A network device configuration labeling method, apparatus, device, and medium

Abstract

This invention relates to a method, apparatus, device, and medium for annotating network device configurations, belonging to the field of network device configuration technology. The method includes: obtaining an operation command stream and device version information, and validating configuration commands within it. For valid commands, the device configuration file is obtained before and after command execution, and the specific configuration change line caused by the command is located by comparison. Subsequently, annotations containing information such as the operator and time are automatically generated and precisely associated with the corresponding configuration change line, finally written to the annotated configuration backup file. This invention achieves automatic annotation of traceability information for each effective command in the configuration file, making the modifier and history of the configuration readily apparent, improving the efficiency and accuracy of configuration auditing, troubleshooting, and security management.

Description

Technical Field

[0001] This invention relates to the field of network device configuration technology, and in particular to a network device configuration labeling method, apparatus, device and medium. Background Technology

[0002] In modern enterprise network and data center operations, the configuration management of network devices, such as routers, switches, and firewalls, is a core element in ensuring network security, stability, and compliance. Every configuration change must be strictly recorded and audited to ensure traceability of operations and accountability, thereby effectively preventing misoperation and malicious behavior and meeting increasingly stringent internal and external compliance requirements.

[0003] To achieve the aforementioned management objectives, the industry commonly adopts a centralized operation and maintenance security management system based on an AAA (Authentication, Authorization, Accounting) framework. The general technical solution is as follows: the system first authenticates the operator logging into the device and grants corresponding command operation permissions according to predefined policies. During operation, the system logs each command executed by the operator, the execution time, and the corresponding account information, forming an independent operation audit log. Administrators can query this log to trace back the operation commands executed by specific personnel within a specific time period.

[0004] However, the operation logs recorded by the AAA system are independent of the final configuration backup files generated by the network devices. The configuration file itself is merely a collection of command lines, lacking any metadata (such as the operator or operation time) to identify the source of the commands. Furthermore, the operation logs contain not only the final effective configuration commands but also a large number of temporary operation records involving viewing, testing, or unsuccessful attempts. This separation between "configuration" and "logs" prevents maintenance or auditing personnel from directly and quickly identifying who created or modified each effective configuration in the device's current running or backup configuration. This deficiency leads to inefficient configuration tracing, significant difficulties in troubleshooting configuration errors, auditing unauthorized changes, or locating those responsible for historical configurations, and increases the complexity of network maintenance management and security risks. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a network device configuration labeling method, apparatus, device and medium, which aims to solve at least one of the above-mentioned technical problems.

[0006] The technical solution of the present invention to solve the above-mentioned technical problems is as follows: Firstly, this application provides a method for configuring and labeling network devices, employing the following technical solution: A method for configuring and labeling network devices, comprising: Obtain the operation command stream and the version information of the target network device. The operation command stream includes the command sequence entered by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. Based on the operation command stream, the version information of the target network device, and the preset validity verification rules, the verification information of the operation command stream is determined. The verification information includes the verification results of multiple commands of the configuration type. For any command whose verification result is valid, obtain the first configuration file and the second configuration file of the target network device, and determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; For any command whose verification result is valid, if there is a change to the content of the command, then the comment information of the command is generated, the comment information is associated with the corresponding configuration change line where the content has changed, and the associated configuration change line and comment information are written into the marked configuration backup file; wherein, the comment information includes the operator's identity information and the command effective timestamp.

[0007] The beneficial effects of this invention are as follows: By automatically associating and clearly marking the creator or modifier and operation time of each effective configuration command in the device's global configuration backup file, the ownership and history of the configuration are readily apparent. This not only quickly identifies the person responsible for the configuration, providing direct evidence for configuration modifications and troubleshooting, but also enhances the accuracy and convenience of configuration auditing, effectively preventing security risks such as unauthorized configuration and unauthorized operations, and providing secure and reliable support for compliant management and efficient maintenance of network configurations. Through a dual confirmation mechanism of validating configuration commands and comparing them with actual changes, the accuracy and authority of the annotations are ensured, avoiding the mislabeling of invalid or test operations. This effectively identifies and prevents security risks such as unauthorized configuration changes and unauthorized service activation, enhancing the compliance, security, and maintainability of network configuration management.

[0008] Based on the above technical solution, the present invention can be further improved as follows.

[0009] Furthermore, determining the verification information of the operation command stream based on the operation command stream, the version information of the target network device, and preset validity verification rules includes: Based on the operation instruction flow and the preset command classification rules, the command type of each command is determined, including query type, test type and configuration type; For each command of type configuration, the execution and verification strategy of the command is determined based on the version information of the target network device; For each command of type configuration, the validity of the command is verified based on the execution and verification strategy of the command, and the verification result of the command is obtained. The verification result includes execution valid and execution invalid.

