Network verification method and device, equipment, storage medium and program product

Abstract

The invention discloses a network verification method and device, equipment, a storage medium and a program product, and the method comprises the steps: determining an abstract network element model based on an abstract network element function; wherein the abstract network element model is a network element model of a network forwarding plane; performing task arrangement based on the network verification task to obtain a reachable matrix; and based on the instance of the abstract network element model, performing network verification on the reachable matrix to obtain a reachable path.

Description

Technical Field

[0001] The present application relates to the field of data services, and in particular to a network verification method, device, equipment, storage medium and program product. Background Art

[0002] With the continuous deployment of services and new network elements, network logic has become more complex, making the network maintenance stability more dependent on the accuracy of manual business logic sorting. In the process of network maintenance, since operation and maintenance personnel need to follow up continuously and synchronously, the communication cost of sorting out business forwarding logic is very high, and there are also cases where operation and maintenance personnel do not sort out the business in place or omissions in work handover. Therefore, network defects will be exposed during the process of business launch and fault handling, causing damage to existing services. The network deployment cost issue restricts network development. With the continuous deployment of services, different types of new and old network elements are shared, resulting in the continuous increase in network complexity, which has become a major difficulty in maintaining the stability of the network system. Summary of the invention

[0003] To solve the above technical problems, the embodiments of the present application provide a network verification method, apparatus, device, storage medium and program product.

[0004] The network verification method provided in the embodiment of the present application includes:

[0005] Based on the abstract network element function, an abstract network element model is determined; wherein the abstract network element model is a network element model of a network forwarding plane;

[0006] Perform task scheduling based on network verification tasks and obtain a reachable matrix;

[0007] Based on the instance of the abstract network element model, network verification is performed on the reachable matrix to obtain a reachable path.

[0008] The network verification device provided in the embodiment of the present application includes:

[0009] A determination unit, configured to determine an abstract network element model based on an abstract network element function; wherein the abstract network element model is a network element model of a network forwarding plane;

[0010] An orchestration unit, used to perform task orchestration based on the network verification task and obtain a reachability matrix;

[0011] A verification unit is used to perform network verification on the reachable matrix based on an instance of the abstract network element model to obtain a reachable path.

[0012] The processing device provided in the embodiment of the present application includes: a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute any one of the above-mentioned network verification methods.

[0013] The computer-readable storage medium provided in the embodiment of the present application is used to store a computer program, and the computer program enables a computer to execute any one of the above-mentioned network verification methods.

[0014] The computer program product provided in the embodiment of the present application includes computer program instructions, which enable a computer to execute any one of the above-mentioned network verification methods.

[0015] In the technical solution of the embodiment of the present application, an abstract network element model is determined based on the abstract network element function, and task orchestration is performed based on the network verification task to obtain a reachable matrix, thereby performing network verification on the reachable matrix based on an instance of the abstract network element model to obtain a reachable path; wherein the abstract network element model is a network element model of the network forwarding plane. In this way, by constructing a unified network element model of the network forwarding plane based on the abstract network element function, it is helpful to avoid the differences in the implementation of various network functions by manufacturers' equipment, and can improve the adaptability and scalability of the model. In addition, based on the data center network verification task, the orchestration design is performed, and the network technology used in the data center network scenario is adapted using a unified abstract network element model, which can not only meet the needs of data center network verification and improve the accuracy and effectiveness of network verification, but also provide a reference for operation and maintenance personnel to actively discover and solve network fault problems, thereby improving the efficiency of network automation operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a network verification method provided in an embodiment of the present application;

[0017] Figure 2 It is a schematic diagram of the architecture of a network verification model design for a cloud data center provided in an embodiment of the present application;

[0018] Figure 3 It is a schematic diagram of the principle of constructing an abstract network element interface model based on the portPBR model provided in an embodiment of the present application;

[0019] Figure 4 It is a schematic diagram of the principle of constructing an abstract network element model based on a Port connected undirected graph and a GRT and VRF routing leakage graph provided in an embodiment of the present application;

[0020] Figure 5a It is a schematic diagram of the principle of scheduling network verification tasks based on a graph structure provided in an embodiment of the present application;

[0021] Figure 5b It is a directed schematic diagram of the paths between the port interfaces in the forwarding reachable matrix provided in the embodiment of the present application;

[0022] Figure 6 It is a schematic diagram of the structure of a network verification device provided in an embodiment of the present application;

[0023] Figure 7 It is a schematic diagram of the structure of the processing device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] It should be noted that in the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the embodiments of the present application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0026] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0027] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0028] In recent years, with the rapid development of cloud computing, except for some dedicated network architectures such as supercomputers, the physical architecture of data centers has evolved from the traditional three-layer network architecture to the Clos-based spine-leaf network architecture. The flattened spine-leaf architecture greatly simplifies the physical architecture of the second and third layers of the network while improving the east-west throughput of the data center. However, with the continuous deployment of services and the deployment of new network elements, the network has become more complex. The deployment of overlay networks, underlay networks, hosts, and container networks has reduced the overall maintainability of the system, making the network maintenance stability more dependent on the accuracy of manual business logic combing.

