Network configuration verification method and device, storage medium and program product

Abstract

The invention relates to a network configuration verification method and device, a storage medium and a program product. The method comprises the following steps: determining change data between current network configuration data and last network configuration data of a physical network of the digital twin network; updating a previous network constraint of the data plane based on the change data to obtain a current network constraint; the previous network constraint corresponds to the previous network configuration data; updating the current network constraint based on the to-be-verified network configuration group to obtain a first network constraint; the to-be-verified network configuration group comprises a plurality of to-be-verified network configurations; verifying the to-be-verified network configuration group according to the first network constraint and the target function to obtain a network configuration verification result; the objective function is determined based on the to-be-verified network configuration group. By adopting the method, a plurality of to-be-verified network configurations can be processed, the association of the network configurations is utilized, the plurality of configurations are comprehensively considered at the same time, the limitation of single verification is avoided, and the configuration verification comprehensiveness is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information communication network, and in particular to a network configuration verification method and device, a storage medium and a program product. BACKGROUND

[0002] With the rapid development of emerging applications such as Internet of Vehicles, Industrial Internet and large-scale AI computing network, the network scale and structure are increasingly complex, and the device heterogeneity is significantly increased. These devices run multiple network protocols (such as OSPF, BGP, MPLS, etc.), which brings great challenges to network configuration and management. The traditional configuration method relying on human experience has been difficult to meet the demand, and the management personnel need to handle thousands of network configuration items, and there is a high correlation and dependency between these configurations, and a slight mistake may cause semantic conflict or logical contradiction. The continuous change of network environment, such as link fluctuation, device online and offline, further increases the difficulty of configuration verification. In order to ensure the correctness of network policy, the network configuration must be verified before physical configuration modification, to ensure the accuracy and consistency of the policy.

[0003] In related technologies, there are two types of network configuration verification techniques: data plane-based and control plane-based verification methods. Data plane verification directly verifies the running state of network functions by analyzing forwarding table entries and actual traffic behavior in network devices. Representative methods include Anteater, ConfigChecker and APKeep, which can verify network properties such as reachability, no forwarding loop, and regional isolation. Control plane verification focuses on analyzing configuration files, protocol logic and policy intent, including simulation-based Batfish, graph theory-based ARC and Tiramisu, and mathematical formula-based Minesweeper, etc.

[0004] However, in related technologies, most of the verification is performed on a single network configuration, which results in the verification result being unable to comprehensively reflect the actual running state of the network, and thus the comprehensiveness of network configuration verification is limited. SUMMARY

[0005] Therefore, it is necessary to provide a network configuration verification method, device, storage medium and program product capable of implementing joint verification of multiple network configurations by utilizing the correlation of network configurations, to effectively improve the comprehensiveness of network verification.

[0006] In a first aspect, the present application provides a network configuration verification method applied to a data plane of a digital twin network. The method comprises:

[0007] determining change data between a current network configuration data of a physical network of the digital twin network and a last network configuration data;

[0008] The current network constraints are obtained by updating the previous network constraints in the data plane based on the changed data; the previous network constraints correspond to the previous network configuration data.

[0009] The first network constraint is obtained by updating the current network constraints based on the network configuration group to be verified; the network configuration group to be verified includes multiple network configurations to be verified.

[0010] The network configuration group to be verified is verified based on the first network constraints and the objective function to obtain the network configuration verification results; the objective function is determined based on the network configuration group to be verified.

[0011] In one embodiment, the current network constraints include current link forwarding constraints and current routing constraints. The current network constraints are obtained by updating the previous network constraints in the data plane based on the changed data, including:

[0012] The forwarding constraints of the previous link are updated based on the changed data to obtain the forwarding constraints of the current link. The forwarding constraints of the previous link are constructed based on the topology parameters of the physical network and the previous data plane. The data plane includes the configuration information of the physical network.

[0013] The previous routing constraints are updated based on the changed data to obtain the current routing constraints. The previous routing constraints are constructed based on the previous link forwarding constraints and the network topology of the physical network. The previous routing constraints correspond to the previous network configuration data.

[0014] In one embodiment, updating the current network constraints based on the network configuration group to be verified yields a first network constraint, including:

[0015] Determine the association information between each network configuration to be verified in the network configuration group to be verified;

[0016] The first network constraint is obtained by updating the current network constraint based on the association information.

[0017] In one embodiment, the network configuration group to be verified is validated according to the first network constraints and the objective function to obtain the network configuration verification result, including:

[0018] Based on the first network constraints and the objective solver, determine the solution result of the objective solver;

[0019] Based on the objective function and the solution results, the network configuration group to be verified is verified to obtain the network configuration verification results.

