Access control list and coloring list consistency verification method, device and equipment

Abstract

This specification relates to data center configuration verification technology in the financial field or other fields, and provides a method, device and equipment for consistency verification of access control lists and coloring lists, the method comprising: collecting configuration status indicators of each IT device in the network topology to form an indicator database; selecting a target device pair from the network topology; determining a verification scenario for the target device pair; when the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario, obtaining the access control list and coloring list of the target device pair from the indicator database; and performing consistency verification on the access control list and coloring list of the target device pair respectively. The embodiments of this specification can reduce the cost of automatic consistency verification of access control lists and coloring lists.

Description

Technical Field

[0001] The present specification relates to data center configuration verification technology in the financial field or other fields, and in particular to a method, device and equipment for verifying the consistency of access control lists and coloring lists. Background Art

[0002] In order to ensure the synchronization (i.e. consistency) of the access control lists and coloring lists in the daily network management of the data center, it is necessary to regularly compare and verify the access control lists and coloring lists of the existing IT equipment, so that necessary corrective measures can be taken in advance for potential risks based on the verification results. In traditional technology, the verification of the access control lists and coloring lists of IT equipment in the data center is generally done manually. Due to the large number of existing network devices in the data center, the workload of manual verification is extremely heavy and the efficiency is low.

[0003] At present, there are some automatic consistency verification schemes for access control lists and coloring lists based on IT equipment; however, under this scheme, it is necessary to collect configuration status information from the corresponding device before each verification to form an access control list and a coloring list, and then perform automatic verification; in this way, the problem of repeated collection of configuration status information may occur, thereby wasting system resources and increasing the cost of automatic consistency verification of access control lists and coloring lists. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a method, device and equipment for checking the consistency of an access control list and a coloring list, so as to reduce the cost of automatic checking the consistency of the access control list and the coloring list.

[0005] To achieve the above objectives, on the one hand, an embodiment of the present specification provides a method for checking consistency between an access control list and a coloring list, including:

[0006] Collect the configuration status indicators of each IT device in the network topology to form an indicator database;

[0007] selecting a target device pair from the network topology;

[0008] Determining a verification scenario for the target device pair;

[0009] When the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario, obtaining an access control list and a coloring list of the target device pair from the indicator database;

[0010] A consistency check is performed on the access control list and the coloring list of the target device pair respectively.

[0011] In the embodiment of this specification, the verification scenario of determining the target device pair includes:

[0012] According to the target device pair, the verification scenario of the target device pair is matched from a device pair and verification scenario correspondence table.

[0013] In the embodiment of this specification, the target device pair includes a first device and a second device; and obtaining an access control list and a coloring list of the target device pair from the indicator database includes:

[0014] Sending an indicator data request to the indicator database; the data request includes an identifier of the first device, an identifier of the second device, and a verification scenario;

[0015] An indicator data response returned by the indicator database is received; the indicator data response includes an access control list and a coloring list of the first device, and an access control list and a coloring list of the second device.

[0016] In the embodiment of the present specification, the access control list and the coloring list are generated by the indicator database according to the indicator data request, by retrieving the corresponding configuration status indicator combination from itself.

[0017] In the embodiment of this specification, the consistency check of the access control list and the coloring list of the target device pair respectively includes:

[0018] Performing a consistency check on the access control list of the first device and the access control list of the second device; and

[0019] A consistency check is performed between the coloring list of the first device and the coloring list of the second device.

[0020] In the embodiment of this specification, the target device pair includes an uplink device and a corresponding downlink device.

[0021] In the embodiment of this specification, the target device pair includes a primary device and a corresponding backup device.

[0022] On the other hand, the embodiment of this specification also provides an access control list and coloring list consistency verification device, including:

[0023] The collection module is used to collect the configuration status indicators of each IT device in the network topology to form an indicator database;

[0024] A selection module, configured to select a target device pair from the network topology;

[0025] A determination module, used to determine a verification scenario for the target device pair;

[0026] An acquisition module, used for acquiring an access control list and a coloring list of the target device pair from the indicator database when the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario;

[0027] The verification module is used to perform consistency verification on the access control list and the coloring list of the target device pair respectively.

[0028] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is executed by the processor, the instructions of the above method are executed.

[0029] On the other hand, an embodiment of the present specification further provides a computer storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer device, the instructions of the above method are executed.

