Cloud network configuration analysis method and system based on MonoSAT

Abstract

This invention discloses a MonoSAT-based cloud network configuration analysis method and system. This method uses formal verification to analyze properties such as the reachability between nodes in a cloud network constructed based on configuration file information when a cloud network user configures the cloud network. By inputting the cloud network configuration file information and the node information for which reachability is to be verified, the user obtains a formal verification result indicating whether the configuration file is reachable under the configuration file information. This helps facilitate further analysis, such as determining whether the user's configuration file is consistent with the user's configuration intent.

Description

Technical Field

[0001] The present invention relates to the field of cloud network configuration analysis, and in particular to a cloud network configuration analysis method and system based on MonoSAT. Background Art

[0002] In cloud networks, configuration analysis is essential for management, for example, verifying the consistency of network behavior with network intent and billing for cloud network resource usage. These technologies rely on auxiliary information such as configuration reachability to aid decision-making. As a service where multiple tenants share resources, configuration analysis and verification deserve even greater attention. Errors in a tenant's configuration can lead to improper allocation of cloud network resources, disrupt the proper functioning of their cloud network, and even impact other tenants sharing the cloud network. Configuration analysis can help tenants promptly identify configuration issues and prevent them from impacting the normal operation of the cloud network. Therefore, deploying configuration analysis in cloud networks is crucial.

[0003] However, with the continuous expansion and increasing complexity of cloud networks, traditional manual configuration analysis methods face challenges such as low efficiency and the requirement for operator experience. These challenges make them unsuitable for complex, large-scale network configuration analysis scenarios. Therefore, automated methods are needed for cloud network configuration analysis. MonoSAT is a modular SAT solver for Boolean and bit vector monotone theory. It supports a wide range of graph predicates, such as reachability and shortest path. Network reachability can be modeled as a symbolic graph of network components consisting of a set of nodes and directed edges, making it suitable for solving network reachability using MonoSAT. However, using MonoSAT for cloud network configuration analysis presents challenges. First, it requires automatically extracting information such as the cloud network topology from user-provided configuration files to construct a graph suitable for MonoSAT analysis. Second, MonoSAT uses logical expressions for judgments, but complex judgment conditions for cloud network components, such as security group matching conditions, are difficult to express using logical expressions.

[0004] In summary, it is difficult to design a cloud network configuration analysis method based on MonoSAT in the field of cloud network configuration analysis. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and design a cloud network configuration analysis method and system based on MonoSAT that can be deployed in a cloud network for use in the field of cloud network configuration analysis.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] According to a first aspect of this specification, a cloud network configuration analysis method based on MonoSAT is provided, the method comprising:

[0008] Receive configuration file information provided by the user, obtain network element component information in the cloud network from the configuration file information, and infer topology information between the network element components;

[0009] Creating corresponding component simulation nodes according to the network element component information as MonoSAT graph nodes;

[0010] According to the topology information, combined with the reachability judgment logic expression of the data packet at each node, the reachability logic edge connection between the nodes of the MonoSAT graph is constructed;

[0011] The MonoSAT solver is used to calculate the reachability logic of all edges on the path between the source node and the destination node, and the reachability results are fed back to the user.

[0012] Furthermore, the steps for converting the configuration information provided by the user into a MonoSAT graph are as follows:

[0013] S1: Initialize and create MonoSAT graph;

[0014] S2: Read the configuration information and create MonoSAT graph nodes according to the types and component numbers of different network element components. The types of network element components include the following:

[0015] (1) VPC private network: Contains VPC ID, IP, and border router information, and records cloud servers, switches, routers, and NAT gateways in the VPC;

[0016] (2) Switch: Contains information such as the switch ID and IP address, records the ACL access control policy bound to the switch and the cloud servers under the switch subnet, and creates a node in the graph;

[0017] (3) ECS cloud server: contains the cloud server ID, IP and other information, records the security group bound to the cloud server, and creates a node in the graph;

[0018] (4) Router: Contains information such as the router's ID and IP address; contains routing table information bound to the router and creates nodes in the graph;

[0019] (5) Security Group: Contains information such as the security group ID; contains security group rules for both inbound and outbound directions; determines whether the IP address, protocol type, and port of a data packet match the security group rules, thereby determining whether it can be received or sent through the cloud server bound to the security group;

[0020] (6) ACL access control policy: Contains information such as the access control policy ID; contains access control policy rules for both inbound and outbound directions; determines whether the IP address, protocol type, and port of a data packet match the access control policy rules, thereby determining whether it can be received or sent through the switch bound to the ACL;

