A FlexE interface security isolation test verification method and system

Abstract

The present invention discloses a FlexE interface security isolation test verification method and system. The present invention adopts a traffic model to configure traffic for different services, sends data to different FlexE clients of the FlexE interface according to the traffic configuration, and applies it to different logical slice channels for data feedback. According to the sent and fedback data, the security isolation of the FlexE interface can be effectively verified, and a concise and effective test verification method is provided for the security isolation of the FlexE interface of router devices and SPN devices using the FlexE technology.

Description

Technical Field

[0001] The present invention relates to a FlexE interface safety isolation test verification method and system, belonging to the field of interface testing. Background Art

[0002] For the comprehensive carrying of multiple services, especially in the power system, different types of services need to have a certain degree of security isolation, such as power dispatching production services with high real-time requirements and management and marketing services with low real-time requirements. At present, the network topology of router + SDH (Synchronous Digital Hierarchy) is used to realize the transmission of service data. The router configures different MPLS VPN (Multi-Protocol Label Switching Virtual Private Network) for different types of services to carry, and SDH configures different time slots for different VPNs (Virtual Private Network) to ensure the security isolation between services. FlexE (Flexible Ethernet) technology integrates routing and transmission. In theory, it has both the packet transmission characteristics of routers and the TDM (Time Division Multiplexing) service isolation of SDH. However, for router equipment or SPN (Slicing Packet Network) equipment using FlexE technology, whether the FlexE interface actually provided by it has security isolation needs to be tested and verified, and there is currently no test and verification method. Summary of the invention

[0003] The present invention provides a FlexE interface security isolation test verification method and system, which solves the problems disclosed in the background technology.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A FlexE interface security isolation test verification method includes:

[0006] If a test verification is performed within the first FlexE interface, traffic configuration is performed for different services according to the preset test traffic model within the interface, and data is sent to different FlexE clients of the first FlexE interface according to the traffic configuration of different services. Based on the data fed back by the FlexE client, the data sent, and the preset judgment logic that matches the test traffic model within the interface, a security isolation judgment is performed within the first FlexE interface; wherein, different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels.

[0007] It also includes the steps of inter-interface test verification, which include:

[0008] If a test verification is performed between the first FlexE interface and the second FlexE interface, traffic is configured for different services according to the preset test traffic model between interfaces, and data is sent to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface for traffic configuration of different services. According to the data fed back by the FlexE client, the data sent, and the preset judgment logic matching the test traffic model between interfaces, the security isolation between the first FlexE interface and the second FlexE interface is judged; wherein, different FlexE clients of the second FlexE interface are respectively bound to different logical slice channels, and the configuration of the logical slice channel of the first FlexE interface and the logical slice channel of the second FlexE interface that transmit the same service data is consistent.

[0009] Services include comprehensive data network services, specific data network services, and substation multicast services;

[0010] The preset test traffic models in the interface include light load traffic model, heavy load traffic model and overload traffic model;

[0011] The preset inter-interface test traffic model includes a heavy load traffic model.

[0012] Data network integrated services: covers VLAN2~VLAN4094, traffic priority is set to N5~N7, frame length covers 128 bytes to 1518 bytes, IP address covers 192.168.0.X / 24 network segment, MAC address covers 00-00-01-00-00-XX, and data packets are configured with MPLS VPN labels;

[0013] Specific data network service: VLAN is A, A∈(2,4094), frame length is 256 bytes, IP address, MAC address and MPLSVPN label overlap with the IP address, MAC address and MPLSVPN label of a certain flow in the data network comprehensive service, and the flow priority is set to N0~N2;

[0014] Substation multicast service: covers VLAN2~VLAN4094, the traffic priority is set to N4, the frame length covers 128 bytes to 1518 bytes, and the MAC address covers 01-0C-CD-04-00-XX; among which, the traffic priority is N0~N7 from low to high.

[0015] The traffic model configures traffic for different services, including:

[0016] The light load traffic model configures traffic for different services: the data network integrated service sending data rate is A1% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A2% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is A2% of the corresponding logical slice bandwidth; where 0 <A2%<A1%≤50% ;

[0017] The heavy-load traffic model configures traffic for different services: the data network integrated service sending data rate is 100% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A3% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is A3% of the corresponding logical slice bandwidth; among them, 50% <A3%<100%;

[0018] The overload traffic model configures traffic for different services: the data network comprehensive service sending data rate is A4% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A3% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is 100% of the corresponding logical slice bandwidth; among which, A4%>100%.