[0020] In one embodiment, based on the objective function and the solution results, the network configuration group to be verified is verified to obtain the network configuration verification result, including:

[0021] screening the result with solution based on the target function to obtain a target solution;

[0022] verifying the network based on the target solution to obtain a network configuration verification result.

[0023] In one of the embodiments, the result with solution of the target solver is determined based on the first network constraint and the target solver, including:

[0024] the result of the target solver is determined based on the first network constraint;

[0025] In the case that the result of the solution is no solution of the target solver, the first network constraint is modified to obtain a second network constraint, and the target solver is re-solved based on the second network constraint until the result with solution of the target solver is obtained.

[0026] In one of the embodiments, the method further includes:

[0027] the previous data plane is updated based on the last network configuration data and the current network configuration data to obtain a current data plane; the previous data plane corresponds to the last network configuration data;

[0028] the previous digital twin network is updated based on the current data plane to obtain a current digital twin network; the previous digital twin network corresponds to the last network configuration data;

[0029] the current digital twin network is verified based on the current data plane to obtain a verification result; the verification result is used to represent whether the current digital twin network is normal, and the current digital twin network includes the current data plane.

[0030] In one of the embodiments, the method further includes:

[0031] initial network element data of the physical network is obtained; the initial network element data includes network element type and network architecture data;

[0032] a virtual network element is constructed based on the network element type, and the virtual network element is configured and connected according to the network architecture data to obtain an initial digital twin network; the initial digital twin network includes an initial data plane.

[0033] In a second aspect, the application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0034] the change data between the current network configuration data and the last network configuration data of the physical network is determined;

[0035] update the previous network constraint based on the change data to obtain a current network constraint; the previous network constraint corresponds to the previous network configuration data;

[0036] update the current network constraint based on the to-be-verified network configuration group to obtain a first network constraint; the to-be-verified network configuration group includes a plurality of to-be-verified network configurations;

[0037] verify the to-be-verified network configuration group according to the first network constraint and a target function to obtain a network configuration verification result; the target function is determined based on the to-be-verified network configuration group.

[0038] In a third aspect, the present application further provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:

[0039] determine change data between current network configuration data and previous network configuration data of the physical network;

[0040] update the previous network constraint based on the change data to obtain a current network constraint; the previous network constraint corresponds to the previous network configuration data;

[0041] update the current network constraint based on the to-be-verified network configuration group to obtain a first network constraint; the to-be-verified network configuration group includes a plurality of to-be-verified network configurations;

[0042] verify the to-be-verified network configuration group according to the first network constraint and a target function to obtain a network configuration verification result; the target function is determined based on the to-be-verified network configuration group.

[0043] In a fourth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and the computer program is executed by a processor to implement the following steps:

[0044] determine change data between current network configuration data and previous network configuration data of the physical network;

[0045] update the previous network constraint based on the change data to obtain a current network constraint; the previous network constraint corresponds to the previous network configuration data;

[0046] update the current network constraint based on the to-be-verified network configuration group to obtain a first network constraint; the to-be-verified network configuration group includes a plurality of to-be-verified network configurations;

[0047] verify the to-be-verified network configuration group according to the first network constraint and a target function to obtain a network configuration verification result; the target function is determined based on the to-be-verified network configuration group.

[0048] The aforementioned network configuration verification method, device, storage medium, and program products, after determining the changes between the current and previous network configuration data of the physical network, update the previous network constraints based on this to obtain the current network constraints. This process closely follows actual network changes, making subsequent verification more accurate. Furthermore, after updating the current network constraints based on the network configuration group to be verified to obtain the first network constraint, the network configuration group to be verified is verified according to the first network constraint and the objective function. This allows for the simultaneous processing of multiple network configurations to be verified, fully utilizing the correlation between network configurations, and comprehensively considering multiple configurations simultaneously. This avoids the limitations of single verification and further improves the comprehensiveness of configuration verification. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating a network configuration verification method in one embodiment;

[0050] Figure 2 This is a flowchart illustrating the steps for obtaining network constraints in one embodiment;

[0051] Figure 3 This is a flowchart illustrating the steps for updating network constraints in one embodiment;

[0052] Figure 4 This is a flowchart illustrating the network configuration verification steps in one embodiment;

[0053] Figure 5 This is a routing result analysis diagram for network configuration verification in one embodiment;

[0054] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0056] In one embodiment, such as Figure 1 As shown, a network configuration verification method is provided. This embodiment illustrates the method applied to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method is applied to the data plane of a digital twin network, and includes the following steps:

[0057] Step 102: Determine the changes between the current network configuration data and the previous network configuration data of the physical network of the digital twin network.

[0058] For example, to verify network configuration, a digital twin network mapping to the physical network is constructed using virtual mirroring technology. After construction, it is necessary to check in real time whether the network configuration data has been updated. If the network configuration data has changed, such as adding routes or modifying ACLs (Access Control Lists), then the changed network configuration data is identified as the modified data.