[0021] (7) Route Table: Contains information such as the routing table ID; contains routing entries that route traffic from a specified target network segment to a specified destination, and determines whether the IP address of a data packet matches a routing entry, thereby determining whether it can be forwarded through the router bound to the routing table;

[0022] (8) CLB load balancing: contains information such as the load balancing ID; contains the backend cloud server information that receives the distributed traffic, the bound security group information, and the node information that needs to be monitored, and creates a node in the graph;

[0023] (9) NAT Gateway: Contains NAT ID, IP and other information; contains DNAT and SNAT conversion information and bound switch information, and creates a node in the graph;

[0024] (10) Internet: Connect to external networks such as the Internet as a node.

[0025] S3: Based on the inferred topology information between network element components and the reachability judgment logic expression of the data packet at each node, the reachability logical edge connection between the nodes of the MonoSAT graph is constructed.

[0026] Furthermore, the connection method between nodes in the MonoSAT graph is as follows:

[0027] For the source node and destination node connected in the inferred topology information, a logical judgment expression that can be transmitted from the source node to the destination node is established based on the reachability judgment logic expression of each node on the path between the source node and the destination node, and is recorded in the MonoSAT graph in the form of an edge;

[0028] When the MonoSAT solver performs reachability judgment, if the data packet is reachable between two nodes, the edge exists, otherwise it does not exist, thereby establishing a truly reachable MonoSAT graph.

[0029] Furthermore, when the type of the network element component is a security group, the creation rules of the reachability judgment logic expression of the corresponding node are as follows:

[0030] Convert security group rules into logical expressions and categorize them into allow, deny, and unconfigured rules. Node ingress and egress rules are matched separately.

[0031] Security group rules are read one by one and sorted from high to low priority. The IP address, port, and protocol type ranges allowed by each priority level are not within the range that has been matched by the higher priority level, and are allowed and not denied within the current priority matching range. The range finally allowed is the union of the ranges allowed by each priority level.

[0032] Furthermore, when the type of the network element component is a routing table, the rules for creating the reachability judgment logical expression of the corresponding node are as follows: the routing entries of the routing table are converted into logical expressions, the routing entries are read one by one, and the destination address range allowed to pass is the union of the configured routing entry addresses.

[0033] Furthermore, when the type of the network element component is load balancing, the creation rules of the reachability judgment logic expression of the corresponding node are as follows: Load balancing reads the monitoring entries one by one, and if the monitoring is in the whitelist and the monitoring is not in the blacklist, the data packet is allowed to pass.

[0034] Furthermore, the connection types of the reachability logical edges between nodes in the MonoSAT graph are as follows:

[0035] Connect the switch and cloud server based on the cloud server's IP and switch subnet address information;

[0036] Connect nodes connected to the switch based on the switch routing table information;

[0037] Connect nodes connected to the router according to the router's routing table;

[0038] Connect to the nodes connected to the load balancer based on the load balancer's monitoring information.

[0039] Furthermore, the MonoSAT solver automatically calculates the reachability between a given source address, port and a destination address, port under a given protocol type according to the topological structure of the MonoSAT graph, and returns a reachability result.

[0040] Furthermore, the MonoSAT solver obtains the reachability logic as follows:

[0041] S1: Based on the source address, destination address, source port, destination port, protocol type, and component type input by the user, the user's configuration file information is read to build a MonoSAT graph. The MonoSAT solver is used to determine whether the data packet can be sent from the source node to the destination node and received. If so, True is returned; otherwise, the next step is to determine whether a NAT gateway is used.

[0042] S2: Read the NAT gateway configuration information one by one. If the conversion conditions of the NAT gateway are met, the source address or destination address and port information of the data packet are updated, and the reachability is re-judged. If it is judged to be reachable, True is returned, otherwise False is returned.

[0043] According to a second aspect of this specification, a cloud network configuration analysis system based on MonoSAT is provided, the system comprising the following modules:

[0044] A configuration file information reading module is used to receive configuration file information provided by a user, obtain network element component information in the cloud network from the configuration file information, and infer topology information between network element components;

[0045] A cloud network component function simulation implementation module is used to create corresponding component simulation nodes as MonoSAT graph nodes based on the network element component information; based on the topology information and in combination with the reachability judgment logic expression of the data packet at each node, construct the reachability logic edge connection between the MonoSAT graph nodes, thereby obtaining a MonoSAT graph;

[0046] The reachability analysis module is used to receive the node information to be analyzed provided by the user, calculate the reachability logic of all edges on the path between the source node and the destination node through the MonoSAT solver, and feed back the reachability results to the user.