[0010] The beneficial effects of adopting the above-mentioned further solutions are as follows: by automatically filtering out query and test commands that do not produce actual configuration changes through preset command classification rules, the efficiency and targeting of subsequent processing are improved; based on the version information of the target network device, differentiated execution and verification strategies are intelligently matched, achieving broad compatibility and accurate judgment of heterogeneous network devices; finally, by validating the configuration commands, it is ensured that only valid commands successfully received and executed by the device will enter the subsequent process, thereby fundamentally guaranteeing the accuracy and authority of the final generated operation traceability annotation.

[0011] Furthermore, determining the command execution and verification strategy based on the version information of the target network device includes: If the version information is a first version, then the execution and verification strategy of the command is determined to be a first execution and verification strategy. The first execution and verification strategy is as follows: send the command of the configuration type to the target network device for execution, and obtain the first execution feedback information of the target network device; if the first execution feedback information includes a predefined error identifier, then the corresponding command execution is determined to be invalid, otherwise it is determined to be valid; wherein, the network device of the first version represents the network device that adopts the configuration direct effective mode; If the version information is the second version, then the execution and verification strategy of the command is determined to be the second execution and verification strategy. The second execution and verification strategy is as follows: add the command of the configuration type to the candidate configuration set; after detecting the submission command for the candidate configuration set, send the candidate configuration set and the submission command to the target network device for execution, and obtain the second execution feedback information returned by the submission command; if the second execution feedback information includes a predefined successful submission identifier, then determine the overall execution validity of the commands in the candidate configuration set; otherwise, determine that the execution is invalid; wherein, the network device of the second version represents the network device that adopts the configuration submission mode.

[0012] The beneficial effects of adopting the above-mentioned further solution are as follows: By identifying the version of network devices and adaptively employing either a first verification strategy for devices in "direct configuration activation mode" or a second verification strategy for devices in "configuration submission mode," compatibility and unified management of heterogeneous devices from different manufacturers and with different system versions within the network are achieved. It can accurately match the device's own configuration activation logic, ensuring the accuracy and reliability of command validity determination whether it's real-time verification of feedback for a single command or verification of the submission results of the entire candidate configuration set. This provides a precise judgment basis for the core process of subsequently annotating traceability information only on configuration changes that have actually taken effect, ensuring the universality and practicality of the entire annotation method in complex hybrid network environments from the source.

[0013] Furthermore, determining the command type of each command based on the operation instruction stream and preset command classification rules includes: For each command in the operation instruction stream, based on a pre-established command library, it is determined whether the command matches any pattern in the pre-established command library. The command library is used to store known query type command patterns and test type command patterns. For each command in the operation instruction stream, if the command successfully matches any pattern in the command library, then the command type of the command is determined to be either a query type or a test type. For each command in the operation instruction stream, if the command fails to match any pattern in the command library, then the command type of the command is determined to be a configuration type.

[0014] The beneficial effects of adopting the above-mentioned further solution are as follows: By pre-establishing a library of query and test commands and using it to quickly match with the operation command stream, query and test commands that do not cause actual configuration changes can be automatically and accurately filtered out. This achieves intelligent preliminary screening of massive operation commands, significantly improving the processing efficiency of subsequent processes, ensuring that only "configuration commands" that may cause configuration changes enter the resource-intensive verification, comparison, and labeling stage, avoiding unnecessary processing of invalid commands.

[0015] Furthermore, determining whether there has been a change to the content of the command based on the first configuration file and the second configuration file includes: Calculate the hash value configured in each line of the first configuration file and the hash value configured in each line of the second configuration file to obtain the first hash value sequence and the second hash value sequence; Based on the first hash sequence and the second hash sequence, rows with different hash values ​​are identified as candidate rows to be changed. The candidate change line is matched with the content of the verified valid command. If the content of the candidate change line matches the content of the verified valid command, it is determined that there is a change in the content of the command, and the candidate change line is determined as a configuration change line.

[0016] The beneficial effects of adopting the above-mentioned further solution are as follows: By calculating and comparing the hash value sequence of each line of the configuration file, the configuration change lines caused by command execution can be quickly and accurately located, improving the efficiency and accuracy of change detection. By performing a secondary matching between candidate change lines and verified valid command content, it is ensured that only genuine configuration changes directly caused by the current operation are identified and marked, effectively eliminating other interference. This provides a solid foundation for generating accurate and reliable traceability annotations, fundamentally solving the problem of difficulty in quickly and accurately tracing configuration changes.

