Network verification method and device

Abstract

The present application provides a method and device for network verification. The method in the embodiment of the present application can improve the accuracy of network fault detection by combining with the intention perception technology in the field of artificial intelligence. The method includes: obtaining intention information, the intention information is used to indicate the requirements that the target data packet should meet when transmitting in the network; parsing the intention information to obtain the network configuration information of the target network node in the network, the network configuration information includes the routing rules when the target network node transmits the target data packet; according to the intention information, judging whether there is a network fault in the network when the target network node is configured according to the routing rules.

Description

Technical Field

[0001] The present application relates to the field of networks, and more specifically, to a method and device for network verification. Background Art

[0002] With the development of the Internet, the scale of the network is becoming larger and larger. In order to meet the growing business needs, the industry has proposed the concept of software defined networking (SDN). SDN can decouple the control plane from the network equipment to form a control layer composed of controllers. The controller has a global perspective and can centrally control the network equipment. For example, the controller can obtain the intent of the application layer (for example, the application layer can include one or more applications) through the northbound interface, and convert the policy or intent into specific configuration information, and send it to the corresponding network device through the southbound interface, thereby realizing the control of the network device.

[0003] At present, SDN-based network verification tools can only detect network invariants. Network invariants may include some basic performance or basic parameters that can meet the normal operation of the network. For example, network invariants may include network reachability, network isolation, whether there are loops in the network, and whether there are routing black holes in the network. However, SDN-based network verification tools cannot verify whether the packet forwarding behavior meets the intention of the application layer. Summary of the invention

[0004] The present application provides a network verification method and device, which can improve the accuracy of network fault detection.

[0005] In a first aspect, a network verification method is provided, the method comprising:

[0006] Acquire intent information, where the intent information is used to represent requirements that a target data packet should meet when it is transmitted in a network; parse the intent information to obtain network configuration information of a target network node in the network, where the network configuration information includes routing rules when the target network node transmits the target data packet; based on the intent information, determine whether there is a network failure in the network when the target network node is configured according to the routing rules.

[0007] In an embodiment of the present application, the intent information is used to indicate the requirements that the target data packet should meet when transmitted in the network. Based on the intent information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. This can verify whether the data packet forwarding behavior meets the intent of the application layer, thereby improving the accuracy of network fault detection.

[0008] Optionally, the routing rules may be used to verify whether there are faults in the network invariants of the network, for example, whether the network meets the reachability requirement, whether the network meets the isolation requirement, whether there is a loop in the network, or whether there is a routing black hole in the network.

[0009] Among them, the requirements that the target data packet should meet when transmitting in the network may include: at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network, that is, the intent information can be used to indicate at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network.

[0010] In combination with the first aspect, in certain implementations of the first aspect, the network configuration information also includes first local intention information, and the first local intention information is determined based on at least one of reachability, security, performance and routing policy when the target network node transmits the target data packet; wherein, judging based on the intention information whether there is a network failure in the network when the target network node is configured according to the routing rule includes: judging based on the first local intention information whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0011] In an embodiment of the present application, the first local intention information can be used to indicate the local intention information of the target network node (for example, the first local intention information is determined based on at least one of the reachability, security, performance and routing policy when the target network node transmits the target data packet). Based on the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. It can be verified whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer, thereby further improving the accuracy of network fault detection.

[0012] The first local intention information may be used to indicate requirements that should be met when the target network node transmits the target data packet.

[0013] Optionally, the first local intention information includes at least one item of reachability, security, performance and routing strategy when the target network node transmits the target data packet, or the first local intention information is obtained by subjecting multiple items of reachability, security, performance and routing strategy when the target network node transmits the target data packet to Boolean operations (for example, logical operations such as intersection, union and complement).

[0014] In combination with the first aspect, in certain implementations of the first aspect, judging based on the first local intention information whether there is a network failure in the network when the target network node is configured according to the routing rule includes: determining an intention state table based on the second local intention information of the previous-hop network node of the target network node, the intention state table including the intention that the target data packet needs to complete at the target network node; judging based on the first local intention information and the intention state table whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0015] In an embodiment of the present application, based on the second local intention information, the intention that the target data packet needs to complete at the target network node can be obtained more accurately.

[0016] Furthermore, based on the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rules, which can more intuitively and accurately verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the determining, based on the first local intention information and the intention status table, whether there is a network failure in the network when the target network node is configured according to the routing rule includes: determining, based on the first local intention information, the intention that the target data packet can complete at the target network node; determining between the intention that the target data packet needs to complete at the target network node and the intention that the target data packet can complete at the target network node; Figure 1 When the intention of the target data packet to be completed at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that there is a network failure at the target network node.

[0018] In an embodiment of the present application, based on the intention that needs to be completed and the intention that can be completed, it is possible to more intuitively and accurately verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0019] In combination with the first aspect, in certain implementations of the first aspect, when it is determined that there is no network failure at the target network node, the method further includes: updating the intention state table according to the first local intention information.

[0020] In an embodiment of the present application, updating the intention state table according to the first local intention information helps to improve the accuracy of fault detection of the next-hop network node of the target network node, thereby further improving the accuracy of network fault detection.

[0021] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: when the next-hop network node of the target network node is an edge network node in the network, determining whether there is an uncompleted intent in the updated intent status table; if there is an uncompleted intent in the updated intent status table, determining that there is a network failure in the next-hop network node; if there is no uncompleted intent in the updated intent status table, determining that there is no network failure in the next-hop network node, and the network verification process ends.

[0022] In combination with the first aspect, in certain implementations of the first aspect, when it is determined that a network failure exists at the target network node, the method further includes: repairing the routing rules of the target data packet at the previous hop network node based on the intention state table and the network topology relationship of the network.

[0023] In an embodiment of the present application, based on the intention state table and the network topology relationship of the network, network failures can be quickly repaired without violating the intention of the application layer.

[0024] In a second aspect, a network verification device is provided, comprising:

[0025] An acquisition module is used to acquire intent information, wherein the intent information is used to indicate requirements that a target data packet should meet when being transmitted in a network; a parsing module is used to parse the intent information to obtain network configuration information of a target network node in the network, wherein the network configuration information includes routing rules when the target network node transmits the target data packet; a judgment module is used to judge, based on the intent information, whether there is a network failure in the network when the target network node is configured according to the routing rules.

[0026] In an embodiment of the present application, the intent information is used to indicate the requirements that the target data packet should meet when transmitted in the network. Based on the intent information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. This can verify whether the data packet forwarding behavior meets the intent of the application layer, thereby improving the accuracy of network fault detection.

[0027] Optionally, the routing rules may be used to verify whether there are faults in the network invariants of the network, for example, whether the network meets the reachability requirement, whether the network meets the isolation requirement, whether there is a loop in the network, or whether there is a routing black hole in the network.

[0028] Among them, the requirements that the target data packet should meet when transmitting in the network may include: at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network, that is, the intent information can be used to indicate at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network.

[0029] In combination with the second aspect, in certain implementations of the second aspect, the network configuration information also includes first local intention information, and the first local intention information is determined based on at least one of reachability, security, performance and routing policy when the target network node transmits the target data packet; wherein the judgment module is specifically used to: judge whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intention information.

