A network policy verification system and method

Abstract

The present invention provides a network policy verification system and method, wherein the system includes an input end, a network policy verification unit and an output end; the input end is used to input network topology, network policy and constraints to be verified; the network policy verification unit is used to receive the network topology, network policy and constraints to be verified, and output network verification results based on the configuration files of the acquired network devices; the output end is used to output constraint satisfaction information, error location information and error repair suggestions. The embodiment of the present invention introduces modular programming into network verification, which can reduce the complexity of the design of network policy verification tools, facilitate the division of workload to achieve agile development, and simplify the debugging, maintenance and problem location of network policy verification tools.

Description

Technical Field

[0001] The present invention relates to the technical field of network policy verification, and in particular to a network policy verification system and method. Background Art

[0002] Traditional network policy verification technology models and designs a certain network, reads the configuration of routers and switches from a specific manufacturer, analyzes network policies based on a specific verification algorithm, such as the algorithm or theorem proof, and traverses the state space of network behavior. Limited by the specific constraints of policy verification technology in many aspects, network operation and maintenance personnel are usually unable to directly apply the original policy verification tools to the network they operate. In addition, faced with a variety of complex network verification tools, operation and maintenance personnel have no idea where to start to analyze and select the appropriate solution.

[0003] Traditional network policy verification tools are limited by programming models and cannot cover various network devices and network constraints. They have the following defects:

[0004] (1) The functional definition is not clear, and it is difficult to select a network policy verification tool with sufficient functions and good performance for a specific network and specific problem.

[0005] (2) The input format is not unified. When using different network policy verification tools to verify the same network, the input format needs to be adapted for each verification tool, which greatly increases the workload of network administrators.

[0006] (3) The code reuse rate is low and repeated development is common. Since the module division of existing network policy verification tools is unclear, developers often choose to redevelop irrelevant modules such as network policy parsing modules when designing new network verification algorithms, which results in a waste of manpower and slows down the speed of technology iteration. Summary of the invention

[0007] The embodiments of the present invention provide a network policy verification system and method, which are used to solve some or all of the above problems existing in the current network policy verification.

[0008] In a first aspect, an embodiment of the present invention provides a network policy verification system, including an input end, a network policy verification unit and an output end;

[0009] The input end is used to input the network topology, network strategy and constraints to be verified;

[0010] The network policy verification unit is used to receive the network topology, network policy and constraints to be verified, and output a network verification result based on the configuration file of the acquired network device;

[0011] The output end is used to output constraint satisfaction information, error location information and / or error repair suggestions.

[0012] Preferably, the network policy verification unit includes an input parsing module, a packet header expression module, a policy expression module, an operation behavior expression module and a constraint verification module;

[0013] The input parsing module is used to obtain a standardized network policy expression based on the configuration file of the acquired network device;

[0014] The packet header expression module is used to store the data structure of expressing and recording the packet header;

[0015] The policy expression module is used to receive the standardized network policy expression, construct a policy set with the class of expressing and recording the policy and perform a preprocessing function on the policy set;

[0016] The operation behavior expression module is used to obtain a policy application port of an operation behavior description abstract class of the network based on a policy set for executing a preprocessing function;

[0017] The constraint verification module is used to obtain the network verification result by calling the policy application port of the operation behavior description abstract class.

[0018] Preferably, the input parsing module is specifically used to implement configuration file parsing classes of different network devices through predefined interfaces, and convert network device configurations of different manufacturers into predefined standardized data structures and format and output them to files to obtain standardized network policy expressions.

[0019] Preferably, the configuration file includes packet header expression mode configuration, policy granularity configuration and forwarding function configuration;

[0020] Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes:

[0021] The abstract class interface of the Baotou expression module is configured to realize a new Baotou expression class through the Baotou expression mode to complete the reconstruction of the Baotou expression module;

[0022] The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module;

[0023] The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

[0024] In a second aspect, an embodiment of the present invention provides a network policy verification method, including:

[0025] Obtain network topology, network policy, and constraints to be verified;

[0026] Obtaining a network verification result based on the network topology, network policy, constraints to be verified, and configuration files of network devices;

[0027] Constraint satisfaction information, error location information and / or error repair suggestions are obtained based on the network verification result.

