Method and apparatus for generating test data of communication tunnel, and electronic device

Abstract

The application discloses a kind of communication tunnel test data generation method and its device, electronic equipment, it is related to automatic test technical field, wherein, the test data generation method includes: determining initial configuration item;Based on target strategy dependency graph, configuration item extension is carried out to initial configuration item, obtains multiple target extension configuration items and at least one target extension configuration item value corresponding to each target extension configuration item, wherein, target strategy dependency graph is constructed by multiple configuration items and multiple constraint relations;Based on initial configuration item, all target extension configuration items and all target extension configuration item values, at least one combination test data for communication tunnel is generated.The present application solves the technical problem that different test data combinations are difficult to cover in related technologies, and there is a risk of missing measurement.

Description

Technical Field

[0001] This invention relates to the field of automated testing technology, and more specifically, to a method, apparatus, and electronic device for generating test data for communication tunnels. Background Technology

[0002] Currently, automated testing of IPSec tunnels (a security protocol system that implements data encryption and authentication at the Internet protocol layer to establish secure communication tunnels) mainly relies on manual preset of fixed configuration combinations and static script execution. At the same time, any change in configuration parameters requires manual modification of multiple related configurations, resulting in high maintenance costs. Furthermore, the configuration data depends on manual experience in selection, making it difficult to cover the testing of different combinations of configuration data and posing a risk of missed tests.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for generating test data for communication tunnels, to at least solve the technical problem in related technologies that it is difficult to cover combinations of different test data and that there is a risk of missed tests.

[0005] According to one aspect of the embodiments of this application, a method for generating test data for a communication tunnel is provided, comprising: determining an initial configuration item; expanding the initial configuration item based on a target policy dependency graph to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item, wherein the target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships; and generating at least one combined test data for the communication tunnel based on the initial configuration item, all target extended configuration items, and all target extended configuration item values.

[0006] Furthermore, before determining the initial configuration items, the process includes: determining multiple configuration items for the communication tunnel and determining the constraint relationships between the configuration items, wherein each configuration item corresponds to at least one configuration item value; representing the configuration items as nodes and the constraint relationships as edges; and constructing a target policy dependency graph based on all nodes, all configuration item values, and all edges.

[0007] Furthermore, the configuration items in the target policy dependency graph include at least: certificate, multiple preset parameters, local subnet, peer subnet, active end role, passive end role, tunnel mode, encryption algorithm, and authentication algorithm; the constraint relationships include at least: dependency relationship, matching relationship, mutual exclusion relationship, mapping relationship, cooperative relationship, and combined constraint.

[0008] Further, based on the target policy dependency graph, the initial configuration item is expanded to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item. This includes: traversing the configuration items in the target policy dependency graph based on the initial configuration item to obtain extended configuration items that have dependencies on the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value; for each extended configuration item, traversing all extended configuration item values ​​and verifying both the extended configuration item and the current extended configuration item value to obtain multiple verification results, wherein the verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, collaborative verification, and combined constraint verification; and based on all verification results under each extended configuration item, determining the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item.

[0009] Further, the step of determining the target extended configuration item and at least one target extended configuration item value based on all verification results under each extended configuration item includes: for the current extended configuration item value under each extended configuration item, if any verification result indicates verification failure, performing a pruning operation, wherein the pruning operation is used to filter the extended configuration item value; if all verification results indicate verification success, determining the extended configuration item as a candidate extended configuration item, and determining the current extended configuration item value as a candidate extended configuration item value; using the candidate extended configuration item and the candidate extended configuration item value as new initial configuration items, continuing to traverse the configuration items in the target policy dependency graph to obtain the candidate extended configuration item and the candidate extended configuration item value for the next round of traversal, until there are no new extended configuration items that have a dependency relationship with the new initial configuration item when traversing the configuration items in the target policy dependency graph; determining each candidate extended configuration item as a target extended configuration item, and determining each candidate extended configuration item value as a target extended configuration item value, wherein there is a correspondence between the target extended configuration item and the target extended configuration item value.

[0010] Furthermore, after generating at least one set of combined test data for the communication tunnel based on the initial configuration items, all target extended configuration items, and the values ​​of all target extended configuration items, the process includes: sorting all the combined test data according to a preset priority; and based on the sorting, calling a test execution script to perform a communication tunnel test to obtain the test execution result for each set of test data.

[0011] Furthermore, after executing the communication tunnel test by calling the test execution script based on the sorting and obtaining the test execution results for each combination of test data, the process includes: determining an adjustment strategy for the combination of test data based on the test execution results, wherein the adjustment strategy includes at least: adjusting the preset priority of the combination of test data and deleting the combination of test data; and adjusting the combination of test data based on the adjustment strategy.

[0012] According to another aspect of the embodiments of this application, a test data generation apparatus for a communication tunnel is also provided, comprising: a determining unit, configured to determine an initial configuration item; an expanding unit, configured to expand the initial configuration item based on a target policy dependency graph to obtain multiple target expanded configuration items and at least one target expanded configuration item value corresponding to each target expanded configuration item, wherein the target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships; and a generating unit, configured to generate at least one combined test data for the communication tunnel based on the initial configuration item, all target expanded configuration items, and all target expanded configuration item values.