[0029] From the perspective of continuous business deployment, the business logic on the cloud is complex and it is difficult to deploy in accordance with the standardized isolation of the management network and business network, or in accordance with the standardized isolation of computing and storage. There is a high probability that there will be non-standard deployment of business. In the process of network maintenance, due to the inadequate business organization of the operation and maintenance personnel or the omissions in the handover of work, the defects of non-standard deployment, the complex network strategies of network elements such as firewalls, and the omissions in the evolution of the old and new network architectures, etc., will be exposed in the process of business launch and fault handling, causing damage to existing businesses.

[0030] From the perspective of the deployment of new network element devices, in order to achieve cloud virtualization and isolation at a lower cost, a wide variety of new network element devices such as Software Defined Networking (SDN) and white box switches have emerged in the field. However, the cost of independently implementing a data center network with unified interfaces and programmable is relatively high. Therefore, the field often adopts the method of superimposing and integrating technical architectures to achieve iterative deployment. In addition, due to the programmability of new network element devices and the convenience of service delivery, the business logic based on new network element devices changes rapidly, which requires operation and maintenance personnel to follow up continuously and synchronously, resulting in high communication costs for sorting out business logic.

[0031] Judging from the actual situation of network development, the deployment cost issue has always been a fundamental problem restricting the unified development of the network. New network element equipment and new protocols will continue to integrate and develop with the existing environment and protocols, resulting in increased complexity in network deployment and becoming a major difficulty in maintaining the stability of the network system.

[0032] Based on the above problems, related technologies provide the following methods to effectively monitor the network or device status and promptly detect network or device failures:

[0033] (1) Obtain a list of all switches and routers within a given network range, analyze the list of switches and routers, determine whether the current network is a Layer 2 subnet or a Layer 3 network, discover the network topology of all Layer 2 subnets through Spanning Tree Protocol (STP) data, discover the Layer 3 network topology through routing table data, merge the network topologies of all Layer 2 subnets or all Layer 3 network topologies to obtain the entire data center network topology, which can effectively discover defects in the data center network topology.

[0034] (2) Initialize the root node of the tree graph to obtain the starting node for generating the topology graph. Based on the starting node, create a canvas in the browser to display scalable vector graphics. Obtain the node data of the next-level associated device from the background according to the node. Calculate the X-axis offset and Y-axis offset of the node at each layer of the canvas according to the node data, build a node offset table, obtain the node position offset data from the node offset table, and calculate the actual node position according to the unit length to generate a topology map of the equipment in the computer room. This topology map can effectively detect equipment failures in the computer room and isolate them. It has a simple structure and is easy to manage and maintain.

[0035] (3) Automatically discover newly launched cloud environment devices, as well as configuration and status changes of cloud environment devices, and monitor the operating status of cloud environment devices. At the same time, it manages device connection relationships, status visualization, and device assets. This method can meet the management needs of multiple types of devices and can also meet the different device discovery methods of different types of devices.

[0036] However, although the above methods have been successfully implemented in the corresponding application scenarios, the network topology discovery method tends to focus on the second and third layer network topology, or the efficiency of automatic topology generation, and is not actually combined with the business scenarios of the cloud data center. The cloud data business topology data link layer and network layer tend to be simplified, and the complexity of the business is realized by dividing the network plane, complex network strategies, and virtualizing multiple network elements to implement business logic. The Spine-Leaf network physical topology has no obvious value for business-related operation and maintenance in cloud data.

[0037] In order to solve the above technical problems, this application proposes a method for constructing a network verification model for a cloud data center to realize the autonomous discovery of the service network. First, a unified network forwarding plane network element model (abstract network element model) is constructed based on the abstract network element function, and then the configuration of traditional network equipment and new network element equipment is mapped to the unified abstract network element model. On this basis, the autonomous discovery capability of the service network in the cloud data is constructed. In addition, by designing a cloud data center network verification system, the automatic combing capability of complex services can be realized, the operation and maintenance personnel's understanding of various complex network services can be strengthened, the operation and maintenance errors can be reduced, and the work efficiency can be improved.

[0038] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined arbitrarily with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0039] The present application embodiment proposes a network verification method. Figure 1 is a flow chart of a network verification method provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0040] Step 101: Determine an abstract network element model based on the abstract network element function.

[0041] The abstract network element model is a network element model of the network forwarding plane.

[0042] In the embodiment of the present application, the abstract network element model is mainly for the service network forwarding of the cloud data center, focusing on the forwarding plane of the network element device, so the abstract network element function mainly includes the function of the network element device on the forwarding plane. Among them, the function of the network element device on the forwarding plane includes the function of the interface of the network element device to actually handle traffic data and the function of virtual routing forwarding, such as interface / device level access control list (Access Control List, ACL), policy-based routing (Policy-BasedRouting, PBR), physical port (phyPort) and logical port (logicPort) link aggregation technology, virtual routing forwarding (Virtual Routing and Forwarding, VRF) technology, etc., that is, the abstract network element function includes the network element interface function and the virtual routing forwarding function, wherein the abstract network element interface model is determined by the network element interface function, and the virtual routing forwarding model is determined by the virtual routing forwarding function. Therefore, determining the abstract network element model based on the abstract network element function may include determining the abstract network element interface model based on the network element interface function, determining the virtual routing forwarding model based on the virtual routing forwarding function, and determining the abstract network element model based on the abstract network element interface model and the virtual routing forwarding model.