[0028] Preferably, obtaining a network verification result based on the network topology, network policy, constraints to be verified and configuration files of network devices includes:

[0029] Obtaining standardized network policy expressions based on the configuration files of the acquired network devices;

[0030] Receiving the standardized network policy expression, and constructing a policy set from the class of the expression and record policy based on the data structure storing the expression and record packet header, and performing a preprocessing function on the policy set;

[0031] A policy application port of an abstract class describing the operation behavior of the network is obtained based on the policy set for executing the preprocessing function;

[0032] The network verification result is obtained by calling the policy application port of the operation behavior description abstract class.

[0033] Preferably, the standardized network policy expression is obtained based on the configuration files of the acquired network devices, including: implementing the configuration file parsing class of different network devices through a predefined interface, and converting the network device configurations of different manufacturers into a predefined standardized data structure and formatting the output file to obtain a standardized network policy expression.

[0034] Preferably, the configuration file includes packet header expression mode configuration, policy granularity configuration and forwarding function configuration;

[0035] Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes:

[0036] The abstract class interface of the Baotou expression module implements a new Baotou expression class through the Baotou expression mode configuration to complete the reconstruction of the Baotou expression module;

[0037] The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module;

[0038] The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

[0039] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the network policy verification method as provided in any one of the second aspects above are implemented.

[0040] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network policy verification method as provided in any one of the second aspects above.

[0041] The embodiment of the present invention provides a network policy verification system and method, which inputs the network topology, network policy and constraints to be verified, and outputs the network verification result based on the configuration file of the obtained network device, and outputs the constraint satisfaction information, error location information and / or error repair suggestions based on the network verification result. The present invention provides a flexible and customizable universal network policy verification framework for network administrators, and provides reusable codes and well-defined interfaces for technical developers, saving the cost of network policy verification tool development and technical iteration. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a structural schematic diagram of a network policy verification system provided by the present invention;

[0044] Figure 2 It is a structural schematic diagram of a network policy verification unit provided by the present invention;

[0045] Figure 3 It is a schematic diagram of the network strategy verification process provided by the present invention;

[0046] Figure 4 It is a schematic diagram of a network topology example provided by the present invention;

[0047] Figure 5 It is a flow chart of a network strategy verification method provided by the present invention;

[0048] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The purpose of the present invention is to reconstruct various network verification algorithms through modular programming based on the functional modular segmentation of network policy verification technology, define a unified module interface and data structure, and realize a flexible and scalable general framework of network policy verification tools, thereby reducing the difficulty of using network policy verification tools and improving the development efficiency of network policy verification tools. Modular programming is a programming paradigm that divides the large program that needs to be implemented into independent small modules according to functions, and defines clear interface functions and data formats between these modules, so as to complete the expected program functions through the collaboration between small modules.

[0051] The present invention provides a universal network policy verification framework, which involves the functional division of the network policy verification process, the interface design and modeling of the functional modules of the network policy verification, the design of the standardized input and output formats of the network policy verification, the modular reconstruction of the existing network policy verification algorithm, and the customization of the network policy verification based on the configuration file.

[0052] Combine the following Figure 1-Figure 6 A network policy verification system and method provided by the present invention are described.

[0053] An embodiment of the present invention provides a network policy verification system. Figure 1 A schematic diagram of the structure of a network policy verification system provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the system includes an input terminal 110, a network policy verification unit 120 and an output terminal 130;

[0054] The input terminal 110 is used to input the network topology, network strategy and constraints to be verified;

[0055] Specifically, the input of the network policy verification framework includes network topology, network policy, and constraints to be verified.

[0056] 1.1 Network topology refers to the nodes in the network, such as switches, routers, and hosts, as well as the connection methods between the ports on these nodes.

[0057] 1.2 Network policy refers to the strategy used to process network packets in the network, such as forwarding tables, firewalls, port mapping, and network protocols.

