Method and system for managing virtual private cloud (VPC) network configuration

Abstract

In order to manage virtual private cloud (VPC) network configuration, a network topology and configuration of each network element are firstly obtained, and then a reachability intention including a target function and an intention attribute is defined. In one embodiment, a network representation is generated that describes how traffic is processed in a network element through an operable filter function, and a minimization problem is defined by converting the network representation into a MaxSAT formula that is used to minimize the number of decision variables to be modified. And according to a target function, defining a decision weight for the decision variable, and obtaining a solution of a minimization problem through a MaxSAT resolution algorithm weighted by the decision weight to generate an optimized network configuration.

Description

Technical Field

[0001] This invention generally relates to virtual private clouds (VPCs), and more specifically, to methods and systems for managing virtual private cloud (VPC) network configurations. Background Technology

[0002] A Virtual Private Cloud (VPC) is a collection of Software-as-a-Service (SaaS) tools, commonly found in modern cloud solutions. VPC SaaS tools cover various aspects of cloud computing, such as storage, compute, security, and networking. Together, these tools provide the basic building blocks for creating custom service deployments within public cloud providers. These deployments typically consist of multiple compute and storage instances, each potentially containing part or all of the service logic. While VPCs aim to simplify network management, configuring and maintaining them remains challenging. Although tools exist to check the correctness of VPC configurations based on user-defined reachability intents, generating new configuration sets for different types of networks can lead to unpredictable consequences. Attempts have been made to generate network configurations for physical networks such as data center networks (DCNs) or wide area networks (WANs), but VPC networks have unique characteristics, such as replicated network elements, replicated network addresses, and complex configurations, making existing methods difficult to apply. Due to the complexity of the problem, these methods struggle to provide rapid response for real-time services while managing large networks.

[0003] A single VPC can accommodate multiple different services that may have varying security requirements, reducing costs and management effort. Depending on the required level of service isolation, the VPC must provide connectivity services that can be isolated from individual compute / storage services or provide seamless access to replicated services. This requires a broad network stack capable of providing fine-grained control over VPC interconnects, as well as a comprehensive toolset for defining VPC security policies.

[0004] The two main components of the VPC network stack are traffic routing services and traffic filtering services. Traffic filtering services, such as network access control lists (NACLs), security groups (SGs), and firewalls, define a set of rules that allow or deny specific traffic flows. Routing services, such as routers, VPC peering connections, and network load balancers (NLBs), are responsible for modifying the path attributes of traffic flows by redirecting traffic flows to specific devices or dropping traffic flows when a device is unavailable.

[0005] The VPC network stack comprises various services, but its primary purpose is to connect compute and storage services, such as Elastic Compute Service (ECS), Elastic Compute Cloud (EC2) instances, VMs, Docker containers, and a Business Management System (BMS). While many different compute / storage services are offered within a VPC, this article will focus on Elastic Cloud Service (ECS) instances. ECS instances are divided into virtual subnets within a VPC and must be connected to one or more network interface cards (NICs) that connect to individual subnets within the VPC network. Each NIC can be associated with one or more security groups, and each subnet can be associated with one or more network ACLs (NACLs) and routing tables. Directly connected network gateways can also be included in the VPC to provide connectivity to external networks, other VPCs in the cloud infrastructure, or the internet. Each element in a VPC has its own configuration, such as a router's routing table or a public IP address for the Elastic Internet Protocol (EIP). A key feature of VPC configuration is that it allows N:N mappings with a single network element. This means that a single configuration can be associated with multiple network elements, and multiple network elements can have more than one associated configuration. This can lead to configuration duplication, configuration confusion, and network address duplication in the VPC network.

[0006] The VPC network stack is based on the traditional International Organization for Standardization / Open Systems Interconnection (ISO / OSI) stack, including IPv4 / IPv6 Layer 3 protocols and Transmission Control Protocol / User Datagram Protocol / Internet Control Message Protocol (TCP / UDP / ICMP) Layer 4 protocols to ensure interoperability. Network configuration is represented by packet header fields, such as the TCP / IP 5-tuple for NACL configuration and the destination IP and next-hop ID pairs for routing tables. The overall VPC network reachability policy is defined by the configuration of all VPC network services, which determines the allowed traffic between VPC elements. Determining the reachability policy is a complex problem, requiring analysis of all possible paths and header field combinations, making it difficult to ensure strong security guarantees. Automated reasoning and formalization techniques, such as satisfiability / satisfiability modulo theorem (SAT / SMT) formulas and data logic or binary decision graphs, are typically used to provide a high degree of confidence in the obtained solution while ensuring acceptable runtime and resource utilization. Modifying reachability policies is more challenging because it may require modifying multiple network elements along the traffic flow path; manual modifications can lead to unexpected behaviors such as service interruptions or security policy violations.