[0030] In an embodiment of the present application, the first local intention information can be used to indicate the local intention information of the target network node (for example, the first local intention information is determined based on at least one of the reachability, security, performance and routing policy when the target network node transmits the target data packet). Based on the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. It can be verified whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer, thereby further improving the accuracy of network fault detection.

[0031] The first local intention information may be used to indicate requirements that should be met when the target network node transmits the target data packet.

[0032] Optionally, the first local intention information includes at least one item of reachability, security, performance and routing strategy when the target network node transmits the target data packet, or the first local intention information is obtained by subjecting multiple items of reachability, security, performance and routing strategy when the target network node transmits the target data packet to Boolean operations (for example, logical operations such as intersection, union and complement).

[0033] In combination with the second aspect, in certain implementations of the second aspect, the judgment module is specifically used to: determine an intention state table based on the second local intention information of the previous hop network node of the target network node, the intention state table including the intention that the target data packet needs to complete at the target network node; and determine whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intention information and the intention state table.

[0034] In an embodiment of the present application, based on the second local intention information, the intention that the target data packet needs to complete at the target network node can be obtained more accurately.

[0035] Furthermore, based on the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rules, which can more accurately and intuitively verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0036] In combination with the second aspect, in some implementations of the second aspect, the judgment module is specifically used to: determine the intention that the target data packet can complete at the target network node according to the first local intention information; determine the intention that the target data packet needs to complete at the target network node and the intention that the target data packet can complete at the target network node; Figure 1 When the intention of the target data packet to be completed at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that there is a network failure at the target network node.

[0037] In an embodiment of the present application, based on the intention that needs to be completed and the intention that can be completed, it is possible to more intuitively and accurately verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0038] In combination with the second aspect, in certain implementations of the second aspect, when it is determined that there is no network failure at the target network node, the judgment module is further used to: update the intention state table according to the first local intention information.

[0039] In an embodiment of the present application, updating the intention state table according to the first local intention information helps to improve the accuracy of fault detection of the next-hop network node of the target network node, thereby further improving the accuracy of network fault detection.

[0040] In combination with the second aspect, in certain implementations of the second aspect, the judgment module is also used to: when the next-hop network node of the target network node is an edge network node in the network, determine whether there is an uncompleted intention in the updated intention status table; if there is an uncompleted intention in the updated intention status table, determine that there is a network failure in the next-hop network node; if there is no uncompleted intention in the updated intention status table, determine that there is no network failure in the next-hop network node, and the network verification process ends.

[0041] In combination with the second aspect, in certain implementations of the second aspect, when it is determined that a network failure exists at the target network node, the device further includes a repair module, which is used to repair the routing rules of the target data packet at the previous hop network node according to the intention state table and the network topology relationship of the network.

[0042] In an embodiment of the present application, based on the intention state table and the network topology relationship of the network, network failures can be quickly repaired without violating the intention of the application layer.

[0043] According to a third aspect, a software-defined network (SDN) system is provided, wherein the SDN system includes an application layer, a control layer, a proxy layer and a network layer; wherein the control layer obtains the intent information of the application layer, and the intent information is used to indicate the requirements that a target data packet should meet when it is transmitted in the network; the control layer parses the intent information to obtain network configuration information of a target network node in the network, and the network configuration information includes routing rules when the target network node transmits the target data packet; the proxy layer receives the network configuration information sent by the control layer; and the proxy layer determines, based on the intent information, whether there is a network failure in the network when the target network node is configured according to the routing rules.

[0044] In an embodiment of the present application, the intent information is used to indicate the requirements that the target data packet should meet when transmitted in the network. Based on the intent information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. This can verify whether the data packet forwarding behavior meets the intent of the application layer, thereby improving the accuracy of network fault detection.

[0045] Optionally, the routing rules may be used to verify whether there are faults in the network invariants of the network, for example, whether the network meets the reachability requirement, whether the network meets the isolation requirement, whether there is a loop in the network, or whether there is a routing black hole in the network.

[0046] Among them, the requirements that the target data packet should meet when transmitting in the network may include: at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network, that is, the intent information can be used to indicate at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network.

[0047] In combination with the third aspect, in certain implementations of the third aspect, the network configuration information also includes first local intention information, and the first local intention information is determined based on at least one of reachability, security, performance and routing policy when the target network node transmits the target data packet; wherein, the proxy layer determines whether there is a network failure in the network when the target network node is configured according to the routing rule based on the intention information, including: the proxy layer determines whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intention information.

[0048] In an embodiment of the present application, the first local intention information can be used to indicate the local intention information of the target network node (for example, the first local intention information is determined based on at least one of the reachability, security, performance and routing policy when the target network node transmits the target data packet). Based on the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. It can be verified whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer, thereby further improving the accuracy of network fault detection.

[0049] The first local intention information may be used to indicate requirements that should be met when the target network node transmits the target data packet.

[0050] Optionally, the first local intention information includes at least one item of reachability, security, performance and routing strategy when the target network node transmits the target data packet, or the first local intention information is obtained by subjecting multiple items of reachability, security, performance and routing strategy when the target network node transmits the target data packet to Boolean operations (for example, logical operations such as intersection, union and complement).

[0051] In combination with the third aspect, in certain implementations of the third aspect, the proxy layer determines whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intention information, including: the proxy layer determines an intention state table based on the second local intention information of the previous hop network node of the target network node, the intention state table including the intention that the target data packet needs to complete at the target network node; the proxy layer determines whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intention information and the intention state table.

[0052] In an embodiment of the present application, based on the second local intention information, the intention that the target data packet needs to complete at the target network node can be obtained more accurately.

[0053] Furthermore, based on the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rules, which can more intuitively and accurately verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0054] In combination with the third aspect, in certain implementations of the third aspect, the proxy layer determines, based on the first local intention information and the intention status table, whether there is a network failure in the network when the target network node is configured according to the routing rule, including: the proxy layer determines, based on the first local intention information, the intention that the target data packet can complete at the target network node; Figure 1 When the intention of the target data packet to be completed at the target network node is inconsistent with the intention that the target data packet can be completed at the target network node, the proxy layer determines that there is a network failure at the target network node.

[0055] In an embodiment of the present application, based on the intention that needs to be completed and the intention that can be completed, it is possible to more intuitively and accurately verify whether the forwarding behavior when the target network node transmits the data packet meets the intention of the application layer.

[0056] In combination with the third aspect, in certain implementations of the third aspect, when it is determined that there is no network failure at the target network node, the proxy layer will also update the intention state table according to the first local intention information.

[0057] In an embodiment of the present application, updating the intention state table according to the first local intention information helps to improve the accuracy of fault detection of the next-hop network node of the target network node, thereby further improving the accuracy of network fault detection.

[0058] In combination with the third aspect, in certain implementations of the third aspect, when the next-hop network node of the target network node is an edge network node in the network, the proxy layer will also determine whether there is an uncompleted intent in the updated intent status table; if there is an uncompleted intent in the updated intent status table, the proxy layer determines that there is a network failure in the next-hop network node; if there is no uncompleted intent in the updated intent status table, the proxy layer determines that there is no network failure in the next-hop network node and the network verification process is completed, and sends the network configuration information to the network layer.

[0059] In combination with the third aspect, in certain implementations of the third aspect, when it is determined that a network failure exists at the target network node, the proxy layer also repairs the routing rules of the target data packet at the previous hop network node based on the intention state table and the network topology relationship of the network.

