VPC Network Configuration Analysis Tool Based on Modular Modeling

Abstract

The present invention discloses a VPC network configuration analysis tool based on modular modeling, belonging to the field of cloud network configuration analysis. The present invention models eleven mainstream components, not only simulating the functions of the components, but also optimizing the storage of configuration parameters, greatly improving the execution efficiency of the tool. The present invention also provides eleven analysis functions for users to choose from. Users can not only perform network reachability analysis, but also diagnose fault configuration parameters for quick repair. By inputting the configuration information of the cloud network, setting any data packet in a given format and any analysis function, the tool can feedback the result of the analysis function and the data packet transmission path to the user, for the user to judge whether the configuration parameters are incorrect and whether they meet the design intention.

Description

Technical Field

[0001] The present invention belongs to the field of cloud network configuration analysis, and relates to a VPC network configuration analysis tool based on modular modeling. Background Art

[0002] VPC (Virtual Private Cloud network service) allows users to configure on-demand the shared resources allocated in the public cloud, providing isolation between users. Fast and secure access to cloud network resources depends on the access control policies formulated by users, and configuration errors have always been the main cause of cloud network security problems. With the popularization of technologies such as virtualization, cloud computing, and the Internet of Things, VPC networks have become increasingly complex, and a large number of complex network components make it extremely difficult to perform scalable, efficient, and accurate configuration and fault analysis on the network. Therefore, it is necessary to deploy a VPC network configuration analysis tool in the field of cloud network configuration analysis.

[0003] In the field of cloud network configuration analysis, formal methods are common in academia and industry. It uses mathematical techniques to provide strong guarantees for the correctness or security properties of the network. Therefore, researchers have tried to apply formal methods to VPC networks. Specifically, they encode the semantics of the VPC network as logic, and then use various reasoning engines to check security-related properties. For a simple example, if the first six bits of a data packet are equal to 111111 and the last four bits are equal to 0000, it can pass through the firewall, and the semantics of passing through the firewall can be encoded as a logic like "Packet[0:5]==111111∩Packet[end - 3:end]". Currently, there are already some formal verification tools, such as SecGuru of Microsoft, TIROS of Amazon, etc. However, they all have certain drawbacks. SecGuru does not support full network reachability queries, TIROS has low analysis efficiency for large networks, and moreover, they only return results or a small number of counterexamples, and cannot provide more practical guidance for users to debug or fix the detected errors. The above drawbacks are largely due to the difficulty of encoding the logical semantics of formal methods and the easy occurrence of logical state explosion for large-scale networks. To overcome the drawbacks of formal methods, the present invention proposes a VPC network configuration analysis tool based on modular modeling, which has the advantages of high analysis efficiency, high practicality, high scalability, and fault analysis compared with existing formal verification tools. Summary of the Invention

[0004] In view of the deficiencies of existing analysis tools in the field of cloud network configuration analysis, the present invention designs a VPC network configuration analysis tool based on modular modeling.

[0005] The present invention takes the VPC network configuration analysis as the application scenario and involves three parts in total: ① Modeling eleven existing mainstream cloud network components. ② Automatically reading the user configuration parameters line by line, storing the configuration parameters according to information such as component type and component ID, generating the corresponding components, and inferring and generating the network topology diagram based on the configuration information. ③ Providing eleven analysis functions for verifying and analyzing the user's configuration.

[0006] First of all, the present invention models eleven existing mainstream cloud network components, including the RoutingTable module, Router module, Switch module, Access Control List (ACL) module, Security Group module, Elastic Compute Service (ECS) module, VPC Peering module, Network Address Translation (NAT) module, Server Group module, Listener module, and Cluster Load Balancing (CLB) module. The descriptions of the eleven modules are shown in Table 1:

[0007] Table 1 Module Description Table

[0008]

[0009]

[0010] During the modeling process, it not only involves the simulation of component functions but also the storage and matching of configuration information such as access control list entries, security group entries, and routing table entries, which is a key issue affecting the operation efficiency of the entire analysis tool. In the present invention, a binary tree is used to store the entry information, and pruning and merging operations are performed on the tree during the storage process to optimize the tree, which is also the key to the high analysis efficiency of the present invention. During the matching process, the present invention only needs to search the corresponding tree according to the longest matching principle.

[0011] Secondly, the present invention can automatically read the user configuration parameters line by line, store the configuration parameters according to information such as component type and component ID, generate the corresponding components, and infer and generate the network topology diagram based on the configuration information. The required configuration parameters are shown in Table 2:

[0012] Table 2 Built-in Parameter Description Table of Modules

[0013]

[0014]

[0015] After the configuration information is read, the corresponding components will run according to the given configuration.