[0058] 1.3 The constraints to be verified refer to the description of the network behavior that the network operation and maintenance personnel want to check, such as whether there are reachable packets between two ports in the network, whether there are loops in the network, and whether there are black holes in the network.

[0059] The network policy verification unit 120 is used to receive the network topology, network policy and constraints to be verified, and output a network verification result based on the configuration file of the acquired network device;

[0060] The output terminal 130 is used to output constraint satisfaction information, error location information and / or error repair suggestions.

[0061] Specifically, the output of the network policy verification framework includes constraint satisfaction information, error location information and / or error repair suggestions.

[0062] 2.1 Constraint satisfaction information refers to information related to constraints, such as the network packets that are reachable between two points and the devices and ports they pass through from one point to another, the network packets that cause loops in the network and the devices and ports that make up the loops, the devices and ports where black holes are located in the network and the network packets that start from the black holes, etc.

[0063] 2.2 Error location information refers to the output of which network strategy causes the network behavior to fail to meet the constraints when the constraints are not met.

[0064] 2.3 Error repair suggestion refers to the output of network policy modification plan to make the network behavior meet the constraints when the constraints are not met.

[0065] The system provided by the embodiment of the present invention is based on modular program design. In order to enable network operation and maintenance personnel to verify different network devices, network policies and network constraints, the functional module sequence of the network verification process is jointly modeled to achieve free combination of the same functional modules based on different principles, so that network operation and maintenance personnel can customize network verification tools whose functions and performance meet the requirements, accelerate the development process of network verification tools through code reuse and standardized interfaces, and reduce the cost of technical iteration.

[0066] Based on any of the above embodiments, Figure 2 As shown, the network policy verification unit includes an input parsing module 210, a packet header expression module 220, a policy expression module 230, an operation behavior expression module 240 and a constraint verification module 250;

[0067] Specifically, the network policy verification framework is based on the modular decomposition of functions. Through the analysis of a large number of existing network policy verification tools, the network policy verification framework splits the verification unit into input parsing module, packet header expression module, policy expression module, operation behavior expression module and constraint verification module.

[0068] The input parsing module 210 is used to obtain a standardized network policy expression based on the configuration file of the acquired network device;

[0069] Specifically, the input of the input parsing module is the configuration file in the network device, and the output is a standardized network policy expression, which can be directly used as the input of subsequent modules or written into a file. The specific expression is as follows:

[0070] Strategy type $input port $strategy information $output port

[0071] Policy types include fwd (forwarding policy), rewrite (packet header rewrite policy), link (physical connection), protocol (specific protocol), etc. Policy information is used to store information specific to each policy. For example, for physical connection policy, this field is empty; for forwarding policy, this field is the packet header information of the packet matched by the forwarding policy.

[0072] The packet header expression module 220 is used to store the data structure expressing and recording the packet header;

[0073] Specifically, the packet header expression module includes an abstract class and its series of implementations, which provide data structures that can express and record packet headers, such as bit arrays, binary trees, etc. This class provides interfaces for packet header space calculations, such as packet header space intersection operations, packet header space subtraction operations, etc., which are called by other classes.

[0074] The policy expression module 230 is used to receive the standardized network policy expression, construct a policy set from the classes expressing and recording the policy, and perform a preprocessing function on the policy set;

[0075] Specifically, the policy expression module contains a class for expressing and recording policies and a series of functions for preprocessing policy sets. The policy class is used to record the network policy parsed by the input parsing module, and the policy processing function preprocesses the policy set of the entire network from the perspective of the entire policy, such as processing mutually overlapping policy sets with priorities into non-overlapping policy sets. The policy set output by the preprocessing function can be further processed by other preprocessing functions, or directly used as the input of subsequent modules.

[0076] The operation behavior expression module 240 is used to obtain a policy application port of an operation behavior description abstract class of the network based on a policy set for executing a preprocessing function;

[0077] Specifically, the operation behavior expression module includes an abstract class and its series of implementations. The input of this class is the policy set output by the policy expression module, and the output is an abstract class describing the operation behavior of the network. The operation behavior description class provides an interface for applying policies to network packets. The underlying implementation of this interface includes graph algorithms, theorem provers, etc., which are called by other classes.