[0060] In an embodiment of the present application, based on the intention state table and the network topology relationship of the network, network failures can be quickly repaired without violating the intention of the application layer.

[0061] In a fourth aspect, a network verification device is provided, the device comprising a storage medium and a central processing unit, the storage medium may be a non-volatile storage medium, the storage medium stores a computer executable program, the central processing unit is connected to the non-volatile storage medium, and executes the computer executable program to implement the method in any possible implementation manner in the first aspect.

[0062] In a fifth aspect, a chip is provided, comprising a processor and a data interface, wherein the processor reads instructions stored in a memory through the data interface to execute a method in any possible implementation of the first aspect.

[0063] Optionally, as an implementation method, the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the method in any possible implementation method of the first aspect.

[0064] In a sixth aspect, a computer-readable storage medium is provided, wherein the computer-readable medium stores a program code for execution by a device, wherein the program code includes instructions for executing the method in any possible implementation manner in the first aspect.

[0065] In a seventh aspect, a controller is provided, wherein the controller includes any possible device in the second aspect or the fourth aspect.

[0066] In an embodiment of the present application, the intent information is used to indicate the requirements that the target data packet should meet when transmitted in the network. Based on the intent information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule. This can verify whether the data packet forwarding behavior meets the intent of the application layer, thereby improving the accuracy of network fault detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 It is a schematic block diagram of a network architecture applicable to an embodiment of the present application.

[0068] Figure 2 It is a schematic block diagram of a network verification method provided by an embodiment of the present application.

[0069] Figure 3 It is a schematic block diagram of a network verification method provided by another embodiment of the present application.

[0070] Figure 4 It is a schematic flowchart of a method for trial verification provided by an embodiment of the present application.

[0071] Figure 5 It is a schematic flowchart of a network repair method provided by an embodiment of the present application.

[0072] Figure 6 It is a schematic block diagram of a network topology diagram provided by an embodiment of the present application.

[0073] Figure 7 It is a schematic diagram of equivalence class division in one embodiment of the present application.

[0074] Figure 8 It is a schematic diagram of routing rules and local intents corresponding to various intents in an embodiment of the present application.

[0075] Fig. 9 It is a schematic diagram of the routing rules and local intentions corresponding to EC1 in one embodiment of the present application.

[0076] Fig.10 It is a schematic diagram of the intention state table corresponding to EC1 in one embodiment of the present application.

[0077] Fig.11It is a schematic diagram of the routing rules and intent state table corresponding to EC2 in one embodiment of the present application.

[0078] Fig.12 It is a schematic flowchart of a network repair method provided by an embodiment of the present application.

[0079] Fig.13 It is a schematic diagram of the repaired routing rules in one embodiment of the present application.

[0080] Fig.14 It is a schematic block diagram of a software defined network (SDN) system provided by an embodiment of the present application.

[0081] Fig.15 It is a schematic block diagram of a network verification method provided by an embodiment of the present application.

[0082] Fig.16 It is a schematic block diagram of a network verification device provided by an embodiment of the present application.

[0083] Fig.17 It is a schematic block diagram of a network verification device provided by another embodiment of the present application. DETAILED DESCRIPTION

[0084] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0085] The technical solutions of the embodiments of the present application can be applied to various computer networks, such as software defined networking (SDN), intent based network (IBN) or other computer networks.

[0086] SDN is a network architecture proposed by scholars from Stanford University and the University of California, Berkeley, which can realize the virtualization of computer networks. Figure 1 The network architecture in is described. It should be understood that Figure 1 The description of SDN is for example only and not for limitation. Figure 1 The network architecture in may also be other computer networks, which is not limited in the embodiments of the present application.

[0087] Figure 1 1 is a schematic block diagram of a network architecture 100 applicable to an embodiment of the present application. Figure 1 As shown, the network architecture 100 may include an application layer, a control layer, and a network layer, wherein the application layer may also be referred to as an application plane, the control layer may also be referred to as a control plane, and the network layer may also be referred to as a data plane or a data layer.

[0088] The application layer may include one or more applications (applications), which may be various upper-layer applications that can be used to complete or obtain user intentions; the control layer may include a controller, for example, the controller may be a Floodlight controller, ONOS controller, Open Daylight controller or other controllers, and the controller is mainly responsible for network service deployment, configuration, management of network equipment, and monitoring of network status; the network layer may include one or more network devices, for example, the network device may be a switch, a router or other network device.

[0089] like Figure 1 As shown, SDN separates the control layer of network devices (e.g., routers) from the network layer. The network devices hand over the control of routing rules to the controller in the control layer, and the network devices only forward data packets according to the rules issued by the controller in the control layer. That is, the controller in the control layer centrally controls the network.

[0090] like Figure 1 As shown, the application program in the application layer can communicate with the controller in the control layer through the northbound interface, and at the same time, the controller in the control layer can communicate with the network device in the network layer through the southbound interface.

[0091] For example, an application in the application layer can send the user's intent to the controller in the control layer through the northbound interface. Accordingly, the controller can make decisions, calculate and / or parse the intent information, obtain the configuration information of the network device, and send the configuration information to the network device in the network layer through the southbound interface, thereby realizing flexible control of the network device.

[0092] In addition, if the subsequent Fig.14 As shown, Figure 1 The network architecture 100 may also include a proxy layer, which may include a fault detection device and a fault repair device. The fault detection device may be used to detect whether the routing rules generated by the control layer meet the user's intention to determine whether there is a network failure, and the fault repair device may be used to repair routing rules that may cause network failures.

[0093] like Fig.14As shown, the proxy layer can be located between the control layer and the network layer. The proxy layer can receive (can also be understood as intercepting) the configuration information sent by the control layer to the network layer. The fault detection device in the proxy layer can detect whether there is a network fault based on the user's intention; when there is no network fault, the proxy layer can send the configuration information (for example, a successfully verified routing rule) to the network layer. When there is a network fault, the fault repair device can repair the configuration information and send the repaired configuration information (for example, a repaired routing rule) to the application layer, so that the application program in the application layer can decide whether to adopt the repair solution of the proxy layer.

[0094] Currently, when performing network fault detection, we can only detect whether there are faults in network invariants, such as whether the network meets the reachability requirements, whether the network meets the isolation requirements, whether there are loops in the network, or whether there are routing black holes in the network. However, when the network invariants meet the requirements, the network may still fail.

[0095] Therefore, the present application proposes a network verification method, which can verify whether the data packet forwarding behavior meets the intention of the application layer, thereby improving the accuracy of network fault detection.

[0096] Figure 2 It is a schematic flowchart of a network verification method 200 provided in an embodiment of the present application.

[0097] Figure 2 The method 200 shown may include step 210, step 220 and step 230. Step 210 and step 220 may be performed by the control layer, and step 230 may be performed by the proxy layer; or the control layer and the proxy layer may be the same layer, in which case the method 200 may be performed by the control layer.

[0098] It should be understood that Figure 2 The method 200 shown is only an example and not a limitation. The method 200 may include more or fewer steps, which is not limited in the embodiments of the present application. These steps are described in detail below.

[0099] S210, obtaining intent information.

[0100] The intent information may be used to indicate requirements that a target data packet should meet when being transmitted in a network.

[0101] Optionally, the intent information may be considered to be the intent of the application in the application layer, or the intent information may be considered to carry the intent of the application in the application layer, which is not limited in the embodiments of the present application.

