A method for processing network configuration rules and related equipment

Abstract

This application discloses a method for processing network configuration rules, which reduces the storage amount of intersection rules in network configuration rule coverage judgment and reduces the memory occupation of network devices. The method of this application includes: obtaining an original rule set, dividing each original rule in the original rule set into different sets according to the position of the wildcard field, performing rule coverage judgment within each set, and generating a set of non-overlapping conflict rules that does not include the covered rules.

Description

Technical Field

[0001] This application relates to the field of network interconnection protocol technology, and in particular to a method for verifying network configuration rules and related equipment. Background Technology

[0002] Network devices are configured with various network configuration rules to perform network processing actions based on these rules. For example, these rules may include rules for processing packets. When a packet received by the network device matches a rule, the network device executes the action defined in the rule, such as forwarding, dropping, or modifying packet header fields. Many rules are configured on a network device, and conflicts may arise between them. For instance, some rules may be overridden by others and never take effect. Therefore, it is necessary to verify whether rules are overridden before configuring rules on the network device.

[0003] One method to verify whether a rule is covered is to first determine a rule to be verified, and then verify, one by one, whether the rule to be verified is fully covered by each of the other rules, based on all other rules besides the rule to be verified. Alternatively, one can determine all rules that intersect with the rule to be verified, generate the intersection rules between all rules that intersect with the rule to be verified and the rule to be verified, and determine whether the rule to be verified is covered based on whether the rule to be verified is fully covered by the union of these intersection rules.

[0004] With the improvement of network performance, in high-bandwidth high-speed networks, the requirements for the number of packets processed and the speed of packet processing of network devices have increased significantly. The number of rules that need to be configured for network devices is enormous. In network verification, the rule coverage judgment needs to generate a large number of intersection rules. Often, due to the excessive amount of computation, the network device will crash due to excessive memory consumption, which will affect the stability and availability of the entire network system. Summary of the Invention

[0005] This application provides a method and related equipment for processing network configuration rules, which reduces the storage amount of intersection rules, reduces the memory usage of network devices, and improves the stability of the network system.

[0006] The first aspect of this application provides a method for processing network configuration rules:

[0007] The network verification device, used to verify whether network configuration rules conflict, verifies the network configuration rules before issuing them to the message processing device or module to determine whether there are any overlapping relationships between the network configuration rules that could cause conflicts.

[0008] First, the network verification device obtains the original rule set. This set includes multiple original rules used for network configuration. Each original rule contains at least two field segments, and these two field segments are distinct. The field segments included in each original rule are identical to those in other original rules. The original rules can be packet classification rules; if so, the field segments represent packet header information.

[0009] If a field in a network configuration rule is a wildcard representing the entire set of possible values, then that field is called a wildcard field. The network verification device divides the original rules into multiple sets based on the position of the wildcard field in each original rule; the position of the wildcard field in each set is different.

[0010] The network verification device selects one set as the target set from the multiple sets of original rules that have been divided. Within the target set, it first selects one original rule as the rule to be verified. If the rule to be verified is fully covered by another rule or fully covered by the union of other rules, then the rule to be verified is the covered rule. The device then selects all the original rules in the set as the rules to be verified in turn, thus determining all the covered rules within each set.

[0011] After identifying the overridden rule, the network verification device removes the overridden rule from the original rule set and generates a set of rules without overriding conflicts from the original rules after removing the overridden rule.

[0012] Understandably, network verification devices only need to judge whether the rule being verified has been overwritten based on other rules of the same rule type, rather than based on all other original rules except the rule being verified. This reduces the generation of intersection rules between different types of rules, reduces the storage of intersection rules, reduces the memory usage of network devices, and improves the stability of the network system.

[0013] Based on the first aspect, the embodiments of this application provide a first implementation of the first aspect:

[0014] Before determining the covered rules in each set, the network verification device can generate the intersection rule of two original rules belonging to two different sets. These two original rules intersect, that is, the value ranges of these two original rules in the same domain segment have an intersection.

[0015] Similar to the partitioning of the original rules, the network verification device partitions the intersection rules into corresponding sets based on the position of the wildcard field segments in the generated intersection rules.

[0016] Understandably, the network verification device generates intersection rules for original rules belonging to different sets, but does not generate intersection rules between original rules in the same set, thus reducing the storage of intersection rules; it determines whether the verified rules in the set are covered based on the generated intersection rules, which increases the basis for covering judgment and improves the accuracy of the judgment.

[0017] Based on the first aspect and the first implementation of the first aspect, this application provides a second implementation of the first aspect:

[0018] The network verification device generates the intersection rule of the original rules of two sets that are not orthogonal. The orthogonality between the two sets means that at the position of a wildcard field segment of each original rule in one set, no original rule in the other set is a wildcard field segment at that position, and at the position of a non-wildcard field segment in one set, every original rule in the other set is a wildcard field segment at that position. The relationship between the two sets is called orthogonal. The relationship that does not satisfy this is called non-orthogonal.

[0019] Understandably, the network verification device only generates intersection rules that are the original rules in the non-orthogonal relation set, which further reduces the generation of intersection rules and the storage amount of intersection rules.

[0020] Based on the first aspect and the second implementation of the first aspect, this application provides a third implementation of the first aspect:

[0021] The network verification device generates virtual rules based on multiple original rules that meet certain conditions. The multiple original rules that can generate virtual rules need to meet the following conditions: the union of the value ranges of the multiple original rules in the same domain segment is the complete set of the value ranges of that domain segment; and the value ranges of the multiple original rules in other domain segments all have intersections. The generated virtual rule is a wildcard domain segment in the domain segment where the value ranges of the original rules are the union; and the value ranges of other domain segments where the value ranges of the multiple original rules all have intersections are the intersections of the value ranges of the other domain segments of the multiple original rules in that domain segment, i.e., the minimum value range.

[0022] Understandably, the network verification device generates virtual rules and determines whether the verified rules are overwritten based on these virtual rules. Without significantly increasing the generation and storage of intersection rules, it adds a basis for determining rule overwriting and improves the accuracy of rule overwriting determination.

[0023] Based on the first aspect to the third implementation of the first aspect, this application provides a fourth implementation of the first aspect:

[0024] The original rule can be a packet classification rule in the network configuration rules. When the network configuration rule is a packet classification rule, each field in the original rule represents the type of packet header information.

[0025] Understandably, network verification devices process packets according to the packet classification rules in the generated set of rules for no-overlapping conflicts, which can improve the accuracy of packet processing and avoid conflicts in packet processing.

[0026] A second aspect of this application provides a network verification device that has the function of implementing the network configuration rule processing method described in the first aspect. This function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described function.