[0043] In some implementations, the abstract network element function includes a network element interface function and a virtual routing forwarding function; wherein, step 101 may specifically include:

[0044] Determine the policy routing model based on the atomic operation of data forwarding in the network element interface function; wherein the atomic operation includes the operation of access control list and policy routing;

[0045] Based on the policy routing model, determine the abstract network element interface model;

[0046] Based on the virtual routing forwarding function, determine the virtual routing forwarding model;

[0047] Based on the abstract network element interface model and the virtual routing and forwarding model, the abstract network element model is determined.

[0048] Here, the atomic operation (atomicOperator) for data forwarding in the network element interface function can be first defined, and a portPBR model, i.e., a policy routing model, can be constructed based on the atomic operation to meet the operations of various data center networks for business traffic, wherein the policy routing model can meet the operations of interface / device-level ACL and PBR; after constructing the policy routing model, the interface functions of the policy routing model can be determined on the basis of the policy routing model: portPBRIn and portPBROut, and an abstract network element interface model can be constructed in combination with the network element interface function, wherein the abstract network element interface model includes logicPort, phyPort, portPBRIn, and portPBROut, and at the same time, a virtual routing forwarding model is determined based on the virtual routing forwarding function, wherein the virtual routing forwarding model includes a routing forwarding table and a routing leakage policy; after constructing the abstract network element interface model and the virtual routing forwarding model, the corresponding virtual routing forwarding model instance can be associated through the VRF field of the abstract network element interface model instance, and the abstract network element model can be constructed based on the abstract network element interface model and the virtual routing forwarding model.

[0049] Here, atomic operation usually refers to an indivisible operation, that is, this operation will not be interrupted by any other operation during execution. For building a policy routing model based on atomic operations, atomic operations can be regarded as the basic steps for building a policy routing model. These steps are operations that must be executed strictly in sequence and ensure the consistency of the network status, including defining the physical or logical interface for PBR, and defining the PBR policy including matching conditions and corresponding actions.

[0050] Here, in the process of constructing the abstract network element interface model, since the network interfaces of the data center mostly use link aggregation technology, the logicPort and phyPort can be constructed accordingly in the abstract network element interface model, where phyPort is data with the actual physical interface as a list, shielding the physical aggregation implementation and focusing on the relevance of the logicPort interface to the business.

[0051] In some implementations, the abstract network element interface model is used to define interface attributes in the abstract network element function, and the virtual routing forwarding model is used to define virtual routing forwarding attributes in the abstract network element function; wherein, “determining the abstract network element model based on the abstract network element interface model and the virtual routing forwarding model” may specifically include:

[0052] Associating the interface attributes with the control policy of the inbound direction and / or outbound direction of the interface and link aggregation to obtain a network element device function representation of the interface policy;

[0053] Associating the virtual routing forwarding attribute with the forwarding table to obtain the network element device function representation of the routing forwarding strategy;

[0054] Associating the virtual route forwarding attribute with the global route table to obtain the network element device function representation of the route leakage policy;

[0055] An abstract network element model is determined based on the network element device function representation of the interface strategy, the network element device function representation of the routing forwarding strategy, and the network element device function representation of the routing leakage strategy.

[0056] Here, on the basis of the abstract network element interface model, a virtual routing and forwarding model is introduced to further construct an abstract network element model taking the cloud data center network as a whole, wherein the abstract network element model includes interface attributes and virtual routing and forwarding attributes. Specifically, first of all, the complexity of the data center network is fully considered, and based on the interface attributes and virtual routing forwarding attributes, the interface attributes are associated with the control strategy and link aggregation of the interface's inbound and / or outbound directions to obtain the network element device function representation of the interface strategy, the virtual routing forwarding attributes are associated with the forwarding table to obtain the network element device function representation of the routing forwarding strategy, and the virtual routing forwarding attributes are associated with the global routing table (or other virtual routing forwarding) to obtain the network element device function representation of the routing leakage strategy, so that various interfaces and device-level strategies can be uniformly abstracted to the interface and the network element functions can be associated; after obtaining the network element device function representation of the interface strategy, the network element device function representation of routing forwarding, and the network element device function representation of routing leakage, a unified abstract network element model can be constructed based on the abstract representation of the interface strategy, routing forwarding strategy, and routing leakage strategy, wherein the abstract network element model is based on the core functions of the cloud data center network element devices: forwarding and isolation, and is independent of the specific implementation of each manufacturer's equipment.