[0016] Finally, the present invention provides a total of eleven analysis functions, including reachability analysis, availability analysis, consistent reachability analysis, consistent availability analysis, cyclicity analysis, locality analysis, isolation analysis, blocked path analysis, access control list conflict detection, simplest routing table export, and component operation difference analysis. The introduction of each analysis function is shown in Table 3 as follows:

[0017] Table 3 Description of Analysis Functions

[0018]

[0019]

[0020] After the user reads in the configuration information, the user can specify the analysis function, set any data packet for the tool to automatically analyze, and the tool will return the corresponding results to the user for the user to analyze whether it meets the design intention. Among them, the format of a normal data packet is a five-tuple information [source address, source port, destination address, destination port, protocol type]. To simulate the transmission of data packets and record the transmission path, the present invention extends the data packet into an eight-tuple information, that is, [source address, source port, destination address, destination port, protocol type, current location, component category of the current location, previous hop location].

[0021] Compared with the prior art, the present invention has the following advantages:

[0022] First, it is not necessary for the user to understand formal verification knowledge. The user can perform configuration analysis by providing a configuration file, selecting the corresponding analysis function, and arbitrarily setting the data packet format.

[0023] Second, the analysis functions are complete. There are not only reachability, availability, etc. analyses, but also fault diagnosis, which is convenient for users to adjust the configuration.

[0024] Third, the analysis efficiency is high and it is applicable to medium and large-scale networks. Description of the Drawings

[0025] Figure 1 It is a specific example schematic diagram of the process of optimizing the storage of the configuration information of the access control list, which is used to understand the process of optimizing the storage of the access control list;

[0026] Figure 2 It is a flowchart of the use of the tool of the present invention. Detailed Embodiments

[0027] In the following description, many specific details are set forth in order to provide a thorough understanding of the present invention. However, the present invention may be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0028] The present invention realizes a VPC network configuration analysis tool based on modular modeling that can read a configuration file provided by a user and use a similar simulation system. The tool consists of three parts: modeling of mainstream network components, reading of user configuration files, and analysis of user configurations.

[0029] In the first part, the present invention models eleven existing mainstream cloud network components, including a routing table module, a router module, a switch module, an access control list (ACL) module, a security group module, an ECS (Elastic Compute Service) module, a VPC peering module, a network address translation (NAT) module, a server group module, a listener module, and a cluster load balancer (CLB) module. The specific implementation of the modeling is as follows:

[0030] (1) Routing table: mainly responsible for controlling the transmission of data packets. When the ID of the VPC to which it belongs, the routing table ID, and routing table entries are added to the routing table, the routing table component can start working. Among them, a routing table entry consists of a destination IP, a next-hop ID, and a next-hop category (routing, switch, etc.). The routing table entries are stored in a binary tree. The destination IP is represented as a binary form of up to 32 bits. Using the destination IP as an index, a node is added to the left for '0' and to the right for '1'. At the end of the index, action information is added to the node, including the next-hop ID and the next-hop component category. While adding nodes to the tree, it is also optimized. When the parent node and the child node have the same action information, the child node will be pruned to ensure the search efficiency of the tree.

[0031] (2) Router: realizes the transmission of data packets by binding to a routing table. When the ID of the VPC to which it belongs, the router's ID, the router's IP, and the ID of the routing table to be bound are added to the router, the router component can start working. When a data packet is transmitted to the router, the router will match the stored information in the bound routing table based on the longest match principle according to the destination address information of the data, so as to realize the transmission of the data packet to the next component.

[0032] (3) Access Control List: It is a table or list that tells the server the access permissions of the network. It is the first line of defense against traffic at the subnet level and is usually bound to a switch. When the ID of the VPC to which it belongs, the access control list ID, and the access control list entries are added to the access control list, the access control list component can work. Among them, the entries include outbound entries and inbound entries. The outbound direction is out of the subnet, and the inbound direction is into the subnet, each containing five parameters. The five parameters of the outbound direction include: priority, destination IP segment, destination port segment, protocol type, allow / deny; the five parameters of the inbound direction include: priority, source IP segment, destination port segment, protocol type, allow / deny. The storage of the entries is similar to that of the routing table, but the merging and optimization processes are much more complex.