[0102] For example, the controller may receive intent information sent by an application program in the application layer through a northbound interface.

[0103] Among them, the requirements that the target data packet should meet when transmitting in the network may include: at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network, that is, the intent information can be used to indicate at least one of the reachability, security, performance and routing strategy when transmitting the target data packet in the network.

[0104] S220, parsing the intent information to obtain network configuration information of the target network node in the network.

[0105] The network configuration information may include routing rules when the target network node transmits the target data packet.

[0106] Optionally, the network may include multiple network nodes, and the target network node is one of the multiple network nodes.

[0107] For example, the controller may parse the intent information to obtain network configuration information of multiple network nodes in the network (wherein the network configuration information of the multiple network nodes includes the network configuration information of the target network node).

[0108] Optionally, the network configuration information may further include first local intent information, and the first local intent information may also be obtained by parsing the intent information.

[0109] The first local intention information is used to indicate requirements that should be met when the target network node transmits the target data packet.

[0110] Specifically, the first local intention information may be determined based on at least one of reachability, security, performance, and routing strategy when the target network node transmits the target data packet.

[0111] For example, the first local intention information includes at least one item of reachability, security, performance and routing strategy when the target network node transmits the target data packet, or the first local intention information is obtained after Boolean operations (for example, logical operations such as intersection, union and complement) on multiple items of reachability, security, performance and routing strategy when the target network node transmits the target data packet.

[0112] For example, the compiler in the controller can be modified, or a compilation plug-in can be designed and added to the compiler in the controller, so that the controller can convert the intent information into the first local intent information of multiple network nodes in the network (wherein the first local intent information of the multiple network nodes includes the first local intent information of the target network node).

[0113] S230: Determine, based on the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0114] In an embodiment of the present application, based on the intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule, and it is possible to verify whether the data packet forwarding behavior meets the intention of the application layer, thereby improving the accuracy of network fault detection.

[0115] Optionally, in a case where the network configuration information includes the first local intention information, judging, according to the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule may further include:

[0116] According to the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0117] Optionally, judging, according to the first local intent information, whether there is a network failure in the network when the target network node is configured according to the routing rule may include:

[0118] Determine an intention state table according to the second local intention information of the previous hop network node of the target network node, wherein the intention state table includes the intention that the target data packet needs to complete at the target network node;

[0119] According to the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0120] For example, the intention state table may indicate at least one of the network nodes that the target data packet needs to pass through, the network nodes that the target data packet is prohibited from passing through, the number of hops that the target data packet passes along the transmission path, and the relationship between the current network node and the edge network device (whether it is an edge network device).

[0121] For example, a heuristic search may be performed on each transmission path of the target data packet in the network, and based on the network configuration information and local intent information of each network node in the network, it may be verified whether a network failure exists in each network node in the network.

[0122] Specifically, based on each transmission path of the target data, each network node in each transmission path may be tested and verified in turn.

[0123] It should be noted that the tentative verification mentioned here refers to verifying whether there is a network failure in each network node in turn according to the transmission order of the target data in the transmission path. In other words, it is only a tentative verification of each network node, rather than actually transmitting the target data packet along the transmission path.

[0124] For example, based on each transmission path of the target data and according to the network configuration information and local intention information of each network node in the network, it can be verified in turn whether each network node has a network failure.

[0125] For another example, when verifying the previous-hop network node of the target network node, the intent that the target data packet needs to complete at the previous-hop network node of the target network node can be determined based on the second local intent information.

[0126] The intention that needs to be completed by the network node of the previous hop is different from the intention that the network node of the previous hop can complete. Figure 1 If the above situation occurs, determine that there is no network failure in the previous hop network node; and update the intention state table.

[0127] It should be noted that the updating of the intention state table mentioned here may mean: assuming that the target data packet has been transmitted from the previous hop network node to the target network node, accordingly, updating the content in the intention state table to the state after the target data packet is transmitted to the target network node.

[0128] When the intention that the previous-hop network node needs to complete is inconsistent with the intention that the previous-hop network node can complete, it is determined that a network failure exists in the previous-hop network node.

[0129] Further, judging, according to the first local intention information and the intention state table, whether there is a network failure in the network when the target network node is configured according to the routing rule may include:

[0130] Determine, according to the first local intention information, an intention that the target data packet can accomplish at the target network node;

[0131] The purpose of the target data packet at the target network node to be completed is different from the purpose of the target data packet at the target network node to be completed. Figure 1 If the target network node is consistent with the target network node, it is determined that there is no network failure at the target network node;

[0132] When the intention that the target data packet needs to complete at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that a network failure exists at the target network node.

[0133] Optionally, when it is determined that the target network node does not have a network failure, the method may further include:

[0134] Update the intention state table according to the first local intention information.

[0135] Optionally, when it is determined that the target network node has a network failure, the method may further include:

[0136] According to the intention state table and the network topology relationship of the network, the routing rule of the target data packet at the previous hop network node is repaired.

[0137] The repaired routing rule of the target data packet at the previous hop network node enables the target data packet to complete the intention of the target data packet at the target network node and the intention of the target data packet at the target network node when the target data packet is transmitted to the target network node. Figure 1 To.

[0138] Figure 3 It is a schematic flowchart of a network verification method 300 provided in an embodiment of the present application.

[0139] Figure 3 The method 300 shown may include step 310, step 320, step 330 and step 340. Among them, step 310 may be performed by the control layer, and step 320, step 330 and step 340 may be performed by the proxy layer; or, the control layer and the proxy layer may also be the same layer, in which case, the method 300 may be performed by the control layer.

[0140] It should be understood that Figure 3 The method 300 shown is only an example and not a limitation. The method 300 may include more or fewer steps, which is not limited in the embodiments of the present application. These steps are described in detail below.

[0141] S310, generating network configuration information with local intent.

[0142] Optionally, the network may include multiple network nodes, and network configuration information with local intent may be generated for each of the multiple network nodes.

[0143] Among them, the local intention can be considered as the local intention information in the above-mentioned method 200. The specific description can refer to the embodiment in method 200, which will not be repeated here.

[0144] Optionally, a local intent annotation grammar may be designed, through which the local intent of each network node in the network may be formally expressed.

[0145] For example, the local intention annotation grammar designed in one embodiment of the present application may be shown in Table 1. It should be noted that the grammar shown in Table 1 is only an example and not a limitation, and the specific grammar description in the embodiment of the present application is not limited.

[0146] Table 1 Local intent annotation syntax

[0147]

[0148] As shown in Table 1, the intent is obtained by performing Boolean operations (for example, logical operations such as intersection, union, and complement) on the annotation.

[0149] The logical operation may include intersection (“∩”), union (“∪”), complement (“|”) and other logical operations, and the annotation may include at least one of the following:

[0150] 1.fix_forward(port): fixed forwarding to port port.

[0151] 2.towards(sw,weight): The data flow needs to go to device sw and specify the weight weight of the flow allocation.

[0152] 3.forbid(sw): Forbid passing through unsafe node sw or faulty node sw.

[0153] 4.end-to-end (count|drop): The end-to-end count count determines the drop time.

[0154] 5.access-level: specifies the permission level for the application of the policy.

