Network change method, network change verification method, and network change verification system

Abstract

A network change method, a network change verification method, and a network change verification system. The verification method comprises: after receiving a first change intent input by a user for changing a target network, generating a second change intent on the basis of the first change intent, wherein the first change intent is a change intent described by using a natural language, and the second change intent is a change intent described by using a formal language; determining a first path set and a second path set, wherein the first path set is a path set which is computed after the second change intent acts on a path set for a target data flow before the target network is changed, and the second path set is a path set for the target data flow after the target network is actually changed on the basis of the second change intent; and on the basis of the first path set and the second path set, verifying a change scheme for the target network.

Description

Method for network change, verification method, verification system Cross-reference to related applications

[0001] The present disclosure claims priority to Chinese Patent Application No. 202411113132.5, filed on August 13, 2024, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of network verification, and in particular, to a method for network change, a verification method, and a verification system. BACKGROUND

[0003] With the demand for upper-layer services of network infrastructure, a large number of changes may need to be made to the network every day. Network administrators change the network state by changing the network configuration and the like, and then manually verify the network change to meet the effect of the change to the network desired by the network administrator. However, the high complexity of network change and the super-large scale of the network make the manual verification inefficient and inaccurate. Related technologies have not yet proposed an effective solution to this technical problem. SUMMARY

[0004] Embodiments of the present disclosure provide a method for network change, a verification method, and a verification system to solve one or more of the above technical problems.

[0005] In a first aspect, embodiments of the present disclosure provide a verification method for network change, comprising: generating a second change intention according to a first change intention input by a user to change a target network after receiving the first change intention, wherein the first change intention is a change intention described using natural language, and the second change intention is a change intention described using formal language; determining a first path set and a second path set, wherein the first path set is a path set calculated after the second change intention acts on a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and verifying a target network change scheme according to the first path set and the second path set.

[0006] In a second aspect, embodiments of the present disclosure provide a method for network change, comprising: verifying a network change scheme in a simulation network environment using the above-mentioned verification method for network change; and applying the network change scheme to a real network environment if the verification is passed.

[0007] In a third aspect, the embodiment provides a network change verification system, comprising: an input interface configured to receive a first change intention input by a user for changing a target network; a generation module configured to generate a second change intention according to the first change intention, wherein the first change intention is a change intention described in natural language, and the second change intention is a change intention described in formal language; a calculation module configured to determine a first path set and a second path set, wherein the first path set is a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and a verifier configured to verify a target network change scheme according to the first path set and the second path set.

[0008] In a fourth aspect, the embodiment provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method of any one of the above aspects when executing the computer program.

[0009] In a fifth aspect, the embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method of any one of the above aspects.

[0010] Compared with related technologies, the present disclosure has the following advantages.

[0011] According to the embodiment of the present disclosure, after receiving a first change intention input by a user for changing a target network, a second change intention is generated according to the first change intention, wherein the first change intention is a change intention described in natural language, and the second change intention is a change intention described in formal language; a first path set and a second path set are determined, wherein the first path set is a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and a target network change scheme is verified according to the first path set and the second path set. That is, the present disclosure can describe a change intention of a network by using formal language (intention language), and compared with describing a change intention by using natural language, the present disclosure can more accurately and concisely define a change intention. In addition, the present disclosure can automatically and efficiently verify a network change scheme according to the first path set and the second path set, and solve the problem of low efficiency and correctness caused by manually verifying a network change in related technologies.

[0012] The above description is only a summary of the technical solutions of the present disclosure. In order to enable a clearer understanding of the technical means of the present disclosure, the above description can be implemented according to the content of the specification, and in order to enable the above and other purposes, features and advantages of the present disclosure to be more apparent and easy to understand, the following specific embodiments of the present disclosure are described. BRIEF DESCRIPTION OF DRAWINGS

[0013] In the drawings, like reference numerals refer to same or similar functionalities throughout the several views. The drawings are not necessarily to scale. It is to be understood that the drawings only depict several embodiments in accordance with the present disclosure and should not be considered as limiting the scope of the present disclosure.

[0014] FIG. 1 shows a flowchart of a method for verifying network change provided in an embodiment of the present disclosure;

[0015] FIG. 2a shows a schematic diagram of a method for verifying network change provided in an embodiment of the present disclosure (I);

[0016] FIG. 2b shows a schematic diagram of a method for verifying network change provided in an embodiment of the present disclosure (II);

[0017] FIG. 3 shows a schematic diagram of another method for verifying network change provided in an embodiment of the present disclosure;

[0018] FIG. 4a shows a schematic diagram of yet another method for verifying network change provided in an embodiment of the present disclosure (I);

[0019] FIG. 4b shows a schematic diagram of yet another method for verifying network change provided in an embodiment of the present disclosure (II);

[0020] FIG. 5 shows a flowchart of a method for verifying network change provided in an embodiment of the present disclosure;

[0021] FIG. 6 shows a structural block diagram of a device for verifying network change provided in an embodiment of the present disclosure;

[0022] FIG. 7 shows a structural block diagram of a device for verifying network change provided in an embodiment of the present disclosure;

[0023] FIG. 8 shows a structural block diagram of a system for verifying network change provided in an embodiment of the present disclosure; and

[0024] FIG. 9 shows a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In the following, only certain exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the concept or scope of the present disclosure. Therefore, the drawings and the description are considered to be exemplary in nature, rather than limiting.