[0059] Step 104: Update the previous network constraints of the data plane based on the changed data to obtain the current network constraints; the previous network constraints correspond to the previous network configuration data.

[0060] For example, the previous network constraint is constructed based on the previous network configuration data. Therefore, after determining the changed data, i.e. the changed network configuration data, it is necessary to update the previous network constraint of the data plane based on the changed data, so as to obtain the current network constraint corresponding to the current network configuration.

[0061] For example, network constraints include link forwarding constraints and routing constraints. Link forwarding constraints describe the allowed conditions for data packets on links between nodes. If a node's forwarding rules or ACLs change, such as adding a new forwarding prefix or blocking specific IP packets in an ACL, the link forwarding constraint formula must be updated accordingly. Routing constraints build paths based on link forwarding constraints. When the network topology or data plane changes, routing constraints also need to be updated to ensure the accuracy of path construction.

[0062] Step 106: Update the current network constraints based on the network configuration group to be verified to obtain the first network constraint; the network configuration group to be verified includes multiple network configurations to be verified.

[0063] For example, the network configuration group to be verified contains multiple network configurations that reflect different network policy requirements, such as reachability, no cycles, no black holes, passing through specific nodes, finite path length, and equivalent paths. The current network constraints are determined based on the existing network state and rules, reflecting the network's current operating logic and limitations. Once we obtain the network configuration group to be verified, we need to integrate it with the current network constraints.

[0064] When multiple network configurations to be verified coexist in a group of network configurations to be verified, we need to comprehensively consider their interrelationships. Some configurations may be interdependent, while others may conflict, requiring a comprehensive analysis and trade-off when updating network constraints. The resulting first network constraints, obtained through this update process, can more accurately reflect the network's operational logic and limitations after the addition of new configurations.

[0065] Step 108: Verify the network configuration group to be verified according to the first network constraints and the objective function to obtain the network configuration verification result; the objective function is determined based on the network configuration group to be verified.

[0066] For example, during verification, specialized tools such as the SMT (Satisfiability ModuloTheories) solver are used. The SMT solver calculates the solution based on the input first network constraints and returns the result. If the solver returns UNSAT (no solution), it indicates a problem with the constraint formula, possibly due to a logical error in constructing the first network constraints, resulting in no solution satisfying all conditions. When it returns SAT (solvable), it means that at least one solution satisfies the constraints, and the solver uses the objective function to determine an optimal solution. Determining the objective function requires in-depth analysis of various information in the network configuration group to be verified, such as network bandwidth allocation and device connectivity. After considering these information, the objective function is obtained, accurately reflecting the actual network requirements. In some possible embodiments, the objective function includes, but is not limited to, functions for calculating available bandwidth, the number of paths, and reachability targets. Specifically:

[0067] The objective function is set as a function for calculating available bandwidth. This is achieved by calculating the sum of available bandwidth across all links and maximizing this sum as the objective function; or...

[0068] The objective function is set as a function to calculate the number of paths, and the number of paths in all data streams is minimized as the objective function; or

[0069] The objective function is set as the calculation function for the reachability objective, which calculates the total number of reachable nodes for all nodes and maximizes the total number of reachable nodes.

[0070] If the objective function is the calculation function of available bandwidth, then the first network constraint can be set as the total capacity of the link bandwidth. Then, the SMT solver is used to solve for the first network constraint to obtain all feasible solutions that satisfy the constraint conditions. Next, the objective function value is calculated for each feasible solution, i.e., the total bandwidth usage of the network configuration scheme corresponding to each feasible solution is calculated. Finally, the objective function values ​​corresponding to all feasible solutions are compared to find the solution that optimizes the objective function value. If the objective function is a minimization problem, then the solution with the smallest objective function value is selected, i.e., the network configuration scheme corresponding to the feasible solution with the smallest total bandwidth usage; otherwise, the solution with the largest objective function value is selected, i.e., the network configuration scheme corresponding to the feasible solution with the largest total bandwidth usage.

[0071] Based on this set of optimal solutions, we can conduct a detailed analysis of the network configuration. By analyzing the relevant variables in the optimal solutions, we can determine whether the network meets the various strategies in the network configuration set to be verified. For example, the values ​​of certain variables can directly reflect information such as packet reachability and whether it passes through specific nodes. Based on these analysis results, we can determine the network configuration verification results, which may include, for example, whether the network configuration is reasonable and whether adjustments are needed.