[0019] When performing the test verification in the first FlexE interface, the judgment logic matching the light load traffic model is: if the data fed back by the FlexEclient is consistent with the sent data, it is determined that there is no crosstalk between the services in the first FlexE interface under light load traffic;

[0020] When performing the test verification in the first FlexE interface, the judgment logic matching the heavy load traffic model is: if the data fed back by the FlexEclient is consistent with the data sent, it is determined that there is no crosstalk between the services in the first FlexE interface under the heavy load traffic;

[0021] When performing test verification within the first FlexE interface, the judgment logic matching the overload traffic model is: if the data network comprehensive service data packet loss is within the preset range, the sent specific data network service data is consistent with the feedback specific data network service data, the forwarding delay distribution of all data packets of the specific data network service is relatively uniform, and the sent substation multicast service data is consistent with the feedback substation multicast service data, then it is determined that there is no crosstalk between the services in the first FlexE interface under overload traffic.

[0022] When performing the test verification between the first FlexE interface and the second FlexE interface, the judgment logic matching the heavy-load traffic model is: if the data fed back by the FlexE client is consistent with the sent data, it is determined that there is no crosstalk between the services between the first FlexE interface and the second FlexE interface under the heavy-load traffic.

[0023] A FlexE interface security isolation test verification system, comprising:

[0024] The in-interface test module, if performing in-interface test verification on the first FlexE interface, configure traffic for different services according to the preset in-interface test traffic model, send data to different FlexE clients of the first FlexE interface according to the traffic configuration of different services, and make a security isolation judgment on the first FlexE interface based on the data fed back by the FlexE client, the data sent, and the preset judgment logic matching the in-interface test traffic model; wherein, different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels.

[0025] The inter-interface test module, if a test verification is performed between the first FlexE interface and the second FlexE interface, traffic configuration is performed for different services according to the preset inter-interface test traffic model, and traffic configuration for different services is performed to send data to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface respectively, and the security isolation judgment between the first FlexE interface and the second FlexE interface is performed according to the data fed back by the FlexEclient, the data sent, and the preset judgment logic matching the inter-interface test traffic model; wherein different FlexEclients of the second FlexE interface are respectively bound to different logical slice channels, and the configuration of the first FlexE interface logical slice channel and the second FlexE interface logical slice channel that transmit the same service data are consistent.

[0026] A computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, which, when executed by a computing device, cause the computing device to perform a FlexE interface security isolation test verification method.

[0027] The beneficial effects achieved by the present invention are as follows: the present invention adopts a traffic model to configure traffic for different services, sends data to different FlexE clients of the FlexE interface according to the traffic configuration, and applies it to different logical slice channels for data feedback. According to the sent and feedback data, the security isolation of the FlexE interface can be effectively verified, providing a concise and effective test and verification method for the security isolation of the FlexE interface of router devices and SPN devices using FlexE technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Flowchart of the FlexE interface security isolation test verification method;

[0029] Figure 2 Physical topology diagram for implementing FlexE interface security isolation test verification;

[0030] Figure 3 Flowchart of the test verification method within the interface;

[0031] Figure 4 The flowchart of the test verification method between interfaces is shown in FIG. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0033] A FlexE interface security isolation test verification method includes:

[0034] If a test verification is performed within the first FlexE interface, traffic configuration is performed for different services according to the preset test traffic model within the interface, and data is sent to different FlexE clients of the first FlexE interface according to the traffic configuration of different services. Based on the data fed back by the FlexE client, the data sent, and the preset judgment logic that matches the test traffic model within the interface, a security isolation judgment is performed within the first FlexE interface; wherein, different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels.

[0035] The above method uses a traffic model to configure traffic for different services, sends data to different FlexE clients of the FlexE interface according to the traffic configuration, and applies it to different logical slice channels for data feedback. According to the sent and fed back data, the security isolation of the FlexE interface can be effectively verified, providing a concise and effective test and verification method for the security isolation of the FlexE interface of router devices and SPN devices using FlexE technology.