[0027] A third aspect of this application provides a network verification device, including a processor, a memory, an input / output device, and a bus;

[0028] The processor, memory, input / output devices are connected to the bus;

[0029] The processor is used to execute the method described in any one of the first aspects above.

[0030] A fourth aspect of this application provides a computer storage medium that stores a program, which, when executed by the computer, performs the method described in any of the first aspects above.

[0031] The fifth aspect of this application provides a computer program product that, when executed on a computer, performs the method described in any one of the first aspects.

[0032] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: Obtaining an original rule set, which includes multiple original rules for network configuration, each original rule including the same number of domain segments, and the domain segments in each original rule being identical; dividing multiple original rules into multiple sets with different wildcard domain segment positions; determining the covered rules in each set; removing the covered rules from the original rule set to generate a set of non-overlapping conflict rules; in this process, determining whether a verified rule is covered only requires judging based on other rules of the same rule type, rather than judging based on all other original rules except the verified rule, reducing the generation of intersection rules between different types of rules, reducing the storage amount of intersection rules, reducing the memory occupation of network devices, and improving the stability of the network system. Attached Figure Description

[0033] Figure 1This is a system architecture diagram of a network configuration rule processing method according to an embodiment of this application;

[0034] Figure 2 This is another system architecture diagram of the network configuration rule processing method according to an embodiment of this application;

[0035] Figure 3 This is another system architecture diagram of the network configuration rule processing method according to an embodiment of this application;

[0036] Figure 4(A) is a flowchart illustrating a method for processing network configuration rules in an embodiment of this application;

[0037] Figure 4(B) is a schematic diagram of the intersection rule generation in an embodiment of this application;

[0038] Figure 4(C) is another schematic diagram of intersection rule generation in the embodiments of this application;

[0039] Figure 5(A) is another flowchart illustrating the method for processing network configuration rules in an embodiment of this application;

[0040] Figure 5(B) is a schematic diagram of virtual rule generation in an embodiment of this application;

[0041] Figure 5(C) is another schematic diagram of virtual rule generation in an embodiment of this application;

[0042] Figure 6 This is a schematic diagram illustrating an application scenario of the network configuration rule processing method in this application embodiment;

[0043] Figure 7 This is a schematic diagram illustrating another application scenario of the network configuration rule processing method in the embodiments of this application;

[0044] Figure 8 This is a schematic diagram illustrating another application scenario of the network configuration rule processing method in the embodiments of this application;

[0045] Figure 9 This is a schematic diagram illustrating another application scenario of the network configuration rule processing method in the embodiments of this application;

[0046] Figure 10 This is a schematic diagram of the network verification device in an embodiment of this application. Detailed Implementation

[0047] This application provides a method and related equipment for verifying network configuration rules, which can reduce the storage amount of intersection rules and the memory occupation of network devices when determining the coverage relationship of network configuration rules, thereby improving the stability of the network system.

[0048] With the rapid development of the Internet, more and more different types of networks are connecting, making networks larger and more complex. In order to cope with the increasingly complex and massive network environment, network applications such as firewalls, intrusion detection, quality of service (QoS), and virtual private networks must provide stronger packet processing capabilities.

[0049] Packet processing typically involves processing packets according to network configuration rules, executing corresponding actions on packets that match those rules. To provide stronger packet processing capabilities, network devices also need to store a large number of rules for packet processing.

[0050] When users configure network configuration rules in network devices, conflicts may occur between rules, causing abnormal operation of the network devices. Therefore, before a rule takes effect, it is necessary to detect whether there are conflicts between rules, remove conflicting rules, and then make the rule effective so that the packet processing device can process packets according to the non-conflicting rules.

[0051] As the number of rules that need to be stored for detecting rule conflicts grows larger and larger, providing rule verification methods that can reduce the amount of rule storage has become an increasingly urgent issue.

[0052] The embodiments of this application can be applied as follows: Figure 1 The system architecture for network configuration rule verification is shown below:

[0053] The system architecture for network configuration rule verification includes a user interface 101, a rule verification module 102, and a message processing module 103.

[0054] User interface 101 provides a control interface for users, enabling them to transmit network configuration rules to the message processing device. The user interface functions include: user authentication, configuring host communication, security checks, command parsing, and viewing statistical information.

[0055] The rule verification module 102 checks whether the network configuration rules are configured correctly during the transmission of network configuration rule data to the message processing device. If there are conflicts between rules, the message processing device will make incorrect processing results based on the conflicting rules, affecting the normal operation of the network.

[0056] One type of rule conflict is an overriding conflict. When a rule is overridden, the overridden rule has no actual effect, leading to errors such as blocking legitimate users from accessing the device and allowing unauthorized users to access it. Rule verification device 102 is used to pre-detect the overriding relationship between rules before the rules take effect, identifying the overridden rules.

[0057] The message processing module 103 is used to process messages and rules. The message processing module 103 is used to split, copy, forward and filter messages, perform corresponding processing actions on messages that match the rules, and save the configuration in the hardware.

[0058] In this embodiment, the rule verification module 102 and the message processing module 103 can be in one network device or two network devices. These network devices can be routers, switches, or other forwarding devices, and are not specifically limited here.

[0059] It should be noted that network configuration rules can be packet classification rules or other rules, such as multi-domain rules; no specific restrictions are made here.

[0060] The embodiments of this application can be applied to, for example... Figure 2 The network device architecture shown is as follows:

[0061] Network device 200 can be a switch or router, etc. Figure 2 As shown, the network device 200 includes a main control board 201 and an interface board 202.

[0062] The main control board 201, also known as the main processing unit (MPU) or route processor card, is used to control and manage the various components in the network device 200, including route calculation, device management, device maintenance, and protocol processing functions. The main control board 201 includes a central processing unit 2011 and a memory 2012.

[0063] Interface board 202, also known as a line processing unit (LPU), linecard, or service board, provides various service interfaces and enables packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and Packet over SONET / SDH (POS) interfaces. Ethernet interfaces may include, for example, Flexible Ethernet Clients (FlexE Clients). Interface board 202 includes: a central processing unit 2021, a network processor 2024, a forwarding table entry memory 2022, and a physical interface card (PIC) 2023.

[0064] The central processing unit 2021 on the interface board 202 is used to control and manage the interface board 202 and communicate with the central processing unit 2011 on the main control board 201.