[0078] The constraint verification module 250 is used to obtain the network verification result by calling the policy application port of the operation behavior description abstract class.

[0079] Specifically, the input of the constraint verification module is the operation behavior description abstract class. The constraint verification module calls the policy application port of the operation behavior description abstract class to implement the verification of specific constraints such as reachability between two points and existence of loops in the network. The output of this module is a human-readable network verification result.

[0080] Based on any of the above embodiments, the input parsing module is specifically used to implement configuration file parsing classes of different network devices through a predefined interface, and convert network device configurations of different manufacturers into a predefined standardized data structure and format it and output it to a file to obtain a standardized network policy expression.

[0081] Specifically, the abstract class of the network policy verification framework adopts the factory class design concept, that is, a public static class is used to output the specified specific class according to the configuration file. The process in the code is as follows:

[0082] 3.1 Implement multiple implementation classes based on pre-defined abstract classes. These implementation classes will be compiled regardless of whether they are used or not;

[0083] 3.2 Define a factory class and implement a static instance generation function inside the factory class. The return class of the instance generation function is an abstract class. The factory class reads the configuration file and decides which abstract class implementation to return based on the content of the configuration file.

[0084] 3.3 When using the implementation class corresponding to the abstract class in other programs, do not directly use the constructor of the implementation class, but call the instance generation function of the factory class.

[0085] Through the above design ideas, it is possible to switch between different functional modules by simply modifying the configuration file without recompiling the program.

[0086] Based on any of the above embodiments, the configuration file includes a packet header expression mode configuration, a policy granularity configuration, and a forwarding function configuration;

[0087] Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes:

[0088] The abstract class interface of the Baotou expression module is configured to realize a new Baotou expression class through the Baotou expression mode to complete the reconstruction of the Baotou expression module;

[0089] The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module;

[0090] The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

[0091] Specifically, the flexibility of the network policy verification framework is achieved through configuration files, which is reflected in the following aspects:

[0092] 4.1 Unified input format. Developers only need to write scripts that convert the configuration of network devices into a predefined standard format to verify the network composed of new network devices, and try different network verification algorithms by modifying the configuration files, without having to adapt the input format for each network verification tool.

[0093] 4.2 Reconstruction of the header expression module. Developers only need to implement a new header expression class based on the interface of the header expression module abstract class to test the impact of various underlying data structures of header expression and header space calculation on the function and performance of network policy verification.

[0094] 4.3 Preprocessing of the policy expression module. Developers only need to design a new policy expression module preprocessing algorithm and insert it into the appropriate position of the policy expression module to test the impact of different granularity policy sets after different preprocessing processes on the function and performance of network policy verification.

[0095] 4.4 Reconstruction of the Operation Behavior Expression Module. Developers only need to implement a new operation behavior expression class based on the interface of the abstract class of the operation behavior expression module to test the impact of various network forwarding modeling algorithms on the function and performance of network policy verification.

[0096] 4.5 Extensibility of the constraint verification module. Developers only need to use the interface of the abstract class to operate the operation behavior to develop new constraint verification functions and verify new network constraints.

[0097] The above network policy verification framework can realize the customization and agile development of network policy verification tools. Through the above factory classes and configuration files, network administrators can customize network policy verification tools with functions and performance that meet the requirements by modifying static configuration files. When the existing functional modules cannot meet the network administrator's verification requirements for network policies, the developers of network policy verification tools can realize the functional expansion of network verification tools through module reconstruction and module expansion in 4.1-4.5, and through the development of a single module with a clear interface, without the need to redesign a new network verification tool, thus realizing a demand-driven agile development model.