[0030] It can be seen from the technical solutions provided in the above embodiments of this specification that in the embodiments of this specification, the configuration status indicators of each IT device in the network topology can be first collected to form an indicator database; when the target device pair needs to be verified, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the target device pair, and verified. Similarly, when the next target device pair is required, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the next target device pair, and verified. In this way, the verification process of the entire network topology can reuse the configuration status indicators in the indicator database without repeatedly collecting from the IT devices in the network topology, thereby avoiding the waste of resources caused by repeated collection, reducing the cost of automatic verification of the consistency of the access control list and the coloring list, and the verification efficiency is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0032] Figure 1 A schematic diagram of a data center in some embodiments of this specification is shown;

[0033] Figure 2 A schematic diagram of the network topology of a data center in an embodiment of this specification is shown;

[0034] Figure 3A flowchart of a method for checking consistency of access control lists and coloring lists in some embodiments of this specification is shown;

[0035] Figure 4 A schematic diagram showing a customized verification scenario in some embodiments of this specification is shown;

[0036] Figure 5 A schematic diagram of a network topology of a data center in another embodiment of the present specification is shown;

[0037] Figure 6 A structural block diagram of a device for checking consistency of access control lists and coloring lists in some embodiments of this specification is shown;

[0038] Figure 7 The structure block diagram of the computer device in some embodiments of the present specification is shown.

[0039] [Description of Reference Numerals]

[0040] 10. Domestic data center;

[0041] 20. Overseas data centers;

[0042] 11. Router;

[0043] 12. Firewall;

[0044] 13. Core switch;

[0045] 14. Server;

[0046] 15. Storage array;

[0047] 16. Access layer switch;

[0048] 17. User terminal.

[0049] 51a, first master device;

[0050] 51b, first slave device;

[0051] 52a, second master device;

[0052] 52b, second slave device;

[0053] 61. Collection module;

[0054] 62. Select module;

[0055] 63. Determine the module;

[0056] 64. Get module;

[0057] 65. Verification module;

[0058] 702. Computer equipment;

[0059] 704, processor;

[0060] 706. Memory;

[0061] 708, driving mechanism;

[0062] 710, input / output interface;

[0063] 712. Input devices;

[0064] 714. Output devices;

[0065] 716. Presentation equipment;

[0066] 718. Graphical user interface;

[0067] 720, network interface;

[0068] 722. Communication link;

[0069] 724. Communication bus. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0071] The Access Control List (ACL) in this manual is a configuration information table containing data packet filtering rules. It is an access control technology based on packet filtering. It can filter data packets on the interface according to the set conditions, allowing them to pass or discard them. Access control lists are widely used in routers and layer 3 switches. With the help of access control lists, users' access to the network can be effectively controlled, thereby ensuring network security to the greatest extent.

[0072] The coloring in this specification may refer to traffic coloring. Traffic coloring refers to setting the traffic coloring rules for the corresponding data packets according to the traffic protocol, marking the traffic of the specified data packets with colors, and carrying the mark in the entire call chain. Traffic coloring can be used to track, route and control specific traffic, thereby achieving management such as traffic control. Therefore, the traffic coloring list in this specification refers to a configuration information table containing data packet traffic coloring rules.

[0073] In order to reduce the cost of automatic consistency verification of access control lists and color lists, this specification provides a method for consistency verification of access control lists and color lists in a data center, which can be applied to any suitable computer device. Figure 3 As shown, in some embodiments, the access control list and coloring list consistency verification method may include the following steps:

[0074] S301. Collect configuration status indicators of each IT device in the network topology to form an indicator database.

[0075] S302: Select a target device pair from the network topology.

[0076] S303: Determine a verification scenario for the target device pair.

[0077] S304: When the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario, obtaining an access control list and a coloring list of the target device pair from the indicator database.

[0078] S305: Perform consistency check on the access control list and the coloring list of the target device pair respectively.

[0079] In the embodiments of the present specification, the configuration status indicators of each IT device in the network topology can be first collected to form an indicator database; when the target device pair needs to be verified, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the target device pair, and verified. Similarly, when the next target device pair is required, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the next target device pair, and verified. In this way, the verification process of the entire network topology can reuse the configuration status indicators in the indicator database without repeatedly collecting from the IT devices in the network topology, thereby avoiding the waste of resources caused by repeated collection, reducing the cost of automatic verification of the consistency of the access control list and the coloring list, and the verification efficiency is higher.