[0007] Existing methods employ SAT encoding of network reachability policies for managing network ACLs. These methods provide basic reachability policy enforcement and / or modification. They are not limited to tree topologies and can be applied to any type of underlying network topology. However, they are not suitable for VPC scenarios, failing to consider replication / merging configurations and replicated network addresses. Furthermore, they lack optimization engines to reduce configuration complexity, making it impossible to adjust desired configurations. Existing methods do not exhibit scalability and typically require more time to converge to a solution.

[0008] Another existing approach employs formal techniques to find the network calibration set, i.e., a set of network elements or services whose modifications would result in an expected reachability policy between two endpoints for a given traffic level. Existing methods utilize optimization engines and support the possibility of finding a minimum calibration set. However, these methods cannot account for duplicated / merged configurations and cluttered endpoints.

[0009] Another existing approach employs formal techniques to manage reachability policies within individual network elements / services. This approach can generate new configurations for network elements / services starting from some previous configurations. However, it cannot account for replicated / merged configurations and cluttered endpoints.

[0010] Therefore, it is necessary to address the aforementioned technical issues and shortcomings in managing virtual private cloud (VPC) network configurations. Summary of the Invention

[0011] The purpose of this invention is to provide a method for managing the configuration of a virtual private cloud (VPC) network, and a system for managing the configuration of a virtual private cloud (VPC) network, while avoiding one or more disadvantages of existing methods.

[0012] This objective is achieved through the features of the independent claims. Further implementations are apparent in the dependent claims, the specification, and the drawings.

[0013] In a first aspect, a method for managing the configuration of a Virtual Private Cloud (VPC) network is provided. The method includes obtaining the configuration of each virtual or physical network element in a deployed VPC network and the network topology of the deployed VPC network. The method includes defining an reachability intent that includes a target objective function and intent attributes. The target objective function includes a target cost for the new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is either allow or deny. The method includes generating a network representation that describes how traffic is processed in each network element based on the network element configuration and network topology, using operable filtering functions for each network element. Each operable filtering function is based on a set of decision variables associated with the corresponding network element, which encode the probability of creating a new filtering function that allows or denies new filtering functions for one or more CHSs associated with the corresponding network element, and encoding modifications to existing filtering functions to allow or deny one or more CHSs. The method defines a minimization problem by converting the network representation into a maximum satisfiability (MaxSAT) formula, which minimizes the amount of decision variables to be modified to satisfy a defined reachability intent. The method includes defining a set of decision weights for each decision variable based on an objective function. The method includes obtaining a solution to the minimization problem using a MaxSAT resolution (MaxRes) algorithm weighted by the defined decision weights. The method includes generating a new network configuration by creating a set of configurations for one or more network elements of a deployed VPC network based on the values ​​of the decision variables obtained from the solution to the minimization problem.

[0014] This approach verifies the correctness of a VPC deployment or identifies network elements in a VPC network that do not include desired reachability attributes. This approach generates a VPC network configuration starting with the user. This approach supports replicated configurations or network elements. This approach considers the possibility of replicated network addresses existing and verifies the correctness of the generated configuration in that case. This approach can scale even with large VPC deployments, such as over two thousand edge nodes, to verify the correctness of the generated configuration. The efficient edge-based encoding of this approach's network preprocessing engine and routing / filtering behavior can scale to large VPC deployments with near real-time response times. This approach allows enriching the user's intent with additional cost functions to optimize specific metrics. This metric could be, for example, the number of modified network configurations, or the total cost of the solution in terms of monetary or performance costs. This approach can optimize VPC network configurations to meet desired KPIs, such as cost / performance / complexity / maintainability. This approach describes near-linear scalability properties across the described ECS range. The described ECS range might be 2000 affected ECSs with a total runtime of less than 10 seconds.

[0015] Optionally, defining the reachability intent includes one or more intent attributes defined by the user and a target objective function. Defining the reachability intent includes defining omitted intent attributes that have not yet been defined by the user as wildcards to generalize each omitted intent attribute to all suitable network elements.

[0016] Optionally, the defined objective function includes either a target cost defined by the user for the new network configuration or a predefined objective function selected by the user.

[0017] Optionally, the target cost in the target objective function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

[0018] Optionally, generating a new network configuration includes adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more network elements, based on the values ​​of decision variables obtained in the solution to the minimization problem.

