WO2020207051A1 - 网络验证的方法和装置 - Google Patents

网络验证的方法和装置 Download PDF

Info

Publication number
WO2020207051A1
WO2020207051A1 PCT/CN2019/127244 CN2019127244W WO2020207051A1 WO 2020207051 A1 WO2020207051 A1 WO 2020207051A1 CN 2019127244 W CN2019127244 W CN 2019127244W WO 2020207051 A1 WO2020207051 A1 WO 2020207051A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
network
configuration data
configuration
network devices
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/127244
Other languages
English (en)
French (fr)
Inventor
邢超
徐科科
陈颖
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP19924113.4A priority Critical patent/EP3890243B1/en
Publication of WO2020207051A1 publication Critical patent/WO2020207051A1/zh
Priority to US17/360,028 priority patent/US11909744B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/085—Retrieval of network configuration; Tracking network configuration history
    • H04L41/0853—Retrieval of network configuration; Tracking network configuration history by actively collecting configuration information or by backing up configuration information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0866—Checking the configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0866—Checking the configuration
    • H04L41/0873—Checking configuration conflicts between network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0883—Semiautomatic configuration, e.g. proposals from system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/12—Discovery or management of network topologies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/42—Centralised routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04—Network management architectures or arrangements
    • H04L41/045—Network management architectures or arrangements comprising client-server management architectures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H04L41/082—Configuration setting characterised by the conditions triggering a change of settings the condition being updates or upgrades of network functionality
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements

Definitions

  • This application relates to the field of information technology, and more specifically, to a method and device for network verification.
  • Network simulation technology is a simulation technology that obtains network performance data required for network design or optimization by establishing network models and simulating the transmission of network traffic. Mainly used in the development and evaluation of new network protocols and network equipment and network planning and design. Network simulation can quickly establish a network model and easily modify the model. It is suitable for predicting network performance, capacity planning, fault analysis, end-to-end performance analysis, and guiding new network construction.
  • network simulation software usually provides various configuration data data. Model, the operation and maintenance personnel can fill in the configuration data of the real network to be simulated in the data model of the configuration data to establish a network model.
  • the aforementioned network simulation software has poor scalability, that is, the time for the network simulation software to update the data model of the configuration data is relatively lagging, usually after a long period of time after the new network equipment is put into use. In this way, before the network simulation software adds the data model of the configuration data of the new network device, the operation and maintenance personnel cannot simulate the real network containing the new network device through the network simulation software.
  • This application provides a network verification method and device to improve the scalability of the network verification system.
  • a network verification method which includes: a network verification system obtains configuration data of multiple network devices, wherein the data model of the configuration data is described by a general data modeling language independent of the network device; The network verification system verifies the data links between the multiple network devices according to the configuration data of the multiple network devices and the topology structure between the multiple network devices.
  • the network verification system can verify the data links between multiple network devices based on configuration data described in a general data modeling language that has nothing to do with network devices, and the topology of multiple network devices. It helps to improve the scalability of the network verification system. It avoids the provision of a template for the configuration data of each network device in the traditional network simulation software, which leads to poor scalability of the network simulation software.
  • the network verification system performs a check on the data link between the multiple network devices according to the configuration data of the multiple network devices and the topology structure between the multiple network devices.
  • Path verification includes: the network verification system calculates a route according to the configuration data of the multiple network devices and the topology structure between the multiple network devices, and the routing and forwarding entries of the multiple network devices The network verification system verifies the data link between the multiple network devices according to the routing and forwarding entries of the multiple network devices.
  • routing forwarding entries are directly generated based on the configuration data of multiple network devices, and the data link of the network is verified based on the routing forwarding entries, which is beneficial to simplify the process of obtaining routing forwarding entries. Avoiding the transmission of the data link process, the network device needs to perform routing learning based on configuration data (for example, IP address) to obtain routing forwarding entries.
  • configuration data for example, IP address
  • the data model includes general data attributes of the configuration data and extensible data attributes of the configuration data.
  • the extensible data attributes can be associated with data attributes that are not added in the data model, such as vendor private attributes.
  • Common data attributes include common data attributes.
  • common data attributes can include one or more of the following data attributes: configuration name, device type, device interface, device Internet protocol address, IP address, or virtual private network routing. Published vrf.
  • the configuration data of the multiple network devices includes the configuration data of the first network device
  • the method further includes: the network verification system performs the verification on the first network device according to the configuration data of the first network device.
  • the network device performs configuration verification, where the configuration verification refers to verifying any one or more data attributes in the data model of the configuration data of the first network device.
  • the aforementioned first network device may be any one of a plurality of network devices.
  • the network verification system can perform configuration verification based on the data model of the configuration data of the first network device to simplify the configuration verification process. It avoids the traditional configuration verification process, because different data attributes in the configuration data are carried in different YANG models, so when the data attributes of multiple configuration data are to be verified, the YANG models based on multiple data attributes need to be verified separately .
  • the data model of the configuration data is the configuration data required to verify the configuration of the network.
  • a data model of configuration data can be used to verify what is required for configuration verification, which is beneficial to simplify the process of obtaining configuration data. It avoids the use of different types of configuration data in the traditional YANG model to be carried in different YANG models.