[0072] In the aforementioned network configuration verification method, after determining the changes between the current and previous network configuration data of the physical network, the previous network constraints are updated based on this to obtain the current network constraints. This process closely follows actual network changes, making subsequent verification more accurate. Furthermore, after updating the current network constraints based on the network configuration group to be verified to obtain the first network constraint, the network configuration group to be verified is verified according to the first network constraint and the objective function. This allows for the simultaneous processing of multiple network configurations to be verified, fully utilizing the correlation between network configurations, and comprehensively considering multiple configurations at the same time. This avoids the limitations of single verification and further improves the comprehensiveness of configuration verification.

[0073] In one embodiment, such as Figure 2 As shown, the current network constraints include the current link forwarding constraints and the current routing constraints. The current network constraints are obtained by updating the previous network constraints in the data plane based on the changed data, including:

[0074] Step 202: Update the forwarding constraints of the previous link based on the changed data to obtain the forwarding constraints of the current link; the forwarding constraints of the previous link are constructed based on the topology parameters of the physical network and the previous data plane; wherein, the data plane includes the configuration information of the physical network.

[0075] For example, the topology parameters of the physical network describe in detail the nodes in the network and the connections between them, forming the basic framework for building the network. The upper data plane contains specific information from the previous network configuration, such as FIB (Forwarding Information Base), ACL (Access Control List), service chain processing flow, WLAN (Virtual Local Area Network) rules and their matching actions, clarifying the actual forwarding and processing behavior of data packets in the network. By combining the physical network's topology parameters and the upper data plane, the upper link forwarding constraints can be constructed. When the network configuration changes, the data plane is updated accordingly, and the upper link forwarding constraints also need to be updated according to the new data plane configuration. By continuously updating the constraints, it can be ensured that the forwarding of data packets by links can be accurately described under different network configurations. Among them, the link forwarding constraint describes whether a certain data packet is allowed to pass through the link between any two nodes u and v. This constraint is related to the forwarding rules and ACLs of that node. For example:

[0076] In any node u, packets with the prefix 10.1.1.0 / 24 will be forwarded to node v, therefore there are constraints on the link between u and v:

[0077]

[0078] Formula (1) above means that if the IP address of the data packet meets the constraint requirements, then Otherwise, it is 0, and it is also 0 if there is no link between the two nodes.

[0079] If an ACL is configured in node v to disallow packets destined for 10.1.1.1, then the constraints on this link should be:

[0080]

[0081] Similarly, for node u, if data packets destined for address 10.1.1.1 are not allowed to be transmitted to node v, the above constraint also applies.

[0082] When the data plane in the network changes, such as a node adding a new forwarding prefix or an ACL blocking packets from a specific IP address, the forwarding constraints on the previous link need to be adjusted based on these changes. For example, when a packet from node u with the prefix 10.2.2.0 / 24 is forwarded to node v, the constraints will become:

[0083]

[0084] The process of updating the previous link forwarding constraints is essentially a process of recalculating and adjusting the link forwarding formula. The changed data is incorporated into the original constraint formula to obtain the current link forwarding constraints. These current link forwarding constraints accurately reflect the current actual situation of the network.

[0085] Step 204: Update the previous routing constraints based on the changed data to obtain the current routing constraints; the previous routing constraints are constructed based on the previous link forwarding constraints and the network topology of the physical network; wherein, the previous routing constraints correspond to the previous network configuration data.

[0086] For example, after determining the previous link forwarding constraint, a previous routing constraint is constructed based on that constraint. For instance, the routing constraint might be:

[0087]

[0088]

[0089]

[0090] Where V is the set of network nodes, u, v, and w are all network nodes, L is the set of links between two nodes, and [u,v] is the link between node u and node v. The destination IP address is the source IP address, and Inf is the parameter factor of the link constraint.

[0091] The purpose of this previous routing constraint is to construct a path from the source IP address to the destination IP address based on the link forwarding constraint.

[0092] By analyzing this changed data, it becomes clear which routing rules need adjustment. Then, the changed data is integrated into the original routing constraint formulas, and the results are recalculated and adjusted to obtain current routing constraints that adapt to the current network conditions. This update process ensures that the routing constraints are consistent with the actual network state.

[0093] In one embodiment, such as Figure 3 As shown, the first network constraint is obtained by updating the current network constraint based on the network configuration group to be verified, including:

[0094] Step 302: Determine the association information between each network configuration to be verified in the network configuration group to be verified.

[0095] For example, the network configurations to be verified are not isolated; they are closely related. For instance, reachability is associated with strategies such as loops, black holes, passing through specific nodes, and finite path length. For example, when performing joint verification based on reachability, multiple strategies can be comprehensively considered using constraints.

[0096] In some possible implementations, ACLs are associated with routing configurations. When a network device configures ACL rules to filter traffic from specific source or destination IP addresses, it affects the effectiveness of routing. In other possible implementations, a change in the VLAN configuration of a port affects the network connectivity of devices connected to that port. For example, in a switched network, a server is connected to a port on a switch that was originally configured in VLAN 10. If an administrator changes the VLAN configuration of that port to VLAN 20, but the server's network configuration remains based on VLAN 10, the server will be unable to access the network.