[0019] Secondly, a system for managing the configuration of a Virtual Private Cloud (VPC) network is provided. The system includes a configuration aggregation module, an intent definition module, and a reachability executor module. The configuration aggregation module is used to obtain the configuration of each virtual or physical network element in the deployed VPC network and the network topology of the deployed VPC network. The intent definition module is used to define reachability intents including a target objective function and intent attributes. The target objective function includes a target cost for the new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is allow or deny. The reachability executor module is used to generate a network representation that describes how traffic is processed in each network element based on the network element configuration and network topology, using operable filtering functions of the network elements. Each operable filter function is based on a set of decision variables associated with the corresponding network element. These decision variables encode the possibility of creating a new filter function that allows or rejects one or more CHSs associated with the corresponding network element, and also encode modifications to existing filter functions to allow or reject one or more CHSs. The reachability executor module defines a minimization problem by converting the network representation into a maximum satisfiability (MaxSAT) formula that minimizes the amount of decision variables to be modified to satisfy the defined reachability intent. The reachability executor module defines a set of decision weights for each decision variable according to the objective function. The reachability executor module obtains a solution to the minimization problem using a MaxSAT resolution (MaxRes) algorithm weighted by the defined decision weights. The reachability executor module generates a new network configuration by creating a set of configurations for one or more network elements of the deployed VPC network based on the values ​​of the decision variables obtained from the solution to the minimization problem.

[0020] The system verifies the correctness of a VPC deployment or identifies network elements in the VPC network that do not include desired reachability attributes. The system generates VPC network configurations starting from the user. The system supports replicated configurations or network elements. The system considers the possibility of replicated network addresses and verifies the correctness of the generated configuration in this case. The system can scale even with large VPC deployments, such as exceeding two thousand edge nodes, to verify the correctness of the generated configurations. The system's efficient edge-based encoding of network preprocessing and routing / filtering behavior can scale to large VPC deployments with near real-time response times. The system allows enriching the user's intent with additional cost functions to optimize specific metrics. This metric could be, for example, the number of modified network configurations, or the total cost of the solution in terms of monetary or performance costs. The system can optimize VPC network configurations to meet desired KPIs, such as cost / performance / complexity / maintainability. The system describes near-linear scalability properties across the described ECS range. The described ECS range might be 2000 affected ECSs with a total runtime of less than 10 seconds.

[0021] Optionally, the intent definition module enables users to define one or more intent attributes and target objective functions. The intent definition module also defines omitted intent attributes that have not yet been defined by the user as wildcards to generalize each omitted intent attribute to all suitable network elements.

[0022] Optionally, the intent definition module is also used to enable users to define a target cost for a new network configuration or to select one of the predefined objective functions.

[0023] Optionally, the target cost in the target objective function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

[0024] Optionally, the reachability actuator module is used to generate new network configurations by adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more network elements based on the values ​​of decision variables obtained in the solution to the minimization problem.

[0025] Therefore, unlike existing technologies, the methods and systems used to manage virtual private cloud (VPC) network configurations can generate and optimize VPC network configurations to scale large-scale deployments.

[0026] These and other aspects of the invention will be apparent from one or more implementations described below. Attached Figure Description

[0027] The implementation of the invention will now be described with reference to the accompanying drawings, which are provided as examples only.

[0028] Figure 1 This is a system for managing the network configuration of a virtual private cloud (VPC) according to an implementation of the present invention;

[0029] Figure 2 This is an exemplary view of a system for managing the network configuration of a virtual private cloud (VPC) according to an implementation of the present invention;

[0030] Figure 3 This is an exemplary diagram of a sequence for managing the configuration of a virtual private cloud (VPC) network according to an implementation of the present invention, based on the maximum satisfiability (MaxSAT) formula.

[0031] Figure 4 This is an exemplary diagram of a user interface for managing the configuration of a virtual private cloud (VPC) network according to an implementation of the present invention;

[0032] Figure 5 It is a graphical representation of the scalability analysis of a virtual private cloud (VPC) based on the maximum satisfiability (MaxSAT) formula according to an implementation of the present invention;

[0033] Figures 6A to 6C This is a flowchart of a method for managing the network configuration of a virtual private cloud (VPC) according to an implementation of the present invention;

[0034] Figure 7The illustration shows a computer system (e.g., a user device) in which various architectures and functions of various prior implementations can be implemented. Detailed Implementation

[0035] The present invention provides a method for managing the network configuration of a virtual private cloud (VPC) and a system for managing the network configuration of a virtual private cloud (VPC).

[0036] To enable those skilled in the art to more easily understand the present invention, the following implementation of the present invention is described in conjunction with the accompanying drawings.

[0037] The terminology used in the description of the invention, the claims, and the foregoing drawings, such as “first,” “second,” “third,” and “fourth,” (if any), is used to distinguish similar objects and is not necessarily used to describe a particular sequence or order. It should be understood that such terminology is interchangeable where appropriate, for example, to allow implementations of the invention described herein to be implemented in sequences other than those shown or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to the steps or units expressly listed, but may include other steps or units not expressly listed or inherent to such processes, methods, products, or apparatuses.