[0047] Compared with the prior art, the present invention has the following advantages:

[0048] First, users only need to provide cloud network profile information and node information for which they want to determine reachability to obtain reachability results.

[0049] Second, accessibility results are obtained automatically without the need for manual operation with professional knowledge.

[0050] Third, the obtained reachability results are formally verified and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flow chart of a cloud network configuration analysis method based on MonoSAT provided in an embodiment of the present invention;

[0052] Figure 2 It is a structural diagram of a cloud network configuration analysis system based on MonoSAT provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0054] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0055] like Figure 1 As shown, an embodiment of the present application provides a cloud network configuration analysis method based on MonoSAT, the method comprising:

[0056] Receive configuration file information provided by the user, obtain network element component information in the cloud network from the configuration file information, and infer topology information between the network element components;

[0057] Creating corresponding component simulation nodes according to the network element component information as MonoSAT graph nodes;

[0058] According to the topology information, combined with the reachability judgment logic expression of the data packet at each node, the reachability logic edge connection between the nodes of the MonoSAT graph is constructed;

[0059] The MonoSAT solver is used to calculate the reachability logic of all edges on the path between the source node and the destination node, and the reachability results are fed back to the user.

[0060] In one embodiment, the configuration information to be read includes:

[0061] (1) VPC private network: VPC ID, subnet IP, and border router;

[0062] (2) Security group: security group ID, security group entry and exit rules, and the VPC where the security group is located;

[0063] (3) Cloud server: the cloud server ID, the VPC to which it belongs, the cloud server IP address, and the set of all security groups bound to the cloud server;

[0064] (4) Access control policy: the access control policy ID, the VPC to which it belongs, and the access control policy entry and exit rules;

[0065] (5) Routing table: routing table ID, VPC, and routing entries;

[0066] (6) Switch: switch ID, VPC to which it belongs, switch subnet IP, access control policy bound to the switch, and switch routing table;

[0067] (7) Router: Router ID, VPC to which it belongs, and routing table bound to the router;

[0068] (8) Load balancing: load balancing ID, VPC to which it belongs, monitoring nodes, server group consisting of cloud servers that process backend traffic, and bound security group;

[0069] (9) Server group: server group ID, VPC to which it belongs, and all cloud servers in the server group that process backend traffic;

[0070] (10) NAT Gateway: NAT ID, VPC to which it belongs, bound switch, IP address of the source address that needs to be changed by SNAT, and the IP address of the node to which DNAT needs to redistribute the received traffic.

[0071] In one embodiment, the method for converting the configuration information provided by the user into a MonoSAT graph is as follows:

[0072] S1: Initialize and create the MonoSAT graph.

[0073] S2: Read configuration information and create MonoSAT graph nodes based on the types and component numbers of different network element components, including private networks, switches, cloud servers, routers, security groups, access control policies, routing tables, load balancing, NAT gateways, and the Internet;

[0074] S3: Based on the inferred topology information between network element components and the logical expression for determining the reachability of data packets at each node, the reachability logical edge connections between nodes in the MonoSAT graph are constructed. The connection method between nodes is as follows:

[0075] For the source node and destination node connected in the inferred topology information, a logical judgment expression that can be transmitted from the source node to the destination node is established based on the reachability judgment logic expression of each node on the path between the source node and the destination node, and is recorded in the MonoSAT graph in the form of an edge;

[0076] When the MonoSAT solver performs reachability judgment, if the data packet is reachable between two nodes, the edge exists, otherwise it does not exist, thereby establishing a truly reachable MonoSAT graph.

[0077] In one embodiment, the connection types of the reachability logical edges between nodes in the MonoSAT graph are as follows:

[0078] (1) Connect the switch and cloud server based on the cloud server's IP and switch subnet network address information;

[0079] (2) Connecting nodes connected to the switch based on the switch routing table information;

[0080] (3) Connecting nodes connected to the router according to the router's routing table;

[0081] (4) Connect to the nodes connected to the load balancer based on the monitoring information of the load balancer.