[0065] The network processor 2024 is used to implement packet forwarding processing. The network processor 2024 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented using an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA). Specifically, the network processor 2024 forwards received packets based on the forwarding table stored in the forwarding table entry memory 2022. If the destination address of the packet is the address of the network device 200, the packet is sent to the CPU (such as the central processing unit 2011) for processing; if the destination address of the packet is not the address of the network device 200, the next hop and outgoing interface corresponding to the destination address are looked up in the forwarding table according to the destination address, and the packet is forwarded to the outgoing interface corresponding to the destination address. Uplink packet processing may include: packet ingress interface processing, forwarding table lookup; downlink packet processing may include: forwarding table lookup, etc. In some embodiments, the central processing unit can also perform the functions of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for a forwarding chip on the interface board.

[0066] The physical interface card 2023 is used to implement physical layer interfacing functions. Raw traffic enters the interface board 202 through this card, and processed packets are sent out from the physical interface card 2023. The physical interface card 2023, also known as a daughter card, can be installed on the interface board 202. It is responsible for converting photoelectric signals into packets, performing validity checks on the packets, and forwarding them to the network processor 2024 for processing. In some embodiments, the central processing unit can also perform the functions of the network processor 2024, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for a network processor 2024 in the physical interface card 2023.

[0067] Optionally, network device 200 includes multiple interface boards. For example, network device 200 also includes interface board 204, which includes a central processing unit 2041, a network processor 2044, a forwarding table entry memory 2042, and a physical interface card 2043. The functions and implementation methods of each component in interface board 204 are the same as or similar to those of interface board 202, and will not be described in detail here.

[0068] Optionally, the network device 200 also includes a switching fabric board 203. The switching fabric board 203 can also be called a switch fabric unit (SFU). When the network device has multiple interface boards 202, the switching fabric board 203 is used to complete data exchange between the interface boards. For example, interface boards 202 and 204 can communicate through the switching fabric board 203.

[0069] The main control board 201 and the interface board 202 are coupled. For example, the main control board 201, interface boards 202 and 204, and the switching network board 203 are interconnected via a system bus and connected to the system backplane. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 201 and the interface board 202, and the main control board 201 and the interface board 202 communicate through the IPC channel.

[0070] Logically, network device 202 includes a control plane and a forwarding plane. The control plane includes a main control board 201 and a central processing unit 2021, while the forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 2022, a physical interface card 2023, and a network processor 2024. The control plane performs functions such as router operation, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the device's status. The control plane distributes the generated forwarding tables to the forwarding plane. In the forwarding plane, the network processor 2024 forwards messages received by the physical interface card 2023 based on the forwarding tables distributed by the control plane. The forwarding tables distributed by the control plane can be stored in the forwarding table entry memory 2022. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.

[0071] It's worth noting that a network device may have one or more main control boards, including a primary and a backup main control board. It may also have one or more interface boards; the more powerful the network device's data processing capabilities, the more interface boards it provides. Each interface board may also have one or more physical interface cards. A switching board may or may not exist; multiple boards can share the load and provide redundancy. In a centralized forwarding architecture, the network device may not need a switching board, as the interface boards handle the entire system's business data processing. In a distributed forwarding architecture, the network device can have at least one switching board, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of a distributed architecture network device are greater than those of a centralized architecture device. Alternatively, the network device can also be a single board, without a switching board. The functions of the interface board and the main control board are integrated on this one board. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU to perform the combined functions. This type of device has lower data exchange and processing capabilities (e.g., low-end switches or routers). The specific architecture used depends on the specific network deployment scenario, and no restrictions are imposed here.

[0072] The embodiments of this application can also be applied to, for example... Figure 3 The general computer device architecture shown is as follows:

[0073] like Figure 3 As shown, the computer device 300 includes at least one processor 301, a memory 303, and at least one communication interface 304.

[0074] Processor 301 may be, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solutions of this application. For example, processor 301 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in connection with the embodiments of this invention. The processor may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0075] Optionally, the computer device 300 also includes a bus. The bus is used to transfer information between the various components of the computer device 300. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0076] Memory 303 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 303 may exist independently and be connected to processor 301 via a bus. Memory 303 may also be integrated with processor 301.

[0077] Communication interface 304 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), or Wireless Local Area Network (WLAN). Communication interface 304 may include wired and wireless communication interfaces. Specifically, communication interface 304 may be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a WLAN interface, a cellular network communication interface, or a combination thereof. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof.

[0078] In a specific implementation, as one example, processor 301 may include one or more CPUs, such as Figure 3 The CPU0 and CPU1 shown are examples of processors. Each of these processors can be a single-core processor or a multi-core processor. A processor here can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0079] In a specific implementation, as one example, the computer device 300 may include multiple processors, such as... Figure 3 The processors 301 and 305 are shown. Each of these processors can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0080] In a specific implementation, as one example, the computer device 300 may further include output devices and input devices. The output device communicates with the processor 301 and can display information in various ways. For example, the output device may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device communicates with the processor 301 and can receive user input in various ways. For example, the input device may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0081] In some embodiments, memory 303 is used to store program code 302 for executing the solution of this application, and processor 301 can execute the program code 302 stored in memory 303. That is, computer device 300 can implement the network configuration rule processing method provided in the method embodiment through processor 301 and program code 302 in memory 303. The program code may include one or more software modules. Optionally, processor 301 itself may also store program code or instructions for executing the solution of this application.

[0082] Based on the above introduction, the verification method for network configuration rules in this application embodiment will be described below:

[0083] In this embodiment of the application, the network verification device obtains an original rule set, which includes multiple original rules for network configuration. Each original rule includes the same number of fields, and the fields in each original rule are the same as those in other original rules. The multiple original rules are divided into multiple sets with different wildcard fields. In each set, the covered rules are determined, and a set of non-overlapping conflict rules is generated for the original rules in the original rule set except for the covered rules.

[0084] It should be noted that the original rule can contain two or more field segments, or it can contain other numbers greater than or equal to two, such as three field segments. The specific number is not limited here.

[0085] It should be noted that the domain segment may include the source port (SPORT) number, or other packet header information types, such as the protocol number, or the destination network interconnection protocol (IP) address. The specifics are not limited here. This application embodiment only uses the SPORT number domain segment and the destination port (DPORT) domain segment as examples for illustration.

[0086] It should be noted that the positions of the same domain segments in each network configuration rule can be the same or different, and this is not limited here. This application embodiment only describes the case where the same domain segments are in the same position. For example, the same domain segments are in the same order in each network configuration rule. In each network configuration rule, the source IP domain segment is in the first position, and in each network configuration rule, the destination IP domain segment is in the second position.

[0087] It should be noted that in the fields of computers and communications, wildcards can be used to replace one or more characters. In the embodiments of this application, the wildcards on the SPORT and DPORT fields both represent a value range of 0-15.