  • the aforementioned general data attributes include common data attributes required for data link verification on the network, or the general data attributes include common data attributes required for configuration verification on the network.
  • the above method simplifies the process of network verification by integrating data attributes required for data link verification in a data template, or configuring data attributes required for verification. It avoids the traditional verification process, because different data attributes in the configuration data are carried by different YANG models, so that the network verification usually needs to be verified based on multiple YANG models.
  • the data model of the configuration data is a tree structure.
  • This application uses a tree structure to represent the data model of the configuration data, that is, uses a data model with a similar structure to the YANG model, so that the degree of matching between the data model of the configuration data and the Netconf protocol is the match between the YANG model and the Netconf protocol Similar to the degree, it is helpful to promote the data model of the above configuration data based on the Netconf protocol.
  • the YANG model can be borrowed to transform the performance of the Netconf message, and the data model of the configuration data of this application is combined with the Netconf message to apply and In the current network.
  • the above process of converting the data model of configuration data into Netconf messages can be referred to as "the YANG of the data model of configuration data”.
  • the configuration data includes any one of the following: configuration data to be configured; configuration data that has been configured; configuration data to be updated.
  • This application is based on different types of configuration data, and the corresponding verification process can be divided into “pre-verification process” and “post-verification process”, so that the method of the embodiment of this application can be compatible with verification processes in multiple scenarios.
  • the multiple network devices include a second network device
  • the universal data modeling language is a YANG model
  • the network verification system obtains configuration data of multiple network devices in the network, including: The network verification system receives a network configuration protocol NetConf message, the NetConf message includes configuration data of the second network device, and the configuration data of the second network device is used to configure the second network device , Or update the configuration of the second network device.
  • the above configuration data used to configure the second network device can be understood as the configuration data to be configured above, and the above configuration data used to update the configuration of the second network device can be understood as the above configuration data to be updated. Configuration data.
  • the NetConf message is combined with the data model of the configuration data, which is beneficial to promote the data model of the configuration data of this application with the help of the degree of promotion of the Netconf protocol.
  • a network verification device in a second aspect, includes modules for performing various aspects of the above-mentioned method.
  • a network verification system which includes an input/output interface, a processor, and a memory.
  • the processor is used to control the input/output interface to send and receive information
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the network verification system executes each method in the above first aspect.
  • a computer program product includes computer program code, which when the computer program code runs on a computer, causes the computer to execute each method in the first aspect.
  • the above computer program code may be stored in whole or in part on a first storage medium, where the first storage medium may be packaged with the processor or separately packaged with the processor, and this application does not specifically limit this .
  • a computer-readable medium stores program code, and when the computer program code runs on a computer, the computer executes the methods in the above aspects.
  • Fig. 1 is a schematic diagram of an SDN network architecture to which an embodiment of the present application is applicable.
  • FIG. 2 is a schematic block diagram of a network verification system 140 according to an embodiment of the present application.
  • Fig. 3 is a schematic flowchart of a network verification method according to an embodiment of the present application.
  • Fig. 4 is a schematic diagram of an organization form of a data model of configuration data in an embodiment of the present application.
  • Fig. 5 is a schematic diagram of the logical structure of a data model of configuration data in an embodiment of the present application.
  • Fig. 6 is a schematic flowchart of a network verification method according to an embodiment of the present application.
  • Fig. 7 is a schematic flowchart of a network verification method according to an embodiment of the present application.
  • Fig. 8 is a schematic diagram of a network verification device according to an embodiment of the present application.
  • Fig. 9 is a schematic diagram of another network verification system according to an embodiment of the present application.
  • the traditional network verification process is based on network simulation software.
  • Multiple data models of configuration data will be configured in the network simulation software to correspond to network devices using data models of different configuration data.
  • this kind of data model based on multiple configuration data is used to describe the network equipment of different manufacturers in order to realize the scheme of simulating the real network, and the scalability is poor.
  • the data model of the configuration data corresponding to a certain network device is not added to the network simulation software, the operation and maintenance personnel cannot accurately simulate the network containing the above-mentioned network device through the network simulation software.
  • this application provides a network verification method, in which the network verification system describes the configuration data of different network devices based on a general model, and decouples the binding relationship between the data model of the configuration data and the network devices to improve The scalability of the network verification system.
  • Fig. 1 is a schematic diagram of an SDN network architecture to which an embodiment of the present application is applicable.
  • the network architecture shown in FIG. 1 includes an application layer 110, a control layer 120, a forwarding layer 130, and a network verification system 140.
  • the application layer (application layer) 110 is used to implement the presentation of network services.
  • the forwarding layer 130 also known as the infrastructure layer (infrastructure layer), is used to implement routing and switching functions.
  • the forwarding layer 130 may include multiple network devices, and the network devices may be switches, routers, and so on.
  • the control layer (control layer) 120 is used to centrally manage the network devices in the forwarding layer 130.
  • the control layer may include an SDN controller, and the SDN controller is the network device in the forwarding layer that is centrally managed.
  • the SDN controller configures corresponding configuration data for each network device.