[0017] Furthermore, it also includes: If the candidate change is the target change line, then the candidate change is determined to be a configuration change line to be deleted, and the deleted configuration change line is not processed. The target change line represents a configuration change line that is missing in the second configuration file but exists in the first configuration file.

[0018] The beneficial effect of adopting the above-mentioned further solution is that by identifying and excluding candidate change lines that are only characterized as configuration line deletions found in the comparison before and after configuration, it ensures that the annotation generation mechanism only targets configuration lines that are actually added or modified and are effective in the current configuration, thus avoiding the generation of invalid or meaningless annotations for historical configurations that no longer exist.

[0019] Furthermore, the annotation information for generating the command includes: Based on the operator's identity information, the command's effective timestamp, and the target network device's version information, the command's annotation information is generated; If a configuration change line is modified from an original configuration change line that already has associated historical comment information, then the historical comment information associated with the original configuration change line will be merged into the comment information generated by the current configuration change line.

[0020] The beneficial effect of adopting the above-mentioned further solution is that by identifying and excluding candidate changed lines found in the before-and-after configuration comparison that only indicate the deletion of configuration lines, it ensures that the annotation generation mechanism only targets configuration lines that are actually added or modified and are effective in the current configuration. This effectively avoids generating invalid or meaningless annotations for historical configurations that no longer exist.

[0021] Secondly, this application provides a network device configuration labeling device, which adopts the following technical solution: A network device configuration labeling device, comprising: The acquisition module is used to acquire the operation command stream and the version information of the target network device. The operation command stream includes the command sequence entered by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. The command classification and verification module is used to determine the verification information of the operation command stream based on the operation command stream, the version information of the target network device, and the preset validity verification rules. The verification information includes the verification results of multiple commands of the configuration type. The configuration comparison module is used to obtain the first configuration file and the second configuration file of the target network device for any command whose verification result is valid, and to determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; The annotation generation module is used to generate annotation information for any command whose verification result is valid, if there is a change in the content of the command, based on the configuration change line with the content change, associate the annotation information with the corresponding configuration change line with the content change, and write the associated configuration change line and annotation information into the annotated configuration backup file; wherein, the annotation information includes the operator's identity information and the command effective timestamp.

[0022] Thirdly, this application provides an electronic device that adopts the following technical solution: An electronic device includes a memory and a processor, wherein the memory stores a computer program capable of being loaded by the processor and executing the network device configuration labeling method according to any one of the first aspects.

[0023] Fourthly, this application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium storing a computer program capable of being loaded by a processor and executing the network device configuration annotation method according to any one of the first aspects.

[0024] Additional aspects and advantages of this application will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of this application.

[0025] In summary, the beneficial effects of this application are as follows: 1. Differentiated processing mechanism based on device version identification: Automatically identifies device manufacturer and system version, distinguishing between "configuration-submit" mode (new devices) and "direct activation" mode (old devices), and employing completely different subsequent command verification and activation judgment processes. This mechanism is the foundation for adapting to heterogeneous networks and achieving accurate auditing.

[0026] 2. The "Dual Triggering Comment Principle" of "Valid Execution and Actual Change": Automatic comment generation must simultaneously meet two strict conditions: first, the configuration command must pass syntax, permission, or conflict checks and be deemed validly executed; second, a comparison of the configuration files before and after the change confirms that the command has indeed caused an actual change in the configuration content. This ensures that each comment corresponds to a real, successful configuration change.

[0027] 3. Configure a precise association algorithm between changed rows and operation commands: Use a fast comparison based on row hash to locate changed rows, and then perform hash matching between the content of the changed row and the valid commands verified in this operation to accurately determine whether the changed row is caused by the current operation, and can distinguish between addition and deletion (deleted rows are not commented), thus realizing change tracing.

[0028] 4. Inheritance and merging of structured comments: When the configuration changes again, the system can associate the original comment history with the new configuration line, ensuring that the operation traceability of the entire life cycle of the configuration item is uninterrupted. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a network device configuration labeling method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a network device configuration labeling device according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0032] This application provides a method for configuring and labeling network devices. This method can be executed by an electronic device, which can be a server or a mobile terminal device. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The mobile terminal device can be a laptop computer, a desktop computer, etc., but is not limited to these.