[0057] Specifically, an undirected graph of port connectivity can be constructed based on the interface policy, and a global routing table (GRT) and a VRF routing leakage graph can be constructed based on the routing forwarding policy and the routing leakage policy. Thus, the complex characteristics of the cloud data center business logic can be abstracted based on the undirected graph of port connectivity and the GRT and VRF routing leakage graphs, including network characteristics such as multi-network VRF plane isolation, different VRF planes belonging to directly connected peer ports, and routing leakage. Finally, a unified abstract network element model is constructed, wherein the instances generated according to the abstract network element model based on the production network configuration can help operation and maintenance personnel automatically sort out the complex business logic in the existing data center network.

[0058] In network configuration and management, interface policies are usually used to control and manage the set of rules for traffic on a specific port or port group, usually including access control policies, security policies, traffic management policies, etc. Routing forwarding policies determine how data packets are forwarded from one network node to another, usually including forwarding tables, routing protocols, routing selection algorithms, virtual routing forwarding, etc. Routing leakage policies allow sharing of routing information between VRF and GRT, as well as between VRF and other VRFs, to achieve network isolation and mutual access. VRF technology allows the creation of multiple logically isolated routing instances on the same physical router. Each routing instance has an independent routing table to achieve isolation of different network traffic, and also enables mutual access of routing information between different VRF instances.

[0059] Step 102: Perform task scheduling based on the network verification task to obtain a reachability matrix.

[0060] In an embodiment of the present application, if the operation and maintenance personnel initiate network verification, a network verification task can be generated based on the network verification, and task scheduling can be performed based on the network verification task to obtain a reachable matrix, wherein the reachable matrix is ​​a forwarding reachable matrix used for network verification.

[0061] Here, after the network verification task is arranged, the network verification task can be executed and the execution results can be fed back to the operation and maintenance personnel. Among them, the network verification task execution method includes Satisfiability ModuloTheories (SMT) coding execution, Header Space Analysis (HSA) mathematical modeling, simulation data forwarding, etc.

[0062] In some implementations, step 102 may specifically include:

[0063] Based on the network verification task, determine multiple hosts and / or container interfaces for network verification;

[0064] Tasks are orchestrated based on multiple hosts and / or container interfaces to obtain a reachability matrix.

[0065] Here, based on the network verification task, multiple hosts and / or container interfaces involved in the need for network verification can be determined, and then tasks can be scheduled based on the multiple hosts and / or container interfaces and the connection relationships between the multiple hosts and / or container interfaces to obtain a reachable matrix corresponding to the multiple hosts and / or container interfaces.

[0066] Among them, the reachable matrix refers to the use of matrix form to describe the degree to which nodes in a directed graph can be reached after a path of a certain length. The reachable matrix does not guarantee that all nodes are reachable, that is, it does not guarantee direct or indirect connections between all nodes.

[0067] In some implementations, “arranging tasks based on multiple hosts and / or container interfaces to obtain a reachability matrix” may specifically include:

[0068] Determining, based on the plurality of hosts and / or container interfaces, a communication path between the plurality of hosts and / or container interfaces;

[0069] A reachability matrix is ​​determined based on the plurality of hosts and / or container interfaces and communication paths between the plurality of hosts and / or container interfaces.

[0070] Here, firstly, the communication path between the multiple hosts and / or container interfaces is determined based on the multiple hosts and / or container interfaces, and then the multiple hosts and / or container interfaces are taken as nodes, the communication path between the multiple hosts and / or container interfaces is taken as edges, and a reachable matrix is ​​constructed based on the multiple nodes and the edges between the multiple nodes. Since the communication path between the multiple hosts and / or container interfaces includes two directions, namely, the outbound direction and the return direction, the reachable path to be verified by the network is a directed path, and the graph corresponding to the reachable path is a directed graph.

[0071] Step 103: Based on the instance of the abstract network element model, perform network verification on the reachability matrix to obtain a reachable path.

[0072] In an embodiment of the present application, since the abstract network element model abstracts the complex characteristics of the cloud data center business logic, the instance of the abstract network element model can provide a unified way to express different elements in the network and the connection relationship between the elements, that is, the instance of the abstract network element model can include forwarding paths corresponding to multiple hosts and / or container interfaces. Therefore, the reachable matrix can be network verified based on the forwarding paths corresponding to multiple hosts and / or container interfaces in the instance of the abstract network element model to obtain a reachable path.

[0073] In some implementations, step 103 may specifically include:

[0074] Determine forwarding paths corresponding to multiple hosts and / or container interfaces in an instance of an abstract network element model;

[0075] Based on the forwarding path, the corresponding model instance in the reachable matrix is ​​traversed. If it is determined that there is a path matching the forwarding path in the reachable matrix, the matching path is determined as the path to be verified;

[0076] Determine a reachable path based on the path to be verified.