[0038] Figure 1This invention relates to a system 100 for managing the configuration of a Virtual Private Cloud (VPC) network according to an implementation thereof. System 100 includes a configuration aggregation module 102, an intent definition module 104, and a reachability executor module 106. The configuration aggregation module 102 is used to obtain the configuration of each virtual or physical network element 110A-N in a deployed VPC network 108 and the network topology of the deployed VPC network 108. The intent definition module 104 is used to define reachability intents including a target objective function and intent attributes. The target objective function includes a target cost for the new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is allow or deny. The reachability executor module 106 is used to generate a network representation that describes how traffic is processed in each network element based on the network element configuration and network topology, using operable filtering functions of the network elements. Each operable filter function is based on a set of decision variables associated with the corresponding network element. These decision variables encode the possibility of creating a new filter function that allows or rejects one or more CHSs associated with the corresponding network element, and also encode modifications to existing filter functions to allow or reject one or more CHSs. The reachability executor module 106 defines a minimization problem by converting the network representation into a maximum satisfiability (MaxSAT) formula that minimizes the amount of decision variables to be modified to satisfy a defined reachability intent. The reachability executor module 106 defines a set of decision weights for each decision variable according to an objective function. The reachability executor module 106 obtains a solution to the minimization problem using a MaxSAT resolution (MaxRes) algorithm weighted by the defined decision weights. The reachability executor module 106 generates a new network configuration by creating a set of configurations for one or more network elements of the deployed VPC network 108 based on the values ​​of the decision variables obtained from the solution to the minimization problem.

[0039] System 100 verifies the correctness of VPC deployments or identifies network elements in the deployed VPC network 108 that do not include desired reachability attributes. System 100 generates VPC network configurations starting from the user. System 100 supports replicated configurations or network elements. System 100 considers the possibility of replicated network addresses and verifies the correctness of the generated configuration in this case. System 100 can scale even in large VPC deployments, such as exceeding two thousand edge nodes, to verify the correctness of the generated configurations. The efficient edge-based encoding of System 100's network preprocessing engine and routing / filtering behavior can scale to large VPC deployments with near real-time response times. System 100 allows enriching the user's intent with additional cost functions to optimize specific metrics. Such metrics could be, for example, the number of modified network configurations, or the total cost of the solution in terms of monetary or performance costs. System 100 can optimize VPC network configurations to meet desired KPIs, such as cost / performance / complexity / maintainability. System 100 describes near-linear scalability attributes within the described ECS scope. The described ECS range could be 2000 affected ECS instances, with a total runtime of less than 10 seconds.

[0040] Optionally, the intent definition module 104 enables the user to define one or more intent attributes and target objective functions. The intent definition module 104 also defines omitted intent attributes that the user has not yet defined as wildcards to generalize each omitted intent attribute to all suitable network elements.

[0041] Optionally, the intent definition module 104 is also used to enable users to define a target cost for a new network configuration or select one of a predefined objective function.

[0042] Optionally, the target cost in the target objective function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

[0043] Optionally, the reachability actuator module 106 is used to generate a new network configuration by adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more network elements based on the values ​​of decision variables obtained in the solution to the minimization problem.

[0044] Figure 2This is an exemplary view of a system 200 for managing a virtual private cloud (VPC) network according to an implementation of the present invention. The exemplary system view 200 includes a configuration aggregation module 202, an intent definition module 204, a reachability executor module 206, and a deployed VPC network 208. The deployed VPC network 208 includes one or more virtual or physical network elements 210A-N. Each of the one or more virtual or physical network elements 210A-N includes a configuration.

[0045] The configuration aggregation module 202 can represent a service that provides all the details of the configuration and topology of the deployed VPC network 208. The configuration aggregation module 202 includes element configuration 212 and network topology 214. Element configuration 212 can describe the configuration of each virtual or physical network element. Network topology 214 can describe the abstract network topology of the deployed VPC network 208. Each virtual or physical network element in one or more virtual or physical network elements 210A-N within the deployed VPC network 208 can be abstracted based on the network behavior of each virtual or physical network element. The network topology 214 can be determined based on the actual virtual or physical network elements 210A-N existing in the network, such as Elastic Container Service (ECS), subnets, virtual private clouds (VPCs), etc. The network topology 214 can be abstracted into a filter / router chain based on the configuration contained in each virtual or physical network element.