[0036] like Figure 1 In addition to the test within the interface, it also further includes a test verification step between interfaces, specifically: if a test verification is performed between the first FlexE interface and the second FlexE interface, traffic configuration is performed for different services according to the preset test traffic model between interfaces, and traffic configuration for different services is performed to send data to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface respectively, and a security isolation judgment is performed between the first FlexE interface and the second FlexE interface based on the data fed back by the FlexE client, the data sent, and the preset judgment logic matching the test traffic model between interfaces; wherein different FlexE clients of the second FlexE interface are respectively bound to different logical slice channels, and the configuration of the logical slice channel of the first FlexE interface and the logical slice channel of the second FlexE interface that transmit the same service data is consistent.

[0037] In order to implement the above method, it is necessary to construct Figure 1 The structure shown in the figure includes a traffic generator and a FlexE interface. The above method is mainly implemented in the traffic generator. There are two FlexE interfaces in the figure. The transceiver ends of the first FlexE interface are A1 and B1 respectively, and the transceiver ends of the second FlexE interface are A2 and B2 respectively. Each FlexE interface is configured with a FlexE Group (FlexE interface group) and 3 FlexE Clients (FlexE interface clients), and error correction parameters are enabled; among which, the 3 FlexE Clients of the first FlexE interface can be recorded as FlexE Client 1, FlexE Client 2, and FlexE Client 3, and the 3 FlexE Clients of the second FlexE interface can be recorded as FlexE Client 4, FlexE Client 5, and FlexE Client 6.

[0038] Figure 2In the figure, two groups of logical slice channels are configured for the first FlexE interface and the second FlexE interface respectively. The first group of logical slice channels includes logical slice channel Slice1-1, logical slice channel Slice1-2, and logical slice channel Slice1-3, and the second group of logical slice channels includes logical slice channel Slice2-1, logical slice channel Slice2-2, and logical slice channel Slice2-3.

[0039] Different FlexE clients of the first FlexE interface are bound to different logical slice channels. For example, in the figure, logical slice channel Slice1-1 is bound to FlexE Client 1, logical slice channel Slice1-2 is bound to FlexE Client 2, and logical slice channel Slice1-3 is bound to FlexE Client 3. Different FlexE clients of the second FlexE interface are bound to different logical slice channels. For example, in the figure, logical slice channel Slice2-1 is bound to FlexE Client 4, logical slice channel Slice2-2 is bound to FlexE Client 5, and logical slice channel Slice2-3 is bound to FlexE Client 6. 6 Binding; The configurations of the first FlexE interface logical slice channel and the second FlexE interface logical slice channel that transmit the same service data are consistent. For example, if logical slice channel Slice1-1 and logical slice channel Slice2-1 transmit the same service data, the two logical slice channels are configured consistently and are both allocated 2 5G time slots. Similarly, logical slice channel Slice1-2 and logical slice channel Slice2-2 are configured consistently and are both allocated 1 5G time slot. Logical slice channel Slice1-3 and logical slice channel Slice2-3 are configured consistently and are both allocated 1 5G time slot.

[0040] Based on the above structure, testing and verification can be carried out. During testing and verification, the business model configuration can be used to simulate the services of different types of applications in the power system. The services mainly include data network comprehensive services, specific data network services, and substation multicast services, which are recorded as service 1, service 2, and service 3 respectively. These three different services can be configured with different business modules, as follows:

[0041] Service module configuration service 1: configure multiple flows, covering VLAN2~VLAN4094, set the flow priority to N5~N7, frame length covers 128 bytes to 1518 bytes, IP address covers 192.168.0.X / 24 network segment, MAC address covers 00-00-01-00-00-XX, data packet is configured with MPLS VPN label, and service 1 is used as background flow; among them, the flow priority is N0~N7 from low to high, which can be expressed as 0~7 with specific numbers, 7 is the highest priority, generally one flow has one priority, and multiple flows can be set with multiple priorities.

[0042] The specific configuration of service 1 can be: covering VLAN2 to VLAN4094, setting the traffic priority to 7, the frame length covering 128 bytes to 1518 bytes, the IP (Internet Protocol) address covering the 192.168.0.X / 24 network segment, the MAC (Media Access Control) address covering 00-00-01-00-00-XX, and the data packet being configured with an MPLS VPN (Multi-Protocol Label Switching Virtual Private Network) label.

[0043] The service module configures service 2: Configure VLAN (Virtual Local Area Network) to A, A∈(2,4094), frame length to 256 bytes, IP address, MAC address and MPLS VPN label to overlap with the IP address, MAC address and MPLS VPN label of a certain flow in service 1, set the flow priority to N0~N2, and use service 2 as test flow.