[0026] In order to facilitate understanding of the technical solutions of the embodiments of the present disclosure, the related technologies of the embodiments of the present disclosure are described below. The following related technologies can be combined with the technical solutions of the embodiments of the present disclosure in any way as optional solutions, and all of them belong to the protection scope of the embodiments of the present disclosure.

[0027] From the perspective of route forwarding, the network can be divided into three layers, including policy, control plane and data plane. The policy is the reference of the control plane and the data plane, and embodies the intention of the network administrator, such as whether host A is allowed to communicate with host B. The control plane is used to implement the policy, which refers to the configuration file in the network device in the traditional network, and refers to various applications in the software-defined network (SDN). Among them, the control plane of the router is used to control and manage the operation of all network protocols, and provides various network information and forwarding query items necessary for data plane data processing and forwarding before the data plane. The data plane is the network topology generated according to the control plane, and the forwarding information in the traditional network refers to the forwarding table, and the forwarding information in the SDN refers to the flow table. According to the two levels of control plane and data plane, network verification corresponds to control plane verification and data plane verification in two directions. The control plane verification can verify the invariance of the network policy by inputting the control plane information to ensure that the control plane is consistent with the requirements of the policy. The present disclosure is mainly proposed for data plane verification. In the process of data plane verification, the network change verification method based on flow path is mainly proposed. The application scenarios of the network change verification method include but are not limited to: new service online (for example, publishing a new service address in the network), link expansion (for example, adding a port on the router), network address recycling (for example, service offline, recycling the address allocated by the network) and the like.

[0028] In a related art before the present disclosure, a regular expression is mainly used to express path behavior of a data flow in a network, and a theory of Kleene algebra with tests (KAT) is used to verify whether the expressed path behavior is satisfied, i.e., network verification (a technology of modeling a network to be verified, and calculating and checking whether each device routing, link traffic, etc. of the network meets an expectation (or verification rule) given by a network administrator). The related art has a disadvantage that it cannot support description of an intention of a change in network state (i.e., a change intention). In a network change, a path of a flow can change before and after the change, and the related art can only be used to define conditions that should be met by the path before the change or after the change, but cannot be used to simultaneously specify how the path before the change and the path after the change should change. For example, the related art can define that a path of a data flow before a change is ABC, and a path of the data flow after the change is DEF, but cannot define a relationship of "all flows with a path of ABC before the change have a path of DEF after the change". Therefore, the related art cannot be used to define an intention of a network change, and cannot be used to verify correctness of the network change.

[0029] Therefore, embodiments of the present disclosure provide a verification method of a network change to wholly or partially solve the above technical problems. As shown in FIG. 1, the verification method of the network change includes S102 to S106.

[0030] S102, after receiving a first change intention of a target network input by a user, a second change intention is generated according to the first change intention, where the first change intention is a change intention described using natural language, and the second change intention is a change intention described using formal language. It should be noted that the user can be a network administrator. The change intention is an effect that the network administrator expects to achieve by changing the network. The target network can be a determined simulation network environment by modeling a real network. Optionally, after the network administrator inputs the first change intention described using natural language, the embodiments of the present disclosure can automatically generate the second change intention described using formal language (i.e., an intention language, a formal language used to describe an expectation of a network administrator on network behavior, a rule) corresponding to the first change intention, and provide an efficient and flexible change intention generation manner, and also standardize a description manner of the change intention by different network administrators. Of course, for an experienced network administrator, the embodiments of the present disclosure can directly receive the change intention described according to the intention language by the network administrator. The description of the intention language and the rule description can be saved in a specified database, and when a network change intention is needed to be described using the intention language, the description of the intention language and the description rule can be called from the specified database. When the intention language is updated, the database can be updated.

[0031] S104, determining a first path set and a second path set, wherein the first path set is a path set of the target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is changed according to the second change intention. It should be noted that the target data flow can be all data flows flowing through the path before the change, or part of the data flows flowing through the path before the change. For example, for all data flows flowing through the path before the change, part of the data flows are specified to change the path. Alternatively, the second change intention at least includes a path relationship, so that after the path set of the target data flow before the target network is changed is affected by the path relationship, a theoretically changed path set can be calculated. Of course, the first path set and the second path set, and the path set of the target data flow before the change can also contain only one path. The path set of the target data flow before the change of the target network and the second path set can be obtained from a simulator of the target network.