[0082] In one embodiment, the rules for creating a reachability judgment logic expression for a cloud network component corresponding to a node are as follows:

[0083] (1) Security group: Convert the security group rules into logical expressions, and divide the security group rules into allow, deny, and not configured in the rules; match the node ingress and egress rules separately;

[0084] Security group rules are read one by one and sorted from high to low priority. The IP address, port, and protocol type ranges allowed by each priority level are not within the range that has been matched by the higher priority level, and are allowed and not denied within the current priority matching range. The range finally allowed is the union of the ranges allowed by each priority level.

[0085] (2) Access control policy: The matching method is the same as that of the security group.

[0086] (3) Routing table: Convert the routing entries in the routing table into logical expressions, read the routing entries one by one, and the destination address range allowed to pass is the union of the configured routing entry addresses.

[0087] (4) Load balancing: Load balancing reads the monitoring entries one by one. If the monitoring is in the whitelist and the monitoring is not in the blacklist, the data packet is allowed to pass.

[0088] (5) Cloud server: When the cloud server is used as a source node, it determines whether the data packet can pass the bound security group outbound rules; when the cloud server is used as a destination node, it determines whether the data packet can pass the bound security group inbound rules.

[0089] (6) Switch: When the switch acts as a source node, it determines whether the data packet can pass the bound access control policy out rules and whether it is allowed to pass through the routing table bound to the switch; when the switch acts as a destination node, it determines whether the data packet can pass the bound access control policy in rules.

[0090] (7) Router: Determine whether the routing table bound to the router is allowed to pass.

[0091] (8) NAT Gateway: SNAT determines whether the source address and source port range belong to the range that needs to be converted to a new source address. If so, the source address is updated. DNAT determines whether the destination address and destination port range belong to the range that needs to be converted to a new destination address. If so, the destination address is updated.

[0092] In one embodiment, the reachability analysis process is as follows:

[0093] S1: Based on the source address, destination address, source port, destination port, protocol type, and component type input by the user, the user's configuration file information is read to build a MonoSAT graph. The MonoSAT solver is used to determine whether the data packet can be sent from the source node to the destination node and received. If so, True is returned; otherwise, the next step is to determine whether a NAT gateway is used.

[0094] S2: Read the NAT gateway configuration information one by one. If the conversion conditions of the NAT gateway are met, the source address or destination address and port information of the data packet are updated, and the reachability is re-judged. If it is judged to be reachable, True is returned, otherwise False is returned.

[0095] Corresponding to the aforementioned MonoSAT-based cloud network configuration analysis method embodiment, the present invention also provides a MonoSAT-based cloud network configuration analysis system embodiment, such as Figure 2 As shown in the figure, the system consists of three components: configuration file information reading module, cloud network component function simulation implementation module, and reachability analysis module. The functions of each component are as follows:

[0096] (1) Configuration file information reading module: used to receive configuration file information provided by the user, obtain network element component information in the cloud network from the configuration file information, and infer the topology information between the network element components.

[0097] Specifically, the configuration file information reading module first reads the user's configuration information line by line. Based on the component type and component number information provided in the configuration information, it calls the cloud network component function simulation implementation module to generate the corresponding component nodes for the MonoSAT graph. Secondly, the topology information between network element components is inferred from the configuration information. For adjacent nodes in the topology, the cloud network component function simulation implementation module is called to establish conditional connections.

[0098] (2) Cloud network component function simulation implementation module: responsible for the MonoSAT simulation function implementation of each component in the cloud network, expressing the functions of the cloud network components with logical expressions, so that MonoSAT can determine the reachability between graph nodes through these logical expression information, thereby realizing the reachability analysis of the simulated cloud network;

[0099] Specifically, corresponding component simulation nodes are created according to the network element component information as MonoSAT graph nodes; according to the topology information and the reachability judgment logic expression of the data packet at each node, the reachability logic edge connection between the MonoSAT graph nodes is constructed to obtain the MonoSAT graph.

[0100] (3) Reachability analysis module: It is used to receive the node information to be analyzed provided by the user, calculate the reachability logic of all edges on the path between the source node and the destination node through the MonoSAT solver, and feed back the reachability results to the user.

[0101] The above description is only a preferred embodiment of the present invention. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art can use the above disclosed methods and technical contents to make many possible changes and modifications to the technical solution of the present invention without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment with equivalent changes. Therefore, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of protection of the technical solution of the present invention.