[0044] The specific configuration of service 2 can be: VLAN is A, A∈(2,4094), frame length is 256 bytes, IP address, MAC address and MPLS VPN label overlap with the IP address, MAC address and MPLS VPN label of a certain flow in the data network integrated service, and the flow priority is set to 1.

[0045] Service module configuration service 3: Configure multiple Layer 2 multicast traffic, covering VLAN2~VLAN4094, set the traffic priority to N4, frame length covers 128 bytes to 1518 bytes, MAC address covers 01-0C-CD-04-00-XX, and service 3 is used as background traffic.

[0046] The specific configuration of Service 3 can be: covering VLAN 2 to VLAN 4094, setting the traffic priority to 4, covering the frame length from 128 bytes to 1518 bytes, and covering the MAC address 01-0C-CD-04-00-XX.

[0047] The above method mainly includes in-interface test verification and inter-interface test verification. Taking the first FlexE interface as an example for in-interface test verification, it mainly detects whether there is crosstalk between services within the first FlexE interface. Taking the first FlexE interface and the second FlexE interface as an example for inter-interface test verification, it mainly detects whether there is crosstalk between services between the first FlexE interface and the second FlexE interface.

[0048] During test verification, it is necessary to use traffic models to configure traffic for different services. The traffic models mainly include light-load traffic model, heavy-load traffic model, and over-load traffic model. Among them, during in-interface test verification, all models need to be used. During inter-interface test verification, since the bearing isolation of the three traffic models has been verified during in-interface testing, and the heavy-load model is the case with the highest requirement for interface processing capabilities, to simplify the test verification steps, the inter-interface test verification can only use the heavy-load traffic model.

[0049] As Figure 3 shown, the in-interface test verification method can be as follows:

[0050] 1) Configure traffic for different services according to the preset in-interface test traffic model;

[0051] Configure traffic for different services with the light-load traffic model: The data rate of the data network integrated service is A1% of the corresponding logical slice bandwidth; the data rate of the specific data network service is A2% of the corresponding logical slice bandwidth; the data rate of the substation multicast service is A2% of the corresponding logical slice bandwidth. Among them, 0 < A2% < A1% ≤ 50%, generally A1% = 50%, that is, 5 Gbit / s, and A2% = 20%, that is, 1 Gbit / s;

[0052] Configure traffic for different services with the heavy-load traffic model: The data rate of the data network integrated service is 100% (10 Gbit / s) of the corresponding logical slice bandwidth; the data rate of the specific data network service is A3% of the corresponding logical slice bandwidth; the data rate of the substation multicast service is A3% of the corresponding logical slice bandwidth. Among them, 50% < A3% < 100%, generally A3% = 80%, that is, 4 Gbit / s;

[0053] The overload traffic model configures traffic for different services: the data network comprehensive service sending data rate is A4% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A3% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is 100% of the corresponding logical slice bandwidth (5Gbit / s); among them, A4%>100%, generally A4%=110%, that is, 11Gbit / s.

[0054] 2) Send data to different FlexE clients of the first FlexE interface according to the traffic configuration of different services.

[0055] 3) Receive data fed back by the FlexE client of the first FlexE interface.

[0056] 4) Based on the data fed back by the FlexE client, the data sent, and the preset judgment logic that matches the test traffic model in the interface, the security isolation judgment in the first FlexE interface is performed;

[0057] The judgment logic matching the light load traffic model is: if the data fed back by the FlexE client is consistent with the data sent, it is determined that there is no crosstalk between the services in the first FlexE interface under light load traffic;

[0058] The judgment logic matching the heavy load traffic model is: if the data fed back by the FlexE client is consistent with the data sent, it is determined that there is no crosstalk between the services in the first FlexE interface under heavy load traffic;

[0059] The judgment logic matching the overload traffic model is: if the packet loss of the data network comprehensive service data is within the preset range (generally set to a packet loss of about 50%), the sent specific data network service data is consistent with the fed-back specific data network service data, the forwarding delay distribution of all data packets of the specific data network service is relatively uniform (that is, there is no large jitter in the data transmission delay), and the sent substation multicast service data is consistent with the fed-back substation multicast service data, then it is determined that there is no crosstalk between the services in the first FlexE interface under overload traffic.

[0060] When testing and verifying within the interface, you can first verify the situation under light load flow, then verify the situation under heavy load flow, and finally verify the situation under overload flow. Of course, the above order can be determined according to the actual situation.