[0046] The intent definition module 204 can be a user-oriented service. The intent definition module 204 can provide users 232 with a desired reachability policy to be applied in the network. Users 232 can provide the reachability policy through user equipment 234. The intent definition module 204 can allow the specification of a desired target configuration through a set of network element weights. The intent definition module 204 includes configuration weights 224, reachability intents 226, and a gateway 228. Configuration weights 224 define a set of network element weights. Reachability intents 226 define a reachability intent that includes a target objective function and intent attributes. Optionally, the target objective function includes a target cost for the new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud-hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is allow or deny. The reachability intent can be specified via gateway 228. Gateway 228 can implement user-facing technologies such as software development kits (SDKs), application programming interfaces (APIs), and graphical user interfaces (GUIs). Gateway 228 can provide connectivity to the Internet 230. The target cost can be based on the resulting configuration complexity, monetary costs, and the requirement to prioritize specific services, such as an Elastic Internet Protocol (EIP) rather than Network Address Translation (NAT).

[0047] The reachability executor module 206 can implement an inference engine that discovers a configuration set to apply to the network, thereby realizing the intent of user 232. The reachability executor module 206 includes a network preprocessing module 216, a model generation module 218, a solution generation module 220, and a network rule synthesis module 222.

[0048] The network preprocessing module 216 can generate a preprocessed network. The network preprocessing module 216 can examine all reachability pairs in the network, which necessitates encoding all associated packet filters and routers in the optimization problem. Optionally, the network preprocessing module 216 implements network element filtering and network element quantization to reduce the dimensionality of the problem. The preprocessed network can describe how to process traffic in each network element based on the network element configuration and network topology, through operable filtering functions of the network elements.

[0049] Model generation module 218 generates a formal model of the preprocessed network through encoding based on the maximum satisfiability (SAT). Model generation 218 defines a minimization problem by converting the network representation into a maximum satisfiability (MaxSAT) formula, which minimizes the amount of decision variables to be modified to satisfy a defined reachability intent. Model generation 218 defines a set of decision weights for each decision variable based on the objective function. Solution generation module 220 generates a solution to the minimization problem using a MaxSAT resolution (MaxRes) algorithm weighted by the defined decision weights. For 2000 endpoint nodes, the MaxRes algorithm runs in less than 10 seconds, making it highly efficient. The solution may be a set of network filters / routers that need to be modified / added.

[0050] The Network Rule Composition 222 module obtains a solution to generate actual ACL rules and / or routing rules and inserts them into a given location within the affected ACL / routing table RTBL. The Network Rule Composition 222 module can append CHS statements and corresponding actions to the beginning of the affected ACL. The Network Rule Composition 222 module can also append CHS statements and corresponding routing actions to the beginning of the affected routing table RTBL. The Network Rule Composition 222 module can resolve any eventualities introduced in the configuration.

[0051] One or more virtual or physical network elements 210A-N can represent the actual network to be operated. One or more virtual or physical network elements 210A-N can be a VPC network or any physical / virtual network that can be reduced to a tree topology. One or more virtual or physical network elements 210A-N can include network elements / services that can be simplified to packet filters / routers. Traffic flow between one or more virtual or physical network elements 210A-N can be illustrated in a diagram. For example, the diagram illustrates the traffic flow from routing table RTB-1 of virtual or physical network element 210A to ACL-2 of virtual or physical network element 210B.

[0052] Figure 3 This is an exemplary diagram of sequence 300 for managing a virtual private cloud (VPC) network configuration according to the maximum satisfiability (MaxSAT) formula, according to an implementation of the present invention. In step 302, management of the VPC network configuration begins in the network preprocessing module 306.

[0053] In step 304, the network is configured by obtaining the network information from an external service. In step 304, the network configuration and abstract network topology are described. In step 304C, each node in the network is abstracted based on the network behavior of the corresponding nodes to obtain an abstract network topology. In steps 304A and 304B, the abstract network topology, as a filter / router chain, is obtained based on the configuration attached to the corresponding nodes. In step 304C, the abstract network topology is described based on the actual nodes present in the network.

[0054] In step 306, network configuration is preprocessed at 308 by incorporating reachability intents to examine all reachability pairs within the network by encoding all associated packet filters and routers within the optimization problem and reducing the problem's dimensionality. In step 306A, the network is represented as a formal configuration representation. In step 306B, the problem's dimensionality is reduced by element filtering. In step 306C, the problem's dimensionality is further reduced by element quantization. In step 306B, the amount of configuration and decision variables is reduced by encoding within the optimization problem. At step 306B, if a network element does not share any identifier with the CHS and there is no explicit packet rerouting to a particular network element for the CHS, that network element and its associated network filter / router are safely removed from the network. In step 306C, long ACLs or routing tables are encoded, and a formal reasoning framework, such as a SAT-based solver, is implemented, which results in excessively expensive runtime. In step 306C, irrelevant portions of the packet filters / routers are filtered out using a binary decision graph.