  • the above-mentioned control layer may configure, modify, and delete configuration data for network devices in the forwarding layer based on the network configuration protocol (Netconf).
  • Networkconf network configuration protocol
  • a network configuration protocol client (Netconf-Client) can be set in the SDN controller
  • a Netconf server (Netconf-Server) can be set in the network device.
  • the SDN controller communicates with the Netconf-Client in the network device through Netconf-Client.
  • -Server communicates to configure, modify, and delete configuration data of network devices based on Netconf.
  • the network verification system 140 is used to verify the configuration or data link of the network device in the forwarding layer.
  • the following describes the architecture of the network verification system of the embodiment of the present application in conjunction with FIG. 2. It should be noted that the network verification system shown in FIG. 2 is only for facilitating the understanding of the solution, and does not limit the solution of the present application.
  • the network verification system can also be in other forms. For example, some functions in the network verification system can be deleted or some functions in the network verification system can be merged according to actual applications.
  • FIG. 2 is a schematic block diagram of a network verification system 140 according to an embodiment of the present application.
  • the network verification system 140 shown in FIG. 2 includes a northbound service application programming interface (API) layer 141, a business layer 142, a core algorithm capability layer 143, a data model 144 for configuration data, a data link model 145, and a southbound Collection module 146.
  • API application programming interface
  • the northbound service API layer 141 is used to provide a service-oriented RESTful (Representational State Transfer) interface for the northbound user interface (UI) or third-party applications to call.
  • RESTful Real-Representational State Transfer
  • the service layer 142 is used to provide functions such as configuration verification, data link verification, and user extension services.
  • the above configuration verification is used to verify the configuration data of the network device, which may specifically include configuration content verification, multiple configuration consistency verification, security policy redundancy or conflict verification, IP conflict detection, planning configuration consistency detection, etc.
  • the configuration content verification is used to verify whether the configuration data content of the network device meets the device specifications/standard requirements.
  • Multi-configuration consistency check is used to verify whether multiple configuration data of the network device configuration in the network are consistent.
  • Security policy redundancy or conflict verification is used to verify whether there are conflicts or redundancy in the security policies related to each network device in the network.
  • IP conflict detection is used to detect whether the configuration data on different network devices have the same IP address by obtaining configuration data from different network devices. If they have the same IP address, then it is considered that there is an IP conflict in the network.
  • Plan configuration consistency check In the Data Communication Network (DCN) scenario, when Zero Touch Provisioning (ZTP) is launched, a plan configuration will be generated according to the user’s needs. This plan configuration is issued to After the device is installed, after the configuration takes effect, it is necessary to verify whether the delivered configuration is consistent with the effective configuration on the network device, and whether it meets the user's planning intention. Specifically, it includes comparing whether the planned configuration data is the same as the generated configuration data, and verifying the reachability of the data link of the entire network based on the generated configuration data, and displaying the on-off status of the data link in the network to the user.
  • DCN Data Communication Network
  • ZTP Zero Touch Provisioning
  • the above data link verification is used to verify the data link in the network, which can specifically include the reachability verification of the data link, the loop check of the data link, the consistency detection of the data link and the black hole of the data link Check etc.
  • the data link reachability verification is used to verify whether the source network device of a certain data link in the network is reachable to the target network device.
  • Data link consistency detection is used to detect whether the data in a data packet transmitted through a data link is consistent before and after transmission.
  • the black hole check of the data link is used to check whether there is a black hole router in the network.
  • the above-mentioned user extension function is used to support users to expand the verification plug-in according to their needs. It usually includes a demand model and a result model.
  • the demand model is used for user-defined input of the question to be verified, and the result model is used for returning the verification result.
  • the core algorithm capability layer 143 is used to provide basic algorithm capabilities. It usually includes configuration verification algorithms, word syntax analysis, routing/topology calculation engines, and satisfiability modulo theories (SMT) solvers.
  • SMT satisfiability modulo theories
  • the configuration verification algorithm is used to verify the configuration data of the network devices in the network. That can be understood as the basic algorithm for configuration verification in the above-mentioned business layer.
  • Word grammar analysis is used to perform word grammatical analysis on the acquired data model of the configuration data and convert it into a general model.
  • the routing/topology calculation engine is used to calculate the routing and forwarding entries used in the network transmission packet in the calculation of the network topology according to the configuration information of the network equipment in the network.
  • the SMT solver can verify the data link in the network through the SMT solver when the above routing and forwarding entries are expressed by a set of first-order logic formulas.
  • the data model 144 of configuration data is used to describe the configuration data of network devices in the network. It usually includes a data model of configuration data collected from the network, that is, a model of configuration data that has been configured for network devices in the network, and a data model of configuration data to be configured for network devices in the network.
  • the data link model 145 is used to describe the model of the data link in the network. For example, it can be a set of first-order logic formulas described above.
  • the southbound collection module 146 is used to collect configuration data of network devices in the network.
  • the aforementioned southbound collection module can be configured with Netconf-Client, so that the southbound collection module 146 can collect configuration data of network devices in the network based on Netconf.
  • network configuration verification system 140 may be deployed in the SDN controller, or separately deployed in the server, which is not limited in the embodiment of the present application.