[0013] Furthermore, the test data generation device for the communication tunnel includes: a first determining module, used to determine multiple configuration items of the communication tunnel before determining the initial configuration items, and to determine the constraint relationship between the configuration items, wherein each configuration item corresponds to at least one configuration item value; a first characterization module, used to characterize the configuration items as nodes and the constraint relationship as edges; and a first construction module, used to construct a target policy dependency graph based on all nodes, all configuration item values, and all edges.

[0014] Furthermore, the configuration items in the target policy dependency graph include at least: certificate, multiple preset parameters, local subnet, peer subnet, active end role, passive end role, tunnel mode, encryption algorithm, and authentication algorithm; the constraint relationships include at least: dependency relationship, matching relationship, mutual exclusion relationship, mapping relationship, cooperative relationship, and combined constraint.

[0015] Further, the extension unit includes: a first traversal module, used to traverse the configuration items in the target policy dependency graph based on the initial configuration item to obtain extended configuration items that have a dependency relationship with the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value; a first verification module, used to traverse all extended configuration item values ​​for each extended configuration item and verify the extended configuration item and the current extended configuration item value to obtain multiple verification results, wherein the verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, collaborative verification, and combined constraint verification; and a second determination module, used to determine the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item based on all verification results under each extended configuration item.

[0016] Further, the second determining module includes: a first execution submodule, used to perform a pruning operation on the current extended configuration item value under each extended configuration item if any verification result indicates a verification failure, wherein the pruning operation is used to filter the extended configuration item value; a first determining submodule, used to determine the extended configuration item as a candidate extended configuration item and the current extended configuration item value as a candidate extended configuration item value if all verification results indicate a verification success; a first traversal submodule, used to take the candidate extended configuration item and the candidate extended configuration item value as new initial configuration items, and continue to traverse the configuration items in the target policy dependency graph to obtain the candidate extended configuration item and the candidate extended configuration item value for the next round of traversal, until there are no new extended configuration items that have a dependency relationship with the new initial configuration item when traversing the configuration items in the target policy dependency graph; and a second determining submodule, used to determine each candidate extended configuration item as a target extended configuration item and each candidate extended configuration item value as a target extended configuration item value, wherein there is a correspondence between the target extended configuration item and the target extended configuration item value.

[0017] Furthermore, the test data generation device for the communication tunnel also includes: a first sorting module, used to sort all the combined test data according to a preset priority after generating at least one combined test data for the communication tunnel based on the initial configuration items, all target extended configuration items, and the values ​​of all target extended configuration items; and a first calling module, used to call a test execution script to execute the communication tunnel test based on the sorting, and obtain the test execution result of each combined test data.

[0018] Furthermore, the test data generation device for the communication tunnel also includes: a third determining module, used to determine an adjustment strategy for the combined test data based on the test execution results after executing the communication tunnel test by calling the test execution script based on the sorting and obtaining the test execution results for each combined test data, wherein the adjustment strategy includes at least: adjusting the preset priority of the combined test data and deleting the combined test data; and a first adjusting module, used to adjust the combined test data based on the adjustment strategy.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the test data generation method for any of the above-described communication tunnels.

[0020] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for generating test data for communication tunnels.

[0021] In this invention, an initial configuration item is determined; based on the target policy dependency graph, the initial configuration item is expanded to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item. The target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships. Based on the initial configuration item, all target extended configuration items, and all target extended configuration item values, at least one combination of test data for the communication tunnel is generated, which solves the technical problem in related technologies that it is difficult to cover combinations of different test data and there is a risk of missed tests.

[0022] In this invention, by determining the initial configuration item as the starting point of the test path, and combining it with the target policy dependency graph constructed from multiple IPSec configuration items and their dependencies, matching, mutual exclusion, mapping, coordination and combination constraints, the initial configuration item is expanded layer by layer. The expansion continues only after each step passes the multi-dimensional constraint verification, and finally multiple target extended configuration items and their corresponding values ​​of at least one target extended configuration item are obtained. Subsequently, the initial configuration item, all target extended configuration items and their values ​​are combined into a tunnel configuration sequence to generate at least one combined test data, which covers the combined configuration data that is difficult to list in manual testing, thereby reducing the risk of missed tests due to incomplete test data coverage caused by combination explosion. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a test data generation method for communication tunnels is shown.

[0025] Figure 2 This is a flowchart of a method for generating test data for a communication tunnel according to Embodiment 1 of this application;

[0026] Figure 3 This is a flowchart illustrating test data generation and test data execution according to an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of a test data generation device for a communication tunnel according to an embodiment of this application;

[0028] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. If the user chooses to refuse, the process enters the expert decision-making process.