[0032] S106, verifying the target network change scheme according to the first path set and the second path set. Alternatively, in the embodiment of the present disclosure, the target network change scheme can be verified according to the inclusion relationship of the first path set and the second path set. For example, when the first path set and the second path set are the same, it is determined that the target network change scheme is verified, when the first path set and the second path set are completely different or partially different, it is determined that the target network change scheme is not verified, and the network management personnel needs to reconfigure the unreasonable places of the network change scheme. Alternatively, in the embodiment of the present disclosure, the determination method of the inclusion relationship of the first path set and the second path set includes but is not limited to: combining the path set of the target data flow before the change of the target network, the path description in the second change intention, the relationship description, etc. to compile into a finite state transducer (FST) by a compiler, and the second path set is also compiled into a FST by a compiler, and the equivalence of the two FSTs is checked to verify the target network change scheme. Of course, other methods of determining the inclusion relationship of the first path set and the second path set by machine can also be used, which are not described herein.

[0033] According to the steps S102-S106, after receiving the first change intention of changing the target network input by the user, the second change intention is generated according to the first change intention, wherein the first change intention is a change intention described by using natural language, and the second change intention is a change intention described by using formal language; the first path set and the second path set are determined, wherein the first path set is a path set of the target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and the target network change scheme is verified according to the first path set and the second path set. That is, the disclosure can describe an intention of network change by using formal language (intention language), and compared with describing the change intention by using natural language, the disclosure can more accurately and concisely define a change intention. In addition, the disclosure can automatically and efficiently verify the network change scheme according to the first path set and the second path set, and solves the problem of low efficiency and correctness caused by manually verifying the network change in the related art.

[0034] In a possible implementation, generating the second change intention according to the first change intention can include: S11, obtaining a formal language description corresponding to the first change intention, wherein the formal language description includes: a range description of an expected constraint data flow, a path description of the data flow, a change relationship description of the data flow, and a rule description between the first path set and the second path set. Optionally, in the embodiment of the disclosure, the optional implementation of the step S11 includes: automatically obtaining the formal language description corresponding to the first change intention from the specified database; and for experienced network management personnel, the formal language description corresponding to the first change intention can be directly input.

[0035] S12, determining the second change intention by the formalized language description. That is, in the embodiment of the present disclosure, the change intention described in natural language is converted into a change intention that can be correctly recognized by a machine through the formalized language description. Specifically, the range description of the expected constraint data flow can be a wildcard "*" used to describe that the change expectation has a constraint on all flows, or other symbols can be used to describe that the change expectation has a constraint on part of the flows. The path description of the data flow can be a regular expression based on the nodes in the target network. It should be noted that the nodes can be network devices, ports, etc. The regular expression is a logical formula for string operations (including ordinary characters (for example, letters between a and z) and special characters (referred to as "meta characters")), that is, a "regular string" is composed of some specific characters and combinations of these specific characters, and the "regular string" is used to express a filtering logic for a string. The regular expression is a text pattern that describes one or more strings to be matched when searching for text. For example, in the embodiment of the present disclosure, two paths P1 and P2 are expected to be described, the path of P1 data flow is ABD, and the path of P2 data flow is ACD, which can be expressed as P1 = ABD and P2 = ACD using the regular expression. The change relationship description of the data flow can be a regular relationship expression based on the path description of the data flow. For example, for the regular expression, the corresponding regular relationship expression is: p1 changes to p2: r1 = p1->p2, the path not containing p1 remains unchanged: r2 = I (~(.*p1.*)); here ~ is a complement operation in the regular expression, and I is a special operator representing that the path remains unchanged before and after the change. In addition, the rule description between the first path set and the second path set can be a symbol corresponding to the inclusion relationship between the first path set and the second path set. For example, in the case where the first path set and the second path set are the same, "==" can be used for description.

[0036] In the case that the first node and the last node are the same among multiple paths in the above regular expression, the above regular expression can include one or more of the following: an operator describing that the path of the data flow entering the first node is unchanged, an operator describing a path relationship transformation, an operator describing that the path of the data flow leaving the last node is unchanged, and an operator describing that the data flow remains unchanged through other paths except the path to be changed. For example, assuming a network change scenario, as shown in FIGS. 2a-2b, there are four routers (A, B, C, and D) and links therebetween, and other devices in the network are not shown. A network administrator wants to change the configurations of router A, router B, and router C. The network administrator sets up internal device communication, organization, and control to manage the entire network (for example, making a change on C to pass a data flow so that C can reach D, making a change on A to forward the data flow to C instead of B, and setting up a blacklist on B) so that all flows originally reaching D from A via B are changed to reach D from A via C. FIGS. 2a-2b show a flow f and its paths before and after the change. Before the change, f enters A from other parts of the network, A forwards it to B, B forwards it to D, and D forwards it to other routers. After the change, the path of f is expected to be changed to A-C-D. In particular, the change does not want to change the path of f entering A and the path of f leaving D. In the above network change scenario, it can be seen that a simple change intention described in natural language is quite complex, and embodiments of the present disclosure can convert the first change intention described in natural language into a second change intention described in formal language, which can be accurately and concisely expressed as: *:(preState>|I(.*)r1 I(.*)|r2)==postState