[0077] Here, based on multiple hosts and / or container interfaces that need to be network verified, the forwarding paths corresponding to the multiple hosts and / or container interfaces in the instance of the abstract network element model can be determined. Specifically, first, the network configuration information related to the multiple hosts and / or container interfaces in the instance is collected, and combined with the network topology structure, the positions of the multiple hosts and / or container interfaces in the network are analyzed and verified, including verifying whether the multiple hosts and / or container interfaces are directly connected to other network elements, or through which intermediate network elements the multiple hosts and / or container interfaces are reachable, and then the forwarding paths corresponding to the multiple hosts and / or container interfaces are calculated using a network model or algorithm, or the paths corresponding to the multiple hosts and / or container interfaces are detected using a network detection technology or tool to determine the forwarding path; after obtaining the forwarding paths corresponding to the multiple hosts and / or container interfaces, the reachable matrix can be traversed based on the forwarding path to find out whether there is a path matching the forwarding path in the reachable matrix, and if so, the matched path is determined as the path to be verified; wherein, since not all forwarding paths are reachable paths, after determining the path to be verified that matches the forwarding path, it is also necessary to determine whether the path to be verified is a reachable path.

[0078] In some implementations, “determining a reachable path based on the path to be verified” may specifically include:

[0079] Based on the path to be verified, a directed graph is constructed for the corresponding model instance in the reachable matrix to obtain the directed graph corresponding to the path to be verified;

[0080] If the directed graph is judged to be closed, the path to be verified is determined to be a reachable path.

[0081] Here, in order to further determine whether the path to be verified that matches the forwarding path is a reachable path, a directed graph construction traversal can be performed on the corresponding model instance in the reachable matrix based on the path to be verified to obtain a directed graph corresponding to the path to be verified, and determine whether the directed graph is a closed loop. If the corresponding path in the directed graph is determined to start from a vertex, pass through a series of edges, and finally return to the vertex, then the path to be verified can be determined to be a reachable path.

[0082] In some embodiments, it may further specifically include:

[0083] Based on the abstract network element model, the reachable matrix is ​​verified to obtain the unreachable path;

[0084] Based on the unreachable path, determine the problem interface corresponding to the unreachable path, and feed back the relevant information of the problem interface to the operation and maintenance end.

[0085] Here, in the process of network verification of the reachable matrix based on the forwarding paths corresponding to multiple hosts and / or container interfaces in the abstract network element model, an unreachable path in the reachable matrix is ​​also determined. The unreachable matrix is ​​an unreachable path corresponding to multiple hosts and / or container interfaces. The end node in the unreachable path is determined as the problem interface, and the relevant information of the problem interface is fed back to the operation and maintenance end so that the operation and maintenance personnel can repair the problem interface, thereby providing a reference for the operation and maintenance personnel to solve network failure problems and improving the efficiency of network automation operation and maintenance.

[0086] In the technical solution of the embodiment of the present application, an abstract network element model is determined based on the abstract network element function, and task orchestration is performed based on the network verification task to obtain a reachable matrix, thereby performing network verification on the reachable matrix based on an instance of the abstract network element model to obtain a reachable path; wherein the abstract network element model is a network element model of the network forwarding plane. In this way, by constructing a unified network element model of the network forwarding plane based on the abstract network element function, it is helpful to avoid the differences in the implementation of various network functions by manufacturers' equipment, and can improve the adaptability and scalability of the model. In addition, based on the data center network verification task, the orchestration design is performed, and the network technology used in the data center network scenario is adapted using a unified abstract network element model, which can not only meet the needs of data center network verification and improve the accuracy and effectiveness of network verification, but also provide a reference for operation and maintenance personnel to actively discover and solve network fault problems, thereby improving the efficiency of network automation operation and maintenance.

[0087] The present application also proposes a method for constructing a network verification model for a cloud data center. Figure 2 Schematic diagram of the network verification model design for cloud data centers provided by the embodiment of the present application. Figure 2 As shown in the figure, the architecture mainly consists of two parts: abstract network element model construction and network verification system construction, including:

[0088] Abstract network element model construction

[0089] The construction of the abstract network element model is mainly aimed at the forwarding of the cloud data center service network, focusing on the forwarding plane of the network element equipment rather than its control plane, in order to avoid the differences in the implementation of various network functions by vendor equipment and meet its scalability. In the construction of the abstract network element model, the network element forwarding of the cloud data center is designed from two aspects, mainly considering the adaptability and scalability of the model.

[0090] First, an abstract network element interface model is designed to fully adapt to the relevant core network virtualization technologies of the data center network, such as link aggregation technology, multi-network plane VRF division, and interface / device-level traffic PBR. Figure 3The figure shows a schematic diagram of the principle of constructing an abstract network element interface model based on the portPBR model provided by an embodiment of the present application. In order to ensure that it can adapt to traditional network devices, new network element devices and host / container networks, the abstract network element interface model abstracts the interface operation, innovatively creates portPBR and defines atomic operations to meet the manipulation of business traffic by various data center networks, and can meet the operations of interface / device-level ACL and policy routing PBR. According to the capabilities of current network element devices, three types of operations are defined: permit, deny, modNextHop, and operations of abstract network element devices. On the basis of constructing the portPBR model, the Port model is further constructed. Since the data center network interface mostly adopts link clustering technology, logicPort and phyPort can be constructed accordingly. Among them, phyPort is data with actual physical interfaces as a list, shielding the physical aggregation implementation, and focusing on the correlation between the logicPort interface and the business.