  • Fig. 3 is a schematic flowchart of a network verification method according to an embodiment of the present application.
  • the method shown in FIG. 3 includes step 310 and step 320.
  • the network verification system obtains configuration data of multiple network devices, where the data model of the configuration data is described by a general data modeling language that has nothing to do with the network device.
  • the configuration data of the aforementioned network device may include the IP address, subnet mask, gateway, port, physical address, and firewall of the network device.
  • the configuration data of the aforementioned multiple network devices may include configuration data that has been configured for the network device, and may also be configuration data to be configured for the network device and configuration data to be updated for the network device.
  • the specific method for the network verification system to obtain the configured configuration data and the configuration data to be configured is described in detail below.
  • the network verification system can directly collect the configuration data from the network equipment. If the data model of the configuration data used by the network equipment of each manufacturer is the data model related to the network equipment, or the data model related to the manufacturer, the data model related to the above network equipment or the data model related to the manufacturer needs to be converted into The above data model has nothing to do with network equipment. Among them, the conversion process between the aforementioned data models can be converted by operation and maintenance personnel, and then input into the aforementioned network verification system.
  • the conversion process of the above-mentioned data model may include: if the network device relies on the Secure Shell (SSH) protocol, the manufacturer characteristic model of the network device can be converted to a general model based on the SSH protocol. The general model is converted to the data model of the embodiment of this application. If the network device supports the Netconf protocol, the configuration data in the network device is converted from the vendor-specific BA (Binding-Aware) model to the BI YANG model, and then the BI (Binding-Independent) YANG model is converted to the embodiment of this application Data model.
  • SSH Secure Shell
  • the BA model refers to a plug-in that uses Java Bindings automatically generated according to the definition of the YANG model
  • the BI model refers to an application programming interface in the format of Document Object Model (Document Object Model, DOM), (Application Programming Interface, API) does not rely on Java Bindings plug-ins.
  • the data model of the configuration data includes general data attributes of the configuration data and extensible data attributes of the configuration data.
  • the extensible data attributes can be associated with data attributes not added in the data model or private attributes of network equipment, such as vendor private attributes.
  • Common data attributes include commonly used data attributes.
  • the common data attributes include common data attributes required for data link verification on the network, or the common data attributes include common data attributes required for configuration verification on the network.
  • the data model of the configuration data used in the embodiments of this application is similar to the principle of the YANG model, but the data model through the configuration data contains the configuration data required to verify the data link of the network, or contains the configuration of the network.
  • the configuration data required for verification allows data link verification to be obtained through a data model of configuration data, or configuration data required for configuration verification, which is beneficial to simplify the process of obtaining configuration data. It avoids the use of different types of configuration data in the traditional YANG model to be carried in different YANG models.
  • the traditional YANG model uses a separate YANG model for configuration data such as access control lists and device interfaces.
  • FIG. 4 is a schematic diagram of an organization form of a data model of configuration data in an embodiment of the present application.
  • FIG. 4 only introduces the data model of the embodiment of the present application from the perspective of easy understanding, and the true logical structure of the data model is shown in FIG. 5.
  • the data model shown in FIG. 4 includes general data attributes 410 and extensible data attributes 420.
  • the general data attributes 410 include configuration name, device type, device interface, device IP address, virtual private network routing and forwarding table (virtual private network routing and forwarding table, vrf), security domain, device manufacturer, and so on.
  • Extensible data attributes 420 include extended value attributes and extended private attributes.
  • extended value data can be understood as data attributes with extended value, that is, data attributes that are not included in the current data model but are subsequently considered to be added to the data model, such as device authentication information.
  • the extended private attributes include device-related private data attributes and vendor-private data attributes.
  • the data model of the configuration data is a tree structure.
  • the configuration data in the above data model can be stored in the node of the attribute structure.
  • the expandable data attribute corresponds to the path of the configuration data of the expandable data attribute, and the path points to the path of the configuration data of the expandable data attribute stored in the tree structure. node.
  • the expandable data attribute is the authentication information of the device.
  • the expandable data attribute can correspond to the path of the device authentication information, and the path can point to the storage device authentication information in the tree structure. node.
  • the data model has a tree-shaped hierarchical structure, so the data model of configuration data is also called "configuration tree".
  • the configuration tree includes a root node 501 and multiple leaf nodes 502.
  • the root node 501 is used to identify the entire configuration tree.
  • the leaf node 502 is used to carry all the atomic configuration data in the data template. It carries the configuration name, device type, device interface, device IP address, vrf, security domain, device manufacturer, etc.
  • a tree structure is used to represent the data model of the configuration data, that is, a structural data model similar to the YANG model is used, so that the matching degree between the data model of the configuration data and the Netconf protocol is comparable to the YANG model and the Netconf protocol.
  • the degree of matching between them is similar, which is conducive to popularizing the data model of the configuration data based on the Netconf protocol.
  • the YANG model can be borrowed to convert the performance of the Netconf message, and the data model of the configuration data of the embodiment of the application can be compared with the Netconf message. Combine it with the current network.