[0033] like Figure 1 As shown, a network device configuration labeling method mainly includes: S1, Obtain the operation command stream and the version information of the target network device. The operation command stream includes the command sequence entered by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. In this embodiment, the operation command stream represents a continuous data set formed in chronological order of a series of commands captured in real time from the Authentication, Authorization, and Accounting (AAA) system and entered by the operator on the target network device. For example, in a login session, the operator sequentially enters commands such as show version, config terminal, interface GigabitEthernet0 / 0 / 1, description To-Core-Switch, and exit, along with their responses.

[0034] By interfacing with the 3A system, all commands entered by operators in network device management terminals (such as SSH terminals, WEB management interfaces, CLI consoles) are captured in real time, and a structured operation instruction stream is extracted. The operation instruction stream encapsulates the identity information, execution timestamp, and command sequence of this operation.

[0035] The target network device refers to the specific network hardware device that needs to be configured and traced, such as a router, switch, or firewall.

[0036] Establish a connection with the target network device via SNMP or NETCONF protocol, send a version query command (such as Cisco 'show version', Huawei 'display version') to the target network device, and then parse the device's return result to extract the version information, which can be the device model or system model.

[0037] It should be noted that Cisco and Huawei, as mainstream network equipment manufacturers, have significant differences in the execution logic of configuration commands for their new and old versions of equipment: newer versions of Cisco IOS / IOS XE 15.0 and above, and Huawei VRP 8.0 and above adopt the "configuration-commit" mode, and the configuration will only take effect after confirmation by the "commit" command; Older devices such as Cisco IOS 15.0 and below, and Huawei VRP 8.0 and below, use the "configuration mode". After entering the "config terminal" (Cisco) or "system-view" (Huawei) mode, the commands entered will take effect immediately (excluding query / test commands).

[0038] S2, based on the operation command stream, the version information of the target network device, and the preset validity verification rules, determine the verification information of the operation command stream, the verification information including the verification results of multiple commands of configuration type; In this embodiment of the application, S2 includes the following sub-steps: S21, based on the operation instruction stream and the preset command classification rules, determine the command type of each command, including query type, test type and configuration type; S22, For each command of type configuration, determine the execution and verification strategy of the command based on the version information of the target network device; S23, for each command of type configuration, perform validity verification on the command based on the execution and verification strategy of the command, and obtain the verification result of the command, the verification result including execution valid and execution invalid.

[0039] In the above implementations, query commands refer to commands used only to read and display the current configuration or running status of the device, without modifying the configuration, such as Cisco's `show running-config`, Huawei's `display current-configuration`, and Cisco's `show ip route`. Test commands refer to diagnostic commands used to check network connectivity or performance, without modifying the configuration, such as Cisco / Huawei's `ping`, `traceroute`, and `tracert`. Configuration commands refer to commands that modify the device's running or startup configuration, such as Cisco's `ip route`, Huawei's `ip route-static`, `interface GigabitEthernet0 / 0`, and `acl 3000`.

[0040] Each command can be quickly categorized using a pre-established command library, filtering out query and test commands that account for a large proportion but have no impact on configuration changes. This significantly reduces the scope of data that needs to be processed in depth later, allowing resources to be focused on configuration-type commands.

[0041] For each selected configuration type command, the version information of the target network device is queried. Based on this information, an appropriate execution and verification strategy is dynamically assigned. This is key to achieving unified management of heterogeneous network devices (different vendors, different OS versions), ensuring that subsequent verification logic accurately matches the actual configuration activation model of the device.

[0042] Each command is sent to the target network device for execution according to the selected strategy, and the device's feedback is closely monitored. The "validity" of the command's operation is determined by analyzing the feedback information for predefined error or success indicators. Only commands marked as "executed successfully" are considered "suspected valid changes" and eligible to enter the subsequent configuration change confirmation process. This ensures that subsequent labeling work is based on actual, successful configuration operations.

[0043] Specifically, based on the operation instruction stream and preset command classification rules, the command type of each command is determined, including: For each command in the operation instruction stream, determine whether the command matches any pattern in a pre-established command library, which stores known query type command patterns and test type command patterns; For each command in the operation instruction stream, if the command successfully matches any pattern in the command library, then the command type of the command is determined to be either a query type or a test type. For each command in the operation instruction stream, if the command fails to match any pattern in the command library, then the command type of the command is determined to be a configuration type.

[0044] By pre-establishing query and test command libraries and using them to quickly match with operation command streams, query and test commands that do not cause actual configuration changes can be automatically and accurately filtered out. This achieves intelligent preliminary screening of massive operation commands, significantly improving the processing efficiency of subsequent processes.