[0055] In step 310, a formal model of the preprocessed network is generated through SAT-based encoding. In step 310A, the encoding describes the end-to-end basic reachability equation representing the current reachability within the network as:

[0056]

[0057] in It is a function that returns the parent node of node n. It is the allowed header space on node n.

[0058] It is a network filter chain f1,...,f n Allowed header space.

[0059] In step 310B, the encoding describes the end-to-end operational reachability equation representing the current reachability within the network as follows:

[0060]

[0061] in It is the operable and allowed header space on node n. It is a network filter chain f1,...,f n The operable, permissible header space.

[0062] The construction of R(s,d) does not require N^2 iterations. In fact,

[0063] R(ECS1,ECS2)=R(ECS1,·)∧R(·,ECS2)

[0064] The total complexity of constructing R(s,d) is O(N).

[0065] In step 310C, the encoding formalizes the constraints of the reachability enforcement problem through reachability conservation encoding using the following equation:

[0066]

[0067] The encoding at 310D is formalized by the following equation, which describes the constraint on the reachability enforcement problem through configuration strictness:

[0068]

[0069] In step 312, a solution to the problem is generated based on the minimum number of modified elements and the minimum configuration cost.

[0070] The MaxSAT problem below can be coded according to the above constraints:

[0071]

[0072] In step 314, network rules are transformed by generating actual ACL rules and / or routing rules and inserting them into given positions within the affected ACL / routing table RTBL. ACL rules and / or routing rules are generated by appending CHS and corresponding actions to the beginning of the affected ACL and corresponding routing actions to the beginning of the affected RTBL, thereby resolving any final anomalies introduced in the configuration. In step 316, configuration costs ω∈Ω are allowed to guide the solver to a specific solution space. These costs may relate to the cost of adding explicit allow / deny rules or the generation of new network configurations. The output of the solution generation is a set of network filters / routers that need to be modified.

[0073] Table 1 below describes the definitions of all variables in the above equation.

[0074] Table 1

[0075]

[0076] Figure 4This is an exemplary view of a user interface 400 for managing a Virtual Private Cloud (VPC) network configuration according to an implementation of the present invention. The exemplary user interface 400 depicts customer-facing cloud services or tools implemented as network management tools, such as ECS-2ABA, Subnet-33G1, VPC-Peer Connection, and ECS-C7F7. The exemplary user interface 400 also illustrates network reachability verification and suggested actions for networks that are not reachable.

[0077] Figure 5 This is a graphical representation 500 of a scalability analysis of a virtual private cloud (VPC) according to the maximum satisfiability (MaxSAT) formula, based on an implementation of the present invention. The graphical representation 500 of the scalability analysis describes time in seconds on the Y-axis and the affected devices on the X-axis. The graphical representation 500 of the scalability analysis at 502 describes the total runtime in the affected end devices. The graphical representation 500 of the scalability analysis at 504 describes the solution time in the affected end devices. The graphical representation 500 of the scalability analysis at 506 describes the reachability generation time in the affected end devices. Solution generation exhibits almost linear characteristics in the affected end devices. For example, on 2000 affected end devices, the total runtime is less than 10 seconds.

[0078] Figures 6A to 6CThis is a flowchart of a method for managing a Virtual Private Cloud (VPC) network configuration according to an implementation of the present invention. In step 602, the configuration of each virtual or physical network element is obtained in the deployed VPC network and its network topology. In step 604, an reachability intent is defined, including a target objective function and intent attributes. The target objective function includes a target cost for the new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is allow or deny. In step 606, a network representation is generated, which describes how traffic is processed in each network element based on the network element configuration and network topology, using operable filtering functions of the network elements. Each operable filter function is based on a set of decision variables associated with the corresponding network element. These decision variables encode the possibility of creating a new filter function that allows or rejects one or more CHSs associated with the corresponding network element, and also encode modifications to existing filter functions to allow or reject one or more CHSs. In step 608, a minimization problem is defined by converting the network representation into a maximum satisfiability (MaxSAT) formula, which minimizes the amount of decision variables to be modified to satisfy a defined reachability intent. In step 610, a set of decision weights is defined for each decision variable according to the objective function. In step 612, a solution to the minimization problem is obtained using a MaxSAT resolution (MaxRes) algorithm weighted by the defined decision weights. In step 614, a new network configuration is generated by creating a set of configurations for one or more network elements of the deployed VPC network based on the values ​​of the decision variables obtained from the solution to the minimization problem.