[0097] Therefore, before verifying the network configuration group to be verified, it is necessary to analyze the relationship between each network configuration to be verified within the network configuration group to obtain the relationship information.

[0098] Step 304: Update the current network constraints based on the association information to obtain the first network constraints.

[0099] For example, current network constraints are updated based on changed data and the previous data plane, reflecting the current network operating logic and limitations. When multiple network configurations to be verified coexist in a group of network configurations to be verified, it is necessary to analyze their interrelationships. This analysis may identify interdependent configurations; for example, when verifying reachability, it may be necessary to consider whether a specific node is traversed. Therefore, interdependent configurations must be associated when updating network constraints. Conflicts between configurations may also occur; for example, reachability requires packets to reach the destination node from the source node, while a no-loop policy may restrict the selection of certain paths. In this case, a comprehensive analysis and trade-offs are needed when updating network constraints. For example, the objective function or constraints can be modified according to different policy requirements to achieve joint verification of multiple policies.

[0100] For example, taking reachability as a starting point, when jointly verifying strategies such as loops, black holes, passing through specific nodes (assuming the node to be passed is i), and finite path length, constraint (4) can be modified as follows:

[0101]

[0102]

[0103] in, It is an auxiliary variable.

[0104] Auxiliary variables are set based on the network node status reflected by the associated information. The requirements of various strategies can be incorporated into the constraints by changing the values ​​of the auxiliary variables. In the above formula (6), the auxiliary variables corresponding to different situations can make the constraints adapt to the verification requirements of different strategies. For example, when verifying reachability, the auxiliary variables are used to determine whether the inflow and outflow of traffic to the source node and the destination node meet the requirements; while when detecting loops and black holes, the auxiliary variables can reflect the traffic balance of the nodes.

[0105] Specifically, auxiliary variables need to be determined based on the role and status of nodes under different strategies, as well as in combination with network topology and traffic conditions. For example, as shown in formula (6) above, when v is the source node... When auxiliary variables are involved in the calculation, they can be used to help determine the outflow of traffic from the source node. If the auxiliary variable is zero, it means that the traffic from the source node is flowing out normally.

[0106] In one embodiment, such as Figure 4 As shown, the network configuration group to be verified is verified according to the first network constraint and the objective function, and the network configuration verification results are obtained, including:

[0107] Step 402: Based on the first network constraints and the objective solver, determine the solution result of the objective solver.

[0108] For example, in verification, specialized tools such as the SMT solver calculate and return results based on the input first network constraints. If UNSAT (no solution) is returned, it indicates a problem with the constraint formula, possibly due to a logical error in constructing the first network constraints, resulting in no solution. A SAT (solution) return indicates the existence of a solution that satisfies the constraints.

[0109] If the constraint formula is flawed, the first network constraint is modified, and the solution is re-solved using specialized tools such as the SMT solver until a SAT is returned, indicating the existence of a solution that satisfies the constraints. In some possible embodiments, the modification of the first network constraint is as follows:

[0110] When there is a problem with link forwarding constraints, it may be due to incorrect IP address constraint settings or ACL rule conflicts. If the IP address constraint settings are incorrect, it is necessary to check whether the IP address prefix and range in the constraint are accurate. If the ACL rules are conflicting, such as an ACL rule that does not allow packets to a specific destination address, the ACL rules need to be adjusted to ensure the consistency of the constraints.

[0111] When routing constraints encounter problems, it may be due to changes in the topology or errors in the formula logic. If the topology has changed, the routing constraints need to be updated promptly. If a logical error is found, such as an error in traffic calculation or node status judgment, the logic of the formula should be corrected based on the actual routing logic.

[0112] When there is a problem with the objective function, it is necessary to analyze and check the objective function to determine whether it can accurately reflect the strategy requirements. If not, the objective function should be redefined; or the use of auxiliary variables in the formula should be checked to determine whether the auxiliary variables are used incorrectly.

[0113] Step 404: Based on the objective function and the solution results, verify the network configuration group to be verified and obtain the network configuration verification results.

[0114] The process of setting the objective function is as follows:

[0115] If we take reachability as the starting point and jointly verify strategies such as loops, black holes, passing through specific nodes (assuming the node to be passed is i), and finite path length, then the objective function can be set as follows:

[0116]

[0117]

[0118] If we want to verify K specific nodes / links (let the set be K), If strategies such as reachability after damage are implemented, then the objective function is set as follows:

[0119]

[0120]

[0121] in, It is an auxiliary variable.