  • the above process of converting the data model of configuration data into Netconf messages can be referred to as "the YANG of the data model of configuration data”.
  • the network verification system verifies the data link between the multiple network devices according to the configuration data of the multiple network devices and the topology structure of the multiple network devices.
  • the network verification system may perform data link verification on the network based on configuration data described in a general data modeling language that is not related to network equipment, and the topology of the network. Conducive to improving the scalability of the network verification system. It avoids the provision of a template for the configuration data of each network device in the traditional network simulation software, which leads to poor scalability of the network simulation software.
  • the above step 320 includes: the network verification system calculates a route according to the configuration data of the multiple network devices and the topology structure between the multiple network devices, and the routes of the multiple network devices Forwarding entries; the network verification system verifies the data links between the multiple network devices according to the routing and forwarding entries of the multiple network devices.
  • routing forwarding entries are directly generated based on the configuration data of multiple network devices, and the data link of the network is verified based on the routing forwarding entries, which is beneficial to simplify the process of obtaining routing forwarding entries. Avoiding the transmission of the data link process, the network device needs to perform routing learning based on configuration data (for example, IP address) to obtain routing forwarding entries.
  • configuration data for example, IP address
  • routing and forwarding entries of the foregoing multiple network devices may be represented by multiple first-order logic expressions.
  • multiple first-order logic expressions can be used to express the routing and forwarding entries of data transmitted in the network, and the process of verifying the data link of the network can be understood as the route forwarding described by the multiple first-order logic expressions.
  • the published item is used as the constraint condition of the transmission message, and then the transmission state of the message in the network is simulated by the state machine to verify the data link in the network.
  • the configuration data of the aforementioned network device may be configuration data that has been configured for the network device, or configuration data to be configured for the network device.
  • the verification process based on the configured configuration data can be referred to as "post verification”
  • the verification process based on the configuration data to be configured or the configuration data to be updated can be referred to as "pre-verification”.
  • FIG. 6 is a schematic flowchart of a network verification method according to an embodiment of the present application. The method shown in FIG. 6 includes step 510 to step 540.
  • the network verification system collects configuration data of multiple network devices from the network (or "real network").
  • the network verification system may send a Netconf-get request to the network device to obtain configuration data from the network device.
  • the format of the above configuration data is the YANG model.
  • the network verification system can also obtain the configuration data of the network device through other commands. For example, if the above network supports the virtual system (Vsys) function, it can also use the configuration data acquisition command (get-config) in Vsys.
  • the configuration data is acquired, which is not limited in the embodiment of the present application.
  • the network verification system obtains the topology structures of multiple network devices.
  • topology may be manually input by the user to the network verification system, or it may be collected from the network by the network verification system based on Netconf, which is not limited in this embodiment of the application.
  • the network verification system obtains routing and forwarding entries of multiple network devices based on the topology structure of multiple network devices and the configuration data of multiple network devices.
  • the network verification system verifies the data link between the multiple network devices according to the routing and forwarding entries of the multiple network devices.
  • FIG. 7 is a schematic flowchart of a network verification method according to an embodiment of the present application. The method shown in FIG. 7 includes step 610 to step 640.
  • the network verification system obtains configuration data to be configured or configuration data to be updated.
  • the configuration data to be configured may be configuration data to be configured for one network device, or configuration data to be configured for multiple network devices.
  • the aforementioned configuration data to be updated may be configuration data to be configured for one network device, or configuration data to be updated for multiple network devices.
  • the configuration data to be configured or the configuration data to be updated can be configured by the controller (for example, SDN controller) in the network for the network device, and the network verification system can be before the controller configures the network device or updates the configuration data.
  • the controller for example, SDN controller
  • the network verification system can be before the controller configures the network device or updates the configuration data.
  • the controller configures configuration data for the network device based on the Netconf protocol, and the configuration data to be updated or the configuration data to be configured obtained by the network verification system from the controller are of the YANG model.
  • the network verification system obtains the topology structures of multiple network devices.
  • topology may be manually input by the user to the network verification system, or it may be collected from the network by the network verification system based on Netconf, which is not limited in this embodiment of the application.
  • the network verification system obtains routing and forwarding entries of multiple network devices based on the topology structures of multiple network devices and the configuration data of multiple network devices.
  • the network verification system verifies the data link between the multiple network devices according to the routing and forwarding entries of the multiple network devices.
  • the network verification system of the embodiment of the present application can also perform configuration verification on the network with the configuration data to be configured or the configuration data already configured in the network. That is, the configuration data of the multiple network devices includes the configuration data of the first network device, and the method shown in FIG. 3 further includes: the network verification system performs the verification on the first network device according to the configuration data of the first network device.
  • a network device performs configuration verification, where the configuration verification refers to verifying any one or more data attributes in the data model of the configuration data of the first network device.
  • the above-mentioned first network device may be any one of a plurality of network devices.
  • the above method can also be used to verify the configuration of multiple network devices at the same time. Since the verification method is similar to the above method for verifying the configuration of the first network device, for the sake of brevity, details are not repeated here.
  • the configuration data is configured configuration data or configuration data to be configured, it can be divided into scenarios of "post-verification” and "pre-verification".