[0079] This approach verifies the correctness of a VPC deployment or identifies network elements in a VPC network that do not include desired reachability attributes. This approach generates a VPC network configuration starting with the user. This approach supports replicated configurations or network elements. This approach considers the possibility of replicated network addresses existing and verifies the correctness of the generated configuration in that case. This approach can scale even with large VPC deployments, such as over two thousand edge nodes, to verify the correctness of the generated configuration. The efficient edge-based encoding of this approach's network preprocessing engine and routing / filtering behavior can scale to large VPC deployments with near real-time response times. This approach allows enriching the user's intent with additional cost functions to optimize specific metrics. This metric could be, for example, the number of modified network configurations, or the total cost of the solution in terms of monetary or performance costs. This approach can optimize VPC network configurations to meet desired KPIs, such as cost / performance / complexity / maintainability. This approach describes near-linear scalability properties across the described ECS range. The described ECS range might be 2000 affected ECSs with a total runtime of less than 10 seconds.

[0080] Optionally, defining the reachability intent includes one or more intent attributes defined by the user and a target objective function. Defining the reachability intent includes defining omitted intent attributes that have not yet been defined by the user as wildcards to generalize each omitted intent attribute to all suitable network elements.

[0081] Optionally, the defined objective function includes either a target cost defined by the user for the new network configuration or a predefined objective function selected by the user.

[0082] Optionally, the target cost in the target objective function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

[0083] Optionally, generating a new network configuration includes adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more network elements, based on the values ​​of decision variables obtained in the solution to the minimization problem.

[0084] Figure 7A diagram illustrates a computer system (e.g., a user equipment or virtual private cloud (VPC) network configuration) in which various architectures and functions of various prior implementations can be implemented. As shown, computer system 700 includes at least one processor 704 connected to bus 702, wherein computer system 700 can be implemented using any suitable protocol, such as peripheral component interconnect (PCI), PCI-Express, accelerated graphics port (AGP), HyperTransport, or any other bus or point-to-point communication protocol. Computer system 700 also includes memory 706.

[0085] The control logic (software) and data are stored in memory 706, which may take the form of random-access memory (RAM). In this invention, a single semiconductor platform can refer to a unique integrated circuit or chip based on a single semiconductor. It should be noted that the term "single semiconductor platform" can also refer to a multi-chip module with increased connectivity, simulating an on-chip module with increased connectivity, representing a substantial improvement over implementations using a traditional central processing unit (CPU) and bus. Of course, depending on the user's expectations, various modules can also be placed individually or in various combinations of semiconductor platforms.

[0086] The computer system 700 may also include auxiliary storage 710. Auxiliary storage 710 includes hard disk drives and removable storage drives, such as floppy disk drives, magnetic tape drives, compact disk drives, digital versatile disk (DVD) drives, recording devices, and universal serial bus (USB) flash memory. The removable storage drives read from and / or write to the removable storage unit in a well-known manner.

[0087] A computer program or computer control logic algorithm may be stored in at least one of the memory 706 and the auxiliary memory 710. Executing such a computer program enables the system 700 to perform the various functions described above. The memory 706, the auxiliary memory 710, and any other memory are possible examples of computer-readable media.

[0088] In one implementation, the architecture and functionality described in the various previous figures can be implemented in the context of processor 704, a graphics processor coupled to communication interface 712, an integrated circuit (not shown) capable of having at least a portion of the capabilities of both processor 704 and graphics processor, and a chipset (i.e., a set of integrated circuits designed to operate and be sold as units performing related functions).

[0089] Furthermore, the architectures and functions described in the various previous figures can be implemented in the context of general computer systems, circuit board systems, game console systems for entertainment purposes, and application-specific systems. For example, computer system 700 can take the form of a desktop computer, a laptop computer, a server, a workstation, a game console, or an embedded system.

[0090] Furthermore, the computer system 700 can take the form of various other devices, including but not limited to personal digital assistant (PDA) devices, mobile phone devices, smartphones, televisions, etc. Additionally, although not shown, the computer system 700 can be coupled to a network (e.g., telecommunications network, local area network (LAN), wireless network, wide area network (WAN) such as the Internet, peer-to-peer network, cable network, etc.) via I / O interface 708 for communication purposes.

[0091] It should be understood that the arrangement of components shown in the described figures is exemplary, and other arrangements are possible. It should also be understood that the various system components (and devices) defined by the claims, described below, and shown in the various block diagrams represent components in some systems configured according to the subject matter disclosed herein. For example, one or more of these system components (and devices) may be implemented wholly or partially by at least some of the components shown in the arrangements shown in the described figures.

[0092] Furthermore, while at least one of these components is implemented at least partially as an electronic hardware component and thus constitutes a machine, the other components may be implemented in software, which, when included in the execution environment, constitutes a machine, hardware, or a combination of software and hardware.