[0045] Specifically, based on the version information of the target network device, the execution and verification strategy of the command is determined, including: If the version information is a first version, then the execution and verification strategy of the command is determined to be a first execution and verification strategy. The first execution and verification strategy is as follows: send the command of the configuration type to the target network device for execution, and obtain the first execution feedback information of the target network device; if the first execution feedback information includes a predefined error identifier, then the corresponding command execution is determined to be invalid, otherwise it is determined to be valid; wherein, the network device of the first version represents the network device that adopts the configuration direct effective mode; If the version information is the second version, then the execution and verification strategy of the command is determined to be the second execution and verification strategy. The second execution and verification strategy is as follows: add the command of the configuration type to the candidate configuration set; after detecting the submission command for the candidate configuration set, send the candidate configuration set and the submission command to the target network device for execution, and obtain the second execution feedback information returned by the submission command; if the second execution feedback information includes a predefined successful submission identifier, then determine the overall execution validity of the commands in the candidate configuration set; otherwise, determine that the execution is invalid; wherein, the network device of the second version represents the network device that adopts the configuration submission mode.

[0046] For example, when the target network device is an older version device (the first version of the network device), the command is executed through the device CLI interface, and the returned result is captured in real time. If a syntax error message such as "% Invalid input detected at '^'marker." or a permission error message such as "% Permission denied" is returned, the execution is considered to have failed; if no error message or a successful feedback that conforms to the device specification is returned, the execution is considered to have been successful.

[0047] When the target network device is a new version device (second version network device), each command in the candidate configuration command set is executed first (without actual effect), and then the "commit" command is executed, capturing the "commit" execution result. If a "Commit complete." or similar identifier is returned, the overall configuration command execution is considered valid; if a configuration conflict message such as "Configuration conflict found" or an invalid configuration-related English error message is returned, the execution is considered to have failed.

[0048] Regardless of the old or new version, when an execution fails, a failure log is only recorded in the 3A system, including information such as the failed command, the reason for failure, the device version, the operator, and the operation time. It does not trigger subsequent configuration change detection and commenting processes.

[0049] By identifying the version of network devices and adaptively adopting either a first verification strategy for devices in "configuration direct-effect mode" or a second verification strategy for devices in "configuration-submit mode", compatibility and unified management of heterogeneous devices from different manufacturers and with different system versions in the network are achieved.

[0050] S3, for any command whose verification result is valid, obtain the first configuration file and the second configuration file of the target network device, and determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; In this embodiment of the application, determining whether there is a change in the content of the command based on the first configuration file and the second configuration file includes: Calculate the hash value configured in each line of the first configuration file and the hash value configured in each line of the second configuration file to obtain the first hash value sequence and the second hash value sequence; Based on the first hash sequence and the second hash sequence, rows with different hash values ​​are identified as candidate rows to be changed. The candidate change line is matched with the content of the verified valid command. If the content of the candidate change line matches the content of the verified valid command, it is determined that there is a change in the content of the command, and the candidate change line is determined as a configuration change line.

[0051] If the candidate change is the target change line, then the candidate change is determined to be a configuration change line to be deleted, and the deleted configuration change line is not processed. The target change line represents a configuration change line that is missing in the second configuration file but exists in the first configuration file.

[0052] In the above implementation, before executing a configuration-type command, the current complete configuration file (previous configuration file) of the target network device is obtained and stored, that is, a configuration backup is performed every time a user logs into the device; after the configuration-type command is executed, the complete configuration file of the target network device is obtained again (later configuration file).

[0053] Next, a fast comparison algorithm based on row hashing is used for comparison. MD5 or SHA-256 hash values ​​are calculated for each line of configuration in both the previous and subsequent configuration files, forming two hash sequences. By comparing the hash sequence, candidate change rows with mismatched hash values ​​are quickly located. Once the change row is located, the configuration of the candidate change row is compared with the configuration sent by the operator. If they match, it is confirmed that the operator has performed the configuration change, and comments such as operator and operation time are added.

[0054] Some of the candidate change lines are deleted configurations, which may result in some lines being missing compared to the original configuration. Deleted configurations will not be commented out.

[0055] If no changes are detected after comparison, meaning the configuration has not changed, the process is terminated, and only the command execution log (including device version, operator, no configuration changes, etc.) is recorded in the 3A system.

[0056] S4. For any command whose verification result is valid, if there is a change in the content of the command, then generate the comment information of the command, associate the comment information with the corresponding configuration change line where the content has changed, and write the associated configuration change line and comment information into the marked configuration backup file; wherein, the comment information includes the operator's identity information and the command effective timestamp.