  • the method of obtaining configuration data can be referred to the introduction in FIG. 6 and FIG.
  • Figure 7 describes the verification process of the data link of the embodiment of the present application.
  • configuration data of the data model carried in the configuration data of the embodiment of the present application can also be used for network configuration.
  • For verification refer to the related introduction in Figure 1 for the specific configuration of the verification type. For brevity, details are not described here.
  • the above configuration verification process can be combined with the "pre-verification” and “post-verification” shown in Figure 6 and Figure 7 above.
  • the configuration verification process can be used after the data link verification, or before the data link, or used independently of the data link verification.
  • the embodiment of the application does not specifically limit this.
  • FIGS. 1 to 7 The method of the embodiment of the present application is described above with reference to FIGS. 1 to 7, and the device of the embodiment of the present application is described below with reference to FIGS. 8 to 9. It should be understood that some or all of the steps in FIG. 3, FIG. 6 and FIG. 7 can be performed in FIGS. 8-9, which are not repeated here for brevity.
  • FIG. 8 is a schematic diagram of a network verification device according to an embodiment of the present application.
  • the device 800 shown in FIG. 8 includes an input and output module 810 and a processing module 820.
  • the input and output module 810 is used to obtain configuration data of multiple network devices, where the data model of the configuration data is described by a general data modeling language that has nothing to do with network devices;
  • the processing module 820 is configured to verify the data link between the multiple network devices according to the configuration data of the multiple network devices and the topology structure between the multiple network devices.
  • the processing module 820 is configured to calculate routes according to the configuration data of the multiple network devices and the topology structure among the multiple network devices to obtain the Routing and forwarding entries; and verifying data links between the multiple network devices according to the routing and forwarding entries.
  • the data model of the configuration data includes the general data attributes of the configuration data and the extensible data attributes of the configuration data, wherein the general data attributes include the following data attributes One or more of: configuration name, device type, device interface, device Internet Protocol address, IP address, or virtual private network routing and forwarding table vrf, and the expandable data attributes include private data attributes.
  • the data model of the configuration data is a tree structure
  • the expandable data attribute in the data model is a path for storing the expandable data attribute, and the path is used to point to The node of the expandable data attribute is stored in the tree structure.
  • the configuration data of the plurality of network devices includes the configuration data of the first network device
  • the processing module 820 is further configured to perform data processing on all the network devices according to the configuration data of the first network device.
  • the first network device performs configuration verification, where the configuration verification refers to verifying any one or more data attributes in the data model of the configuration data of the first network device.
  • the configuration data is any one of the following: configuration data to be configured; configuration data that has been configured; configuration data to be updated.
  • the multiple network devices include a second network device
  • the general data modeling language is a YANG model
  • the input and output module is further configured to: receive a network configuration protocol NetConf message, so The NetConf message includes configuration data of the second network device, and the configuration data of the second network device is used to configure the second network device or to update the configuration of the second network device.
  • the processing module 810 may be a processor 920
  • the input/output module 820 may be an input/output interface 930
  • the network verification system may further include a memory 910, as shown in FIG. 9 .
  • Fig. 9 is a schematic diagram of another network verification system according to an embodiment of the present application.
  • the network verification system 900 shown in FIG. 9 may include: a memory 910, a processor 920, and a communication interface 930.
  • the memory 910, the processor 920, and the input/output interface 930 are connected through an internal connection path, such as a bus.
  • the memory 910 is used to store instructions
  • the processor 920 is used to execute instructions stored in the memory 920, receive input data and information through the communication interface 930, and output operation results.
  • the foregoing network verification system 900 may include one or more servers, which is not limited in the embodiment of the present application.
  • the steps of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 920 or instructions in the form of software.
  • the method disclosed in combination with the embodiments of the present application may be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory 910, and the processor 920 reads information in the memory 910, and completes the steps of the foregoing method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor 920 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (digital signal processors, DSP), application specific integrated circuits (ASICs), ready-made Field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory may include a read-only memory and a random access memory, and provides instructions and data to the processor.
  • Part of the processor may also include non-volatile random access memory.
  • the processor may also store device type information.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B based on A does not mean that B is determined only based on A, and B can also be determined based on A and/or other information.