[0098] To better illustrate the above network policy verification system, specific application examples are as follows:

[0099] Combination Figure 3 The network policy verification process Figure 4 The specific implementation of the present invention is further described in detail. Figure 3 It can be seen from the network policy verification process that the network policy and network topology are used as the input of the verification framework. The packet header expression configuration selects the packet header expression 1~n and implements the policy set corresponding to the packet header expression. At the same time, the policy granularity configuration selects the preprocessing function 1~n and performs the preprocessing of the previous policy set to obtain a new policy set. Finally, the forwarding function configuration selects the forwarding function 1~n and performs the forwarding processing of the new policy set. The network verification indicators including reachability, loop detection, black hole detection, multipath detection and K-failure detection are output. These indicators are used to determine whether the network requirements are met under the current configuration. Figure 4 The instance topology and partial forwarding strategy of the instance data plane can be applied to cloud data centers, operator networks, and enterprise networks.

[0100] Figure 4 There are three terminals H1-H3 and two forwarding devices SW1-SW2. Only the last 3 bits of the destination IP used to distinguish the forwarding port are considered. The connection is as follows Figure 4 As shown in the figure, some forwarding strategies in the network are expressed in the standard input format. Assume that the configuration file of the framework is that the packet header expression mode is HS, the policy granularity is a priority-containing coverage policy set, and the forwarding function is a forward static forwarding model. The network constraint to be verified is the reachability from port 101 to port 112.

[0101] 1. The program reads the input file. Since HS is selected as the underlying data plane expressed by the packet header, the policy set is expressed as a data structure.

[0102] 2. Because the priority-containing overriding policy set is selected as the policy granularity option, the policy set is not processed and is directly input into the forwarding function.

[0103] 3. Use the selected forward static forwarding model as the forwarding function, check the selected reachability constraints, and initialize a key-value pair (xxx, 101) in the format of (packet header, port number), where xxx indicates that each of the three digits of the packet header can be 0 or 1, and 101 indicates that the packet is currently located at port 101. Apply the forward strategy with the input port containing 101 to the packet, and obtain the key-value pair array [(0xx, 103), (1xx, 102)] after the first round of forward iteration; apply the link strategy with the input port including its port number to the key-value pair array, and obtain the key-value pair array [(0xx, 111)] after the first round of link strategy iteration. Apply the forward strategy with the input port containing 111 to the key-value pair array, and obtain the key-value pair array [(01x,112)] after the second round of forward application iteration. The key-value pair is located at the destination port 112, and the key-value pair and its propagation history are recorded; apply the link strategy with the input port containing 112 to the key-value pair array, and obtain the key-value pair array [] after the second round of link strategy iteration. The array is empty, and the iteration ends. Output all recorded paths [01x,(101,102,111,112)].

[0104] If the framework configuration file is modified to use BDD as the packet header expression mode, a non-overlapping policy set as the policy granularity, and an SMT solver as the forwarding function, the reachability check process for ports 101 to 112 will become as follows:

[0105] 1. The program reads the input file. Since BDD is selected as the underlying data plane expressed by the packet header, the policy set is expressed as a data structure.

[0106] 2. Because mutually non-overlapping policy sets are selected as the policy set granularity option, the policy sets are processed as mutually non-overlapping policy sets.

[0107] 3. Use the selected SMT solver as the forwarding function to check the selected reachability constraints. For each port, establish two Z3 variables to express whether the packet leaves the port and arrives at the port. The variable type is Boolean. Then convert the policy set into SMT constraints and use the SMT solver to solve the constraints. The result is that when pkt = 010, it can be sent from port 101 to port 112. However, this encoding scheme of the SMT solver cannot find all the reachable packet header spaces, such as 011 here. In addition, the order of ports passed by the path cannot be obtained.

[0108] Regarding the extensibility of the framework, adding new modules to the framework requires the following steps:

[0109] 1. Initialize the function of the entity class according to the interface class corresponding to the module you want to implement. If you want to add a new header expression module, create the following entity class:

[0110]

[0111] 2. Use new algorithms to implement functions in entity classes, such as:

[0112]

[0113] 3. Register the entity class in the factory class

[0114]

[0115] After that, you can modify the configuration file to use the function module implemented by the new algorithm to perform network policy verification.

[0116] A network policy verification method provided by the present invention is described below. The network policy verification method described below and the network policy verification system described above can be referenced to each other.