[0093] While the invention and its advantages have been described in detail, it should be understood that various changes, substitutions and modifications may be made without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A method for managing the network configuration of a virtual private cloud (VPC), characterized in that, The method includes: Obtain the configuration of each virtual or physical network element (110A) in the deployed VPC network (108) and the network topology of the deployed VPC network (108); Define an reachability intent that includes a target objective function and intent attributes, wherein the target objective function includes a target cost for a new network configuration, and the intent attributes include the source and destination endpoints of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and a desired reachability attribute, wherein the desired reachability attribute is either allow or deny. A network representation is generated, which describes how traffic is processed in each virtual or physical network element (110A-N) based on the configuration of the virtual or physical network elements (110A-N) and the network topology, through operable filtering functions of the virtual or physical network elements (110A-N). Each operable filtering function is based on a set of decision variables associated with the corresponding virtual or physical network element (110A), which encode the possibility of creating a new filtering function that allows or denies one or more CHS associated with the corresponding virtual or physical network element (110A), and also encodes modifications to existing filtering functions to allow or deny the one or more CHS. The minimization problem is defined by converting the network representation into a maximum satisfiability (MaxSAT) formula, which minimizes the number of decision variables to be modified to satisfy the defined reachability intent. Based on the objective function, a set of decision weights is defined for each decision variable; The solution to the minimization problem is obtained by using the MaxSAT resolution (MaxRes) algorithm, which is weighted by the defined decision weights. The new network configuration is generated by creating a set of configurations for one or more virtual or physical network elements (110A-N) of the deployed VPC network (108) based on the values ​​of the decision variables obtained from the solution of the minimization problem.

2. The method according to claim 1, characterized in that, The reachability intent defined herein includes: The intent attributes and the target objective function are defined by the user. The omitted intent attributes that have not yet been defined by the user are defined as wildcards to generalize each omitted intent attribute to all appropriate network elements.

3. The method according to claim 2, characterized in that, The definition of the target objective function includes either the target cost defined by the user for the new network configuration or one of the predefined objective functions selected by the user.

4. The method according to any one of claims 1 to 3, characterized in that, The target cost in the target function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

5. The method according to any one of claims 1 to 4, characterized in that, The generation of the new network configuration includes adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more virtual or physical network elements (110A-N) based on the values ​​of the decision variables obtained in the solution of the minimization problem.

6. A system (100) for managing the network configuration of a virtual private cloud (VPC), characterized in that, The system includes: The configuration aggregation module (102) is used to obtain the configuration of each virtual or physical network element (110A) in the deployed VPC network (108) and the network topology of the deployed VPC network (108); The intent definition module (104) is used to define an reachability intent including a target objective function and intent attributes, wherein the target objective function includes a target cost for a new network configuration, and the intent attributes include the source terminal device and destination terminal device of the traffic flow, the intent header space (IHS) of the cloud hosted service (CHS), and the expected reachability attribute, wherein the expected reachability attribute is allowed or denied. Reachability actuator module (106), used for: A network representation is generated, which describes how traffic is processed in each virtual or physical network element (110A-N) based on the configuration of the virtual or physical network element (110A-N) and the network topology, through operable filtering functions of the virtual or physical network element (110A-N). Each operable filtering function is based on a set of decision variables associated with the corresponding virtual or physical network element (110A-N), which encode the possibility of creating a new filtering function that allows or denies one or more CHSs associated with the corresponding virtual or physical network element (110A-N), and encoding modifications to existing filtering functions to allow or deny the one or more CHSs. The minimization problem is defined by converting the network representation into a maximum satisfiability (MaxSAT) formula, which minimizes the number of decision variables to be modified to satisfy the defined reachability intent. Based on the objective function, a set of decision weights is defined for each decision variable; The solution to the minimization problem is obtained by using the MaxSAT resolution (MaxRes) algorithm, which is weighted by the defined decision weights. The new network configuration is generated by creating a set of configurations for one or more virtual or physical network elements (110A-N) of the deployed VPC network (108) based on the values ​​of the decision variables obtained from the solution of the minimization problem.

7. The system according to claim 6, characterized in that, The intent definition module (104) is used for: Users can define one or more of the intent attributes and the target objective function; The omitted intent attributes that have not yet been defined by the user are defined as wildcards to generalize each omitted intent attribute to all appropriate network elements.

8. The system according to claim 7, characterized in that, The intent definition module (104) is also used to enable the user to define the target cost for the new network configuration or select one of the predefined target functions.

9. The system according to any one of claims 6 to 8, characterized in that, The target cost in the target function is based on one or more of the following: configuration complexity, monetary cost, and the need to use a certain service in the new network configuration, such as an Elastic Internet Protocol (EIP) address or Network Address Translation (NAT).

10. The system according to any one of claims 6 to 9, characterized in that, The reachability actuator module (106) is used to generate the new network configuration by adding new rules to allow or deny traffic flow of one or more CHSs in the configuration of one or more virtual or physical network elements (110A-N) based on the values ​​of the decision variables obtained in the solution of the minimization problem.

Images