[0122] For example, when a specialized tool such as an SMT solver returns a solution outcome (SAT), it means that at least one set of solutions to the network constraints exists. Based on a defined objective function, a specialized tool such as an SMT solver returns a set of optimal solutions.

[0123] The specific verification process is as follows:

[0124] If we take reachability as the starting point and jointly verify strategies such as loops, black holes, passing through specific nodes (assuming the node to be passed is i) and finite path length, the verification needs to adopt the above formulas (6) and (7).

[0125] like Figure 5As shown in (a), suppose there is a network in which the reachability from A1 to F1 needs to be verified.

[0126] When all nodes If both are 0, it means there exists a link that allows the data packet to reach the destination, and the link traversed by the data packet can be... It is concluded that, Figure 5 (b). When A value of 1 indicates that link [u,v] is selected, thus the entire route can be analyzed based on the source and destination addresses of the data packet. Additionally, to verify whether a data packet will pass through node i, one can check if a link passing through node i exists. If selected, it means that node i will be passed through, because the cost of selecting node i in formula (7) is lower.

[0127] When node u exists A value of 1 indicates that there is no route that allows the data packet to reach it. For example... Figure 5 (c) If an intermediate node (such as node E) has only inbound links and no outbound links, then that intermediate node is a black hole. Figure 5 As shown in (d), if a node (such as node C) has two incoming links and one outgoing link, and they form a loop, then there is a cycle at that node.

[0128] If we want to verify K specific nodes / links (let the set be K), ) Strategies such as reachability after damage, when all nodes A value of 0 indicates the existence of a link that allows the data packet to reach the destination. An additional term is needed to verify whether the final route contains K nodes or links. This is because selecting a specific K nodes or links in the objective function is more costly, so the algorithm will bypass these K nodes or links. If the final route contains these K nodes or links, it means there are no other routes that can bypass them; otherwise, they exist. For example, setting... For each damaged node, the set of damaged nodes is defined as follows: Add constraints:

[0129] and

[0130] in, This means that no other link from any other node to the damaged node n will be selected. This indicates that the damaged node n will not have any links pointing to other nodes.

[0131] Then, the added constraints are combined with the original routing constraints, and the SMT solver is used to solve the problem. If the SMT solver can find a set of... The value of makes all nodes If all values ​​are 0, it means that there is a reachable path even if these specific nodes are damaged.

[0132] Or set For each damaged link, the set of damaged links is considered. Add constraints:

[0133]

[0134] in, Indicates a damaged link They will not be selected.

[0135] Then, the added constraints are combined with the original routing constraints, and the SMT solver is used to solve the problem. If the SMT solver can find a set of... The value of makes all nodes If all values ​​are 0, it indicates that a reachable path exists in the network even when these specific links are damaged. This is obtained through analysis and solution. Take the value, if If it is 1, then the corresponding link It is used to construct reachable paths. Conversely, if the solver cannot find a suitable path... If the value is zero, it means that there is no reachable path in the network at this time, and it may be necessary to repair the damaged link or re-plan the network topology.

[0136] When node u exists When the value is 1, it means that there is no route that allows the data packet to reach the destination. The subsequent analysis is the same as before.

[0137] Figure 5 In the diagram, (a) represents the original network scenario, (b) represents the route-reachable scenario, (c) represents the scenario with a black hole, and (d) represents the scenario with a loop.

[0138] In one embodiment, based on the objective function and the solution, the network configuration group to be verified is verified to obtain the network configuration verification result, including:

[0139] The solution is obtained by filtering the available solutions based on the objective function; the network configuration group to be verified is then verified based on the objective solution to obtain the network configuration verification result.

[0140] For example, when the SMT solver outputs a solution (SAT) result, it means that there exists a variable solution that satisfies the network constraints. At this point, the objective function becomes the key criterion for selection. By evaluating the objective function, the best-fitting objective solution is precisely selected from among numerous solutions. The selection of the objective solution depends on the specific network verification strategy and requirements. Different strategies can have different objective function settings. For example:

[0141] When considering reachability as a starting point and jointly verifying strategies such as loops, black holes, passing through specific nodes, and finite path length, this strategy requires finding the path with the lowest cost to satisfy multiple verification conditions. Therefore, the objective function for selecting the target solution is set to find the minimum value.

[0142] The objective function selection of target solutions is mainly based on the specific network verification scenario. The minimum value is used as the criterion. By continuously optimizing the objective function value, the target solution that best meets the requirements of the specific strategy is selected from many solutions that satisfy the constraints.

[0143] Once the target solution is obtained, its components can be utilized. and Verification work was carried out on the network configuration group to be verified. According to... Determine the reachability of data packets; if all nodes... If the value is 0, the data packet can be reached, using... Determine the specific route; if it exists A node with a value of 1 may indicate a network anomaly. This can also be used to verify whether there are workarounds for specific node or link failures. Ultimately, the network configuration verification result is derived by combining all verifications.