[0117] Figure 5 A flow chart of a network policy verification method provided by an embodiment of the present invention is as follows: Figure 5 As shown, the method includes:

[0118] Step 510, obtaining network topology, network policy and constraints to be verified;

[0119] Step 520, obtaining a network verification result based on the network topology, network policy, constraints to be verified, and configuration files of network devices;

[0120] Step 530: Obtain constraint satisfaction information, error location information and / or error repair suggestions based on the network verification result.

[0121] The method provided in the embodiment of the present invention is based on modular program design. In order to enable network operation and maintenance personnel to verify different network devices, network policies and network constraints, the functional module sequence of the network verification process is jointly modeled to achieve free combination of the same functional modules based on different principles, so that network operation and maintenance personnel can customize network verification tools whose functions and performance meet the requirements, accelerate the development process of network verification tools through code reuse and standardized interfaces, and reduce the cost of technical iteration.

[0122] Based on any of the above embodiments, obtaining a network verification result based on the network topology, network policy, constraints to be verified, and configuration files of network devices includes:

[0123] Obtaining standardized network policy expressions based on the configuration files of the acquired network devices;

[0124] Receiving the standardized network policy expression, and constructing a policy set from the class of the expression and record policy based on the data structure storing the expression and record packet header, and performing a preprocessing function on the policy set;

[0125] A policy application port of an abstract class describing the operation behavior of the network is obtained based on the policy set for executing the preprocessing function;

[0126] The network verification result is obtained by calling the policy application port of the operation behavior description abstract class.

[0127] Based on any of the above embodiments, the configuration file of the network device obtained is used to obtain a standardized network policy expression, including: implementing a configuration file parsing class for different network devices through a predefined interface, and converting network device configurations from different manufacturers into a predefined standardized data structure and formatting the output file to obtain a standardized network policy expression.

[0128] Based on any of the above embodiments, the configuration file includes a packet header expression mode configuration, a policy granularity configuration, and a forwarding function configuration;

[0129] Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes:

[0130] The abstract class interface of the Baotou expression module implements a new Baotou expression class through the Baotou expression mode configuration to complete the reconstruction of the Baotou expression module;

[0131] The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module;

[0132] The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

[0133] In summary, the key technical points of the present invention are:

[0134] 1) Divide the network policy verification process into functional modules to implement a general policy verification framework.

[0135] 2) Define the interface of each functional module in a modular programming way, and modularly reconstruct network policy verification tools based on different principles.

[0136] 3) Standardized network policy input format simplifies the process of expanding supported devices.

[0137] 4) Network header expression abstract class and operation behavior expression abstract class unify different underlying header expression data structures and graph algorithms, theorem proving, static forwarding and other models with different underlying implementation principles into a set of interfaces.

[0138] 5) The differences in the expressions of different network strategy sets are demonstrated in the form of preprocessing functions, and an extensible preprocessing function sequence is designed.

[0139] 6) The functionalized constraint verification module can batch perform multiple underlying implementations of a single network constraint verification by operating the interface of the abstract class that expresses the operation behavior.

[0140] 7) The factory class design of the abstract class works together with the preprocessing function sequence in 5) to combine each basic functional module by modifying the static configuration file.

[0141] The present invention implements an expandable and customizable general network policy verification framework as follows:

[0142] (1) Support the expansion and customization of network policy verification tools based on the functional and performance requirements of a given network policy verification task.

[0143] (2) The input format of the network policy verification tool is unified, which makes it easier for the existing network verification tool to access the actual network composed of new devices, thereby improving the scalability of the network policy verification tool.

[0144] (3) Modular programming improves the code reuse rate of network policy verification tools, reduces the development workload of new algorithms, and shortens the technology iteration cycle.

[0145] (4) The performance of various existing network policy verification tools can be tested by controlling variables to find the network model and verification algorithm with the best performance in a specific scenario.

[0146] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 6As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the network policy verification method, which includes: obtaining the network topology, the network policy and the constraints to be verified; obtaining the network verification result based on the network topology, the network policy, the constraints to be verified and the configuration file of the network device; obtaining the constraint satisfaction information, the error location information and / or the error repair suggestion based on the network verification result.