[0155] 6. constraint: performance constraint of network forwarding, which consists of metadata and predicate (pred). Pred includes less than (<), less than or equal to (<=), greater than (>), greater than or equal to (>=), equal to (=), not equal to (!=), and meta includes hop count, delay, and bandwidth.

[0156] The local intent annotation grammar in Table 1 can cover most scenarios. The following Table 2 is the local intent designed based on the local intent annotation grammar in Table 1.

[0157] Table 2 Examples of local intent annotations

[0158]

[0159] Optionally, the compilation module in the controller can be modified based on the local intent annotation syntax in Table 1, or a compilation plug-in can be designed and added to the compiler in the controller so that the controller can generate network configuration information containing local intent (obtained by Boolean operation of the local intent annotation) for each network node among the multiple network nodes.

[0160] S320: Generate an intention state table according to the network configuration information.

[0161] Optionally, data packets with the same destination IP (internet protocol address) prefix may be divided into equivalence classes (ECs).

[0162] Among them, the equivalence class can refer to a set of data packets with the same IP prefix. For the specific definition of the equivalence class and the specific division method of the equivalence class, reference can be made to the prior art and will not be repeated in the embodiments of the present application.

[0163] Optionally, data packets from multiple applications (application, App) can be divided into equivalence classes, and a forwarding graph is generated for each equivalence class, wherein each equivalence class corresponds to a forwarding graph; an intent state table is generated for each equivalence class to indicate the completion status of the intent of each equivalence class.

[0164] For example, the intention state table generated in one embodiment of the present application may be shown in Table 3. It should be noted that the intention state table shown in Table 3 is only an example and not a limitation, and the content and form of the specific intention state table are not limited in the embodiments of the present application.

[0165] Table 3 Example of intention status table

[0166]

[0167] S330: Perform a test verification on the network based on the intention state table.

[0168] Optionally, the network may be tentatively verified by dynamically maintaining an intent state table corresponding to all data packets in each equivalence class on each network device.

[0169] It should be noted that the tentative verification mentioned here refers to verifying whether there is a network failure in each network node in turn according to the transmission order of the target data in the transmission path. In other words, it is only a tentative verification of each network node, rather than actually transmitting the target data packet along the transmission path.

[0170] like Figure 4 As shown, the trial verification process may specifically include the following steps:

[0171] S410, initializing the intention state table.

[0172] Specifically, the information in the intention state table (eg, historical information in the intention state table) may be cleared.

[0173] S420, adding the current network node to the intention state table.

[0174] Specifically, the current network node and the local intention of the current network node may be added to the intention state table.

[0175] S430, checking whether the current network node meets the intention.

[0176] Specifically, it is checked whether the routing rule of the current network node satisfies the intention state in the intention state table. If not, failure (false) is returned; otherwise, S440 is executed.

[0177] S440, update the intention state table.

[0178] Since the current node has passed the verification, the network node in the intention state table needs to be updated to the network node of the next hop of the current network node, for example, the next hop of the current network node is assigned to the current network node pointer.

[0179] Correspondingly, the intention state in the intention state table is also updated to the intention state corresponding to the next hop (network node).

[0180] S450, check whether the next hop is an edge network device.

[0181] If it is an edge network device, perform verification of the last hop (the last hop requires special processing, which can be specifically referred to in the prior art and will not be described here), and execute S460; otherwise, execute S430.

[0182] S460, confirm whether all intentions have been satisfied.

[0183] Returns success (true) if all intents are satisfied; otherwise, returns failure (false).

[0184] Furthermore, in the case of a successful return, the network configuration information of the multiple network nodes generated in S310 may be used to configure the multiple network nodes in the network respectively.

[0185] In case of a return failure, it indicates that there is a network failure in the network, and the following S340 may be continued to be executed.

[0186] S340: When a network failure occurs in the network, repair the network.

[0187] Optionally, when repairing the network, with the goal of satisfying all intentions in the intention state table, a new transmission path is sought among the multiple network nodes based on the network topology relationship of the network.

[0188] like Figure 5 As shown, the network repair process may specifically include the following steps:

[0189] S510, initializing the repair state.

[0190] S520: Determine whether the repair is completed.

[0191] If the repair has not been successful and the history record is not empty, execute S530; otherwise, return failure (false).

[0192] S530: Restore the history record of the previous hop.

[0193] Remove the latest historical record, that is, the current wrong node status, and obtain the previous hop status.

[0194] S540: traverse the neighboring nodes of the previous hop.

[0195] Traverse the neighbor nodes of the previous hop and obtain a neighbor node as the current network node.

[0196] S550, checking whether the current network node meets the intention.

[0197] If the current network node meets the intention, execute S560; otherwise, execute S540.

[0198] S560, update the intention state table.

[0199] After the intention state table is updated, S570 may be executed.

[0200] S570, check whether the next hop is an edge network device.

[0201] If it is an edge network device, perform the last hop verification (the last hop requires special processing, which can be referred to the prior art and will not be described here), and execute S580; otherwise, execute S540 to obtain another neighbor node as the current network node.

[0202] S580, confirm whether all intentions have been satisfied.

[0203] If all intentions are met, the repair status is successful, and success (true) is returned. The rules are modified according to the new intention status table to obtain the repair plan.

[0204] Otherwise, execute S540 to obtain another neighbor node as the current network node.

[0205] If the repair is not successful until all other neighbors of the previous hop are traversed, the repair status is failure, indicating that it cannot be repaired, and failure (false) is returned.

[0206] Combine the following Figures 6 to 13 , for the above Figure 2 and Figure 3 The network verification method in is described in detail.

[0207] Figure 6 A topological diagram of a network applicable to an embodiment of the present application is shown, and the network may be Figure 2 or Figure 3 The network in the embodiment includes multiple network nodes, and the network can obtain the intention from the application program in the application layer.

[0208] For example, take the network obtaining intents from two applications (App1 and App2) as an example. Figure 1 (intent1) and App2 Figure 2 (intent2) can be as follows:

[0209] intent1: F1=dst:10.0.*.*, waypoint B, low priority;

[0210] intent2: F2=dst:10.0.0.1, hop<3, high priority.

[0211] Among them, based on intent1, routing rule F1 can be generated, and App1’s intent Figure 1 (intent1) indicates that the data packets with the destination IP address 10.0.*.* (10.0.*.* is a wildcard, including all IP addresses with the prefix "10.0") need to pass through network node B and have a low priority. The expected transmission path of the data packets of App1 can be as follows: Figure 6 As shown, it is A->B->D.

[0212] Based on intent2, routing rule F2 can be generated. Figure 2 (intent2) indicates that the data packet with the destination IP address 10.0.0.1 should have less than 3 hops and has a high priority. The expected transmission path for the data packet of App2 can be as follows: Figure 6 As shown, it is A->D.

[0213] Alternatively, if Figure 7 As shown, all data packets can be divided into two equivalence classes (EC) according to the prefix of the destination IP.

[0214] Among them, EC1 can include all data packets with a destination IP of 10.0.0.1, and EC2 can include all data packets with a destination IP of 10.0.*.* and not 10.0.0.1.

[0215] from Figure 7 As can be seen, there are two intents in EC1: intent1 and intent2; while there is only one intent in EC2: intent2.

[0216] The compiler in the control layer then issues routing rules, such as Figure 8 As shown, for easy distinction, the contents in the dotted box and the solid box respectively represent the routing rules sent by App1 and App2 to the routing node before the local intent is added, and the content in the box below the routing rules is the local intent added in the embodiment of the present application.