[0080] The network topology in step S301 may be a data center network topology. A data center is a globally collaborative network of specific devices used to transmit, accelerate, display, calculate, and store data information on an Internet infrastructure. Figure 1As shown, in some embodiments, the data center may include a domestic data center 10 and an overseas data center 20. The domestic data center 10 may include one or more sub-data centers, and each sub-data center may be further divided. For example, in some embodiments, each sub-data center may be a regional data center, and each regional data center may be divided into one or more branch data centers. The overseas data center 20 may be one or more (e.g. Figure 1 The domestic data center 10 and the foreign data center 20 can communicate with each other, the foreign data centers 20 can communicate with each other, and the sub-data centers within the domestic data center 10 can communicate with each other.

[0081] Obviously, even if Figure 1 For the data centers shown in FIG. 1 , any one of the data centers may include multiple IT devices, and these IT devices are associated to form the network topology of the data center. Therefore, the network topology of the entire data center is generally more complex. For ease of understanding and description, in some embodiments, the data center can be simplified to only include a domestic data center, and the domestic data center is not further classified. For example, Figure 2 In the illustrated embodiment, the data center may include IT devices such as a router 11, a firewall 12, a core switch 13, a server 14, a storage array 15, an access layer switch 16, and a user terminal 17, and these IT devices may communicate with each other. For example, the user terminal 17 may access the server 14 via the access layer switch 16 and the core switch 13. For another example, based on a query request from outside the data center, the server 14 may read relevant data from the storage array 15 to generate a query response, and return the query response via the core switch 13, the firewall 12, and the router 11.

[0082] Those skilled in the art will appreciate that the above-mentioned data center is merely an example, and in other embodiments of this specification, the data center may also be any other suitable structure, which is not limited in this specification.

[0083] In the embodiments of this specification, the configuration status indicators of each IT device in the network topology are collected to form an indicator database. The indicator database can provide a data basis for subsequent customized verification scenarios on demand, and since the configuration status indicators of each IT device in the network topology are collected, any IT device in the network topology, no matter how many times it needs to be verified, can obtain the configuration status indicator of the IT device from the indicator database, thereby realizing data reuse without having to collect data from the IT device every time it is verified, thereby avoiding repeated collection of configuration status indicator data.

[0084] The configuration status indicator of IT equipment refers to: the configuration information of IT equipment configuration related to access control and service quality control (such as flow control). Among them, the access control configuration information may include the filtering policy of data packets (such as which data packets can be received and which data packets need to be rejected. As for whether the data packet is received or rejected, it can be determined by specific indication conditions such as source address, destination address, port number, etc.). The service quality control configuration information may include flow rate limit, which key queues' packets should be given priority in the case of port blocking, etc.

[0085] In some embodiments, the target device pair may be an uplink device and a corresponding downlink device (ie, an uplink device and a corresponding downlink device in a specified communication direction). Figure 2 In the embodiment shown, the core switch 13 forwards an access request to the server 14; in this access request transmission and reception communication, the core switch 13 is an upstream device and the server 14 is a downstream device. When the server 14 generates an access response according to the access request, the access response can be returned to the core switch 13 for the core switch 13 to forward; in this access response transmission and reception communication, the server 14 is an upstream device and the core switch 13 is a downstream device.

[0086] To improve the stability and robustness of the data center, some IT equipment in the data center may adopt a master-slave redundant design. In this case, a consistency check is also required between the master device and the backup device. In other embodiments, the target device pair may also be a master device and a corresponding backup device.

[0087] It should be noted that in the embodiments of this specification, based on the indicator database, users can customize any suitable verification scenario, not limited to the access control configuration verification scenario and the coloring configuration verification scenario. Taking the access control configuration verification scenario as an example, since the network topology generally includes multiple IT devices, the access control configuration verification scenario will involve the verification of multiple device pairs. Therefore, for the entire access control configuration verification scenario, the access control configuration scenario of any device pair can be called a verification sub-scenario of the access control configuration verification scenario (for example, Figure 4 Similarly, for the entire coloring configuration verification scenario, the coloring configuration verification scenario of any device pair can also be called a verification sub-scenario of the coloring configuration verification scenario (for example, Figure 4 shown).