[0057] In this embodiment of the application, the annotation information for generating the command includes: Based on the operator's identity information, the command's effective timestamp, and the target network device's version information, the command's annotation information is generated; If a configuration change line is modified from an original configuration change line that already has associated historical comment information, then the historical comment information associated with the original configuration change line will be merged into the comment information generated by the current configuration change line.

[0058] In this embodiment of the application, the configuration change line refers to the specific configuration command line that, after comparison, is confirmed to have changed the content in the device configuration file due to the execution of the command whose current verification result is valid.

[0059] By integrating information from multiple sources, a structured annotation is automatically constructed. This information includes at least the operator's identity information and command effective timestamp extracted from the operation command stream, and typically also the version information of the target network device obtained from the device, to form a complete change snapshot.

[0060] The generated comment information is then bound to the configuration change lines. This is achieved by inserting the comment lines immediately preceding (usually before) the configuration change lines in the configuration file, thus establishing a one-to-one correspondence in the description.

[0061] Write all associated configuration change lines and their corresponding comments into a new, independent file, namely the annotated configuration backup file, following the original configuration syntax and structure.

[0062] This method automatically associates and clearly marks the creator or modifier and operation time of each effective configuration command in the device's global configuration backup file, making the ownership and history of configurations readily apparent. This not only quickly identifies the responsible party for configurations, providing direct evidence for configuration modifications and troubleshooting, but also enhances the accuracy and convenience of configuration auditing, effectively preventing security risks such as unauthorized configuration and unauthorized operations. It provides secure and reliable support for compliant network configuration management and efficient maintenance. Through a dual confirmation mechanism of validating configuration commands and comparing them with actual changes, the accuracy and authority of the annotations are ensured, preventing invalid or test operations from being mislabeled. This effectively identifies and prevents security risks such as unauthorized configuration changes and unauthorized service activation, enhancing the compliance, security, and maintainability of network configuration management.

[0063] Figure 2 A schematic diagram of a network device configuration labeling device 200 is shown.

[0064] like Figure 2 As shown, a network device configuration labeling device 200 mainly includes: The acquisition module 201 is used to acquire the operation command stream and the version information of the target network device. The operation command stream includes the command sequence input by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. The command classification and verification module 202 is used to determine the verification information of the operation command stream based on the operation command stream, the version information of the target network device, and the preset validity verification rules. The verification information includes the verification results of multiple commands of the configuration type. The configuration comparison module 203 is used to obtain the first configuration file and the second configuration file of the target network device for any command whose verification result is valid, and to determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; The annotation generation module 204 is used to generate annotation information for any command whose verification result is valid, if there is a change in the content of the command, based on the configuration change line with the content change, associate the annotation information with the corresponding configuration change line with the content change, and write the associated configuration change line and annotation information into the marked configuration backup file; wherein, the annotation information includes the operator's identity information and the command effective timestamp.

[0065] Optional, the command classification and verification module 202 includes: The first determining submodule is used to determine the command type of each command based on the operation instruction stream and preset command classification rules. The command type includes query type, test type and configuration type. The second determination submodule is used to determine the execution and verification strategy of each command of type configuration based on the version information of the target network device for each command. The validity verification submodule is used to perform validity verification on each command of type configuration based on the execution and verification strategy of the command, and obtain the verification result of the command, which includes execution valid and execution invalid.

[0066] Optional, the second determining submodule is specifically used for: If the version information is a first version, then the execution and verification strategy of the command is determined to be a first execution and verification strategy. The first execution and verification strategy is as follows: send the command of the configuration type to the target network device for execution, and obtain the first execution feedback information of the target network device; if the first execution feedback information includes a predefined error identifier, then the corresponding command execution is determined to be invalid, otherwise it is determined to be valid; wherein, the network device of the first version represents the network device that adopts the configuration direct effective mode; If the version information is the second version, then the execution and verification strategy of the command is determined to be the second execution and verification strategy. The second execution and verification strategy is as follows: add the command of the configuration type to the candidate configuration set; after detecting the submission command for the candidate configuration set, send the candidate configuration set and the submission command to the target network device for execution, and obtain the second execution feedback information returned by the submission command; if the second execution feedback information includes a predefined successful submission identifier, then determine the overall execution validity of the commands in the candidate configuration set; otherwise, determine that the execution is invalid; wherein, the network device of the second version represents the network device that adopts the configuration submission mode.