[0033] First, represent the IP as a binary form with a maximum of 32 bits. Using the IP as the index, add nodes to the left for '0' and to the right for '1'. Add judgment information and action information at the end node of the index, in the following format: '{Priority 1: {Accept / Deny: {Protocol Type 1: Port Number, Protocol Type 2: Port Number,...}}, Priority 2: {Accept / Deny: {Protocol Type 1: Port Number, Protocol Type 2: Port Number,...}},...}', where 'Accept / Deny' is the action information, and '{Protocol Type: {...}}' is the judgment information, and the judgment information is used to determine whether to execute the 'Accept / Deny' action;

[0034] Secondly, since the IP segment of the child node is a subset of the IP segment of the parent node, for example, '224.158.0.0 / 3' must be a subset of '192.168.0.0 / 2', then for the '{Protocol Type: Port Number}' accepted / denied by the parent node, the child node must also abide by it. Therefore, the child node has a merging operation of action information and judgment information for the parent node, specifically:

[0035] For information with the same priority, the action information of the child node, that is, the '{Accept / Deny: {...}}' information, is overwritten by the action information of the parent node. For information with different priorities, the different priority information of the parent node is added;

[0036] For information with the same priority and the same action, the judgment information of the child node, that is, the '{Protocol Type: {...}}' information, is overwritten by the judgment information of the parent node. For information with the same priority but different actions, the action information of the parent node is added;

[0037] For information with the same priority, action, and protocol type, the port information of the child node is overwritten by the port information of the parent node. For information with the same priority and action but different protocol types, the judgment information of the parent node is added;

[0038] There may be problems of duplicate port numbers and priority conflicts in the port numbers accepted / rejected after the merge operation. Therefore, we also performed a simplification operation to return the simplest action information and judgment information without conflicts, in the following format: '{Accept: {Protocol type 1: port number, Protocol type 2: port number,...}, Reject: {Protocol type 1: port number, Protocol type 2: port number,...}}', and at this time, priority information is not included; among them, the simplification operation is based on three criteria:

[0039] ①For the same action, the judgment information with a lower priority must comply with the judgment information with a higher priority;

[0040] ②For different actions, in the case of conflicting judgment information with the same priority, the judgment information of the accept action must comply with the judgment information of the reject action;

[0041] ③For the same priority, if there are duplicate parts in the judgment information, they need to be de-duplicated and merged;

[0042] Finally, after the merge and simplification operations are completed, when the parent node and the child node have the same action information, pruning operations will be performed on the child node to ensure the search efficiency of the tree. A specific example is used to illustrate the above process, as Figure 1 shown.

[0043] (4) Security group: Similar to a firewall installed on an ECS instance, a security group can be bound to multiple hosts, and a host can be bound to multiple security groups. When adding the ID of the VPC to which it belongs, the ID of the security group, the ID of the bound ECS, and the security group entries, the security group component can work. Among them, the entries also include the outbound list and the inbound list, and the format, storage, and optimization process are similar to the access control list.

[0044] (5) Switch: It has the functions of routing, subnet division, and protection. When adding the ID of the VPC to which it belongs, the switch ID, the switch IP, the ID of the bound routing table, and the ID of the bound access control list to the switch, the switch can start working. When a data packet is transmitted to the switch, the switch will determine whether it is an inbound data packet or an outbound data packet. For the inbound direction, it will match the inbound rules of the bound access control list, and for the outbound direction, it will match the outbound rules of the bound access control list. Taking the inbound direction as an example, according to the packet destination address index, it will match the bound access control list rules according to the maximum length matching principle. Among them, the matching principle is described as follows: ①Match according to the port number; ②Higher priority first; ③If both the allow action and the reject action are matched, the reject action takes precedence. When the rule matching is completed, it is judged whether to accept the data packet or reject the data packet. If the data packet is accepted, route matching is performed and the data packet is transmitted to the next hop. Otherwise, the data packet is discarded.

[0045] (6) ECS: A high-performance, stable, reliable, and scalable IaaS-level service provided by Alibaba Cloud. It is the main body for transmitting data packets and is often directly connected to switches. After adding the ID of the VPC and the ID and IP of the ECS, the ECS starts to work.

[0046] (7) Peer connection: Enables full resource sharing between two VPCs. After adding the IDs of the two VPCs to be peer-connected, the peer connection starts to work. Cross-VPC data packet transmission must pass through the top routers of each VPC. Therefore, it means that the peer connection is actually directly connected to the top routers of the two VPCs, and the next hop must be another peer connection or the top router.

[0047] (8) Service group: Before using the CLB service, users must add ECS as a backend server to receive requests forwarded by the load balancer. The service group is used to monitor and manage backend servers. After adding the ID of the VPC to which it belongs, the ID of the service group, and the list of ECSs bound to the service group, the service group starts to work. Each list item contains the address of the backend server and the port number to be monitored.