[0144] In one embodiment, determining the solution result of the objective solver based on the first network constraints and the objective solver includes:

[0145] The solution result of the target solver is determined based on the first network constraint; if the solution result is that the target solver has no solution, the first network constraint is modified to obtain the second network constraint, and the target solver is re-solved based on the second network constraint until a solution result of the target solver is obtained; if the solution result is that the target solver has a solution, the solution result is determined as a solution result.

[0146] For example, the objective solver is prompted to solve the problem based on a first network constraint, which reflects the basic conditions and requirements of the network corresponding to the first network constraint.

[0147] If the solution result shows that the target solver has no solution, it indicates that the current first network constraint may be unreasonable, and a solution that meets the conditions cannot be found. In this case, the first network constraint needs to be modified to obtain the second network constraint. This modification process may involve adjusting parameters, relaxing certain restrictions, or adding new conditions. For example, by analyzing the unsolvable solution result of the SMT solver, if it is determined that there is a logical error in the settings or constraints in the data plane, the erroneous logic is corrected to obtain a logically correct second network constraint; or if the analysis determines that the constraint settings are unreasonable, the constraint conditions are reset based on the analysis results to obtain the second network constraint. Then, the target solver is re-solved based on the second network constraint. This process is repeated continuously, with adjustments and solutions, until the target solver yields a solution.

[0148] When the solution result indicates that the target solver has a solution, the solution result can be directly determined as a solution.

[0149] In one embodiment, the method further includes:

[0150] Based on the previous network configuration data and the current network configuration data, the previous data plane is updated to obtain the current data plane; the previous data plane corresponds to the previous network configuration data; based on the current data plane, the previous digital twin network is updated to obtain the current digital twin network; the previous digital twin network corresponds to the previous network configuration data; based on the current data plane, the current digital twin network is verified to obtain the verification result; the verification result is used to characterize whether the current digital twin network is normal, and the current digital twin network includes the current data plane.

[0151] For example, since network configuration is constantly changing, new configuration requirements will continuously emerge. The previous network configuration data corresponds to the previous data plane. When current network configuration data is generated, since the network configuration is the basis for generating the data plane, the previous data plane needs to be updated based on these two network configuration data. The data plane contains key elements such as the network element's FIB and ACL, and these elements change as the configuration changes, thus generating the current data plane.

[0152] A digital twin network is a precise mapping of a physical network, and the previous digital twin network is associated with the previous network configuration data. The current data plane reflects the latest network configuration, so it is used to update the previous digital twin network to obtain the current digital twin network.

[0153] Next, the entire system needs to be validated using the current data plane to comprehensively check whether it meets the requirements of the new configuration. The validation results can clearly indicate whether the current digital twin network is functioning correctly. If it is, it means that the new configuration is running well in the virtual environment; if it is not, potential problems can be identified in time, avoiding failures during deployment in the real network and ensuring network stability and security.

[0154] In one embodiment, the method further includes:

[0155] Obtain initial network element data of the physical network; the initial network element data includes network element type and network architecture data; construct virtual network elements based on the network element types, and configure and connect the virtual network elements according to the network architecture data to obtain the initial digital twin network; the initial digital twin network includes the initial data plane.

[0156] For example, when initially constructing a digital twin network, it is necessary to first obtain the initial network element data of the physical network. This data includes network element types and network architecture data. Network element types specify the types of devices such as routers and switches, which form the basis for constructing virtual network elements. Virtual network elements with matching functions are constructed based on different types. The network architecture data reflects the connection relationships and topology between network elements. This data is used to configure and connect the virtual network elements, ensuring they are connected according to the physical network architecture, thus obtaining the initial digital twin network. The initial data plane in this initial digital twin network defines the rules for forwarding and processing data packets, reflecting the initial operating mechanism of the physical network.

[0157] In one exemplary embodiment, a network configuration verification method is provided, applied to the data plane of a digital twin network, the method comprising the following steps:

[0158] The current data plane is obtained by updating the previous data plane based on the previous network configuration data and the current network configuration data; the previous data plane corresponds to the previous network configuration data.

[0159] The current digital twin network is obtained by updating the previous digital twin network based on the current data plane; the previous digital twin network corresponds to the previous network configuration data.

[0160] The verification result is obtained by verifying the current digital twin network based on the current data plane; the verification result is used to characterize whether the current digital twin network is normal, and the current digital twin network includes the current data plane.

[0161] Determine the changes between the current network configuration data and the previous network configuration data of the physical network of the digital twin network.

[0162] The forwarding constraints of the previous link are updated based on the changed data to obtain the forwarding constraints of the current link. The forwarding constraints of the previous link are constructed based on the topology parameters of the physical network and the previous data plane. The data plane includes the configuration information of the physical network.