  • the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, rather than corresponding to the embodiments of the present application
  • the implementation process constitutes any limitation.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be read by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (DVD)) or a semiconductor medium (for example, a solid state disk (SSD)) )Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Algebra (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Pure & Applied Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种网络验证的方法和装置，该方法包括：网络验证系统获取多个网络设备的配置数据，其中，配置数据的数据模型为与网络设备无关的通用数据建模语言描述的；所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证。上述方法中，网络验证系统可以基于与网络设备无关的通用数据建模语言描述的配置数据，以及多个网络设备的拓扑结构，对多个网络设备之间的数据链路进行验证。有利于提高网络验证系统的可扩展性。避免了传统的网络仿真软件中，提供针对每种网络设备的配置数据的模板，导致网络仿真软件的扩展性较差。

Description

网络验证的方法和装置 技术领域
本申请涉及信息技术领域，并且更具体地，涉及网络验证的方法和装置。
背景技术
网络仿真技术是一种通过建立网络模型,并模拟网络流量的传输,从而获取网络设计或优化所需要的网络性能数据的仿真技术。主要应用在开发和评价新的网络协议和网络设备以及网络规划设计等方面。网络仿真能迅速建立起网络模型,方便地修改模型,适用于预测网络性能、容量规划、故障分析、端到端性能分析、指导新网络建设等。
由于不同厂商生产的网络设备之间配置数据的数据模型存在差异，不同型号的网络设备之间的配置数据的数据模型也可能存在差异，因此，网络仿真软件中通常会提供各种配置数据的数据模型，运维人员可以向配置数据的数据模型中填写待仿真的真实网络的配置数据，以建立网络模型。
然而，上述网络仿真软件的扩展性较差，即网络仿真软件更新配置数据的数据模型的时间比较滞后，通常在新的网络设备投入使用较长的一段时间后。这样，在网络仿真软件添加新的网络设备的配置数据的数据模型天之前，运维人员无法通过网络仿真软件仿真包含新的网络设备的真实网络。
发明内容
本申请提供一种网络验证的方法和装置，以提高网络验证系统的可扩展性。
第一方面，提供了一种网络验证的方法，包括：网络验证系统获取多个网络设备的配置数据，其中，配置数据的数据模型为与网络设备无关的通用数据建模语言描述的；所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证。
上述方法中，网络验证系统可以基于与网络设备无关的通用数据建模语言描述的配置数据，以及多个网络设备的拓扑结构，对多个网络设备之间的数据链路进行验证。有利于提高网络验证系统的可扩展性。避免了传统的网络仿真软件中，提供针对每种网络设备的配置数据的模板，导致网络仿真软件的扩展性较差。
在一种可能的实现方式中，所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证，包括：所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，计算路由得到，所述多个网络设备的路由转发表项；所述网络验证系统根据所述多个网络设备的路由转发表项，对所述多个网络设备之间的数据链路进行验证。
本申请中，基于多个网络设备的配置数据直接生成路由转发表项，并基于路由转发表项对网络的数据链路进行验证，有利于简化得到路由转发表项的过程。避免了传输的数据 链路过程中，网络设备需要基于配置数据(例如，IP地址)进行路由学习，得到路由转发表项。
在一种可能的实现方式中，所述数据模型包括所述配置数据的通用的数据属性以及所述配置数据的可扩展的数据属性。其中，可扩展的数据属性可以关联数据模型中未添加的数据属性，例如厂商私有属性等。通用的数据属性中包括对常用数据属性，例如，通用的数据属性可以包括以下数据属性中的一个或多个：配置名称、设备类型、设备接口、设备互联网协议地址IP地址或虚拟专用网络路由转发表vrf。
上述方法中，一方面通过在数据模型中增加可扩展的数据属性，有利于提高数据模型的可扩展性。另一方面，通过在一个数据模型中包含配置数据的多个常用数据属性，避免了基于传统的YANG模型描述配置数据时，配置数据的不同的数据属性承载于不同的YANG模型中，有利于提高数据模型的描述能力。
可选地，所述多个网络设备的配置数据中包括第一网络设备的配置数据，所述方法还包括：所述网络验证系统根据所述第一网络设备的配置数据，对所述第一网络设备进行配置验证，其中，配置验证是指对所述第一网络设备的配置数据的数据模型中的任意一个或多个数据属性进行验证。
上述第一网络设备可以是多个网络设备中的任意一个网络设备。
上述方法中，网络验证系统可以基于第一网络设备的配置数据的数据模型进行配置验证，以简化配置验证的过程。避免了传统的配置验证过程中，由于配置数据中不同的数据属性承载于不同的YANG模型，导致要对多个配置数据的数据属性进行验证时，需要基于多个数据属性的YANG模型分别进行验证。
可选地，配置数据的数据模型对网络的配置进行验证的所需的配置数据。如此，使得通过一个配置数据的数据模型可以验证进行配置验证所需的，有利于简化获取配置数据的流程。避免了使用传统的YANG模型中不同类型的配置数据承载于不同的YANG模型中。
可选地，上述通用的数据属性中包括对网络进行数据链路的验证所需的常用数据属性，或者通用的数据属性中包括对网络进行配置验证所需的常用数据属性。