[0217] For example, Figure 8 As shown in the figure, the routing rule "F1,fwd B;prio=1" in the dotted box on the left side of network node A is the routing rule of App1. Figure 1 (intent1) is the routing rule sent to network node A, and “Twds B{h<16; h+1}” in the dotted box is the local intent of network node A determined according to intent1 in the embodiment of the present application.

[0218] The routing rule "F2,fwd D;prio=2" in the solid box on the left side of network node A is the routing rule of App2. Figure 2 (intent2) is the routing rule sent to network node A. “Twds D{h<3; h+1}” in the solid line box is the local intent of network node A determined according to intent2 in the embodiment of the present application.

[0219] Figure 8 The meanings of the contents in the remaining boxes in the figure are similar to the meanings of the contents in the boxes in the subsequent figures, and will not be repeated in the subsequent embodiments.

[0220] For EC1, its forwarding diagram is as follows Fig. 9 As shown in the figure, since there are two intents, the local intents generated after the two intents are compiled and located on each network device are marked at the same time. Among them, intent1 does not specify the hop, the default hop is 16, and the hop of intent2 is 3.

[0221] Fig.10 This is an example of the intent state table for EC1, where 'toward' indicates a list of network nodes that need to be passed through, 'forbid' indicates a list of network nodes that are forbidden to be passed through, 'fix' indicates whether it is an edge network device, and 'hop' indicates the number of hops that the data packet passes through.

[0222] For network node A, the corresponding EC1 intention state table is as follows: Fig.10 As shown above, EC1 has two intents, so there are two candidates in 'toward': B and D. B is determined based on the partial intent of intent1, and D is determined based on the partial intent of intent2.

[0223] In order to avoid a closed loop, 'forbid' is A; network node A is not an edge network device, so 'fix' is empty; at this time, the forwarding hop count is 1, so 'hop' is 1.

[0224] During forwarding, since intent2 has a higher priority than intent1, the routing rule of intent2 is executed first and the data packet is forwarded to network node D.

[0225] For network node D, the corresponding EC1 intention state table is as follows: Fig.10 Shown below.

[0226] Since the data packet has reached D, D is deleted in 'toward', leaving only B. Similarly, to avoid a closed loop, D is added to 'forbid'. Since network node D is an edge network device, host is filled in 'fix' (reaching the edge network device means the end of the forwarding process). The forwarding hop count is 2, so 'hop' is 2.

[0227] At this time, when reaching the edge network device, hop=2 meets the requirements, but 'toward' is not empty, which means that some intentions have not been completed. In the embodiment of the present application, 'toward' also includes B, which means that the intention of App1's intent1 to pass through network node B has not been completed. Therefore, a network failure is detected in the network.

[0228] It should be noted that the existing Veriflow (verifying network-wide invariants in realtime) cannot detect the above network failure because, in the above embodiment, the network status does not violate any network invariants, but only some data packets in App1 (data packets sent to 10.0.0.1) do not meet the application intent.

[0229] For EC2, the forwarding graph and verification process are as follows: Fig.11 As shown. Among them, Fig.11 The upper side shows the intention state table of EC1 corresponding to network node A. Fig.11 The middle part shows the intention state table of EC1 corresponding to network node B. Fig.11 The lower side shows the intention state table of EC1 corresponding to network node D.

[0230] like Fig.11 As shown, there is only one application intent on EC2 in the embodiment of the present application. When it reaches the edge network device (network node D), all intents in the intent status table have been completed. Therefore, for EC2, the method in the embodiment of the present application verifies that there is no network failure in its network.

[0231] After the above network verification process, it is determined that there is a problem in EC1. Therefore, the routing rules in EC2 can be modified to meet all application intentions. The specific repair process is as follows: Fig.12 shown.

[0232] like Fig.12 As shown, firstly, the current network node D is rolled back to the previous hop network node, that is, network node A; other neighboring network nodes of network node A are traversed to find a new transmission path that can satisfy all intentions in the intention state table.

[0233] If a new transmission path that can satisfy all the intentions in the intention state table can be found, the network repair is successful; otherwise, the network repair fails.

[0234] In the embodiment of the present application, a new transmission path A->B->D that satisfies all the intentions in the intention state table can be found, and therefore the network repair is successful.

[0235] because Fig.12 The illustrated embodiment traverses other neighboring network nodes of the network node A based on a heuristic search, so the network repair process can be completed in polynomial time.

[0236] pass Fig.12 The heuristic search shown can obtain a network repair solution that satisfies both Intent1 and Intent2. At this time, the control layer can send new routing rules to each network device to enable it to forward and transmit data packets according to the repaired forwarding rules.

[0237] like Fig.13 As shown, for the above embodiment, the forward in the routing rule F2 of the network node A can be modified to "fwd B". At this point, the network verification and the rapid repair of the network failure are completed.

[0238] In an embodiment of the present application, based on the intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule, and it is possible to verify whether the data packet forwarding behavior meets the intention of the application layer, thereby improving the accuracy of network fault detection.

[0239] Fig.14 It is a schematic flow chart of the software defined network SDN system 1400 provided in an embodiment of the present application. Fig.14 The SDN system 1400 shown may include an application layer 1410 , a control layer 1420 , an agent layer 1430 , and a network layer 1440 .

[0240] Among them, the application layer 1410 may include one or more application programs (also referred to as applications for short), which may be various upper-layer applications that can be used to complete or obtain user intentions; the control layer 1420 may include a controller, which is mainly responsible for network service deployment, configuration, management of network equipment, and monitoring of network status, etc.; the proxy layer 1430 may include a fault detection device and a fault repair device, the fault detection device can be used to detect whether the routing rules generated by the control layer meet the user's intentions to determine whether there is a network failure, and the fault repair device can be used to repair routing rules that may cause network failures; the network layer 1440 may include one or more network devices, which may be switches, routers or other network devices.

[0241] like Fig.14As shown, the proxy layer 1430 can be located between the control layer 1420 and the network layer 1440. The proxy layer 1430 can receive (also can be understood as intercepting) the configuration information sent by the control layer 1420 to the network layer 1440. The fault detection device in the proxy layer 1430 can detect whether there is a network fault based on the user's intention; when there is no network fault, the proxy layer 1430 can send the configuration information (for example, the routing rule that has been successfully verified) to the network layer 1440. When there is a network fault, the fault repair device can repair the configuration information and send the repaired configuration information (for example, the repaired routing rule) to the application layer 1410, so that the application in the application layer 1410 can decide whether to adopt the repair plan of the proxy layer 1430.

[0242] Fig.14 The system 1400 shown can be used to perform Fig.15 A method 1500 of network authentication is shown.

[0243] Fig.15 The method 1500 shown may include steps 1510, 1520, 1530, and 1540. It should be understood that Fig.15 The method 1500 shown is only an example and not a limitation. The method 1500 may include more or fewer steps, which is not limited in the embodiments of the present application. These steps are described in detail below.

[0244] Among them, step 1510 and step 1520 can be executed by the control layer, and step 1530 and step 1540 can be executed by the proxy layer; or, the control layer and the proxy layer can also be the same layer, in which case, method 1500 can be executed by the control layer.

[0245] S1510, the control layer obtains the intention information of the application layer.