[0163] The previous routing constraints are updated based on the changed data to obtain the current routing constraints. The previous routing constraints are constructed based on the previous link forwarding constraints and the network topology of the physical network. The previous routing constraints correspond to the previous network configuration data.

[0164] Determine the association information between each network configuration to be verified in the network configuration to be verified group; the network configuration to be verified group includes multiple network configurations to be verified.

[0165] The first network constraint is obtained by updating the current network constraint based on the association information.

[0166] The solution result of the objective solver is determined based on the first network constraint.

[0167] If the solution result is that the target solver has no solution, the first network constraint is modified to obtain the second network constraint, and the target solver is re-solved based on the second network constraint until a solution result of the target solver is obtained.

[0168] The target solution is obtained by filtering the available solutions based on the objective function; the objective function is determined based on the network configuration group to be verified.

[0169] Based on the target solution, network verification is performed on the network configuration group to be verified, and the network configuration verification results are obtained.

[0170] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0171] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores network element data of the physical network and configuration data of each network to be verified. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a network configuration verification method.

[0172] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0173] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0174] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0175] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0176] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0177] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0178] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0179] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network configuration verification method, characterized in that, The method, applied to the data plane of a digital twin network, includes: Determine the changes between the current network configuration data and the previous network configuration data of the physical network of the digital twin network; The previous network constraints of the data plane are updated based on the changed data to obtain the current network constraints; the previous network constraints correspond to the previous network configuration data. The first network constraint is obtained by updating the current network constraint based on the network configuration group to be verified; the network configuration group to be verified includes multiple network configurations to be verified. The network configuration group to be verified is verified according to the first network constraint and the objective function to obtain the network configuration verification result; the objective function is determined based on the network configuration group to be verified.

2. The method according to claim 1, characterized in that, The current network constraints include current link forwarding constraints and current routing constraints. The step of updating the previous network constraints of the data plane based on the changed data to obtain the current network constraints includes: The forwarding constraints of the previous link are updated based on the changed data to obtain the forwarding constraints of the current link; the forwarding constraints of the previous link are constructed based on the topology parameters of the physical network and the previous data plane; wherein, the data plane includes the configuration information of the physical network; The previous routing constraint is updated based on the changed data to obtain the current routing constraint; the previous routing constraint is constructed based on the previous link forwarding constraint and the network topology of the physical network; wherein the previous routing constraint corresponds to the previous network configuration data.

3. The method according to claim 1, characterized in that, The step of updating the current network constraints based on the network configuration group to be verified to obtain the first network constraint includes: Determine the association information between each network configuration to be verified in the network configuration group to be verified; The first network constraint is obtained by updating the current network constraint based on the associated information.

4. The method according to claim 1, characterized in that, The step of verifying the network configuration group to be verified based on the first network constraints and the objective function to obtain the network configuration verification result includes: Based on the first network constraints and the objective solver, the solution result of the objective solver is determined; Based on the objective function and the solution results, the network configuration group to be verified is verified to obtain the network configuration verification results.

5. The method according to claim 4, characterized in that, The process of verifying the network configuration group to be verified based on the objective function and the solution results to obtain the network configuration verification results includes: Based on the objective function, the available solutions are filtered to obtain the target solution; Based on the target solution, network verification is performed on the network configuration group to be verified to obtain the network configuration verification result.

6. The method according to claim 4, characterized in that, The step of determining the solution result of the objective solver based on the first network constraints and the objective solver includes: The solution result of the target solver is determined based on the first network constraints; If the solution result is that the target solver has no solution, the first network constraint is modified to obtain the second network constraint, and the target solver is re-solved based on the second network constraint until a solution result is obtained for the target solver.

7. The method according to any one of claims 1-3, characterized in that, The method further includes: Based on the previous network configuration data and the current network configuration data, the previous data plane is updated to obtain the current data plane; the previous data plane corresponds to the previous network configuration data. The current digital twin network is obtained by updating the previous digital twin network based on the current data plane; the previous digital twin network corresponds to the previous network configuration data; The current digital twin network is verified based on the current data plane to obtain a verification result; the verification result is used to characterize whether the current digital twin network is normal, and the current digital twin network includes the current data plane.

8. The method according to claim 1, characterized in that, The method further includes: Obtain initial network element data of the physical network; the initial network element data includes network element type and network architecture data; Virtual network elements are constructed based on the network element type, and the virtual network elements are configured and connected according to the network architecture data to obtain an initial digital twin network; the initial digital twin network includes an initial data plane.

9. A computer device, characterized in that, The method includes a memory and a processor, the memory storing a computer program, characterized in that the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, It stores a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that, The method includes a computer program, characterized in that, when executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 8.

Images