[0067] Optional, the first determined submodule is used for: For each command in the operation instruction stream, determine whether the command matches any pattern in a pre-established command library, which stores known query type command patterns and test type command patterns; For each command in the operation instruction stream, if the command successfully matches any pattern in the command library, then the command type of the command is determined to be either a query type or a test type. For each command in the operation instruction stream, if the command fails to match any pattern in the command library, then the command type of the command is determined to be a configuration type.

[0068] Optionally, the configuration comparison module 203 includes: The calculation submodule is used to calculate the hash value configured in each line of the first configuration file and the hash value configured in each line of the second configuration file to obtain a first hash value sequence and a second hash value sequence. The third determination submodule is used to determine rows with different hash values ​​as candidate rows for modification based on the first hash sequence and the second hash sequence; The matching submodule is used to match the candidate change line with the content of the verified valid command. If the content of the candidate change line matches the content of the verified valid command, it is determined that there is a change in the content of the command, and the candidate change line is determined as a configuration change line.

[0069] Optionally, the matching submodule is also used for: If the candidate change is the target change line, then the candidate change is determined to be a configuration change line to be deleted, and the deleted configuration change line is not processed. The target change line represents a configuration change line that is missing in the second configuration file but exists in the first configuration file.

[0070] Optional, annotation generation module, specifically used for: Based on the operator's identity information, the command's effective timestamp, and the target network device's version information, the command's annotation information is generated; If a configuration change line is modified from an original configuration change line that already has associated historical comment information, then the historical comment information associated with the original configuration change line will be merged into the comment information generated by the current configuration change line.

[0071] In one example, the module in any of the above devices may be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0072] For example, when modules in a device can be implemented via a processing element scheduler, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling programs. Alternatively, these modules can be integrated together as a system-on-a-chip (SOC).

[0073] In this application, various objects such as messages / information / devices / network elements / systems / apparatus / actions / operations / processes / concepts may be named. It is understood that these specific names do not constitute a limitation on the relevant objects. The names may be changed depending on the scenario, context, or usage habits. The understanding of the technical meaning of the technical terms in this application should be mainly determined from their functions and technical effects embodied / performed in the technical solution.

[0074] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0075] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0076] Figure 3 This is a structural block diagram of an electronic device 300 according to an embodiment of this application.

[0077] like Figure 3 As shown, the electronic device 300 includes a processor 301 and a memory 302, and may further include one or more of an information input / output (I / O) interface 303, a communication component 304, and a communication bus 305.

[0078] The processor 301 controls the overall operation of the electronic device 300 to complete all or part of the steps in the network device configuration labeling method described above. The memory 302 stores various types of data to support the operation of the electronic device 300. This data may include, for example, instructions for any application or method operating on the electronic device 300, as well as application-related data. The memory 302 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as one or more of Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0079] I / O interface 303 provides an interface between processor 301 and other interface modules, such as keyboards, mice, and buttons. These buttons can be virtual or physical. Communication component 304 is used to test wired or wireless communication between electronic device 300 and other devices. Wireless communication includes Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof. Therefore, the corresponding communication component 304 may include a Wi-Fi component, a Bluetooth component, and an NFC component.

[0080] The communication bus 305 may include a path for transmitting information between the aforementioned components. The communication bus 305 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The communication bus 305 may be divided into an address bus, a data bus, a control bus, etc.

[0081] The electronic device 300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to execute a network device configuration annotation method given in the above embodiments.

[0082] The following describes the computer-readable storage medium provided in the embodiments of this application. The computer-readable storage medium described below can be referred to in correspondence with the network device configuration annotation method described above.

[0083] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described network device configuration labeling method.

[0084] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] The terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0086] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing application concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions claimed in this application.

Claims

1. A method for configuring and labeling network devices, characterized in that, include: Obtain the operation command stream and the version information of the target network device. The operation command stream includes the command sequence entered by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. Based on the operation command stream, the version information of the target network device, and the preset validity verification rules, the verification information of the operation command stream is determined. The verification information includes the verification results of multiple commands of the configuration type. For any command whose verification result is valid, obtain the first configuration file and the second configuration file of the target network device, and determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; For any command whose verification result is valid, if there is a change to the content of the command, then the comment information of the command is generated, the comment information is associated with the corresponding configuration change line where the content has changed, and the associated configuration change line and comment information are written into the marked configuration backup file; wherein, the comment information includes the operator's identity information and the command effective timestamp.