[0091] Secondly, on the basis of constructing the Port model, we further construct an abstract network element model with the cloud data center network as a whole. Specifically, first of all, we fully consider the complexity of the data center network, and based on the tuple of {Port, VRF}, we associate the Port with the interface policy, and the VRF with the FIB table. We abstract various interfaces and device-level policies to the interface and associate the network element functions to shield the characteristics of the manufacturer's equipment. Secondly, we construct a unified abstract network element model based on the forwarding functions of the cloud data center network element equipment: Port, Port policy, VRF routing forwarding, GRT, VRF routing leakage. This model is based on the core functions of the data center network element equipment, namely isolation and forwarding, and is independent of the specific implementation of each manufacturer's equipment. Figure 4 The figure shows a schematic diagram of the principle of constructing an abstract network element model based on a Port connectivity undirected graph and a GRT and VRF routing leakage graph provided by an embodiment of the present application. By adopting the idea of ​​points, lines and surfaces in a two-dimensional view to construct a model, a two-dimensional view of the network function of the network element is constructed, which solves the model abstraction problem of VRF and Port link aggregation in network virtualization. The model combines the Port connectivity undirected graph and the GRT and VRF routing leakage graph, that is, the points, lines and surfaces in the two-dimensional view, and effectively abstracts the complex characteristics of the current cloud data center business logic, including network characteristics such as isolation of multiple network VRF planes, different VRF planes belonging to directly connected peer ports, and routing leakage. The model can help operation and maintenance personnel automatically sort out the complex business logic in the existing data center network.

[0092] The abstract network element model is adaptable to various network characteristics of data center network elements, and the scalability of the model is mainly reflected in two aspects:

[0093] (1) The construction of the portPBR model can cope with complex traffic manipulation and can continue to meet the functional abstraction issues of subsequent new self-developed network elements.

[0094] (2) The abstract network element model is based on {Port, VRF} and is independent of the IP network. It can be subsequently extended to networks such as SRv6 and Ethernet.

[0095] Network verification system construction

[0096] In the construction of network verification system, it mainly includes network verification task orchestration and network verification task execution. For network verification task execution, there are many solutions in the field. The core solutions include SMT encoding execution, HSA mathematical modeling, simulation data forwarding, etc. There is currently a lack of orchestration design patterns for cloud data center network verification tasks.

[0097] First of all, in the network verification task, reachability verification is the most basic and important verification task. However, in the actual operation and maintenance process, with the maintenance progress of the system, network reachability verification and network-level high availability verification are difficult to guarantee. Often, reachability verification is triggered by events and failures. In the absence of task scheduling, it is difficult to understand the actual situation of network reachability. Based on this, the embodiment of the present application performs task scheduling by combining the host / container Port interface and designs a configuration matching algorithm based on a graph structure to perform network verification task scheduling, such as Figure 5a The figure is a schematic diagram of the principle of scheduling network verification tasks based on a graph structure provided by an embodiment of the present application. The execution steps of the algorithm specifically include:

[0098] (1) The communication paths between all port interfaces of the host / container are taken as set S, and a forwarding reachability matrix is ​​constructed based on set S to generate the task of the verification matrix. If the forwarding reachability graph corresponding to the forwarding reachability matrix is ​​connected, it means that the communication path satisfies the connectivity.

[0099] (2) Perform reachability calculation on the forwarding reachability matrix, where all port interfaces of the host / container in the forwarding reachability matrix are taken as set P, and a directed graph between the port interfaces is constructed from source to destination and from destination to source based on set P, as follows: Figure 5b The figure shows a directed schematic diagram of the paths between Port interfaces in the forwarding reachable matrix provided in an embodiment of the present application, wherein in the directed graph, Port_2 and Port_3 are end nodes in the directed graph.

[0100] (3) Based on the directed graph, the forwarding reachability matrix is ​​connected in series with the port interface operation, the reachability of the forwarding reachability matrix is ​​verified through the instance of the abstract network element model, and possible path references in the forwarding reachability matrix are given, such as providing the paths {Port_2, Port_5, Port_3}, {Port_2, Port_3}.

[0101] (4) After the reachability of the forwarding reachability matrix is ​​verified, if the feedback contains a problem node that is not closed, the path is actually unreachable, such as Figure 5b If the Port_2 and Port_3 nodes are not connected, it means that there are problems with the interfaces corresponding to the Port_2 and Port_3 nodes, resulting in the unreachable problem.

[0102] In the technical solution of the embodiment of the present application, by building a unified abstract network element model based on abstract network element functions, the adaptability and scalability of the model can be improved, which helps to avoid differences in manufacturers' equipment in implementing various network functions. At the same time, by building a network verification system, network verification tasks are orchestrated, and the forwarding reachable matrix generated by the network verification task orchestration is verified for reachability using an abstract network element model instance, which can not only meet the needs of network verification and improve the accuracy and effectiveness of network verification, but also provide a reference for operation and maintenance personnel to actively discover and solve network fault problems, thereby improving the efficiency of network automation operation and maintenance.