[0032] Because there are many dependencies between IPSec configuration items and their values, the combination space grows exponentially. It is difficult to fully cover the test data manually, and the test results cannot effectively influence the generation and execution of test data, thus failing to continuously improve test efficiency and quality. In this invention, IPSec tunnel configuration items and their constraints are uniformly modeled, and combined test data is automatically generated. High-priority tunnel combined test data is executed first, and the tunnel combined test data is continuously optimized based on the execution results to improve test quality.

[0033] The present invention will now be described in detail with reference to various embodiments.

[0034] Example 1

[0035] According to an embodiment of this application, an embodiment of a method for generating test data for a communication tunnel is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a test data generation method for communication tunnels is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0037] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0038] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the communication tunnel test data generation method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned communication tunnel test data generation method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0039] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0040] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0041] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for generating test data for the communication tunnel is shown. Figure 2 This is a flowchart of a method for generating test data for a communication tunnel according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:

[0042] Step S201: Determine the initial configuration items.

[0043] In this embodiment of the invention, the initial configuration item is a configuration node that can be selected first as the starting point during the test data generation process without any prior dependencies, such as the local certificate.

[0044] Step S202: Based on the target policy dependency graph, the initial configuration item is expanded to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item. The target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships.

[0045] In this embodiment of the invention, the target policy dependency graph is a directed graph model composed of all IPSec configuration items as nodes and six types of constraint relationships (i.e., dependency, matching, mutual exclusion, mapping, cooperation, and composition) as directed edges. This target policy dependency graph can be dynamically generated based on user-input configuration items and configuration rules. Configuration item expansion refers to selecting the next configuration item to be added from the expandable nodes based on the initial configuration items and the edge relationships of the policy dependency graph, trying each of its optional configuration values, and determining whether it can be retained through constraint verification, ultimately obtaining multiple target expanded configuration items and at least one target expanded configuration item value corresponding to each target expanded configuration item.

[0046] By dynamically selecting the next node and its value under the current path based on the dependency relationship defined in the policy dependency graph, and pruning is performed through real-time verification to reduce the proportion of invalid test data.

[0047] Step S203: Based on the initial configuration item, all target extended configuration items, and the values ​​of all target extended configuration items, generate at least one combination of test data for the communication tunnel.

[0048] In this embodiment of the invention, the target extension configuration item is each configuration node confirmed to be added to the path during each round of extension. The value of the target extension configuration item is the specific value corresponding to each extension node that has been verified. The combined test data is an IPSec tunnel configuration sequence composed of the above-mentioned initial configuration item, target extension configuration item, and value. It can be directly used as input parameters for automated test scripts to drive real devices to establish tunnels and verify functionality.

[0049] In summary, by constructing a policy dependency graph model of IPSec tunnel configuration items and multi-dimensional constraint relationships, and combining depth-first search and real-time constraint pruning mechanisms, only complete configuration paths that pass six types of verification (dependency, matching, mutual exclusion, mapping, collaboration, and combination constraints) are retained. This ultimately generates multiple combined test data sets, achieving intelligent generation and efficient execution of automated IPSec tunnel test data. This reduces the proportion of invalid tests, improves the breadth and depth of test coverage, and achieves a synergistic improvement in test resource utilization, defect detection rate, and maintenance efficiency. Furthermore, it solves the technical problem in related technologies where it is difficult to cover combinations of different test data, leading to the risk of missed tests.

[0050] In order to accurately construct the target policy dependency graph, in the test data generation method for communication tunnels provided in Embodiment 1 of this application, multiple configuration items of the communication tunnel are determined, and the constraint relationships between the configuration items are determined, wherein each configuration item corresponds to at least one configuration item value; the configuration items are represented as nodes, and the constraint relationships are represented as edges; and the target policy dependency graph is constructed based on all nodes, all configuration item values, and all edges.

[0051] In this embodiment of the invention, before starting the test, all configuration items are structured and treated as nodes. The relationships between them (must be consistent, cannot exist simultaneously, must match, etc.) are treated as edges. Based on the values ​​of all nodes, all configuration items, and all edges, a target policy dependency graph is constructed.

[0052] The configuration items in the target policy dependency graph include at least: certificates, multiple preset parameters (such as IKE (Internet KeyExchange, a protocol in the IPSec protocol suite used for automatically negotiating security associations and exchanging keys) parameters, SA (Security Association, used to define the set of security parameters for communicating parties in an IPSec tunnel) parameters, DH (a key exchange algorithm) group parameters, local subnet, peer subnet, active end role, passive end role, tunnel mode, encryption algorithm, and authentication algorithm); the constraints include at least: dependency relationships, matching relationships, mutual exclusion relationships, mapping relationships, cooperative relationships, and combined constraints. Each configuration item corresponds to a set of predefined selectable values ​​(i.e., configuration item values), for example, the selectable values ​​for the IKE encryption algorithm are {AES, SM4}, etc. Certificates can be divided into local device certificates and peer device certificates. Local and peer subnets define the network address ranges protected by the local and peer devices, respectively. Active and passive end roles identify the initiator and responder of tunnel negotiation, and the tunnel mode can be either tunnel mode or transport mode.