2. The network device configuration labeling method according to claim 1, characterized in that, The determination of verification information for the operation command stream based on the operation command stream, the version information of the target network device, and preset validity verification rules includes: Based on the operation instruction flow and the preset command classification rules, the command type of each command is determined, including query type, test type and configuration type; For each command of type configuration, the execution and verification strategy of the command is determined based on the version information of the target network device; For each command of type configuration, the validity of the command is verified based on the execution and verification strategy of the command, and the verification result of the command is obtained. The verification result includes execution valid and execution invalid.

3. The network device configuration labeling method according to claim 2, characterized in that, The step of determining the execution and verification strategy of the command based on the version information of the target network device includes: If the version information is a first version, then the execution and verification strategy of the command is determined to be a first execution and verification strategy. The first execution and verification strategy is as follows: send the command of the configuration type to the target network device for execution, and obtain the first execution feedback information of the target network device; if the first execution feedback information includes a predefined error identifier, then the corresponding command execution is determined to be invalid, otherwise it is determined to be valid; wherein, the network device of the first version represents the network device that adopts the configuration direct effective mode; If the version information is the second version, then the execution and verification strategy of the command is determined to be the second execution and verification strategy. The second execution and verification strategy is as follows: add the command of the configuration type to the candidate configuration set; after detecting the submission command for the candidate configuration set, send the candidate configuration set and the submission command to the target network device for execution, and obtain the second execution feedback information returned by the submission command; if the second execution feedback information includes a predefined successful submission identifier, then determine the overall execution validity of the commands in the candidate configuration set; otherwise, determine that the execution is invalid; wherein, the network device of the second version represents the network device that adopts the configuration submission mode.

4. The network device configuration labeling method according to claim 2, characterized in that, The process of determining the command type of each command based on the operation instruction stream and preset command classification rules includes: For each command in the operation instruction stream, determine whether the command matches any pattern in a pre-established command library, which stores known query type command patterns and test type command patterns; For each command in the operation instruction stream, if the command successfully matches any pattern in the command library, then the command type of the command is determined to be either a query type or a test type. For each command in the operation instruction stream, if the command fails to match any pattern in the command library, then the command type of the command is determined to be a configuration type.

5. A network device configuration labeling method according to claim 1, characterized in that, The step of determining whether there has been a change in the content of the command based on the first configuration file and the second configuration file includes: Calculate the hash value configured in each line of the first configuration file and the hash value configured in each line of the second configuration file to obtain the first hash value sequence and the second hash value sequence; Based on the first hash sequence and the second hash sequence, rows with different hash values ​​are identified as candidate rows to be changed. The candidate change line is matched with the content of the verified valid command. If the content of the candidate change line matches the content of the verified valid command, it is determined that there is a change in the content of the command, and the candidate change line is determined as a configuration change line.

6. The network device configuration labeling method according to claim 5, characterized in that, Also includes: If the candidate change is the target change line, then the candidate change is determined to be a configuration change line to be deleted, and the deleted configuration change line is not processed. The target change line represents a configuration change line that is missing in the second configuration file but exists in the first configuration file.

7. A network device configuration labeling method according to claim 1, characterized in that, The annotation information used to generate the command includes: Based on the operator's identity information, the command's effective timestamp, and the target network device's version information, the command's annotation information is generated; If a configuration change line is modified from an original configuration change line that already has associated historical comment information, then the historical comment information associated with the original configuration change line will be merged into the comment information generated by the current configuration change line.

8. A network device configuration labeling device, characterized in that, include: The acquisition module is used to acquire the operation command stream and the version information of the target network device. The operation command stream includes the command sequence entered by the operator on the target network device, the execution timestamp of each command, and the corresponding operator's identity information. The command classification and verification module is used to determine the verification information of the operation command stream based on the operation command stream, the version information of the target network device, and the preset validity verification rules. The verification information includes the verification results of multiple commands of the configuration type. The configuration comparison module is used to obtain the first configuration file and the second configuration file of the target network device for any command whose verification result is valid, and to determine whether there is a change in the content of the command based on the first configuration file and the second configuration file; wherein, the first configuration file represents the configuration file obtained before the execution of the command of the configuration type, and the second configuration file represents the configuration file obtained after the execution of the command of the configuration type takes effect; The annotation generation module is used to generate annotation information for any command whose verification result is valid, if there is a change in the content of the command, based on the configuration change line with the content change, associate the annotation information with the corresponding configuration change line with the content change, and write the associated configuration change line and annotation information into the annotated configuration backup file; wherein, the annotation information includes the operator's identity information and the command effective timestamp.

9. An electronic device, characterized in that, Includes a processor, which is coupled to a memory; The processor is configured to execute a computer program stored in the memory to cause the electronic device to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Includes a computer program or instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1-7.

Images