[0088] In this embodiment, the network verification device can selectively generate intersection rules and determine the covered rules in the target set based on the intersection rules, or it can generate virtual rules and determine the covered rules in the target set based on the virtual rules. These will be explained separately below:

[0089] 1. The network verification device selectively generates intersection rules and determines the covered rules in the target set based on the intersection rules:

[0090] In this embodiment, the network verification device determines all types of network verification rules theoretically based on the number and position of wildcard domain segments. Each type corresponds to a set. After the original rules are divided into the corresponding sets, intersection rules are selectively generated based on the orthogonal and non-orthogonal relationships between each set and the intersection rules are divided into the corresponding sets. After determining the covered rules in the target set based on the intersection rules, a set of non-covered conflict rules that does not include the covered rules is generated.

[0091] Please refer to Figure 4(A). The method for processing network configuration rules in this embodiment includes:

[0092] 401. The network verification device obtains the original rule set.

[0093] The network verification device obtains a set of original rules, which includes the original rules used for network configuration. Each original rule in the set of original rules includes the same number of domain segments, and the domain segments included in each original rule are the same as those included in other original rules.

[0094] Please refer to Figure 4(B). In this embodiment, the original rules for network configuration included in the original rule set are shown in Table 1 below:

[0095] Table 1

[0096] Original rules Rule1(0-6, *) Rule 2 (8-15, *) Rule 3 (*, 3-6) Rule 4 (5-10, 10-14) Rule 5 (7-10, 10-14) Rule 6 (*, 12-13)

[0097] 402. The network verification device divides the original rules into P sets based on the location of the wildcard field.

[0098] The network verification device categorizes the original rules according to the number and position of wildcard fields in each rule in the original rule set. The positions of wildcard fields differ within each type. Having the same wildcard field position means that the fields containing the wildcard are in exactly the same location. For example, if there are rules A and B, both containing three fields (F1, F2, and F3), and both F1 and F2 in rule A are wildcard fields, and both F1 and F2 in rule B are also wildcard fields, then the positions of the wildcard fields in rules A and B are the same. However, if F1 in rule A is a wildcard field, and both F1 and F2 in rule B are wildcard fields, then the positions of the wildcard fields in rules A and B are different.

[0099] Rules with the same wildcard field position are placed in the same set. If the original rules can be divided into P types, then the original rules can be divided into P sets.

[0100] It should be noted that the maximum value of P can be obtained from the number of domain segments included in the original rule and whether each domain segment is a wildcard domain segment. Theoretically, the number of the most rule types in the original rule is the maximum number of domain segments. If each original rule includes M domain segments, then the theoretical maximum number of rule types, i.e., the maximum value of P, is 2 to the power of M.

[0101] Please refer to Figure 4(B). In this embodiment, each original rule in the original rule set has two domains, namely the SPORT number and the DPORT number. Therefore, theoretically, there are four rule types: (*, *), (SPORT, *), (*, DPORT), and (SPORT, DPORT). The original rules in the sets corresponding to each rule type obtained after dividing each original rule in the original rule set according to the wildcard domain are shown in Table 2 below:

[0102] Table 2

[0103] (*,*)gather (SPORT, *) set (*, DPORT) collection (SPORT, DPORT) set / Rule1(0-6, *) Rule 3 (*, 3-6) Rule 5 (7-10, 10-14) / Rule 2 (8-15, *) Rule 6 (*, 12-13) Rule 4 (5-10, 10-14)

[0104] 403. Network verification devices selectively generate intersection rules.

[0105] Among the P sets obtained by classifying the original rules, based on the different situations of wildcard field segments in different sets, any two sets among the P sets are either orthogonal or non-orthogonal. Orthogonality means that if a wildcard field segment in one set is located at a position in another set, the field segment at that position in the other set is not a wildcard field segment, and vice versa. Two sets that do not satisfy this condition are called non-orthogonal. The network verification device selects two sets with non-orthogonal relationships and generates intersection rules based on the original rules that intersect between the two sets. Original rules that intersect between sets with orthogonal relationships are not used to generate intersection rules.

[0106] Please refer to Figure 4(B). In this embodiment, in the SPORT domain segment, the (SPORT, *) set represents specific values, while the (*, DPORT) set represents a wildcard domain segment. In the DPORT domain segment, the (SPORT, *) set represents a wildcard domain segment, while the (*, DPORT) set represents specific values. Therefore, the (SPORT, *) set and the (*, DPORT) set are orthogonal. Other sets do not satisfy this condition and are all non-orthogonal. Rule1 in the (SPORT, *) set intersects with Rule4 in the (SPORT, DPORT) set, and Rule2 in the (SPORT, *) set intersects with Rule4 in the (SPORT, DPORT) set. The resulting intersection rules are shown in Table 3 below:

[0107] Table 3

[0108]

[0109] The first field value of Rule1 is 0-7, and the first field value of Rule4 is 5-10. The intersection of 0-7 and 5-10 is 5-7. The second field value of Rule1 is *, and the second field value of Rule4 is 10-14. The intersection of *(0-15) and 10-14 is 10-14. Therefore, the intersection of Rule1 and Rule4 is (5-7, 10-14). The method for generating the intersection rule of Rule2 and Rule4 is the same as the method for generating the intersection rule of Rule1 and Rule4, and will not be repeated here.

[0110] The generation of intersection rules can be visually represented in space, as shown in Figure 4(C):

[0111] Taking the original rules Rule1(0-6,*), Rule2(8-15,*), Rule3(*,3-6), and Rule4(5-10,10-14) as examples, we can illustrate how to generate intersection rules in space. Rule1 and Rule4 have a common part in two-dimensional space, and Rule2 and Rule4 also have a common part in two-dimensional space. Rule7 is generated based on the common part of Rule1 and Rule4, and Rule8 is generated based on the common part of Rule2 and Rule4. The set (SPORT,*) to which Rule1 and Rule2 belong and the set (*,DPORT) to which Rule3 belongs are orthogonal. Therefore, we do not generate intersection rules based on the common parts of Rule1 and Rule3 or the common parts of Rule2 and Rule3.

[0112] 404. The network verification device divides the intersection rules into P sets.

[0113] The network verification device divides the intersection rules into P sets based on the position of the wildcard field in the intersection rules.

[0114] Please refer to Figure 4(B). In this embodiment, the sets corresponding to the intersection rules are shown in Table 4 below:

[0115] Table 4

[0116] Intersection rules gather Rule 7 (5-6, 10-14) (SPORT, DPORT) set Rule 8 (8-10, 10-14) (SPORT, DPORT) set

[0117] 405. The network verification device determines the covered rules in the target set.