[0053] Dependencies refer to the requirement that a certain configuration item must be set after other items, including but not limited to: an IPSec tunnel must be bound to an IKE policy, and an IKE policy must be bound to a certificate authentication configuration. For example, a certificate algorithm must have been selected in the current path before selecting an IKE algorithm; if a certificate algorithm has not been selected, the configuration of the IKE algorithm cannot begin.

[0054] Matching requires that the configurations at both ends be consistent, including but not limited to: the encryption algorithms at both ends of the tunnel must be consistent, the authentication algorithms at both ends of the tunnel must be consistent, the IKE versions at both ends must be consistent, and the SA lifecycle parameters must meet compatibility requirements. For example, the IKE algorithms at both ends must be consistent, so this checks whether the IKE algorithms selected at both ends of the IPSec in the current path are consistent.

[0055] Mutual exclusion prevents certain combinations from coexisting, including but not limited to: certain algorithm combinations cannot be used simultaneously, and certain authentication methods are not supported in specific modes. For example, there is a conflict between tunnel mode being the transport mode and NAT-T (an extension mechanism of IPsec) being enabled.

[0056] The mapping relationship requires that the local and peer subnets must be protected objects of each other. For example, in a path, the peer subnets of both sides must correspond to each other. Here, if the configurations of the two subnets set in the current path do not correspond, the path will be cut off.

[0057] The cooperative relationship requires that the parameters at both ends be compatible in terms of timing or range. For example, the update times of IPSec configured in a path must overlap. Here, the SA update times configured on both sides are checked. If they cannot overlap to correctly update the IPSec tunnel, they will be cut off.

[0058] Combination constraints judge the correctness of specific parameter combinations. For example, if both ends of DPD (Dead PeerDetection, a mechanism for detecting whether the peer in IPSec communication is alive) both detect and clear, and both ends clear SA after the peer dies (such as network disconnection, device failure, etc.), the tunnel cannot be rebuilt, so it is an abnormal parameter combination.

[0059] To accurately determine the target extended configuration item and the value of at least one target extended configuration item corresponding to it, in the test data generation method for communication tunnels provided in Embodiment 1 of this application, based on the initial configuration item, the configuration items in the target policy dependency graph are traversed to obtain extended configuration items that have a dependency relationship with the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value; for each extended configuration item, all extended configuration item values ​​are traversed, and the extended configuration item and the current extended configuration item value are verified to obtain multiple verification results, wherein the verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, cooperative verification, and combined constraint verification; based on all verification results under each extended configuration item, the target extended configuration item and the value of at least one target extended configuration item corresponding to it are determined.

[0060] In this embodiment of the invention, starting with the initial configuration item, a depth-first traversal is performed on the target policy dependency graph to gradually expand the tunnel configuration path. An expanded configuration item refers to the next configuration node that can be added subsequently, based on the dependency edges in the target policy dependency graph and the currently configured nodes. For example, if the current path already contains a local certificate, the system will query all nodes in the target policy dependency graph that have the local certificate as a prerequisite, such as the IKE encryption algorithm, IKE authentication algorithm, and IKE version. These are the expanded configuration items for the current round. For each expanded configuration item, the system will traverse all its preset expanded configuration item values. For example, when the expanded configuration item is the IKE encryption algorithm, its expanded configuration item value set is {AES-128, AES-256, SM4}. These values ​​can be tried one by one, and six core checks (i.e., dependency check, matching check, mutual exclusion check, mapping check, cooperative check, and combination constraint check) are performed on each combination of expanded configuration item and the current expanded configuration item value, reducing the generation of invalid test data.

[0061] Dependency checks are used to verify whether the current path already contains the prerequisite nodes that the extended configuration item depends on. For example, if the local certificate is not yet loaded in the current path, the verification will fail due to missing dependencies if the IKE encryption algorithm is set to AES-256. Match checks determine whether the current value is consistent with the configured item on the peer. For example, if the peer has set IKE encryption algorithm to AES-128, and the current attempt is made to set IKE encryption algorithm to AES-256, the verification will fail due to the mismatch. Mutual exclusion checks detect conflicts with existing configuration items in the current path. For example, if "Connection mode = Active" is already set in the current path, attempting to set "Peer connection mode = Active" will be rejected due to role mutual exclusion. Mapping checks verify whether the local subnet and the peer subnet constitute an allowed network protection pair. For example, if the local subnet is 192. .10.0 / 24, with a corresponding terminal block size of 192. If the network configuration is .20.0 / 24, but the two are not configured as peer networks, the mapping verification will fail. Cooperative verification is used to ensure that parameters at both ends are compatible in terms of time or function. For example, if the local SA lifetime is 3600 seconds and the peer's is 7200 seconds, but the renegotiation windows do not overlap, the cooperative verification will fail. Combination constraint verification is used to determine whether a specific combination violates protocol or device limitations. For example, if both ends' DPD behavior is set to "detect and clear," this combination will cause the tunnel to fail to rebuild and will therefore be judged as abnormal.