[0246] The intent information is used to indicate the requirements that the target data packet should meet when being transmitted in the network.

[0247] S1520, the control layer parses the intent information to obtain network configuration information of the target network node in the network.

[0248] The network configuration information includes routing rules when the target network node transmits the target data packet.

[0249] S1530, the proxy layer receives the network configuration information sent by the control layer.

[0250] S1540, the proxy layer determines, based on the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0251] Optionally, the network configuration information further includes first local intention information, which is determined based on at least one of reachability, security, performance, and routing policy when the target network node transmits the target data packet; wherein the proxy layer determines, based on the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule, including:

[0252] The proxy layer determines, based on the first local intent information, whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0253] Optionally, the proxy layer determines, according to the first local intent information, whether there is a network failure in the network when the target network node is configured according to the routing rule, including:

[0254] The proxy layer determines an intent state table based on the second local intent information of the previous-hop network node of the target network node, and the intent state table includes the intent that the target data packet needs to complete at the target network node; the proxy layer determines whether there is a network failure in the network when the target network node is configured according to the routing rule based on the first local intent information and the intent state table.

[0255] Optionally, the proxy layer determines, according to the first local intent information and the intent state table, whether there is a network failure in the network when the target network node is configured according to the routing rule, including:

[0256] The proxy layer determines the intention that the target data packet can complete at the target network node according to the first local intention information; the intention that the target data packet needs to complete at the target network node is different from the intention that the target data packet can complete at the target network node. Figure 1 When the intention of the target data packet to be completed at the target network node is inconsistent with the intention that the target data packet can be completed at the target network node, the proxy layer determines that there is a network failure at the target network node.

[0257] Optionally, when it is determined that there is no network failure in the target network node, the proxy layer will also update the intention state table according to the first local intention information.

[0258] Optionally, when the next-hop network node of the target network node is an edge network node in the network, the proxy layer will also determine whether there is an uncompleted intent in the updated intent status table; if there is an uncompleted intent in the updated intent status table, the proxy layer determines that there is a network failure in the next-hop network node; if there is no uncompleted intent in the updated intent status table, the proxy layer determines that there is no network failure in the next-hop network node and the network verification process ends, and sends the network configuration information to the network layer.

[0259] Optionally, when it is determined that a network failure exists in the target network node, the proxy layer also repairs the routing rule of the target data packet at the previous hop network node according to the intention state table and the network topology relationship of the network.

[0260] Fig.16 1400 is a schematic block diagram of a network authentication device 1400 provided by an embodiment of the present application. It should be understood that Fig.16 The network verification device 1400 shown is only an example, and the device 1400 of the embodiment of the present application may also include other modules or units. It should be understood that the device 1400 is capable of executing Figure 2 and Figure 3 To avoid repetition, the steps in the method are not described in detail here.

[0261] An acquisition module 1410 is used to acquire intent information, where the intent information is used to indicate requirements that a target data packet should meet when being transmitted in a network;

[0262] A parsing module 1420, configured to parse the intent information to obtain network configuration information of a target network node in the network, wherein the network configuration information includes a routing rule when the target network node transmits the target data packet;

[0263] The judgment module 1430 is used to judge whether there is a network failure in the network when the target network node is configured according to the routing rule based on the intention information.

[0264] Optionally, the network configuration information further includes first local intention information, wherein the first local intention information is determined based on at least one of reachability, security, performance, and routing strategy when the target data packet is transmitted at the target network node;

[0265] The determining module 1430 is specifically used for:

[0266] According to the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0267] Optionally, the determining module 1430 is specifically configured to:

[0268] According to the second local intention information of the previous hop network node of the target network node, an intention state table is determined, wherein the intention of the target data packet needs to be completed at the target network node; according to the first local intention information and the intention state table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

[0269] Optionally, the determining module 1430 is specifically configured to:

[0270] Determine the intention that the target data packet can complete at the target network node according to the first local intention information; determine the intention that the target data packet needs to complete at the target network node and the intention that the target data packet can complete at the target network node Figure 1 When the intention of the target data packet to be completed at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that there is a network failure at the target network node.

[0271] Optionally, when it is determined that there is no network failure in the target network node, the judging module 1430 is further configured to:

[0272] Update the intention state table according to the first local intention information.

[0273] Optionally, the determining module 1430 is further configured to:

[0274] In the case that the next-hop network node of the target network node is an edge network node in the network, determine whether there is an uncompleted intent in the updated intent status table; if there is an uncompleted intent in the updated intent status table, determine that there is a network failure in the next-hop network node; if there is no uncompleted intent in the updated intent status table, determine that there is no network failure in the next-hop network node, and the network verification process ends.

[0275] Optionally, when it is determined that a network failure exists in the target network node, the device further includes a repair module 1440, and the repair module 1440 is used to repair the routing rules of the target data packet at the previous hop network node according to the intention state table and the network topology relationship of the network.

[0276] It should be understood that the network verification device 1400 here is embodied in the form of a functional module. The term "module" here can be implemented in the form of software and / or hardware, and is not specifically limited to this. For example, a "module" can be a software program, a hardware circuit, or a combination of the two that implements the above functions. The hardware circuit may include an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor, or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit, and / or other suitable components that support the described functions.

[0277] As an example, the network verification device 1400 provided in the embodiment of the present application may be a controller in a control layer, or may be a chip configured in the controller, so as to execute the method described in the embodiment of the present application.

[0278] Fig.17 It is a schematic block diagram of a network verification device 800 according to an embodiment of the present application. Fig.17 The device 800 shown includes a memory 801, a processor 802, a communication interface 803 and a bus 804. The memory 801, the processor 802 and the communication interface 803 are connected to each other through the bus 804.

[0279] The memory 801 may be a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM). The memory 801 may store a program. When the program stored in the memory 801 is executed by the processor 802, the processor 802 is used to execute the various steps of the network authentication method of the embodiment of the present application. For example, the processor 802 may execute Figures 2 to 13 The various steps of the illustrated embodiment.

[0280] Processor 802 can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute relevant programs to implement the network verification method of the method embodiment of the present application.

[0281] The processor 802 may also be an integrated circuit chip with signal processing capability. In the implementation process, each step of the network verification method of the embodiment of the present application may be completed by an integrated logic circuit of hardware in the processor 802 or by instructions in the form of software.

[0282] The processor 802 may also be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0283] The steps of the method disclosed in the embodiment of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 801, and the processor 802 reads the information in the memory 801, and combines its hardware to complete the functions required to be executed by the units included in the network verification device in the embodiment of the present application, or execute the network verification method of the method embodiment of the present application, for example, it can be executed Figures 2 to 13 The various steps / functions of the illustrated embodiment.

[0284] The communication interface 803 may use, but is not limited to, a transceiver or other transceiver device to implement communication between the apparatus 800 and other devices or a communication network.

[0285] The bus 804 may include a path for transmitting information between various components of the device 800 (eg, the memory 801 , the processor 802 , and the communication interface 803 ).

[0286] It should be understood that the device 800 shown in the embodiment of the present application may be a controller in the control layer, or may also be a chip configured in the controller.