[0088] For example, in an exemplary embodiment, the sub-scenario is to check the compliance of the fiber switch plug-in dual-path. The indicators that need to be collected for several specific fiber switch hardware in the network topology may include: World Wide Name (WWN), host name, port id (port_id), virtual storage area network (Virtual Storage Area Network, VSAN), zone set name (zoneset_name), running status (running_status), etc.

[0089] According to the needs, users can customize which verification scenarios are required for the network topology. Specifically, a table of device pairs and verification scenarios can be pre-configured, which records all the device pairs that need to be verified in the network topology and the required verification scenarios. Figure 5 Taking the network topology shown in FIG. 1 as an example, access control configuration verification and dye configuration verification are required between the first master device 51a and the second master device 52a, between the first master device 51a and the first slave device 51b, and between the second master device 52a and the second slave device 52b. If the device IDs of the first master device 51a, the first slave device 51b, the second master device 52a and the second slave device 52 are 001, 002, 003 and 004 respectively, the corresponding relationship table between the device pairs and the verification scenarios shown in Table 1 below can be pre-configured. Among them, the symbol Y in Table 1 indicates that the device pair needs to be verified. When verification is not required, it can be represented by the symbol N.

[0090] Table 1

[0091] Device Pair ID Access control configuration verification Staining configuration verification Other checks 001 / 003 Y Y N 001 / 002 Y Y N 003 / 004 Y Y N

[0092] Therefore, determining the verification scenario of the target device pair may include: matching the verification scenario of the target device pair from a device pair and verification scenario correspondence table according to the target device pair. Figure 5 Taking the network topology shown as an example, when the target device pair is 001 / 003, it can be learned by querying Table 1 that the verification scenarios of 001 / 003 include the access control configuration verification scenario and the dye configuration verification scenario.

[0093] In some embodiments, different verification scenarios generally require different verification rules; for the same verification scenario, the verification rules can be the same or different. In order to improve the verification efficiency, the corresponding verification rules can also be configured in the device pair and verification scenario correspondence table. In this way, during subsequent verification, the verification rules of any device pair in the verification scenario can be obtained by querying the device pair and verification scenario correspondence table. Figure 5Taking the network topology shown in FIG. 1 as an example, the correspondence table between the device pairs and the verification scenarios containing the verification rules can be shown in Table 2 below.

[0094] Table 2

[0095]

[0096]

[0097] In some embodiments, taking the target device pair as a first device and a second device as an example; the acquiring the access control list and the coloring list of the target device pair from the indicator database may include the following steps:

[0098] (1) Sending an indicator data request to the indicator database; the data request includes an identifier of the first device, an identifier of the second device, and a verification scenario.

[0099] In the embodiment of the present specification, the indicator database can retrieve the corresponding configuration status indicator from itself according to the indicator data request, and combine it into a corresponding data table according to the verification scenario.

[0100] For example, Figure 5 Taking the network topology shown as an example, when the target device pair is 001 / 003, and the verification scenarios are the access control configuration verification scenario and the dyeing configuration verification scenario, the indicator database can retrieve from itself: the configuration status indicators of 001 corresponding to the access control configuration verification scenario; the configuration status indicators of 002 corresponding to the access control configuration verification scenario; the configuration status indicators of 001 corresponding to the dyeing configuration verification scenario; and the configuration status indicators of 002 corresponding to the dyeing configuration verification scenario.

[0101] On this basis, the indicator database can combine the configuration status indicators of 001 corresponding to the access control configuration verification scenario into the first access control list of 001; combine the configuration status indicators of 002 corresponding to the access control configuration verification scenario into the second access control list of 002; combine the configuration status indicators of 001 corresponding to the dyeing configuration verification scenario into the first dyeing list of 001; and combine the configuration status indicators of 002 corresponding to the dyeing configuration verification scenario into the second dyeing list of 002.

[0102] Then, the indicator database generates an indicator data response based on the first access control list, the second access control list, the first coloring list and the second coloring list, and returns it.

[0103] (2) Receive an indicator data response returned by the indicator database; the indicator data response includes an access control list and a coloring list of the first device, and an access control list and a coloring list of the second device.

[0104] In some embodiments, taking the target device pair as a first device and a second device as an example, the consistency check of the access control list and the coloring list of the target device pair respectively may include: performing a consistency check on the access control list of the first device with the access control list of the second device; and performing a consistency check on the coloring list of the first device with the coloring list of the second device.