[0062] To improve the accuracy of determining the target extended configuration item and the value of at least one corresponding target extended configuration item, in the test data generation method for communication tunnels provided in Embodiment 1 of this application, for the current extended configuration item value under each extended configuration item, if any verification result indicates verification failure, a pruning operation is performed, wherein the pruning operation is used to filter the extended configuration item value; if all verification results indicate verification success, the extended configuration item is determined as a candidate extended configuration item, and the current extended configuration item value is determined as a candidate extended configuration item value; the candidate extended configuration item and the candidate extended configuration item value are used as new initial configuration items, and the configuration items in the target policy dependency graph are traversed again to obtain the candidate extended configuration item and the candidate extended configuration item value for the next round of traversal, until no new extended configuration item with a dependency relationship with the new initial configuration item is found when traversing the configuration items in the target policy dependency graph; each candidate extended configuration item is determined as a target extended configuration item, and each candidate extended configuration item value is determined as a target extended configuration item value, wherein there is a correspondence between the target extended configuration item and the target extended configuration item value.

[0063] When traversing the dependency graph of the target strategy, for each extended configuration item, all its extended configuration item values ​​are iterated one by one, and six checks are performed sequentially: dependency check, matching check, mutual exclusion check, mapping check, cooperation check, and combination constraint check. If any check fails, the system immediately performs a pruning operation, that is, it terminates the further expansion of the current extended configuration item value and removes it from the test data to prevent the continued spread of invalid branches. For example, if the extended configuration item is tunnel mode and its current extended configuration item value is transmission mode, but NAT-T=enabled already exists in the path, the system finds a compatibility conflict between transmission mode and NAT-T in the combination constraint check, and immediately performs pruning, directly discarding the combination and no longer recursively expanding downwards, thereby significantly compressing the invalid search space.

[0064] If all six checks pass, the system marks the extended configuration item and its current extended configuration item value as candidate extended configuration item and candidate extended configuration item value, respectively. This means the combination has been verified as an extended path under the current path. For example, if the current path already contains "local certificate=cert_A.pem" and the current extended path is "IKE authentication algorithm=SHA256", and all six checks pass, then the IKE authentication algorithm is identified as a candidate extended configuration item, and SHA256 is identified as a candidate extended configuration item value.

[0065] Then, using the candidate extended configuration item as the new initial configuration item, the downstream dependent nodes, such as SA lifecycle and DPD behavior, are searched in the target policy dependency graph. The above traversal and verification process is repeated, expanding layer by layer, until in a certain round of traversal, there are no new extended configuration items in the target policy dependency graph that are not yet included and have a dependency relationship. At this point, all candidate extended configuration items and their values ​​that have passed verification are confirmed as target extended configuration items and their values. Based on the initial configuration item, the configuration item value of the initial configuration item, and the target extended configuration items and their values, multiple executable tunnel configuration item data (i.e., combined test data) are constructed. For example, combined test data 1: [local certificate = cert_A.pem, IKE version = IKEv2, ...]; combined test data 2: [local certificate = cert_A.pem, IKE version = IKEv1, ...], etc.

[0066] In order to accurately obtain the test execution results of each combination of test data, in the test data generation method for communication tunnels provided in Embodiment 1 of this application, all combination of test data are sorted according to a preset priority; based on the sorting, the test execution script is called to execute the communication tunnel test and obtain the test execution results of each combination of test data.

[0067] In this embodiment of the invention, priorities can be set based on whether a vulnerability has occurred, whether it has been manually marked as important, whether it has not been tested yet, or whether it covers new dependencies. For example, a combination of test data is configured as "local certificate = revoked status, IKE version = IKEv2, DPD behavior = detect and restart". This combination has caused a serious defect in the online environment that prevents tunnel reconstruction, so the system automatically assigns it a high priority; another combination is "local subnet = 10". . 0 / 8, opposite terminal mesh = 10. . Version .0 / 24, "Tunnel Mode = Tunnel Mode", while lacking historical defects, covers the subnet mapping logic added in this version and is dynamically prioritized by the system, changing from low to medium priority. All combined test data are sorted according to the above priorities to form a priority queue. Based on this sorting, the test execution script is called sequentially to perform the communication tunnel test, obtaining the test execution results for each combined test data.

[0068] To improve the accuracy of combined test data, in the test data generation method for communication tunnels provided in Embodiment 1 of this application, an adjustment strategy for the combined test data is determined based on the test execution results. The adjustment strategy includes at least: adjusting the preset priority of the combined test data and deleting the combined test data; and adjusting the combined test data based on the adjustment strategy.

[0069] In this embodiment of the invention, by determining the reason for the test execution failure, if it is an environmental problem (such as network anomaly), the combined test data can be left unchanged; if it is a real system vulnerability, the test priority of the combined test data is increased; if it is found to be invalid test data through manual investigation, the combined test data is removed, thereby continuously optimizing the combined test data and the execution order of the combined test data.