[0048] (9) Listener: The listener is used to check whether the data packets reaching the ports of the backend servers are within the whitelist. If so, it allows the data packets to continue to be transmitted to the backend servers; otherwise, it discards the data packets. After adding the ID of the VPC to which it belongs, the listener ID, the listening protocol, the listening port number, and the listening whitelist list, the listener starts to work. The listening whitelist list is a series of source addresses.

[0049] (10) CLB: Distributes network traffic among ECS instance groups in the same region using a virtual IP address to ensure high performance and high availability. After adding the ID of the VPC to which it belongs, the ID and IP of the CLB, the CLB can start to work. CLB is mainly used to allocate data traffic to each server bound to the service group according to the traffic balancing algorithm to reduce the workload of each server.

[0050] (11) NAT: It is a network address translation service. Users can use the NAT gateway to enable instances in a private subnet to connect to public network services, but external services cannot initiate connections to these instances. When the ID of the VPC to which the NAT belongs, the NAT ID, the switch ID bound to the NAT, the NAT network address translation list, the SNAT parameter, and the DNAT parameter are added to the NAT, the NAT can start working. Among them, the network address translation list is a series of IP addresses used to randomly convert the IP address of an instance in the private subnet to be connected into one of the IP addresses in this list for external connection, protecting privacy. SNAT determines whether the source address and source port range belong to the range that needs to be converted to a new source address. If so, it updates the source address; DNAT determines whether the destination address and destination port range belong to the range that needs to be converted to a new destination address and new source port. If so, it updates the destination address.

[0051] In the second part, the configuration parameters to be verified by the user are automatically read line by line. According to the information such as the component type and component ID read, the configuration parameters are stored, corresponding components are automatically generated, and a network topology diagram is speculated and generated according to the configuration information.

[0052] In the third part, the present invention provides a total of eleven analysis functions, including reachability analysis, availability analysis, consistent reachability analysis, consistent availability analysis, cyclicity analysis, locality analysis, isolation analysis, blocked path analysis, access control list conflict detection, simplest routing table export, and component operation difference analysis. The descriptions of each analysis function are shown in Table 3. The data packet is transmitted in an octuple format as follows: [source address, source port, destination address, destination port, protocol type, current location, component category of the current location, previous hop location]; the current location is the ID of the current component. Combining the component category of the current location, the judgment information and action information storage index required for executing the function of the current component can be obtained; the previous hop location is the ID of the previous hop component, which is used to record the data packet transmission path.

[0053] Users can customize the data packet content. For example, a certain data packet is set in the following octuple format: '[192.168.0.1 80 192.168.1.1 80 TCP ECS1 Instance‘’]', where '‘’ represents no previous hop. During the transmission of the data packet through each component, the first five elements of the data packet format generally do not change, which are the source address, source port, destination address, destination port, and protocol type, unless it encounters NAT, and the last three elements will change in real time during the transmission. Then, by selecting the corresponding analysis function, the tool can automatically return the corresponding analysis result for the user to analyze whether the configuration parameters meet the design intention.

[0054] For example, when a user discovers a problem with the configuration parameters, they can specify functions such as blocked path analysis, access control list conflict detection, and component operation difference analysis to identify the specific errors in the configuration parameters. The user can use the simplest routing table export function to achieve the transformation of redundant routing table entries to the simplest routing table entries, improving the efficiency of the routing table in forwarding data packets.

[0055] The present invention models eleven mainstream cloud network components, enabling the correctness analysis of medium and large-scale cloud network component configurations in most application scenarios and providing certain guiding information for users to improve the configuration parameters. As long as the user follows Figure 2 the process shown, they can use the tool of the present invention for cloud network configuration analysis.

[0056] The above description is only a preferred embodiment of the present invention. Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make many possible changes and modifications to the technical solution of the present invention, or modify it into an equivalent embodiment with equivalent changes, without departing from the scope of the technical solution of the present invention. Therefore, any simple modification, equivalent change, and modification made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the protection of the technical solution of the present invention.