[0061] like Figure 4 As shown, the interface test verification method can be as follows:

[0062] S1) Configure the traffic of different services according to the heavy load traffic model; the traffic configuration here is the same as the test verification within the interface.

[0063] S2) Send traffic of different services to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface respectively.

[0064] S3) receiving traffic fed back by the FlexE client of the first FlexE interface and the second FlexE interface.

[0065] S4) Based on the sent traffic, received traffic, and the preset judgment logic matching the heavy traffic model, the security isolation between the FlexE interfaces is judged;

[0066] The judgment logic matching the heavy-load traffic model is: if the data fed back by the FlexE client is consistent with the sent data, it is determined that there is no crosstalk between the services between the first FlexE interface and the second FlexE interface under the heavy-load traffic.

[0067] The present invention combines and implements targeted business models and traffic models based on specific physical topology and logical configuration, and applies data to different logical slice channels respectively to test whether the business is affected by the crosstalk of background traffic when passing through the corresponding logical slice channel under different traffic flows, and whether the forwarding performance (packet loss rate, latency) is degraded as the judgment logic. It can effectively verify the security isolation within and between FlexE interfaces, and provide a concise and effective test and verification method for the security isolation of FlexE interfaces of router devices and SPN devices using FlexE technology.

[0068] Based on the same technical solution, the present invention also discloses a software system of the above method, a FlexE interface security isolation test verification system, comprising:

[0069] The in-interface test module, if the first FlexE interface in-interface test verification is performed, the traffic is configured for different services according to the preset in-interface test traffic model, and data is sent to different FlexE clients of the first FlexE interface according to the traffic configuration of different services. According to the data fed back by the FlexE client, the sent data, and the preset judgment logic matching the in-interface test traffic model, the security isolation judgment within the first FlexE interface is performed; wherein, different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels, and the services include data network integrated services, specific data network services, and substation multicast services. The preset in-interface test traffic models include light-load traffic model, heavy-load traffic model and overload traffic model.

[0070] The inter-interface test module, if a test verification is performed between the first FlexE interface and the second FlexE interface, traffic configuration is performed for different services according to the preset inter-interface test traffic model, and traffic configuration for different services is performed to send data to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface respectively, and the security isolation judgment between the first FlexE interface and the second FlexE interface is performed according to the data fed back by the FlexEclient, the data sent, and the preset judgment logic matching the inter-interface test traffic model; wherein different FlexEclients of the second FlexE interface are respectively bound to different logical slice channels, and the configurations of the first FlexE interface logical slice channel and the second FlexE interface logical slice channel that transmit the same service data are consistent, and the preset inter-interface test traffic model includes an overload traffic model.

[0071] The data processing flow of each module in the above system is consistent with the corresponding steps of the method and will not be repeated here.

[0072] Based on the same technical solution, the present invention also discloses a computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, which, when executed by a computing device, enable the computing device to perform a FlexE interface security isolation test verification method.

[0073] Based on the same technical solution, the present invention also discloses a computing device, comprising one or more processors, one or more memories and one or more programs, wherein the one or more programs are stored in the one or more memories and are configured to be executed by the one or more processors, and the one or more programs include instructions for executing a FlexE interface security isolation test verification method.

[0074] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0076] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0077] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0078] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A FlexE interface security isolation test verification method, characterized in that: include: If the test verification is performed in the first FlexE interface, traffic configuration is performed for different services according to the preset test traffic model in the interface, and data is sent to different FlexE clients of the first FlexE interface according to the traffic configuration of different services. According to the data fed back by the FlexE client, the sent data, and the preset judgment logic matching the test traffic model in the interface, the security isolation judgment in the first FlexE interface is performed; wherein different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels; It also includes the steps of inter-interface test verification, which include: If a test verification is performed between the first FlexE interface and the second FlexE interface, traffic is configured for different services according to the preset test traffic model between interfaces, and data is sent to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface for traffic configuration of different services. According to the data fed back by the FlexE client, the data sent, and the preset judgment logic matching the test traffic model between interfaces, the security isolation between the first FlexE interface and the second FlexE interface is judged; wherein different FlexE clients of the second FlexE interface are respectively bound to different logical slice channels, and the configurations of the logical slice channels of the first FlexE interface and the second FlexE interface that transmit the same service data are consistent.

2. A FlexE interface security isolation test verification method according to claim 1, characterized in that: Services include comprehensive data network services, specific data network services, and substation multicast services; The preset test traffic models in the interface include light load traffic model, heavy load traffic model and overload traffic model; The preset inter-interface test traffic model includes a heavy load traffic model.