[0037] That is, for any flow (the * before the colon), the path before the change (preState) should be equal to the path after the change (==) after the path relationship (I(.*)r1 I(.*)|r2) is applied. Here, the path relationship includes the two parts mentioned above. I(.*)r1 I(.*) indicates that the path entering A is unchanged (i.e., the first I(. )), ABD is changed to ACD (i.e., r1), and the path leaving D is unchanged (i.e., the second I(. )), and r2 indicates that if the path of the flow does not pass through ABD, the path remains unchanged.

[0038] Since the finite state transducer is a kind of directed graph, which is composed of a set of states and transitions between states, each state can represent a certain specific language unit or symbol, and the transition between states represents the relationship between these units and symbols, and the deterministic FST has only one possible transition path when given input, based on this, the embodiment of the disclosure verifies the network change scheme using the FST. In a possible implementation manner, according to the first path set and the second path set, verifying the target network change scheme includes: S21, taking the path set of the target data flow before the target network change in the first path set determination process and the second change intention as inputs of the finite state transducer, generating a first finite state transducer; S22, taking the second path set as inputs of the finite state transducer, generating a second finite state transducer; S23, verifying the target network change scheme according to the first finite state transducer and the second finite state transducer. That is, the first finite state transducer and the second finite state transducer can automatically verify whether a network change scheme conforms to the change intention without manually checking each path, which has high implementation difficulty (there can be a large number of paths in any flow in the network, and it is difficult to successfully manually check each path), and thus the technical effect of improving the network change verification efficiency is achieved.

[0039] In a possible implementation manner, taking the path set of the target data flow before the target network change in the first path set determination process and the second change intention as inputs of the finite state transducer to generate the first finite state transducer includes: determining a target state of the first finite state transducer through the path set of the target data flow before the target network change and the first path set; and determining the first finite state transducer according to conditions that should be met for state transition on edges between adjacent states of the target state according to the second change intention. For example, as shown in FIG. 3, the FST includes four states (S1 to S4), wherein S1 is a start state and S4 is an accept state. Each edge is marked with a condition that should be met for state transition. For example, S1 needs to be changed to S2, the first hop of the path before the change is A, and the first hop of the path after the change is also A. S2 needs to be changed to S3, the second hop of the path before the change is B, and the second hop of the path after the change is C, and S3 needs to be changed to S4, the third hop of the path before the change is D, and the third hop after the change is also D.

[0040] After the first finite state machine and the second finite state machine are determined, the target network change scheme can be verified according to the first finite state machine and the second finite state machine. The verification can include: S31, judging the equivalence of the first finite state machine and the second finite state machine; S32, if the equivalence of the first finite state machine and the second finite state machine is no, determining that the verification result of the target network change scheme is not passed. Optionally, in the embodiment of the present disclosure, the equivalence judgment can be to judge whether the states and the edges between the states of the first finite state machine and the second finite state machine are the same. Specifically, when the states of the first finite state machine and the second finite state machine are the same, but the edges of the first finite state machine are one more than those of the second finite state machine, it is considered that the verification is not passed. Or, when the edges of the first finite state machine and the second finite state machine are the same, but the states of the first finite state machine are one more than those of the second finite state machine, it is also considered that the verification is not passed. For example, assuming that the path set before the data flow f is changed is {ABD, Z}, the path set after the data flow f is changed is {ACD}, and the second change intention is: preState |> I(. *) r1 I(. *) | r2, where the pre-change path (preState) corresponds to the FST (first FST) after the action of the path relationship (I(. *) r1 I(. *) | r2) as shown in FIG. 4a. Wherein I(. *) r1 I(. *) means that the path entering A does not change (i.e. the first I(. *)), ABD changes to ACD (i.e. r1), and the path after leaving D does not change (i.e. the second I(. *)). R2 specifies that if the path of the flow does not pass through ABD, the path remains unchanged. Then the changed FST (second FST) is as shown in FIG. 4b. The equivalence of the two FSTs is verified. Since the FST in FIG. 4a has one more S1->S4 edge than the FST in FIG. 4b, they are not equivalent. Therefore, it is determined that the verification is not passed.

[0041] In summary, the embodiments of the present disclosure can accurately help network managers to describe the intention of network change and automatically verify whether a change conforms to the intention of change, thereby avoiding potential change errors in advance and improving network stability.

[0042] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to select authorization or refusal.

[0043] The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the foregoing technical problems will be described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0044] Corresponding to the application scenarios of the method provided by the embodiments of the present disclosure and the method, the embodiments of the present disclosure also provide a network changing method, as shown in FIG. 5, including S502 to S504.