[0070] Figure 3 This is a flowchart illustrating test data generation and test data execution according to an embodiment of this application, such as... Figure 3 As shown, the process includes user operation flow and system-side operation flow. The prerequisites for the process execution are: existing automated test scripts, and the input of various test data configurations obtained from this system before executing the test scripts. On the user side, step one is executed first: input the IPSec policy under test and the corresponding optional detection values, and then step two is executed: establish constraint relationships according to the security product rules, and add, delete, and modify rules according to the actual situation of the IPSec under test. On the system side, steps one and two on the left (i.e., the user side) jointly drive the construction of a policy dependency graph, and then generate test data according to the policy dependency graph and calculate the priority of the test data. This priority can also be obtained by the user side in advance by adjusting the execution priority of different test data under different test scenarios. Then, the script can be driven to execute according to the priority of the test data, and the execution result of each test data is recorded. On the user side, the execution results can be viewed, the cause of failure can be determined, and the confirmed results can be fed back to the system. The system side automatically adjusts and continuously optimizes the test data and execution order based on the manually confirmed results.

[0071] The communication tunnel test data generation method provided in this application abstracts IPSec configuration items into structured nodes with constraints such as dependency, matching, mutual exclusion, mapping, and collaboration, constructs a policy dependency graph model, and automatically generates all combined test data through depth-first search combined with real-time constraint verification and pruning mechanism. Furthermore, it introduces an execution result feedback mechanism to dynamically adjust the priority of combined test data based on dimensions such as defect discovery and manual marking, so as to realize intelligent generation, efficient execution and continuous optimization of combined test data.

[0072] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0073] Example 2

[0074] This application also provides a test data generation apparatus for communication tunnels. It should be noted that this apparatus can be used to execute the test data generation method for communication tunnels provided in this application. The test data generation apparatus for communication tunnels provided in this application will be described below.

[0075] According to an embodiment of this application, an apparatus for implementing the above-described method for generating test data for a communication tunnel is also provided. Figure 4 This is a schematic diagram of a test data generation device for a communication tunnel according to an embodiment of this application, as shown below. Figure 4 As shown, the test data generation device for the communication tunnel may include: a determining unit 40, an expanding unit 41, and a generating unit 42.

[0076] Among them, the determining unit 40 is used to determine the initial configuration items;

[0077] Extension unit 41 is used to extend the initial configuration item based on the target policy dependency graph to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item, wherein the target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships;

[0078] The generation unit 42 is used to generate at least one combination of test data for the communication tunnel based on the initial configuration item, all target extended configuration items, and the values ​​of all target extended configuration items.

[0079] The test data generation device for the communication tunnel provided in this application embodiment can determine the initial configuration item through the determining unit 40, expand the initial configuration item based on the target policy dependency graph through the expansion unit 41 to obtain multiple target expanded configuration items and at least one target expanded configuration item value corresponding to each target expanded configuration item, and generate at least one combined test data for the communication tunnel through the generating unit 42 based on the initial configuration item, all target expanded configuration items and all target expanded configuration item values.

[0080] Optionally, the test data generation device for the communication tunnel includes: a first determining module, used to determine multiple configuration items of the communication tunnel before determining the initial configuration items, and to determine the constraint relationship between the configuration items, wherein each configuration item corresponds to at least one configuration item value; a first characterization module, used to characterize the configuration items as nodes and the constraint relationship as edges; and a first construction module, used to construct a target policy dependency graph based on all nodes, all configuration item values, and all edges.

[0081] Optionally, the configuration items in the target policy dependency graph include at least: certificate, multiple preset parameters, local subnet, peer subnet, active end role, passive end role, tunnel mode, encryption algorithm, and authentication algorithm; the constraint relationships include at least: dependency relationship, matching relationship, mutual exclusion relationship, mapping relationship, cooperative relationship, and combined constraint.

[0082] Optionally, the extension unit 41 includes: a first traversal module, used to traverse the configuration items in the target strategy dependency graph based on the initial configuration item to obtain extended configuration items that have a dependency relationship with the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value; a first verification module, used to traverse all extended configuration item values ​​for each extended configuration item and verify the extended configuration item and the current extended configuration item value to obtain multiple verification results, wherein the verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, collaborative verification, and combined constraint verification; and a second determination module, used to determine the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item based on all verification results under each extended configuration item.

[0083] Optionally, the second determining module includes: a first execution submodule, configured to perform a pruning operation on the current extended configuration item value under each extended configuration item if any verification result indicates a verification failure, wherein the pruning operation is used to filter the extended configuration item value; a first determining submodule, configured to determine the extended configuration item as a candidate extended configuration item and the current extended configuration item value as a candidate extended configuration item value if all verification results indicate a verification success; a first traversal submodule, configured to use the candidate extended configuration items and their values ​​as new initial configuration items, and continue traversing the configuration items in the target policy dependency graph to obtain the candidate extended configuration items and their values ​​for the next round of traversal, until no new extended configuration item with a dependency relationship with the new initial configuration item exists when traversing the configuration items in the target policy dependency graph; and a second determining submodule, configured to determine each candidate extended configuration item as a target extended configuration item and each candidate extended configuration item value as a target extended configuration item value, wherein there is a correspondence between the target extended configuration item and the target extended configuration item value.