3. A FlexE interface security isolation test verification method according to claim 2, characterized in that: Data network integrated services: covers VLAN2~VLAN4094, traffic priority is set to N5~N7, frame length covers 128 bytes to 1518 bytes, IP address covers 192.168.0.X / 24 network segment, MAC address covers 00-00-01-00-00-XX, and data packets are configured with MPLS VPN labels; Specific data network service: VLAN is A, A∈(2,4094), frame length is 256 bytes, IP address, MAC address and MPLS VPN label overlap with the IP address, MAC address and MPLS VPN label of a certain flow in the data network comprehensive service, and the flow priority is set to N0~N2; Substation multicast service: covers VLAN2~VLAN4094, the traffic priority is set to N4, the frame length covers 128 bytes to 1518 bytes, and the MAC address covers 01-0C-CD-04-00-XX; among which, the traffic priority is N0~N7 from low to high.

4. A FlexE interface security isolation test verification method according to claim 2, characterized in that: The traffic model configures traffic for different services, including: The light load traffic model configures traffic for different services: the data network integrated service sending data rate is A1% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A2% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is A2% of the corresponding logical slice bandwidth; where 0 <A2%<A1%≤50% ; The heavy-load traffic model configures traffic for different services: the data network integrated service sending data rate is 100% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A3% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is A3% of the corresponding logical slice bandwidth; among them, 50% <A3%<100%; The overload traffic model configures traffic for different services: the data network comprehensive service sending data rate is A4% of the corresponding logical slice bandwidth; the specific data network service sending data rate is A3% of the corresponding logical slice bandwidth; the substation multicast service sending data rate is 100% of the corresponding logical slice bandwidth; among which, A4%>100%.

5. A FlexE interface security isolation test verification method according to claim 2, characterized in that: When performing the test verification in the first FlexE interface, the judgment logic matching the light load traffic model is: if the data fed back by the FlexE client is consistent with the data sent, it is determined that there is no crosstalk between the services in the first FlexE interface under light load traffic; When performing the test verification in the first FlexE interface, the judgment logic matching the heavy load traffic model is: if the data fed back by the FlexEclient is consistent with the data sent, it is determined that there is no crosstalk between the services in the first FlexE interface under the heavy load traffic; When performing test verification within the first FlexE interface, the judgment logic matching the overload traffic model is: if the data network comprehensive service data packet loss is within the preset range, the sent specific data network service data is consistent with the feedback specific data network service data, the forwarding delay distribution of all data packets of the specific data network service is relatively uniform, and the sent substation multicast service data is consistent with the feedback substation multicast service data, then it is determined that there is no crosstalk between the services in the first FlexE interface under overload traffic.

6. A FlexE interface security isolation test verification method according to claim 2, characterized in that: When performing test verification between the first FlexE interface and the second FlexE interface, the judgment logic matching the heavy-load traffic model is: if the data fed back by the FlexEclient is consistent with the sent data, it is determined that there is no crosstalk between the services between the first FlexE interface and the second FlexE interface under heavy-load traffic.

7. A FlexE interface security isolation test verification system, characterized in that: include: The interface test module, if the first FlexE interface test verification is performed, configure traffic for different services according to the preset interface test traffic model, send data to different FlexE clients of the first FlexE interface according to the traffic configuration of different services, and make a security isolation judgment in the first FlexE interface according to the data fed back by the FlexE client, the sent data, and the preset judgment logic matching the interface test traffic model; wherein different FlexE clients of the first FlexE interface are respectively bound to different logical slice channels; The inter-interface test module, if a test verification is performed between the first FlexE interface and the second FlexE interface, traffic configuration is performed for different services according to the preset inter-interface test traffic model, and traffic configuration for different services is performed to send data to different FlexE clients of the first FlexE interface and different FlexE clients of the second FlexE interface respectively, and the security isolation judgment between the first FlexE interface and the second FlexE interface is performed according to the data fed back by the FlexEclient, the data sent, and the preset judgment logic matching the inter-interface test traffic model; wherein different FlexEclients of the second FlexE interface are respectively bound to different logical slice channels, and the configuration of the first FlexE interface logical slice channel and the second FlexE interface logical slice channel that transmit the same service data are consistent.

8. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions which, when executed by a computing device, cause the computing device to perform any one of the methods according to claims 1 to 6.

Images