[0118] After dividing the intersection rules into corresponding sets, the rules included in each set are shown in Table 5 below:

[0119] Table 5

[0120] (*,*)gather (SPORT, *) set (*, DPORT) collection (SPORT, DPORT) set / Rule1(0-6, *) Rule 3 (*, 3-6) Rule 5 (7-10, 10-14) / Rule 2 (8-15, *) Rule 6 (*, 12-13) Rule 4 (5-10, 10-14) / / / Rule 7 (5-6, 10-14) / / / Rule 8 (8-10, 10-14)

[0121] The network verification device determines a target set from the P sets obtained by classifying the wildcard domains of the rules. It selects a rule to be verified in the target set and determines whether the rule to be verified is fully covered by another rule in the same set, or fully covered by the union of other rules in the same set. If either of the above two situations is true, the rule to be verified is determined to be a covered rule.

[0122] In this embodiment, within the (SPORT, DPORT) set, Rule 5 is fully covered by a single Rule 4, and Rule 4 is fully covered by the union of Rule 5 and Rule 7. Therefore, Rule 4 and Rule 5 are determined to be the covered rules.

[0123] It should be noted that the target set may include the original rules, other network configuration rules, such as intersection rules, and newly inserted network configuration rules; the specifics are not limited here.

[0124] 406. The network verification device generates a set of rules without coverage conflicts.

[0125] After the covered rules are determined, the covered rules are removed from the original rule set to obtain the set of non-covered conflicting rules. The intersection rules are only used for the coverage judgment of the original rules and do not participate in the generation of the set of non-covered conflicting rules.

[0126] In this embodiment, Rule4 and Rule5 are determined to be covered rules, so the set of non-covered conflicting rules includes Rule1, Rule2, Rule3 and Rule6.

[0127] 407. The network verification device sends a set of rules without coverage conflicts.

[0128] After generating a set of no-overlap rule conflicts, the network verification device needs to send the set of no-overlap rule conflicts to a device or module with message processing capabilities. The device or module with message processing capabilities will process the messages according to the original rules in the set of no-overlap rule conflicts, so that no overlap conflicts will occur during message processing.

[0129] It should be noted that a device or module with message processing capabilities can be an independent message processing device or other devices or modules with message processing capabilities, such as the forwarding plane of a network device. No specific limitation is made here.

[0130] It is understood that in this embodiment, determining whether a verified rule is covered only requires judging based on other rules of the same rule type, rather than judging based on all other original rules except the verified rule. This reduces the generation of intersection rules between different types of rules, reduces the storage of intersection rules, reduces the memory usage of network devices, and improves the stability of the network system.

[0131] Furthermore, intersection rules are selectively generated based on the original rules in the non-orthogonal set, and then the intersection rules are assigned to the corresponding set. Rule coverage judgment is performed in the target set containing the original rules and intersection rules, which improves the accuracy of rule coverage judgment. Selectively generating intersection rules based on the original rules in the non-orthogonal set reduces the generation of unnecessary intersection rules, reduces memory consumption, and improves network stability while achieving the same technical effect.

[0132] 2. The network verification device generates virtual rules and determines the rules to be covered in the target set based on the virtual rules:

[0133] In this embodiment, the network verification device determines all types of network verification rules theoretically based on the number and position of wildcard domain segments. Each type corresponds to a set. After the original rules are divided into the corresponding sets, virtual rules are generated based on the original rules whose union of the value ranges of the same domain segments is a wildcard. The virtual rules are then divided into the corresponding sets. After determining the covered rules in the target set based on the virtual rules, a set of non-overlapping conflict rules that does not include the covered rules is generated.

[0134] Please refer to Figure 5(A). The method for processing network configuration rules in this embodiment includes:

[0135] 501. The network verification device obtains the original rule set.

[0136] 502. The network verification device divides the original rules into P sets based on the location of the wildcard field.

[0137] Steps 501 to 502 in this embodiment are similar to steps 401 to 402 in the embodiment shown in FIG4(A) above, and will not be described again here.

[0138] 503. Network verification device generates virtual rules.

[0139] The network verification device generates virtual rules based on at least two original rules. The union of all value ranges corresponding to at least one domain segment in these at least two original rules is a wildcard. In addition to the domain segment whose union is a wildcard, the value ranges of all value ranges corresponding to each domain segment in these at least two original rules have a common intersection. Virtual rules can be generated after these at least two original rules satisfy the above two conditions. In the virtual rules, the value of the domain segment whose value range union with the at least two original rules is a wildcard is a wildcard. This domain segment is called the wildcard domain segment. In the virtual rules, the value ranges of other domain segments are the intersection of the value ranges of the response domain segments of these at least two original rules, that is, the minimum common part of the values.

[0140] Please refer to Figure 5(B). In this embodiment, the generation of virtual rules is shown in Table 6 below:

[0141] The SPORT field ranges of Rule1 and Rule2 in the (SPORT, *) set are 0-6 and 8-15 respectively. The SPORT field range in the (SPORT, DPORT) set is 5-10. The union of the SPORT field ranges of Rule1, Rule2, and Rule4, i.e., the union of 0-7, 8-15, and 5-10, is a wildcard. Furthermore, the value ranges of Rule1, Rule2, and Rule4 in the DPORT field all intersect. Therefore, the SPORT field of the virtual rule generated by Rule1, Rule2, and Rule4 is a wildcard, and the DPORT field is the intersection of Rule1, DPORT field *, Rule2, DPORT field * and Rule4, and DPORT field 10-14.

[0142] Table 6

[0143]

[0144] The generation of virtual rules can be visually represented in space, as shown in Figure 5(C):

[0145] Taking the original rules Rule1(0-6, *), Rule2(8-15, *), and Rule4(5-10, 10-14) as an example, we can illustrate the generation of virtual rules in space. The union of Rule1, Rule2, and Rule4 in two-dimensional space, that is, the two-dimensional spatial graph including Rule1, Rule2, and Rule4, can correspond to all the value ranges of the SPORT domain segment. In the graph formed by the union of Rule1, Rule2, and Rule4 in two-dimensional space, we select a rectangular rule that can take all the values ​​of the SPORT domain segment, namely Rule9. The SPORT domain segment of Rule9 is all the values ​​of that domain segment, and the values ​​of the DPORT domain segment are the values ​​that can form a rectangular rule, that is, the intersection of the value ranges of the original rules in the DPORT domain segment in the generated virtual rules.

[0146] 504. The network verification device divides the virtual rules into P sets.

[0147] The network verification device divides the intersection rules into P sets based on the position of the wildcard field in the virtual rules.

[0148] Please refer to Figure 5(B). In this embodiment, the set of virtual rules is shown in Table 7 below:

[0149] Table 7

[0150] Virtual rules gather Rule 9 (*, 10-14) (*, DPORT) collection

[0151] 505. The network verification device determines the covered rules in the target set.