[0103] The present application also provides a network verification device. Figure 6 is a schematic diagram of the structure of a network verification device provided in an embodiment of the present application, such as Figure 6 As shown, the device comprises:

[0104] The determination unit 601 is used to determine an abstract network element model based on the abstract network element function; wherein the abstract network element model is a network element model of a network forwarding plane.

[0105] The scheduling unit 602 is used to schedule tasks based on the network verification tasks to obtain a reachable matrix.

[0106] The verification unit 603 is used to perform network verification on the reachable matrix based on the instance of the abstract network element model to obtain a reachable path.

[0107] In some embodiments, the abstract network element function includes a network element interface function and a virtual routing forwarding function; the determination unit 601 is specifically used to: determine the policy routing model based on the atomic operation of data forwarding in the network element interface function; wherein the atomic operation includes the operation of access control list and policy routing; determine the abstract network element interface model based on the policy routing model; determine the virtual routing forwarding model based on the virtual routing forwarding function; determine the abstract network element model based on the abstract network element interface model and the virtual routing forwarding model.

[0108] In some embodiments, the abstract network element interface model is used to define the interface attributes in the abstract network element function, and the virtual routing forwarding model is used to define the virtual routing forwarding attributes in the abstract network element function; the determination unit 601 is also specifically used to: associate the interface attributes with the control policy and link aggregation of the interface's inbound and / or outbound directions to obtain the network element device function representation of the interface policy; associate the virtual routing forwarding attributes with the forwarding table to obtain the network element device function representation of the routing forwarding policy; associate the virtual routing forwarding attributes with the global routing table to obtain the network element device function representation of the routing leakage policy; determine the abstract network element model based on the network element device function representation of the interface policy, the network element device function representation of the routing forwarding policy, and the network element device function representation of the routing leakage policy.

[0109] In some implementations, the orchestration unit 602 is specifically configured to: determine multiple hosts and / or container interfaces for network verification based on the network verification task; and perform task orchestration based on the multiple hosts and / or container interfaces to obtain a reachable matrix.

[0110] In some embodiments, the orchestration unit 602 is further specifically configured to: determine a communication path between multiple host and / or container interfaces based on multiple host and / or container interfaces; determine a reachable matrix based on multiple host and / or container interfaces and the communication path between multiple host and / or container interfaces.

[0111] In some embodiments, the verification unit 603 is specifically used to: determine the forwarding paths corresponding to multiple host and / or container interfaces in an instance of the abstract network element model; traverse the corresponding model instances in the reachable matrix based on the forwarding paths, and if it is determined that there is a path in the reachable matrix that matches the forwarding path, the matching path is determined as the path to be verified; based on the path to be verified, determine the reachable path.

[0112] In some embodiments, the verification unit 603 is further specifically used to: construct a directed graph for the corresponding model instance in the reachable matrix based on the path to be verified, and obtain a directed graph corresponding to the path to be verified; if the directed graph is judged to be closed, the path to be verified is determined to be a reachable path.

[0113] In some implementations, the verification unit 603 is further specifically configured to: perform network verification on the reachable matrix based on the abstract network element model to obtain an unreachable path.

[0114] In some embodiments, the device further comprises: a feedback unit; wherein,

[0115] The feedback unit is used to determine the problem interface corresponding to the unreachable path based on the unreachable path, and feed back relevant information of the problem interface to the operation and maintenance end.

[0116] In the technical solution of the embodiment of the present application, an abstract network element model is determined based on the abstract network element function, and tasks are orchestrated based on the network verification task to obtain a reachable matrix, thereby performing network verification on the reachable matrix based on an instance of the abstract network element model to obtain a reachable path; wherein the abstract network element model is a network element model of the network forwarding plane. In this way, by constructing a unified network element model of the network forwarding plane based on the abstract network element function, it is helpful to avoid the differences in the implementation of various network functions among manufacturers' equipment, and can improve the adaptability and scalability of the model. In addition, by performing orchestration design based on the data center network verification task and using a unified abstract network element model to adapt the network technology used in the data center network scenario, it can not only meet the needs of data center network verification and improve the accuracy and effectiveness of network verification, but also provide a reference for operation and maintenance personnel to actively discover and solve network fault problems, thereby improving the efficiency of network automation operation and maintenance.

[0117] Those skilled in the art should understand that Figure 6 The implementation functions of each unit in the network verification device shown can be understood by referring to the relevant description of the aforementioned method. Figure 6 The functions of each unit in the network authentication device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0118] Figure 7 is a schematic diagram of the structure of a processing device provided in an embodiment of the present application. The processing device may be a terminal device or a network device. Figure 7 The processing device shown includes a processor 701, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0119] Alternatively, if Figure 7 As shown, the processing device may further include a memory 702. The processor 701 may call and run a computer program from the memory 702 to implement the method in the embodiment of the present application.

[0120] The memory 702 may be a separate device independent of the processor 701 , or may be integrated into the processor 701 .

[0121] Alternatively, if Figure 7 As shown, the processing device may further include a transceiver 703, and the processor 701 may control the transceiver 703 to communicate with other devices, specifically, may send information or data to other devices, or receive information or data sent by other devices.