[0045] S502, using the network changing verification method described above, verifying the network changing scheme in the simulation network environment. Specifically, after receiving the first changing intention of the user input for changing the target network, a second changing intention is generated according to the first changing intention, wherein the first changing intention is a changing intention described using natural language, and the second changing intention is a changing intention described using formal language; a first path set and a second path set are determined, wherein the first path set is a path set calculated after the second changing intention acts on the path set of the target data flow before the target network is changed, and the second path set is the path set of the target data flow after the target network is actually changed according to the second changing intention; and the target network changing scheme is verified according to the first path set and the second path set. That is, the present disclosure can describe a network changing intention through formal language (intention language). Compared with describing the changing intention through natural language, the present disclosure can more accurately and concisely define a changing intention. In addition, the present disclosure can automatically and efficiently verify the network changing scheme according to the first path set and the second path set, thereby solving the problem of low efficiency and correctness caused by manually verifying the network changing in the related art.

[0046] S504, in the case of passing the verification, applying the network changing scheme to the real network environment.

[0047] Through the above steps S502 to S504, the network changing scheme in the simulation network environment is verified using the network changing verification method, and in the case of passing the verification, the network changing scheme is applied to the real network environment. The network stability problems that may occur, such as the network address cannot be sent out, the service cannot be accessed due to the recycling of others' network address, etc., are effectively reduced or avoided.

[0048] Corresponding to the application scenario of the method and the method provided in the embodiments of the present disclosure, the embodiments of the present disclosure further provide a network change verification device. As shown in FIG. 6, a structural block diagram of a network change verification device according to an embodiment of the present disclosure is shown. The device can include a generation module 62, a determination module 64, and a first verification module 66.

[0049] The generation module 62 is configured to generate a second change intention according to a first change intention input by a user after receiving the first change intention, wherein the first change intention is a change intention described in natural language, and the second change intention is a change intention described in formal language. It should be noted that the user can be a network administrator. The change intention is the effect that the network administrator expects to achieve by changing the network. The target network can be a simulation network environment determined by modeling a real network. Alternatively, after the network administrator inputs the first change intention described in natural language, the embodiments of the present disclosure can automatically generate a second change intention described in formal language (i.e., an intention language, a formal language used to describe the expectations of the network administrator on the network behavior and rules) corresponding to the first change intention. This provides an efficient and flexible change intention generation method, and also standardizes the description of change intentions by different network administrators. Of course, for experienced network administrators, the embodiments of the present disclosure can directly receive a change intention described in the above-mentioned intention language by the network administrator. The description of the intention language and the rule description can be saved in a specified database. When a network change intention needs to be described in the intention language, the description of the intention language and the description of the rules can be called from the specified database. When the intention language is updated, the database can be updated.

[0050] The determination module 64 is configured to determine a first path set and a second path set, wherein the first path set is a path set calculated after the path set of the target data flow before the target network is changed via the second change intention, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention. It should be noted that the target data flow can be all data flows flowing through the path before the change, or part of the data flows flowing through the path before the change. For example, for all data flows flowing through the path before the change, part of the data flows are specified to change the path. Alternatively, the second change intention at least includes a path relationship, so that the path set of the target data flow before the target network is changed via the path relationship can calculate a theoretically changed path set. Of course, the first path set and the second path set, and the path set of the target data flow before the change can also only include one path. The path set of the target data flow before the change of the target network and the second path set can be obtained from a simulator of the target network.

[0051] The first verification module 66 is configured to verify the target network change scheme according to the first path set and the second path set.

[0052] Optionally, in the embodiment of the present disclosure, the target network change scheme can be verified according to the inclusion relationship between the first path set and the second path set. For example, in the case that the first path set and the second path set are the same, it is determined that the target network change scheme is verified, in the case that the first path set and the second path set are completely different or partially different, it is determined that the target network change scheme is not verified, and the network management personnel needs to reconfigure the unreasonable places of the network change scheme. Optionally, in the embodiment of the present disclosure, the determination manner of the inclusion relationship between the first path set and the second path set includes but is not limited to: combining the path set of the target data flow before the target network change, compiling the path description and the relationship description in the second change intention into a finite state transducer (FST) through a compiler, compiling the second path set into a FST through a compiler, checking the equivalence of the two FSTs to verify the target network change scheme. Of course, it can also be other manners of determining the inclusion relationship between the first path set and the second path set by machine, which is not described herein.

[0053] In a possible implementation manner, the generation module 62 includes: an acquisition unit configured to acquire a formal language description corresponding to the first change intention, wherein the formal language description includes: a range description of an expected constraint data flow, a path description of the data flow, a change relationship description of the data flow, and a rule description between the first path set and the second path set; and a determination unit configured to determine the second change intention through the formal language description.