[0152] After the virtual rules are divided into corresponding sets, the rules included in each set are shown in Table 8 below:

[0153] Table 8

[0154] (*,*)gather (SPORT, *) set (*, DPORT) collection (SPORT, DPORT) set \ Rule1(0-6, *) Rule 3 (*, 3-6) Rule 5 (7-10, 10-14) \ Rule 2 (8-15, *) Rule 6 (*, 12-13) Rule 4 (5-10, 10-14) \ \ Rule 9 (*, 10-14) \

[0155] Step 505 in this embodiment is similar to step 405 in the embodiment shown in Figure 4(A), and will not be described again here.

[0156] Please refer to Figure 5(B). In this embodiment, in the (*, DPORT) set, Rule6 (*, 12-13) is completely covered by a single Rule9 (*, 10-14), so Rule6 is determined to be the covered rule.

[0157] 506. The network verification device generates a set of rules without coverage conflicts.

[0158] Step 506 in this embodiment is similar to step 406 in the embodiment shown in Figure 4(A), and will not be described again here.

[0159] Please refer to Figure 5(B). In this embodiment, Rule 6 is the overridden rule, so the set of non-overriding conflict rules includes Rule 1, Rule 2, Rule 3, Rule 4 and Rule 5.

[0160] 507. The network verification device sends a set of rules without coverage conflicts.

[0161] Step 506 in this embodiment is similar to step 406 in the embodiment shown in Figure 4(A), and will not be described again here.

[0162] It is understood that in this embodiment, determining whether a verified rule is covered only requires judging based on other rules of the same rule type, rather than judging based on all other original rules except the verified rule. This reduces the generation of intersection rules between different types of rules, reduces the storage of intersection rules, reduces the memory usage of network devices, and improves the stability of the network system.

[0163] Furthermore, virtual rules are generated based on the original rules whose wildcard is the union of the value ranges of the same domain segment, and the virtual rules are divided into corresponding sets. Rule coverage judgment is then performed in the target set containing the original rules and virtual rules, which improves the accuracy of rule coverage judgment.

[0164] The above describes how to determine whether there is an overlay conflict in the original rules based on selectively generated intersection rules and virtual rules. In practical applications, selectively generated intersection rules and virtual rules are often combined to improve the accuracy of overlay determination. The following describes an application scenario of an embodiment of this application:

[0165] Please see Figure 6 The network verification device generates both intersection rules and virtual rules based on the original rules in the non-orthogonal sets. It does not restrict the order in which the intersection rules and virtual rules are generated. Based on the sets to which the intersection rules and virtual rules are assigned, it performs rule coverage judgment within each set.

[0166] First, the network verification device obtains the original rule set. In this embodiment, the original rule set is shown in Table 2, the generated intersection rules are shown in Table 4, and the generated virtual rules are shown in Table 8. The rules included in each set are shown in Table 9 below:

[0167] Table 9

[0168] (*,*)gather (SPORT, *) set (*, DPORT) collection (SPORT, DPORT) set \ Rule1(0-6, *) Rule 3 (*, 3-6) Rule 5 (7-10, 10-14) \ Rule 2 (8-15, *) Rule 6 (*, 12-13) Rule 4 (5-10, 10-14) \ \ Rule 9 (*, 10-14) Rule 7 (5-6, 10-14) Rule 8 (8-10, 10-14)

[0169] In the (SPORT, DPORT) set, Rule 4 and Rule 5 are determined to be the overridden rules based on the intersection rules Rule 7 and Rule 8. In the (*, DPORT) set, Rule 6 is determined to be the overridden rule based on the virtual rule Rule 9. The generated set of non-overriding conflict rules includes Rule 1, Rule 2 and Rule 3.

[0170] In summary, in practical applications, if the number of original rules used for network configuration is very large, putting significant pressure on the network device's memory, the original rules can be divided into different sets based on the position of wildcards. Within the target set, only the original rules are used to determine the rules to be overridden, reducing the generation and storage of other rules besides the original rules, thus reducing memory pressure. Please refer to [link to relevant documentation]. Figure 7 Another application scenario of this application includes:

[0171] 701. The network verification device obtains the original rule set.

[0172] 702. The network verification device divides the original rules into P sets based on the location of the wildcard field.

[0173] Steps 701 to 702 in this embodiment are similar to steps 401 and 402 in the embodiment shown in Figure 4(A), and will not be described in detail here.

[0174] 703. The network verification device determines the covered rules in the target set.

[0175] The target set includes only the original rules. The network verification device selects one original rule from the target set as the rule to be verified and determines whether the rule to be verified is fully covered by another original rule in the same set, or fully covered by the union of multiple other original rules. If either of the above two conditions is met, it is determined that the rule to be verified is covered.

[0176] 704. Generate a set of rules that do not cover conflicts.

[0177] Optionally, the method further includes step 705:

[0178] 705. Send a set of rules for no-overlay conflicts.

[0179] Steps 704 to 705 in this embodiment are similar to steps 406 and 407 in the embodiment shown in Figure 4(A), and will not be described in detail here.

[0180] In conjunction with the above description, this application provides another application scenario for the network configuration rule processing method. Please refer to [link to relevant documentation]. Figure 8 :

[0181] The network configuration rule processing method in this embodiment can be used to process network configuration rules comprising two domain segments, or to process network configuration rules comprising N domain segments, where N is a positive integer. Furthermore, the original rules can be overridden based on intersection rules and virtual rules separately, or the original rules can be overridden based on intersection rules and virtual rules within the same set.

[0182] It should be noted that in this embodiment, the network verification device can generate intersection rules based on the original rules, or it can generate intersection rules based on other rules, such as generating intersection rules based on virtual rules. The specific method is not limited here.

[0183] It should be noted that this embodiment only illustrates the following scenario: Intersection rules generated between rules within a rule type are not generated; traditional algorithms are used within the rule type to construct an intersection covering structure. Intersection rules within a type do not participate in generating intersection rules for other types. Intersection rules do not participate in the generation of any virtual rules.

[0184] It should be noted that in this embodiment, only the first field segment is F1, the second field segment is F2, and the third field segment is F3 as an example for explanation. The * in the F1, F2 and F3 field segments all represent 0-15.

[0185] First, the network verification device obtains the original rule set, which is shown in Table 10 below:

[0186] Table 10

[0187] Original rules Rule1(*,*,5-10) Rule2(*, 4-12, 3-7) Rule 3 (0-7, 2-13, 4-8) Rule 4 (8-15, 3-14, 5-12)

[0188] The intersection rules generated by the network verification device are shown in Table 11 below:

[0189] Table 11

[0190]

[0191] The generated virtual rules are shown in Table 12 below:

[0192] Table 12

[0193]

[0194] The rules included in each set are shown in Table 13 below:

[0195] Table 13

[0196]

[0197] In the set (*, F2, F3), Rule2 is fully covered by the union of the intersection rule Rule5 and the virtual rule Rule10, so Rule2 is determined to be the covered rule. The generated set of non-covering conflicting rules includes Rule1, Rule3 and Rule4.