[0084] Optionally, the test data generation device for the communication tunnel further includes: a first sorting module, used to sort all the combined test data according to a preset priority after generating at least one combined test data for the communication tunnel based on the initial configuration items, all target extended configuration items, and the values ​​of all target extended configuration items; and a first calling module, used to call a test execution script to perform the communication tunnel test based on the sorting, and obtain the test execution result of each combined test data.

[0085] Optionally, the test data generation device for the communication tunnel further includes: a third determining module, used to determine an adjustment strategy for the combined test data based on the test execution results after executing the communication tunnel test by calling the test execution script based on the sorting and obtaining the test execution results for each combined test data, wherein the adjustment strategy includes at least: adjusting the preset priority of the combined test data and deleting the combined test data; and a first adjusting module, used to adjust the combined test data based on the adjustment strategy.

[0086] The aforementioned test data generation device for the communication tunnel may also include a processor and a memory. The aforementioned determining unit 40, expanding unit 41, generating unit 42, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0087] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, at least one combination of test data for the communication tunnel can be generated based on the initial configuration item, all target extended configuration items, and the values ​​of all target extended configuration items.

[0088] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0089] It should be noted that the aforementioned determining unit 40, expanding unit 41, and generating unit 42 correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by these units and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these units can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0090] Example 3

[0091] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0092] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0093] In this embodiment, the computer terminal described above can execute the program code for the following steps in the method for generating test data for a communication tunnel: determining an initial configuration item; expanding the initial configuration item based on a target policy dependency graph to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item, wherein the target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships; and generating at least one combined test data for the communication tunnel based on the initial configuration item, all target extended configuration items, and all target extended configuration item values.

[0094] Optionally, the computer terminal described above can execute program code for the following steps in the method for generating test data for a communication tunnel: determining multiple configuration items for the communication tunnel and determining the constraint relationships between the configuration items, wherein each configuration item corresponds to at least one configuration item value; representing the configuration items as nodes and the constraint relationships as edges; and constructing a target policy dependency graph based on all nodes, all configuration item values, and all edges.

[0095] Optionally, the computer terminal described above can execute program code for the following steps in the method for generating test data for a communication tunnel: the configuration items in the target policy dependency graph include at least: certificate, multiple preset parameters, local subnet, peer subnet, active end role, passive end role, tunnel mode, encryption algorithm, and authentication algorithm; the constraint relationships include at least: dependency relationship, matching relationship, mutual exclusion relationship, mapping relationship, cooperative relationship, and combined constraint.

[0096] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the method for generating test data for a communication tunnel: based on the initial configuration item, traverse the configuration items in the target policy dependency graph to obtain extended configuration items that have a dependency relationship with the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value; for each extended configuration item, traverse all extended configuration item values ​​and verify the extended configuration item and the current extended configuration item value to obtain multiple verification results, wherein the verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, cooperative verification, and combined constraint verification; based on all verification results under each extended configuration item, determine the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item.

[0097] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the method for generating test data for a communication tunnel: For the current extended configuration item value under each extended configuration item, if any verification result indicates a verification failure, a pruning operation is performed, wherein the pruning operation is used to filter the extended configuration item value; if all verification results indicate a verification success, the extended configuration item is determined as a candidate extended configuration item, and the current extended configuration item value is determined as a candidate extended configuration item value; the candidate extended configuration item and the candidate extended configuration item value are used as new initial configuration items, and the configuration items in the target policy dependency graph are traversed again to obtain the candidate extended configuration item and the candidate extended configuration item value for the next round of traversal, until no new extended configuration item with a dependency relationship with the new initial configuration item is found when traversing the configuration items in the target policy dependency graph; each candidate extended configuration item is determined as a target extended configuration item, and each candidate extended configuration item value is determined as a target extended configuration item value, wherein there is a correspondence between the target extended configuration item and the target extended configuration item value.

[0098] Optionally, the computer terminal described above can execute the program code for the following steps in the method for generating test data for a communication tunnel: sorting all combined test data according to a preset priority; based on the sorting, calling the test execution script to perform the communication tunnel test, and obtaining the test execution result for each combined test data.

[0099] Optionally, the aforementioned computer terminal may execute program code for the following steps in the method for generating test data for a communication tunnel: determining an adjustment strategy for the combined test data based on the test execution results, wherein the adjustment strategy includes at least: adjusting the preset priority of the combined test data and deleting the combined test data; and adjusting the combined test data based on the adjustment strategy.

[0100] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0101] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the communication tunnel test data generation method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned communication tunnel test data generation method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0102] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the method for generating test data for the communication tunnel.

[0103] This application provides a scheme for generating test data for communication tunnels. By constructing a policy dependency graph, it achieves accurate modeling of the semantics of IPSec tunnel configuration. Based on this, starting from the initial configuration item, it traverses and expands the configuration items layer by layer. By performing six types of checks in real time and combining them with pruning operations, it dynamically generates conflict-free and protocol-compliant combined test data. Subsequently, the combined test data is sorted, with high-priority combined test data being executed first. The priority is automatically adjusted or invalid combined test data is deleted based on the execution results, forming a feedback loop. This achieves intelligent generation, accurate scheduling, and continuous optimization of IPSec tunnel test scenarios, improving test coverage and reducing the proportion of invalid executions. This solves the technical problem in related technologies that it is difficult to cover combinations of different test data, resulting in the risk of missed tests.