[0054] Optionally, the range description of the expected constraint data flow is a wildcard, the path description of the data flow is based on a regular expression of a node in the target network, the change relationship description of the data flow is based on a regular relationship expression of the path description of the data flow, and the rule description between the first path set and the second path set is a symbol corresponding to the inclusion relationship between the first path set and the second path set. In the case that there are multiple paths in the regular expression with the same first node and last node, the regular relationship expression includes one or more of the following: an operator describing that the path of the data flow entering the first node is unchanged, an operator describing path relationship transformation, an operator describing that the path of the data flow leaving the last node is unchanged, and an operator describing that the data flow keeps unchanged through other paths except the to-be-changed path.

[0055] In one possible implementation, the first verification module 66 includes: a first generation unit, used to generate a first finite state device by taking the path set of the target data flow before the target network change in the first path set determination process and the second change intention as inputs to the finite state device; a second generation unit, used to generate a second finite state device by taking the second path set as inputs to the finite state device; and a verification unit, used to verify the target network change scheme based on the first finite state device and the second finite state device.

[0056] The first generation unit includes a first determination subunit, used to determine the target state of the first finite state device by using the path set of the target data stream before the target network change and the first path set; and a second determination subunit, used to determine the first finite state device by marking the conditions that the state transition should satisfy on the edges between adjacent states of the target state according to the second change intention.

[0057] The verification unit includes: a judgment subunit for judging the equivalence of the first finite state device and the second finite state device; and a third determination subunit for determining that the verification result of the target network change scheme is unsuccessful if the equivalence of the first finite state device and the second finite state device is not found.

[0058] Using the apparatus shown in Figure 6, after receiving a user's input of a first change intention to modify the target network, a second change intention is generated based on the first change intention. The first change intention is described using natural language, and the second change intention is described using formal language. A first path set and a second path set are determined. The first path set is the path set of the target data flow before the network change, calculated after the second change intention is applied. The second path set is the path set of the target data flow after the network is actually modified according to the second change intention. The target network modification scheme is verified based on the first path set and the second path set. In other words, this disclosure can describe a network change intention using formal language (intention language), which allows for a more accurate and concise definition of a change intention compared to using natural language. Furthermore, this disclosure can automatically and efficiently verify the network modification scheme based on the obtained first and second path sets, solving the problem of low efficiency and accuracy caused by manual network change verification in related technologies.

[0059] Corresponding to the application scenarios and methods of the method provided by the embodiments of the present disclosure, the embodiments of the present disclosure further provide an apparatus for network change. As shown in FIG. 7, it is a structural block diagram of an apparatus for network change according to an embodiment of the present disclosure. The apparatus can include a second verification module 72 and an application module 74.

[0060] The second verification module 72 is configured to verify a network change scheme in a simulation network environment by using the method for verifying network change described above. Specifically, after receiving a first change intention of changing a target network input by a user, a second change intention is generated according to the first change intention, wherein the first change intention is a change intention described by using natural language, and the second change intention is a change intention described by using formal language; a first path set and a second path set are determined, wherein the first path set is a path set calculated after the second change intention acts on a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and the target network change scheme is verified according to the first path set and the second path set. That is, the present disclosure can describe a change intention of a network by using formal language (intention language), which can more accurately and concisely define a change intention than using natural language to describe a change intention. In addition, the present disclosure can automatically and efficiently verify a network change scheme according to the first path set and the second path set, thereby solving the problem of low efficiency and correctness caused by manually verifying a network change in the related art.

[0061] The application module 74 is configured to apply the network change scheme to a real network environment if the verification is passed.

[0062] By using the apparatus shown in FIG. 7 and the method for verifying network change described above, the network change scheme in the simulation network environment is verified, and the network change scheme is applied to the real network environment if the verification is passed. This effectively reduces or avoids possible network stability problems, such as network address not being sent out, service being unable to access due to recycling of other network addresses, and the like.

[0063] The functions of each module in each apparatus of the embodiments of the present disclosure can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be described here again.

[0064] Corresponding to the application scenarios and methods of the method provided by the embodiments of the present disclosure, the embodiments of the present disclosure further provide a verification system for network change. As shown in FIG. 8, it is a structural block diagram of a verification system for network change according to an embodiment of the present disclosure. The system can include an input interface 82, a generation module 84, a calculation module 86, and a verifier 88.

[0065] The input interface 82 is configured to receive a first change intention of changing the target network input by a user.

[0066] The generation module 84 is configured to generate a second change intention according to the first change intention, where the first change intention is a change intention described by using natural language, and the second change intention is a change intention described by using formal language. It should be noted that the user can be a network manager. The change intention is an effect of changing the network expected by the network manager. The target network can be a determined simulation network environment by modeling a real network. Alternatively, after the network manager inputs the first change intention described by using natural language, the embodiment of the present disclosure can automatically generate the second change intention described by using formal language (i.e., an intention language, a formal language used to describe the expectation of the network manager on the network behavior and rules) corresponding to the first change intention, thereby providing an efficient and flexible change intention generation manner, and meanwhile, the embodiment of the present disclosure also standardizes the description manner of the change intention by different network managers. Of course, for the experienced network manager, the embodiment of the present disclosure can also directly receive the change intention described by using the intention language by the network manager. The description of the intention language and the rule description can be stored in a specified database, and when a network change intention is needed to be described by using the intention language, the description of the intention language and the description rule can be called from the specified database. When the intention language is updated, the database can be updated.