Claims

1. A method for analyzing VPC network configuration based on modular modeling, characterized in that It includes the following three parts: The first part: Model eleven cloud network components, including a routing table module, a routing module, a switch module, an access control list module, a security group module, a host module, a peer connection module, a network address translation module, a service group module, a listener module, and a cluster load balancing module; Optimize the storage of configuration information by using the method of data structure; Optimize the storage of access control lists and security groups, including: Both security group entries and access control list entries are stored in a binary tree. The IP is represented as a binary form of up to 32 bits. Using the IP as the index, add nodes to the left for '0' and to the right for '1'. Add judgment information and action information at the end node of the index. The format is as follows: '{Priority 1: {Accept / Reject: {Protocol type 1: port number, Protocol type 2: port number,...}}, Priority 2: {Accept / Reject: {Protocol type 1: port number, Protocol type 2: port number,...}},...}', where 'Accept / Reject' is the action information, and '{Protocol type: {...}}' is the judgment information, and the judgment information is used to determine whether to execute the 'Accept / Reject' action; Since the IP segment of the child node is a subset of the IP segment of the parent node, for the '{Protocol type: port number}' accepted or rejected by the parent node, the child node must also comply. Therefore, the child node performs a merge operation on the action information and judgment information of the parent node; After performing the merge operation, there may be problems of duplicate port numbers and priority conflicts in the accepted or rejected port numbers. Perform a simplification operation to return a simplest action information and judgment information without conflicts. The format is as follows: '{Accept: {Protocol type 1: port number, Protocol type 2: port number,...}, Reject: {Protocol type 1: port number, Protocol type 2: port number,...}}', and at this time, priority information is not included; After performing the merge and simplification operations, when the parent node and the child node have the same action information, perform a pruning operation on the child node to ensure the search efficiency of the tree; The second part: Automatically read the user configuration parameters line by line, store the configuration parameters according to the component type and component ID information, generate the corresponding components, and infer and generate a network topology diagram according to the configuration information; The third part: Provide eleven analysis functions, including reachability analysis, availability analysis, consistent reachability analysis, consistent availability analysis, cyclicity analysis, locality analysis, isolation analysis, blocked path analysis, access control list conflict detection, simplest routing table export, and component operation difference analysis; When obtaining the user configuration information, the analysis function specified by the user, and any data packet set by the user, the tool automatically analyzes and returns the corresponding results to the user for the user to analyze whether it meets the design intention.

2. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein In the first part, optimize the storage of the routing table, including: The routing table entries are stored in a binary tree. The destination IP is represented in binary form with a maximum of 32 bits. Using the destination IP as an index, a node is added to the left for '0' and to the right for '1'. At the end of the index, action information is added to the node, including the next-hop ID and the next-hop component category. The tree is optimized while adding nodes. When the parent node and the child node have the same action information, the child node is pruned to ensure the search efficiency of the tree.

3. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein The merging operation includes: For information with the same priority, the action information of the child node, i.e., the '{accept / reject: {...}}' information, is overwritten by the action information of the parent node. For information with different priorities, the different priority information of the parent node is added. For information with the same priority and the same action, the judgment information of the child node, i.e., the '{protocol type: {...}}' information, is overwritten by the judgment information of the parent node. For information with the same priority but different actions, the action information of the parent node is added. For information with the same priority, action, and protocol type, the port information of the child node is overwritten by the port information of the parent node. For information with the same priority and action but different protocol types, the judgment information of the parent node is added.

4. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein The simplification operation is based on the following three criteria: ① For the same action, the judgment information of the lower priority must follow the judgment information of the higher priority. ② For different actions, for the judgment information with conflicts at the same priority, the judgment information of the accept action must follow the judgment information of the reject action. ③ At the same priority, the duplicate parts of the judgment information need to be de-duplicated and then merged.

5. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein In the second part, after automatically reading the component category and component parameters of the user configuration file line by line, the tool automatically generates the corresponding components and runs them exactly according to the requirements of the user configuration parameters. At the same time, based on the IP addresses and routing tables of each component, the connection situation of each component is inferred, and then the network topology is inferred.

6. The method for analyzing VPC network configuration based on modular modeling according to claim 1, characterized in that In the third part, the tool can imitate the transmission process of data packets and record the data packet transmission path. The data packets are transmitted in an octuple format as follows: [source address, source port, destination address, destination port, protocol type, current location, current location component category, previous hop location]. The current location is the ID of the current component. Combining the current location component category, the judgment information and action information storage index required to execute the function of the current component can be obtained. The previous hop location is the ID of the previous hop component and is used to record the data packet transmission path.

7. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein In the third part, when the user finds that there is a problem with the configuration parameters, the user can select to specify functions such as blocked path analysis, access control list conflict detection, and component operation difference analysis for analysis to find out the specific errors in the configuration parameters.

8. The method for analyzing VPC network configuration based on modular modeling according to claim 1, wherein In the third part, the user can choose to use the simplest routing table export function to convert the redundant routing table entries into the simplest routing table entries, improving the efficiency of the routing table for forwarding data packets.

Images