[0104] Those skilled in the art will understand that Figure 5The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0105] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0106] Example 4

[0107] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the communication tunnel test data generation method provided in Embodiment 1.

[0108] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0109] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing the steps of a method for generating test data for a communication tunnel.

[0110] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0115] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0116] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating test data for a communication tunnel, characterized in that, include: Determine the initial configuration items; Based on the target policy dependency graph, the initial configuration item is expanded to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item. The target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships. Based on the initial configuration item, all the target extended configuration items, and the values ​​of all the target extended configuration items, at least one combination of test data for the communication tunnel is generated.

2. The method for generating test data for a communication tunnel according to claim 1, characterized in that, Before determining the initial configuration items, the following are included: Determine multiple configuration items of the communication tunnel and determine the constraint relationships between the configuration items, wherein each configuration item corresponds to at least one configuration item value; The configuration items are represented as nodes, and the constraint relationships are represented as edges; The target policy dependency graph is constructed based on all the nodes, all the configuration item values, and all the edges.

3. The method for generating test data for a communication tunnel according to claim 1, characterized in that, The configuration items in the target policy dependency graph include at least: certificate, multiple preset parameters, local subnet, peer subnet, active terminal role, passive terminal role, tunnel mode, encryption algorithm, and authentication algorithm; the constraint relationships include at least: dependency relationship, matching relationship, mutual exclusion relationship, mapping relationship, cooperative relationship, and combined constraint.

4. The method for generating test data for a communication tunnel according to claim 1, characterized in that, Based on the target policy dependency graph, the initial configuration item is expanded to obtain multiple target expanded configuration items and at least one target expanded configuration item value corresponding to each target expanded configuration item, including: Based on the initial configuration item, the configuration items in the target policy dependency graph are traversed to obtain extended configuration items that have a dependency relationship with the initial configuration item, wherein each extended configuration item corresponds to at least one extended configuration item value. For each of the extended configuration items, all extended configuration item values ​​are traversed, and the extended configuration item and the current extended configuration item value are verified to obtain multiple verification results. The verification includes at least: dependency verification, matching verification, mutual exclusion verification, mapping verification, collaborative verification, and combined constraint verification. Based on all the verification results under each of the extended configuration items, the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item are determined.

5. The method for generating test data for a communication tunnel according to claim 4, characterized in that, The step of determining the target extended configuration item and at least one target extended configuration item value corresponding to the target extended configuration item based on all the verification results under each of the extended configuration items includes: For each of the extended configuration items, if any verification result indicates a verification failure, a pruning operation is performed, wherein the pruning operation is used to filter the extended configuration item values. If all the verification results indicate that the verification was successful, the extended configuration item is determined as a candidate extended configuration item, and the current extended configuration item value is determined as the candidate extended configuration item value; The candidate extended configuration item and its value are used as the new initial configuration item. The configuration items in the target policy dependency graph are traversed again to obtain the candidate extended configuration item and its value for the next round of traversal, until there is no new extended configuration item that is dependent on the new initial configuration item when traversing the configuration items in the target policy dependency graph. Each candidate extended configuration item is determined as the target extended configuration item, and the value of each candidate extended configuration item is determined as the value of the target extended configuration item, wherein there is a correspondence between the target extended configuration item and the value of the target extended configuration item.

6. The method for generating test data for a communication tunnel according to claim 1, characterized in that, After generating at least one set of combined test data for the communication tunnel based on the initial configuration item, all the target extended configuration items, and the values ​​of all the target extended configuration items, the process includes: Sort all the combined test data according to a preset priority; Based on the sorting, the test execution script is invoked to perform the communication tunnel test, and the test execution result of each combination of test data is obtained.

7. The method for generating test data for a communication tunnel according to claim 6, characterized in that, After executing the communication tunnel test by calling the test execution script based on the sorting, and obtaining the test execution result for each combination of test data, the process includes: Based on the test execution results, an adjustment strategy for the combined test data is determined, wherein the adjustment strategy includes at least: adjusting the preset priority of the combined test data and deleting the combined test data; The combined test data are adjusted based on the aforementioned adjustment strategy.

8. A test data generation device for a communication tunnel, characterized in that, include: The determination unit is used to determine the initial configuration items; An extension unit is used to extend the initial configuration item based on the target policy dependency graph to obtain multiple target extended configuration items and at least one target extended configuration item value corresponding to each target extended configuration item, wherein the target policy dependency graph is constructed through multiple configuration items and multiple constraint relationships; The generation unit is used to generate at least one combination of test data for the communication tunnel based on the initial configuration item, all the target extended configuration items, and the values ​​of all the target extended configuration items.

9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the test data generation method for the communication tunnel as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the test data generation method for the communication tunnel as described in any one of claims 1 to 7.

Images