[0067] The calculation module 86 is configured to determine a first path set and a second path set, where the first path set is a path set calculated after the path set of the target data flow before the target network is changed and the second change intention is applied, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention. It should be noted that the target data flow can be all data flows flowing through the path before the change, or can be part of the data flows flowing through the path before the change. For example, for all data flows flowing through the path before the change, part of the data flows are specified to change the path. Alternatively, the second change intention at least includes a path relationship, so that the path set of the target data flow before the target network is changed and the path relationship is applied, a theoretically changed path set can be calculated. Of course, the first path set and the second path set, and the path set of the target data flow before the change can also only include one path. The path set of the target data flow before the change of the target network and the second path set can be obtained from a simulator of the target network.

[0068] The verifier 88 is configured to verify the target network change scheme according to the first path set and the second path set. Optionally, in the embodiment of the present disclosure, the target network change scheme can be verified according to the inclusion relationship between the first path set and the second path set. For example, when the first path set and the second path set are the same, it is determined that the target network change scheme is verified, when the first path set and the second path set are completely different or partially different, it is determined that the target network change scheme is not verified, and the network management personnel needs to reconfigure the unreasonable part of the network change scheme. Optionally, in the embodiment of the present disclosure, the determination manner of the inclusion relationship between the first path set and the second path set includes but is not limited to: combining the path set of the target data flow before the target network change, the path description and the relationship description in the second change intention, compiling the second change intention into a finite state transducer (FST) through a compiler, compiling the second path set into an FST through the compiler, and verifying the equivalence of the two FSTs to verify the target network change scheme. Of course, other manners of determining the inclusion relationship between the first path set and the second path set through a machine can also be used, which are not described herein.

[0069] According to the apparatus shown in FIG. 8, after receiving a first change intention of changing the target network input by a user, a second change intention is generated according to the first change intention, where the first change intention is a change intention described in a natural language, and the second change intention is a change intention described in a formal language; a first path set and a second path set are determined, where the first path set is a path set of a target data flow before the target network change, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; and the target network change scheme is verified according to the first path set and the second path set. That is, the present disclosure can describe a network change intention through a formal language (intention language), which can more accurately and concisely define a change intention compared with describing a change intention in a natural language. In addition, the present disclosure can automatically and efficiently verify a network change scheme according to the first path set and the second path set, thereby solving the problem of low efficiency and correctness caused by manually verifying a network change in the related art.

[0070] The functions of each module in each system in the embodiments of the present disclosure can be referred to the corresponding description in the above method, and has the corresponding beneficial effects, which are not described herein.

[0071] FIG. 9 is a block diagram of an electronic device used to implement embodiments of the present disclosure. As shown in FIG. 9, the electronic device includes a memory 901 and a processor 902, and the memory 901 stores a computer program executable on the processor 902. The processor 902 implements the method in the above embodiments when executing the computer program. The number of the memory 901 and the processor 902 can be one or more.

[0072] The electronic device further includes a communication interface 903 for communicating with external devices and transmitting data.

[0073] If the memory 901, the processor 902 and the communication interface 903 are independently implemented, the memory 901, the processor 902 and the communication interface 903 can be connected to each other through a bus and complete communication therebetween. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or only one type of bus.

[0074] Optionally, in a specific implementation, if the memory 901, the processor 902 and the communication interface 903 are integrated on a chip, the memory 901, the processor 902 and the communication interface 903 can complete communication therebetween through an internal interface.

[0075] Embodiments of the present disclosure provide a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the method provided in the embodiments of the present disclosure.

[0076] Embodiments of the present disclosure also provide a chip, which includes a processor for calling and running instructions stored in a memory, so that a communication device installed with the chip executes the method provided in the embodiments of the present disclosure.

[0077] Embodiments of the present disclosure also provide a chip, which includes an input interface, an output interface, a processor and a memory, and the input interface, the output interface, the processor and the memory are connected through an internal connection path. The processor is configured to execute code in the memory, and when the code is executed, the processor is configured to execute the method provided in the embodiments.

[0078] It is to be understood that the above-mentioned processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. It is to be noted that the processor can be a processor supporting an advanced RISC machine (ARM) architecture.

[0079] Further, the memory can include a read-only memory and a random access memory, optionally. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. The non-volatile memory can include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can include a random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available. For example, a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a SyncLink DRAM (SLDRAM), and a direct Rambus RAM (DR RAM) can be used.

[0080] In the above-described embodiments, all or part can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed by a computer, all or part generates the flow or function according to the present disclosure. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium.

[0081] In the description of the present disclosure, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. Also, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, different embodiments or examples described in the present disclosure and features of different embodiments or examples can be combined and combined by those skilled in the art without contradiction.