[0105] In this specification, consistency check refers to checking whether specific configurations of corresponding check objects are identical or corresponding.

[0106] For example, in an exemplary embodiment, the target device pair is end A (a core switch) and end B (device). The rules set up by end A and the configuration rules set up by end B must be consistent. Among them, a configuration of end A is as follows:

[0107] acl name Interactive

[0108] rule permit ip source 76.111.246.1 0

[0109] The configuration information means: allow any IP address to 76.111.246.1 to enter the Interactive queue where the configuration is located. The corresponding B end is found by the verification logic below, and a policy that can correspond to this policy is found in the Interactive queue of the B end.

[0110] Verification logic includes: Since end A is a core switch, the IP range it covers can be queried from the configuration on the switch, and the access control policy of end A is that any source IP to 76.111.246.1 is in the Intractive queue; in contrast, as long as the access control policy of end B includes "to 76.111.246.1" in the Intractive queue, it can be considered that the access control policy of end B is consistent with the access control policy of end A. However, if the access policy of end A controls the source, so that 1.1.1.0 / 24 to 76.1111.246.1 is in the Intractive queue, then the access control policy of end B needs to include control of its own source and destination (for example, in the access control policy of end B, the source IP needs to include the destination of end A); if the access control policy of end B does not control its own source and destination, it can be considered that the access control policy of end B is inconsistent with the access control policy of end A.

[0111] Although the process flows described above include multiple operations that occur in a particular order, it should be clearly understood that the processes may include more or fewer operations, which may be performed sequentially or in parallel (eg, using parallel processors or a multi-threaded environment).

[0112] Corresponding to the above method, this specification also provides an embodiment of an access control list and coloring list consistency verification device. The access control list and coloring list consistency verification device can be configured on any suitable computing device to implement access control list and coloring list consistency verification in a data center. Figure 6 As shown, in some embodiments, the access control list and coloring list consistency verification device may include:

[0113] The collection module 61 may be used to collect configuration status indicators of each IT device in the network topology to form an indicator database;

[0114] A selection module 62 may be used to select a target device pair from the network topology;

[0115] A determination module 63 may be used to determine a verification scenario for the target device pair;

[0116] The acquisition module 64 may be used to acquire the access control list and the coloring list of the target device pair from the indicator database when the verification scenario includes the access control configuration verification scenario and the coloring configuration verification scenario;

[0117] The verification module 65 may be used to perform consistency verification on the access control list and the coloring list of the target device pair respectively.

[0118] In the embodiments of the present specification, the access control list and coloring list consistency verification device can collect configuration status indicators of each IT device in the network topology to form an indicator database; when the target device pair needs to be verified, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the target device pair; and verified. Similarly, when the next target device pair is required, the access control list and coloring list of the target device pair can be obtained from the indicator database according to the verification scenario of the next target device pair, and verified. In this way, the verification process of the entire network topology can reuse the configuration status indicators in the indicator database without repeatedly collecting from the IT devices of the network topology, thereby avoiding the waste of resources caused by repeated collection, reducing the cost of automatic consistency verification of access control lists and coloring lists, and the verification efficiency is higher.

[0119] In some apparatus embodiments, determining the verification scenario of the target device pair may include:

[0120] According to the target device pair, the verification scenario of the target device pair is matched from a device pair and verification scenario correspondence table.

[0121] In some apparatus embodiments, the target device pair includes a first device and a second device; and obtaining an access control list and a coloring list of the target device pair from the indicator database may include:

[0122] Sending an indicator data request to the indicator database; the data request includes an identifier of the first device, an identifier of the second device, and a verification scenario;

[0123] An indicator data response returned by the indicator database is received; the indicator data response includes an access control list and a coloring list of the first device, and an access control list and a coloring list of the second device.

[0124] In some device embodiments, the access control list and the coloring list are generated by the indicator database according to the indicator data request, by retrieving corresponding configuration status indicator combinations from itself.

[0125] In some apparatus embodiments, performing consistency check on the access control list and the coloring list of the target device pair respectively may include:

[0126] Performing a consistency check on the access control list of the first device and the access control list of the second device; and

[0127] A consistency check is performed between the coloring list of the first device and the coloring list of the second device.

[0128] In some apparatus embodiments, the target device pair includes an uplink device and a corresponding downlink device.