Claims

1. A cloud network configuration analysis method based on MonoSAT, characterized in that: include: Receive configuration file information provided by the user, obtain network element component information in the cloud network from the configuration file information, and infer topology information between the network element components; Creating corresponding component simulation nodes according to the network element component information as MonoSAT graph nodes; According to the topology information, combined with the reachability judgment logic expression of the data packet at each node, the reachability logic edge connection between the nodes of the MonoSAT graph is constructed; The MonoSAT solver is used to calculate the reachability logic of all edges on the path between the source node and the destination node, and the reachability results are fed back to the user.

2. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: The steps for converting the configuration information provided by the user into a MonoSAT graph are as follows: S1: Initialize and create MonoSAT graph; S2: Read configuration information and create MonoSAT graph nodes based on the types and component numbers of different network element components, including private networks, switches, cloud servers, routers, security groups, access control policies, routing tables, load balancing, NAT gateways, and the Internet; S3: Based on the inferred topology information between network element components and the reachability judgment logic expression of the data packet at each node, the reachability logical edge connection between the nodes of the MonoSAT graph is constructed.

3. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: The connection method between nodes in the MonoSAT graph is as follows: For the source node and destination node connected in the inferred topology information, a logical judgment expression that can be transmitted from the source node to the destination node is established based on the reachability judgment logic expression of each node on the path between the source node and the destination node, and is recorded in the MonoSAT graph in the form of an edge; When the MonoSAT solver performs reachability judgment, if the data packet is reachable between two nodes, the edge exists, otherwise it does not exist, thereby establishing a truly reachable MonoSAT graph.

4. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: When the type of the network element component is a security group, the rules for creating the reachability judgment logic expression of the corresponding node are as follows: Convert security group rules into logical expressions and categorize them into allow, deny, and unconfigured rules. Node ingress and egress rules are matched separately. Security group rules are read one by one and sorted from high to low priority. The IP address, port, and protocol type ranges allowed by each priority level are not within the range that has been matched by the higher priority level, and are allowed and not denied within the current priority matching range. The range finally allowed is the union of the ranges allowed by each priority level.

5. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: When the type of the network element component is a routing table, the rules for creating the reachability judgment logical expression of the corresponding node are as follows: the routing entries of the routing table are converted into logical expressions, the routing entries are read one by one, and the destination address range allowed to pass is the union of the configured routing entry addresses.

6. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: When the type of the network element component is load balancing, the creation rule of the reachability judgment logic expression of the corresponding node is as follows: Load balancing reads the monitoring entries one by one, and if the monitoring is in the whitelist and the monitoring is not in the blacklist, the data packet is allowed to pass.

7. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: The connection types of the reachability logical edges between nodes in the MonoSAT graph are as follows: Connect the switch and cloud server based on the cloud server's IP and switch subnet address information; Connect nodes connected to the switch based on the switch routing table information; Connect nodes connected to the router according to the router's routing table; Connect to the nodes connected to the load balancer based on the load balancer's monitoring information.

8. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: The MonoSAT solver automatically calculates the reachability between a given source address, port and a destination address, port under a given protocol type according to the topological structure of the MonoSAT graph, and returns a reachability result.

9. The cloud network configuration analysis method based on MonoSAT according to claim 1, characterized in that: The MonoSAT solver obtains the reachability logic as follows: S1: Based on the source address, destination address, source port, destination port, protocol type, and component type input by the user, the user's configuration file information is read to build a MonoSAT graph. The MonoSAT solver is used to determine whether the data packet can be sent from the source node to the destination node and received. If so, True is returned; otherwise, the next step is to determine whether a NAT gateway is used. S2: Read the NAT gateway configuration information one by one. If the conversion conditions of the NAT gateway are met, the source address or destination address and port information of the data packet are updated, and the reachability is re-judged. If it is judged to be reachable, True is returned, otherwise False is returned.

10. A cloud network configuration analysis system based on MonoSAT, characterized in that: include: A configuration file information reading module is used to receive configuration file information provided by a user, obtain network element component information in the cloud network from the configuration file information, and infer topology information between network element components; A cloud network component function simulation implementation module is used to create corresponding component simulation nodes as MonoSAT graph nodes based on the network element component information; based on the topology information and in combination with the reachability judgment logic expression of the data packet at each node, construct the reachability logic edge connection between the MonoSAT graph nodes, thereby obtaining a MonoSAT graph; The reachability analysis module is used to receive the node information to be analyzed provided by the user, calculate the reachability logic of all edges on the path between the source node and the destination node through the MonoSAT solver, and feed back the reachability results to the user.

Images