[0082] In addition, the terms "first", "second", etc. are used only for the purpose of description and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "a plurality of" is two or more, unless otherwise explicitly specified.

[0083] Any process or method described in the flowchart or otherwise described herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing specific logic functions or steps. And the scope of the preferred embodiments of the present disclosure includes additional implementations in which the functions can be performed in an order other than that shown or discussed, including functions performed in a substantially simultaneous manner or in reverse order according to the functions involved.

[0084] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing the logic function, which can be specifically implemented in any computer-readable medium for instruction execution system, device or equipment, such as computer-based system, system including processor or other system that can take instructions from instruction execution system, device or equipment and execute instructions, or in conjunction with these instructions execution system, device or equipment.

[0085] It should be understood that each part of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above-mentioned embodiment method can be completed by a program instructing the relevant hardware, which can be stored in a computer readable storage medium, and the program includes one of the steps of the method embodiment or a combination thereof when executed.

[0086] In addition, each functional unit in various embodiments of the present disclosure can be integrated into one processing module, or each unit can exist physically independently, or two or more units can be integrated into one module. The above integrated module can be realized in the form of hardware or in the form of a software functional module. The above integrated module, if realized in the form of a software functional module and sold or used as an independent product, can also be stored in a computer readable storage medium. The storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0087] The above is only an exemplary embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art can easily think of various changes or replacements within the technical range disclosed in the present disclosure, which should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A method for verifying network change, comprising: generating a second change intention according to a first change intention after receiving the first change intention input by a user, wherein the first change intention is a change intention described in natural language, and the second change intention is a change intention described in formal language; determining a first path set and a second path set, wherein the first path set is a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; verifying a target network change scheme according to the first path set and the second path set.

2. The method of claim 1, wherein, The generating of the second change intention according to the first change intention comprises: obtaining a formal language description corresponding to the first change intention, wherein the formal language description comprises: a range description of an expected constraint data flow, a path description of the data flow, a change relationship description of the data flow, and a rule description between the first path set and the second path set; determining the second change intention through the formal language description.

3. The method of claim 2, wherein, The range description of the expected constraint data flow is a wildcard, the path description of the data flow is based on a regular expression of a node in the target network, the change relationship description of the data flow is based on a regular relationship expression of the path description of the data flow, and the rule description between the first path set and the second path set is a symbol corresponding to an inclusion relationship between the first path set and the second path set.

4. The method of claim 3, wherein, In a case where a plurality of paths in the regular expression have the same first node and last node, the regular relationship expression comprises one or more of the following: an operator describing a path unchanged when the data flow enters the first node, an operator describing a path relationship transformation, an operator describing a path unchanged when the data flow leaves the last node, and an operator describing that the data flow remains unchanged through paths other than a to-be-changed path.

5. The method according to any one of claims 1 to 4, wherein, The verifying of the target network change scheme according to the first path set and the second path set comprises: determining a first finite state machine by taking the path set of the target data flow before the target network is changed and the second change intention as inputs of the finite state machine during the determination of the first path set; determining a second finite state machine by taking the second path set as an input of the finite state machine; verifying the target network change scheme according to the first finite state machine and the second finite state machine.

6. The method of claim 5, wherein, The determination of the first finite state machine by taking the path set of the target data flow before the target network is changed and the second change intention as inputs of the finite state machine during the determination of the first path set comprises: determining a target state of the first finite state machine through the path set of the target data flow before the target network is changed and the first path set. According to the second change intention, conditions that should be met by state transition on edges between adjacent states of the target state are marked, and the first finite state machine is determined.

7. The method of claim 6, wherein, According to the first finite state machine and the second finite state machine, the target network change scheme is verified, including: determining equivalence of the first finite state machine and the second finite state machine; if the equivalence of the first finite state machine and the second finite state machine is no, determining that the verification result of the target network change scheme is failed.

8. A network change method, comprising: verifying a network change scheme in a simulation network environment by using the method in any one of claims 1 to 7; and applying the network change scheme to a real network environment if the verification is passed.

9. A network change verification system, comprising: an input interface configured to receive a first change intention of a target network input by a user; a generation module configured to generate a second change intention according to the first change intention, wherein the first change intention is a change intention described by using natural language, and the second change intention is a change intention described by using formal language; a calculation module configured to determine a first path set and a second path set, wherein the first path set is a path set of a target data flow before the target network is changed, and the second path set is a path set of the target data flow after the target network is actually changed according to the second change intention; a verifier configured to verify the target network change scheme according to the first path set and the second path set.

10. An electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method in any one of claims 1 to 7 or claim 8 when executing the computer program.

11. A computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method in any one of claims 1 to 7 or claim 8.

12. A computer program product, comprising computer instructions, wherein the computer instructions are executed by a processor to implement the method in any one of claims 1 to 7 or claim 8.

Images