[0129] In some apparatus embodiments, the target device pair includes a primary device and a corresponding backup device.

[0130] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0131] This specification also provides a computer device embodiment. Figure 7As shown, in some embodiments, the computer device 702 may include one or more processors 704, such as one or more central processing units (CPUs) or graphics processing units (GPUs), and each processing unit may implement one or more hardware threads. The computer device 702 may also include any memory 706, which is used to store any kind of information such as code, settings, data, etc. In a specific embodiment, the computer program on the memory 706 and can be run on the processor 704, when the computer program is run by the processor 704, can execute the instructions of the access control list and coloring list consistency verification method described in any of the above embodiments. Non-limiting, for example, the memory 706 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 702. In one case, when the processor 704 executes an associated instruction stored in any memory or a combination of memories, the computer device 702 can perform any operation of the associated instruction. The computer device 702 also includes one or more drive mechanisms 708 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0132] The computer device 702 may also include an input / output interface 710 (I / O) for receiving various inputs (via input device 712) and for providing various outputs (via output device 714). A specific output mechanism may include a presentation device 716 and an associated graphical user interface 718 (GUI). In other embodiments, the input / output interface 710 (I / O), input device 712, and output device 714 may not be included, and the computer device 702 may be used as a computer device in a network. The computer device 702 may also include one or more network interfaces 720 for exchanging data with other devices via one or more communication links 722. One or more communication buses 724 couple the components described above together.

[0133] The communication link 722 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 722 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0134] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of some embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processor to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processor generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0135] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processor to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0136] These computer program instructions can also be loaded onto a computer or other programmable data processor so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0137] In a typical configuration, a computer device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0138] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0139] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computer device. As defined in this specification, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0140] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0141] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processors connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0142] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0143] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0144] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for checking consistency of an access control list and a coloring list, characterized in that: include: Collect the configuration status indicators of each IT device in the network topology to form an indicator database; The configuration status indicators include: configuration information of access control and service quality control of IT equipment configuration; Selecting a target device pair from the network topology; the target device pair includes an uplink device and a corresponding downlink device in a specified communication direction; Determining a verification scenario for the target device pair; When the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario, obtaining an access control list and a coloring list of the target device pair from the indicator database; A consistency check is performed on the access control list and the coloring list of the target device pair respectively.

2. The access control list and coloring list consistency verification method according to claim 1, characterized in that: The determining of the verification scenario of the target device pair includes: According to the target device pair, the verification scenario of the target device pair is matched from a device pair and verification scenario correspondence table.

3. The access control list and coloring list consistency verification method according to claim 1, characterized in that: The target device pair includes a first device and a second device; and obtaining an access control list and a coloring list of the target device pair from the indicator database includes: Sending an indicator data request to the indicator database; the data request includes an identifier of the first device, an identifier of the second device, and a verification scenario; An indicator data response returned by the indicator database is received; the indicator data response includes an access control list and a coloring list of the first device, and an access control list and a coloring list of the second device.

4. The access control list and coloring list consistency verification method according to claim 3, characterized in that: The access control list and the coloring list are generated by the indicator database according to the indicator data request by retrieving the corresponding configuration status indicator combination from itself.

5. The access control list and coloring list consistency verification method according to claim 3, characterized in that: The performing consistency check on the access control list and the coloring list of the target device pair respectively includes: Performing a consistency check on the access control list of the first device and the access control list of the second device; and A consistency check is performed between the coloring list of the first device and the coloring list of the second device.

6. A device for checking consistency of access control lists and coloring lists, characterized in that: include: The collection module is used to collect the configuration status indicators of each IT device in the network topology to form an indicator database; The configuration status indicators include: configuration information of access control and service quality control of IT equipment configuration; A selection module, configured to select a target device pair from the network topology; the target device pair comprises an uplink device and a corresponding downlink device in a specified communication direction; A determination module, used to determine a verification scenario for the target device pair; An acquisition module, used for acquiring an access control list and a coloring list of the target device pair from the indicator database when the verification scenario includes an access control configuration verification scenario and a coloring configuration verification scenario; The verification module is used to perform consistency verification on the access control list and the coloring list of the target device pair respectively.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the computer program is executed by the processor, the computer program executes the instructions of the method according to any one of claims 1 to 5.

8. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of a computer device, the computer program executes the instructions of the method according to any one of claims 1 to 5.

Images