy space is expanded successfully.
The policy control mechanism of above-mentioned self-management has solved the problems of bringing after the policy space expansion such as conflict effectively, has guaranteed that the policy space expansion is without fear of an attack from the rear.
After policy space is expanded successfully, enter step 5, policy space structure after policy space property vector and the expansion is compared, whether undefined property value and vector be consistent with the attribute in the structure in the structure of whether having living space in the inspection vector, if it is consistent, enter step 6, otherwise enter step 7.
More than be the acceptance control system and the control method thereof of support policy space dynamic expansion, use system and method for the present invention, not only considered professional qos parameter, and user identity, level of security, business characteristic, the visit moment, access node etc. more accurately information write and admit in the strategy, the fail safe and the reliability that insert have been satisfied better, simultaneously along with network state changes, new user's new business appearance etc., the mechanism of policy space dynamic expansion can satisfy extensive and various customer service demand better.