[0198] Based on the above description, another application scenario of the network configuration rule processing method in this application embodiment is described below. Please refer to [link / reference]. Figure 9 :

[0199] When extending this to scenarios involving coverage judgment of original rules comprising N domain segments, it is necessary to define an orthogonal relationship graph based on the orthogonal relationship of sets of different rule types, generate intersection rules between non-orthogonal original rules and generate virtual rules based on the orthogonal relationship graph, and then perform coverage judgment of original rules comprising N domain segments.

[0200] In this embodiment, only the orthogonal relationship graph of the original rules, which includes three domain segments, is used as an example for introduction. The three domain segments are the source IP address domain segment, the destination IP address domain segment, and the port number domain segment.

[0201] Rule Type (T): Rules are categorized into different types based on whether they contain wildcards in each domain segment. The three domain segments correspond to (*, *, *), (sip, *, *), etc., for a total of 2... 3 =8 types.

[0202] Rule Dimension (D = |T|): The number of wildcards in a rule is called its dimension. It's easy to see that rules of the same type will have the same dimension. For example, in the diagram below, (*, *), the dimension of (sip, *), the dimension of (*), etc., is 3.

[0203] Orthogonality of rule types: If the intersection of rules from two different types T1 and T2 lies in a new type T3, and |T3| < |T1|, |T3| < |T2|, then types T1 and T2 are said to be orthogonal. As shown in the diagram, the intersection type of (sip, *) and (*, dip, *) is (sip, dip, *). Since the dimension of the intersection type is smaller, the two types (sip, *) and (*, dip, *) are orthogonal. This definition of orthogonality is equivalent to the orthogonality definition in the claims and embodiments.

[0204] Orthogonal relation graph of rule types: Based on the above concepts of rule types and rule dimensions, configuration rules can be represented as follows: Figure 6 The diagram shows the orthogonal relationship between rule types. Based on the inclusion relationships of each rule type, the corresponding orthogonal relationship diagram can be obtained. The direction of the arrows in the orthogonal relationship diagram indicates "inclusion". In the orthogonal relationship diagram of rule types, two unreachable rule types must have an orthogonal relationship.

[0205] Rule grouping: When inserting rules of different types, they are directly inserted into the corresponding rule type. This can be viewed as a grouping of rules. Rule overriding is only checked within each rule type. Within each rule type, rule overriding is checked every time a new rule (original rule, intersection rule, virtual rule) is inserted.

[0206] The criteria for determining whether to generate intersection rules are: intersection nodes of rules between two types with orthogonal relationships do not need to be generated; intersection nodes of rules between non-orthogonal types must be generated.

[0207] Packet equivalence class (PEC) calculation: Since this embodiment does not store all intersection relationships between rules, the algorithm cannot accurately calculate the PEC of each rule. However, in practice, it is sufficient to focus on whether the PEC of each rule is 0. Therefore, this embodiment aims to accurately calculate whether the PEC of each rule is 0, rather than precisely calculating the PEC of each rule.

[0208] This embodiment can perform rule coverage judgment based on orthogonal relation graphs. The detailed process is as follows:

[0209] (1) Recursively search from the root node of the orthogonal relationship graph of rule types. In this embodiment, the root node is (*, *, *). If the current type is not orthogonal to other rule types, then perform intersection rule judgment and generation. The specific method for generating intersection rules is as follows: Figures 2 to 3 The embodiments shown are similar, and will not be described in detail here;

[0210] (2) Starting from the leaf nodes of the orthogonal relationship graph of rule types, merge each dimension one by one to determine whether merging can generate high-dimensional virtual rules. In this embodiment, the rule type nodes other than the root node are called leaf nodes. The specific method for generating virtual rules and... Figures 2 to 3 The embodiments shown are similar, and will not be described in detail here.

[0211] The network verification device in the embodiments of this application is described below:

[0212] Please see Figure 10 In the embodiments of this application, Figure 10 The network verification device shown includes an acquisition unit 1001, a partitioning unit 1002, a determination unit 1003, and a generation unit 1004.

[0213] Acquisition unit 1001 is used to acquire an original rule set, which includes N original rules, where N is greater than or equal to 2. Each of the N original rules includes the same M domain segments, where M is greater than or equal to 2. Acquisition unit 1001 is used to execute step 401 in the embodiment shown in Figure 4(A), and step 501 in the embodiment shown in Figure 5(A). Figure 7 The method described in step 701 of the illustrated embodiment will not be described in detail here;

[0214] The partitioning unit 1002 is used to partition N original rules into P sets according to the position of wildcard field segments, wherein the position of the wildcard field segments is different in each of the P sets, and the wildcard field segment is a field segment containing wildcards. The partitioning unit 1002 is used to execute step 402 in the embodiment shown in Figure 4(A), step 502 in the embodiment shown in Figure 5(A), and step 502. Figure 7 The method described in step 702 of the illustrated embodiment will not be described in detail here;

[0215] Determining unit 1003 is used to determine the covered rule in the target set, where the target set is any one of P sets. Determining unit 1003 is used to execute step 405 in the embodiment shown in Figure 4(A), step 505 in the embodiment shown in Figure 5(A), and step 505. Figure 7 The method described in step 703 of the illustrated embodiment will not be described in detail here;

[0216] Generation unit 1004 is used to remove covered rules from the original rule set to generate a set of non-covering conflicting rules. Generation unit 1004 is used to execute step 406 in the embodiment shown in Figure 4(A), step 506 in the embodiment shown in Figure 5(A), and step 506. Figure 7 The method described in step 704 of the illustrated embodiment will not be described in detail here.

[0217] Optionally, in the above Figure 10Based on the corresponding embodiments, in another embodiment of the network verification device provided in this application,

[0218] The generation unit 1004 is specifically used to generate the intersection rule of the first original rule and the second original rule among N original rules. The first original rule and the second original rule intersect. The first original rule belongs to the first set among P sets, and the second original rule belongs to the second set among P sets. The first set and the second set are different. The generation unit 1004 is used to execute the method described in step 403 in the embodiment shown in Figure 4(A). The specific details will not be repeated here.

[0219] Unit 1003 is specifically used to divide the intersection rules into P sets based on the position of the wildcard field.