[0287] It should be understood that the processor in the embodiment of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0288] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0289] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0290] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0291] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0292] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0293] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0294] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0295] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0296] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0297] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0298] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0299] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network verification method, characterized in that: include: Acquire intent information, where the intent information is used to indicate requirements that a target data packet should meet when being transmitted in a network; Parsing the intent information to obtain network configuration information of a target network node in the network, wherein the network configuration information includes a routing rule when the target network node transmits the target data packet; According to the intention information, determining whether there is a network failure in the network when the target network node is configured according to the routing rule; The network configuration information further includes first local intention information, wherein the first local intention information is determined based on at least one of reachability, security, performance, and routing strategy when the target data packet is transmitted at the target network node; Wherein, judging, according to the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule includes: According to the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

2. The method according to claim 1, characterized in that: The determining, according to the first local intent information, whether the network has a network failure when the target network node is configured according to the routing rule includes: Determine an intention state table according to the second local intention information of the previous hop network node of the target network node, wherein the intention state table includes the intention that the target data packet needs to complete at the target network node; According to the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

3. The method according to claim 2, characterized in that The determining, based on the first local intent information and the intent state table, whether there is a network failure in the network when the target network node is configured according to the routing rule includes: Determine, according to the first local intention information, an intention that the target data packet can accomplish at the target network node; When the intention of the target data packet to be completed at the target network node is consistent with the intention of the target data packet to be completed at the target network node, determining that there is no network failure at the target network node; When the intention that the target data packet needs to complete at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that a network failure exists at the target network node.

4. The method according to claim 3, characterized in that In the case where it is determined that the target network node does not have a network failure, the method further includes: Update the intention state table according to the first local intention information.

5. The method according to claim 3 or 4, characterized in that: The method further comprises: In a case where the next-hop network node of the target network node is an edge network node in the network, determining whether there is an uncompleted intention in the updated intention state table; If there is an uncompleted intention in the updated intention state table, determining that a network failure exists in the next-hop network node; If there is no uncompleted intention in the updated intention status table, it is determined that there is no network failure in the next-hop network node, and the network verification process ends.

6. The method according to claim 3, characterized in that In the case where it is determined that a network failure exists in the target network node, the method further includes: According to the intention state table and the network topology relationship of the network, the routing rule of the target data packet at the previous hop network node is repaired.

7. A network verification device, characterized in that: include: An acquisition module, used to acquire intent information, where the intent information is used to indicate requirements that a target data packet should meet when being transmitted in a network; A parsing module, used to parse the intention information to obtain network configuration information of a target network node in the network, wherein the network configuration information includes a routing rule when the target network node transmits the target data packet; A judgment module, used to judge whether there is a network failure in the network when the target network node is configured according to the routing rule according to the intention information; The network configuration information further includes first local intention information, wherein the first local intention information is determined based on at least one of reachability, security, performance, and routing strategy when the target data packet is transmitted at the target network node; Wherein, the judgment module is specifically used for: According to the first local intention information, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

8. The device according to claim 7, characterized in that The judgment module is specifically used for: Determine an intention state table according to the second local intention information of the previous hop network node of the target network node, wherein the intention state table includes the intention that the target data packet needs to complete at the target network node; According to the first local intention information and the intention status table, it is determined whether there is a network failure in the network when the target network node is configured according to the routing rule.

9. The device according to claim 8, characterized in that The judgment module is specifically used for: Determine, according to the first local intention information, an intention that the target data packet can accomplish at the target network node; When the intention of the target data packet to be completed at the target network node is consistent with the intention of the target data packet to be completed at the target network node, determining that there is no network failure at the target network node; When the intention that the target data packet needs to complete at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, it is determined that a network failure exists at the target network node.

10. The device according to claim 9, characterized in that In the case where it is determined that the target network node does not have a network failure, the judgment module is further used to: Update the intention state table according to the first local intention information.

11. The device according to claim 9 or 10, characterized in that The judging module is also used for: In a case where the next-hop network node of the target network node is an edge network node in the network, determining whether there is an uncompleted intention in the updated intention state table; If there is an uncompleted intention in the updated intention state table, determining that a network failure exists in the next-hop network node; If there is no uncompleted intention in the updated intention status table, it is determined that there is no network failure in the next-hop network node, and the network verification process ends.

12. The device according to claim 9, characterized in that In the case where it is determined that the target network node has a network failure, the device further includes a repair module, wherein the repair module is used to: According to the intention state table and the network topology relationship of the network, the routing rule of the target data packet at the previous hop network node is repaired.

13. A software defined network (SDN) system, characterized in that: The SDN system includes an application layer, a control layer, an agent layer and a network layer; The control layer obtains the intention information of the application layer, and the intention information is used to indicate the requirements that the target data packet should meet when being transmitted in the network; The control layer parses the intention information to obtain network configuration information of the target network node in the network, wherein the network configuration information includes a routing rule when the target network node transmits the target data packet; The proxy layer receives the network configuration information sent by the control layer; The proxy layer determines, based on the intent information, whether there is a network failure in the network when configuring the target network node according to the routing rule; The network configuration information further includes first local intention information, wherein the first local intention information is determined based on at least one of reachability, security, performance, and routing strategy when the target data packet is transmitted at the target network node; The proxy layer determines, based on the intention information, whether there is a network failure in the network when the target network node is configured according to the routing rule, including: The proxy layer determines, based on the first local intent information, whether there is a network failure in the network when the target network node is configured according to the routing rule.

14. The system according to claim 13, characterized in that The proxy layer determines, according to the first local intent information, whether there is a network failure in the network when the target network node is configured according to the routing rule, including: The proxy layer determines an intention state table according to the second local intention information of the previous hop network node of the target network node, wherein the intention state table includes the intention that the target data packet needs to complete at the target network node; The proxy layer determines, based on the first local intent information and the intent state table, whether there is a network failure in the network when the target network node is configured according to the routing rule.

15. The system according to claim 14, characterized in that The proxy layer determines, according to the first local intent information and the intent state table, whether there is a network failure in the network when the target network node is configured according to the routing rule, including: The proxy layer determines the intent that the target data packet can accomplish at the target network node according to the first local intent information; When the intention of the target data packet to be completed at the target network node is consistent with the intention of the target data packet that can be completed at the target network node, the proxy layer determines that there is no network failure at the target network node; When the intention that the target data packet needs to complete at the target network node is inconsistent with the intention that the target data packet can complete at the target network node, the proxy layer determines that a network failure exists at the target network node.

16. The system according to claim 15, characterized in that When it is determined that there is no network failure in the target network node, the proxy layer will also update the intention state table according to the first local intention information.

17. The system according to claim 15 or 16, characterized in that In the case where the next-hop network node of the target network node is an edge network node in the network, the proxy layer will also determine whether there is an uncompleted intent in the updated intent state table; If there is an unfulfilled intention in the updated intention state table, the proxy layer determines that a network failure exists in the next-hop network node; If there is no uncompleted intention in the updated intention status table, the proxy layer determines that there is no network failure in the next-hop network node and the network verification process is completed, and sends the network configuration information to the network layer.

18. The system according to claim 15, characterized in that When it is determined that a network failure exists in the target network node, the proxy layer also repairs the routing rule of the target data packet at the previous hop network node according to the intention state table and the network topology relationship of the network.

19. A network verification device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store program instructions, and the processor is used to call the program instructions to execute the method according to any one of claims 1 to 6.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

21. A chip, characterized in that: The chip includes a processor and a data interface, and the processor reads instructions stored in a memory through the data interface to execute the method according to any one of claims 1 to 6.

Images