[0122] The transceiver 703 may include a transmitter and a receiver. The transceiver 703 may further include an antenna, and the number of antennas may be one or more.

[0123] The processing device may specifically be a network verification device of an embodiment of the present application, and the processing device may implement the corresponding processes of each method implemented in the embodiment of the present application, which will not be described in detail here for the sake of brevity.

[0124] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0125] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0126] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0127] The embodiment of the present application also provides a computer-readable storage medium for storing a computer program. The computer-readable storage medium can be applied to the processing device in the embodiment of the present application, and the computer program enables the computer to execute the corresponding process of each method implemented in the embodiment of the present application, which will not be described here for the sake of brevity.

[0128] The embodiment of the present application also provides a computer program product, including computer program instructions. The computer program product can be applied to the processing device in the embodiment of the present application, and the computer program instructions enable the computer to execute the corresponding process of each method implemented in the embodiment of the present application, which will not be described here for the sake of brevity.

[0129] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0130] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0131] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0132] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0133] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0134] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (RandomAccess Memory, RAM), disk or optical disk and other media that can store program codes.

[0135] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network verification method, characterized in that: The method comprises: Based on the abstract network element function, determine an abstract network element model; wherein the abstract network element model is a network element model of a network forwarding plane; Perform task scheduling based on network verification tasks and obtain a reachable matrix; Based on the instance of the abstract network element model, network verification is performed on the reachable matrix to obtain a reachable path.

2. The method according to claim 1, characterized in that The abstract network element function includes a network element interface function and a virtual routing forwarding function; The determining of the abstract network element model based on the abstract network element function includes: Determine a policy routing model based on the atomic operation of data forwarding in the network element interface function; wherein the atomic operation includes operations of access control lists and policy routing; Based on the policy routing model, determining an abstract network element interface model; Based on the virtual routing forwarding function, determining a virtual routing forwarding model; The abstract network element model is determined based on the abstract network element interface model and the virtual routing and forwarding model.

3. The method according to claim 2, characterized in that The abstract network element interface model is used to define interface attributes in the abstract network element function, and the virtual routing and forwarding model is used to define virtual routing and forwarding attributes in the abstract network element function; The determining the abstract network element model based on the abstract network element interface model and the virtual routing forwarding model includes: Associating the interface attribute with the inbound direction and / or outbound direction control policy and link aggregation of the interface to obtain a network element device function representation of the interface policy; Associating the virtual routing forwarding attribute with the forwarding table to obtain a network element device function representation of the routing forwarding strategy; Associating the virtual routing forwarding attribute with the global routing table to obtain a network element device function representation of the routing leakage strategy; The abstract network element model is determined based on the network element device function representation of the interface strategy, the network element device function representation of the routing forwarding strategy, and the network element device function representation of the routing leakage strategy.

4. The method according to claim 1, characterized in that The task scheduling is performed based on the network verification task to obtain a reachable matrix, including: Based on the network verification task, determining a plurality of hosts and / or container interfaces for performing network verification; Task scheduling is performed based on the multiple hosts and / or container interfaces to obtain the reachable matrix.

5. The method according to claim 4, characterized in that The performing task orchestration based on the multiple hosts and / or container interfaces to obtain the reachable matrix includes: Based on the multiple hosts and / or container interfaces, determining a communication path between the multiple hosts and / or container interfaces; The reachability matrix is ​​determined based on the multiple hosts and / or container interfaces and communication paths between the multiple hosts and / or container interfaces.

6. The method according to claim 1, characterized in that The performing network verification on the reachable matrix based on the instance of the abstract network element model to obtain a reachable path includes: Determine forwarding paths corresponding to the multiple host and / or container interfaces in the instance of the abstract network element model; Traversing the corresponding model instance in the reachable matrix based on the forwarding path, if it is determined that there is a path matching the forwarding path in the reachable matrix, determining the matching path as the path to be verified; The reachable path is determined based on the path to be verified.

7. The method according to claim 6, characterized in that The determining the reachable path based on the path to be verified includes: Based on the path to be verified, construct a directed graph for the corresponding model instance in the reachable matrix to obtain a directed graph corresponding to the path to be verified; If it is determined that the directed graph is closed, the path to be verified is determined to be a reachable path.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Performing network verification on the reachable matrix based on an instance of the abstract network element model to obtain an unreachable path; Based on the unreachable path, a problem interface corresponding to the unreachable path is determined, and relevant information of the problem interface is fed back to the operation and maintenance end.

9. A network verification device, characterized in that: The device comprises: A determination unit, configured to determine an abstract network element model based on an abstract network element function; wherein the abstract network element model is a network element model of a network forwarding plane; An orchestration unit, used to perform task orchestration based on the network verification task and obtain a reachability matrix; A verification unit is used to perform network verification on the reachable matrix based on an instance of the abstract network element model to obtain a reachable path.

10. A processing device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The method comprises computer program instructions which cause a computer to execute the method as claimed in any one of claims 1 to 8.

Images