[0147] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0148] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network policy verification method provided by the above methods, and the method includes: obtaining network topology, network policy and constraints to be verified; obtaining network verification results based on the network topology, network policy, constraints to be verified and configuration files of network devices; and obtaining constraint satisfaction information, error location information and / or error repair suggestions based on the network verification results.

[0149] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the above-mentioned network policy verification methods, the method comprising: obtaining network topology, network policy and constraints to be verified; obtaining network verification results based on the network topology, network policy, constraints to be verified and configuration files of network devices; obtaining constraint satisfaction information, error location information and / or error repair suggestions based on the network verification results.

[0150] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0151] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0152] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network policy verification system, It is characterized in that It includes an input terminal, a network strategy verification unit and an output terminal; The input end is used to input the network topology, network strategy and constraints to be verified; The network policy verification unit is used to receive the network topology, network policy and constraints to be verified, and output a network verification result based on the configuration file of the acquired network device; The output terminal is used to output constraint satisfaction information, error location information and / or error repair suggestions; The network policy verification unit includes an input parsing module, a packet header expression module, a policy expression module, an operation behavior expression module and a constraint verification module; The input parsing module is used to obtain a standardized network policy expression based on the configuration file of the acquired network device; The packet header expression module is used to store the data structure of expressing and recording the packet header; The policy expression module is used to receive the standardized network policy expression, construct a policy set with the class of expressing and recording the policy and perform a preprocessing function on the policy set; The operation behavior expression module is used to obtain a policy application port of an operation behavior description abstract class of the network based on a policy set for executing a preprocessing function; The constraint verification module is used to obtain the network verification result by calling the policy application port of the operation behavior description abstract class; the input parsing module is specifically used to implement the configuration file parsing class of different network devices through a predefined interface, and convert the network device configuration of different manufacturers into a predefined standardized data structure and format the output file to obtain a standardized network policy expression; the configuration file includes the packet header expression mode configuration, the policy granularity configuration and the forwarding function configuration; Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes: The abstract class interface of the Baotou expression module is configured to realize a new Baotou expression class through the Baotou expression mode to complete the reconstruction of the Baotou expression module; The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module; The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

2. A network policy verification method, It is characterized in that include: Obtain network topology, network policy, and constraints to be verified; Obtaining a network verification result based on the network topology, network policy, constraints to be verified, and configuration files of network devices; Obtaining constraint satisfaction information, error location information and / or error repair suggestions based on the network verification result; The network verification result is obtained based on the network topology, network policy, constraints to be verified and configuration files of network devices, including: Obtaining standardized network policy expressions based on the configuration files of the acquired network devices; Receiving the standardized network policy expression, and constructing a policy set from the class of the expression and record policy based on the data structure storing the expression and record packet header, and performing a preprocessing function on the policy set; A policy application port of an abstract class describing the operation behavior of the network is obtained based on the policy set for executing the preprocessing function; The network verification result is obtained by calling the policy application port of the operation behavior description abstract class. The configuration file based on the obtained network device obtains a standardized network policy expression, including: implementing a configuration file parsing class of different network devices through a predefined interface, and converting the network device configurations of different manufacturers into a predefined standardized data structure and formatting the output file to obtain a standardized network policy expression; the configuration file includes a packet header expression mode configuration, a policy granularity configuration and a forwarding function configuration; Modifying the static configuration file to adapt to different network verification algorithms to meet the customization of the network policy verification tool includes: The abstract class interface of the Baotou expression module implements a new Baotou expression class through the Baotou expression mode configuration to complete the reconstruction of the Baotou expression module; The new preprocessing function is inserted into the designated position of the strategy expression module through the strategy granularity configuration to complete the preprocessing of the strategy expression module; The forwarding function configuration enables the interface of the abstract class of the operation behavior expression module to implement a new operation behavior expression abstract class.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the program, the steps of the network policy verification method as claimed in claim 2 are implemented.

4. A non-transitory computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the steps of the network policy verification method as claimed in claim 2 are implemented.

Images