[0220] The first set and the second set are not orthogonal. The M domain segments include the first domain segment and the second domain segment. Orthogonality means that the value of the first original rule in the first domain segment includes wildcards, and the value of the second original rule in the first domain segment does not include wildcards, and the value of the first original rule in the second domain segment does not include wildcards, and the value of the second original rule in the second domain segment includes wildcards. The determining unit 1003 is used to execute the method described in step 404 of the embodiment shown in Figure 4(A), and the specific details will not be repeated here.

[0221] The generation unit 1004 is specifically used to generate a virtual rule based on S original rules out of N original rules, where S is greater than or equal to 2 and less than or equal to N. The union of the S first value ranges of the S original rules in the first domain segment is the complete set of the value ranges of the first domain segment. All S second value ranges of the S original rules in the second domain segment intersect. The first domain segment of the virtual rule includes wildcards, and the value of the second domain segment of the virtual rule is the intersection of the S second value ranges. The generation unit 1004 is used to execute the method described in step 503 in the embodiment shown in Figure 5(A), and the specific details will not be repeated here.

[0222] The partitioning unit 1002 is specifically used to partition the virtual rules into P sets. The partitioning unit 1002 is used to execute the method described in step 504 of the embodiment shown in Figure 5(A), and the specific details will not be repeated here.

[0223] The original rule is a message classification rule, where each of the M field segments represents the type of message header information.

[0224] In the embodiments of this application Figures 4(A) to 9 The processing method for the network configuration rules shown can optionally be achieved through... Figure 10 The network authentication device shown is implemented as follows: the network authentication device is, for example, as... Figure 2 The network devices shown, such as network authentication devices, are switches, routers, etc. Alternatively, the network authentication device may be, for example, a switch, a router, etc. Figure 3 The computer equipment shown, such as network authentication equipment, is a host, server, or personal computer.

[0225] when Figure 10 When the network verification device shown is implemented as a network device 200, the acquisition unit 1001, the partitioning unit 1002, the determination unit 1003, and the generation unit 1004 are software modules in the program code, executed by the processors in the main control board 201 and the interface board 202 of the network device 200. The processors in the main control board 201 and the interface board 202 of the network device 200 are used to execute, for example... Figures 4(A) to 9 The method for processing network configuration rules is shown.

[0226] when Figure 10 When the network verification device shown is implemented as a computer device 300, the acquisition unit 1001, the partitioning unit 1002, the determination unit 1003, and the generation unit 1004 are software modules in the program code, stored in the memory 302 of the network device 300, and the processor 301 of the computer device 300 is used to execute, for example... Figures 4(A) to 9 The method for processing network configuration rules is shown.

[0227] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0228] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0229] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0230] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0231] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for processing network configuration rules, characterized in that, include: Obtain an original rule set, which includes N original rules, where N is greater than or equal to 2, and each of the N original rules includes the same M domain segments, where M is greater than or equal to 2; The N original rules are divided into P sets according to the position of the wildcard field segment, wherein the position of the wildcard field segment is different in each of the P sets, and the wildcard field segment is a field segment that includes wildcards. Determine the covered rules in the target set, where the target set is any one of the P sets; Remove the covered rules from the original rule set to generate a set of non-covered conflicting rules.

2. The method for processing network configuration rules according to claim 1, characterized in that, The method further includes: Generate the intersection rule of the first original rule and the second original rule among the N original rules. The first original rule and the second original rule intersect. The first original rule belongs to the first set among the P sets. The second original rule belongs to the second set among the P sets. The first set and the second set are different. The intersection rules are divided into the P sets based on the position of the wildcard field.

3. The method for processing network configuration rules according to claim 2, characterized in that, The first set and the second set are not orthogonal. The M domain segments include the first domain segment and the second domain segment. The orthogonal relationship means that the value of the first original rule in the first domain segment includes the wildcard, and the value of the second original rule in the first domain segment does not include the wildcard, and the value of the first original rule in the second domain segment does not include the wildcard, and the value of the second original rule in the second domain segment includes the wildcard.

4. The method for processing network configuration rules according to claim 3, characterized in that, The M domain segments include the first domain segment and the second domain segment, and the method further includes: A virtual rule is generated based on S original rules out of the N original rules, where S is greater than or equal to 2 and less than or equal to N. The union of the S first value ranges of the S original rules in the first domain segment is the complete set of the value ranges of the first domain segment. All S second value ranges of the S original rules in the second domain segment intersect. The first domain segment of the virtual rule includes the wildcard, and the value of the second domain segment of the virtual rule is the intersection of the S second value ranges. The virtual rules are divided into the P sets.

5. The method for processing network configuration rules according to claim 4, characterized in that, The original rule is a message classification rule, and each of the M field segments represents the type of message header information.

6. A network verification device, characterized in that, include: An acquisition unit is used to acquire an original rule set, which includes N original rules, where N is greater than or equal to 2, and each of the N original rules includes the same M domain segments, where M is greater than or equal to 2. A partitioning unit is used to partition the N original rules into P sets according to the position of the wildcard field segment, wherein the position of the wildcard field segment is different in each of the P sets, and the wildcard field segment is a field segment that includes wildcards. A determining unit is used to determine the covered rule in a target set, wherein the target set is any one of the P sets; A generation unit is used to remove the covered rules from the original rule set to generate a set of rules without overlapping conflicts.

7. The network verification device according to claim 6, characterized in that, The generation unit is specifically used to generate the intersection rule of the first original rule and the second original rule among the N original rules. The first original rule and the second original rule intersect. The first original rule belongs to the first set among the P sets, and the second original rule belongs to the second set among the P sets. The first set and the second set are different. The determining unit is specifically used to divide the intersection rule into the P sets according to the position of the wildcard field.

8. The network verification device according to claim 7, characterized in that, The first set and the second set are not orthogonal. The M domain segments include the first domain segment and the second domain segment. The orthogonal relationship means that the value of the first original rule in the first domain segment includes the wildcard, and the value of the second original rule in the first domain segment does not include the wildcard, and the value of the first original rule in the second domain segment does not include the wildcard, and the value of the second original rule in the second domain segment includes the wildcard.

9. The network verification device according to claim 8, characterized in that, The M domain segments include the first domain segment and the second domain segment; The generation unit is specifically used to generate a virtual rule based on S original rules out of the N original rules, where S is greater than or equal to 2 and less than or equal to N, the union of the S first value ranges of the S original rules in the first domain segment is the complete set of the value ranges of the first domain segment, the S second value ranges of the S original rules in the second domain segment all intersect, the first domain segment of the virtual rule includes the wildcard, and the value of the second domain segment of the virtual rule is the intersection of the S second value ranges; The partitioning unit is specifically used to partition the virtual rules into the P sets.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains a program that, when executed by the computer, performs the method as described in any one of claims 1 to 5.

Images