上述方法通过在一个数据模板中集成对数据链路进行验证所需的数据属性，或者配置验证所需的数据属性，以简化网络验证的过程。避免了传统的验证过程中，由于配置数据中不同的数据属性承载于不同的YANG模型，导致进行网络验证时通常需要基于多个YANG模型进行验证。
在一种可能的实现方式中，所述配置数据的数据模型为树形结构。
本申请通过使用树形结构表示配置数据的数据模型，即使用与YANG模型相似结构的数据模型，使得配置数据的数据模型与Netconf协议之间的匹配程度，与YANG模型与Netconf协议之间的匹配程度相似，有利于基于Netconf协议推广上述配置数据的数据模型。
另一方面，由于本申请的配置数据的数据模型的结构与YANG模型类型，因此可以借用YANG模型可以转化Netconf报文的性能，将本申请的配置数据的数据模型与Netconf报文结合，应用与目前的网络中。上述将配置数据的数据模型转化为Netconf报文的过程可以称为“配置数据的数据模型的YANG化”。
在一种可能的实现方式中，所述配置数据包括以下任一种：待配置的配置数据；已配置的配置数据；待更新的配置数据。
本申请基于配置数据的类型不同，相应的验证过程可以分为“事前验证过程”以及“事后 验证过程”，使得本申请实施例的方法可以兼容多种场景的验证过程。
在一种可能的实现方式中，所述多个网络设备包括第二网络设备，所述通用数据建模语言为YANG模型，所述网络验证系统获取网络中多个网络设备的配置数据，包括：所述网络验证系统接收网络配置协议NetConf报文，所述NetConf报文中包括所述第二网络设备的配置数据，所述第二网络设备的配置数据用于对所述第二网络设备进行配置，或者对所述第二网络设备的配置进行更新。
上述用于对所述第二网络设备进行配置的配置数据可以理解为上文中待配置的配置数据，上述用于对所述第二网络设备的配置进行更新的配置数据可以理解为上文中待更新的配置数据。
本申请通过NetConf报文与配置数据的数据模型结合，有利于借助Netconf协议的推广程度，推广本申请的配置数据的数据模型。
第二方面，提供了一种网络验证装置，所述网络验证装置包括用于执行上述方法中各个方面的模块。
第三方面，提供了一种网络验证系统，包括输入/输出接口、处理器和存储器。该处理器用于控制输入/输出接口收发信息，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该网络验证系统执行上述第一方面中的各个方法。
第四方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述第一方面中的各个方法。
需要说明的是，上述计算机程序代码可以全部或者部分存储在第一存储介质上，其中第一存储介质可以与处理器封装在一起的，也可以与处理器单独封装，本申请对此不作具体限定。
第五方面，提供了一种计算机可读介质，所述计算机可读介质存储有程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行上述各方面中的方法。
附图说明
图1是本申请实施例适用的SDN网络架构的示意图。
图2是本申请实施例的网络验证系统140的示意性框图。
图3是本申请实施例的网络验证方法的示意性流程图。
图4是本申请实施例的配置数据的数据模型的组织形式的示意图。
图5是本申请实施例的配置数据的数据模型的逻辑结构的示意图。
图6是本申请实施例的网络验证方法的示意性流程图。
图7是本申请实施例的网络验证方法的示意性流程图。
图8是本申请实施例的网络验证装置的示意图。
图9是本申请实施例的另一网络验证系统的示意图。
具体实施方式
下面将结合附图，对本申请的技术方案进行描述。
传统的网络验证过程，都是基于网络仿真软件实现的。网络仿真软件中会配置多个配 置数据的数据模型，以对应使用不同配置数据的数据模型的网络设备。然而，这种基于多种配置数据的数据模型以描述不同厂商的网络设备，以实现对真实网络进行仿真的方案，扩展性较差。当网络仿真软件中未添加某一网络设备对应的配置数据的数据模型时，运维人员则无法通过网络仿真软件准确地对包含上述网络设备的网络进行仿真。
为了避免上述问题，本申请提供一种网络验证方法，在该方法中网络验证系统基于通用模型描述不同网络设备的配置数据，解耦配置数据的数据模型与网络设备之间的捆绑关系，以提高网络验证系统的扩展性。
为了便于理解，先结合图1，以本申请应用于软件定义网络(software defined network，SDN)架构为例，介绍本申请适用的网络架构。需要说明的是，本申请实施例的方法还可以应用其他网络架构。
图1是本申请实施例适用的SDN网络架构的示意图。图1所示的网络架构包括应用层110，控制层120，转发层130以及网络验证系统140。
应用层(application layer)110，用于实现对网络业务的呈现。
转发层130，又称基础设施层(infrastructure layer)，用于实现路由、交换功能。具体地，转发层130可以包含多个网络设备，网络设备可以是交换机、路由器等。
控制层(control layer)120，用于集中管理转发层130中的网络设备，具体地，控制层可以包括SDN控制器，由SDN控制器为集中管理转发层中的网络设备。例如，由SDN控制器为各个网络设备配置相应的配置数据等。
上述控制层可以基于网络配置协议(network configuration protocol，Netconf)为转发层中的网络设备配置、修改、删除配置数据。例如，SDN控制器中可以设置有网络配置协议客户端(Netconf-Client)，网络设备中可以设置有Netconf服务端(Netconf-Server)，这样，SDN控制器通过Netconf-Client与网络设备中的Netconf-Server进行通信，以基于Netconf配置、修改、删除网络设备的配置数据。
网络验证系统140，用于对转发层中的网络设备的配置或者数据链路进行验证。
下文结合图2，介绍本申请实施例的网络验证系统的架构。需要说明的是，图2所示的网络验证系统仅仅为了便于理解方案，并不会对本申请的方案造成限定。网络验证系统还可以是其他形式的，例如，可以根据实际应用，删除网络验证系统中的某些功能，或者合并网络验证系统中的某些功能。
图2是本申请实施例的网络验证系统140的示意性框图。图2所示的网络验证系统140包括北向服务应用程序接口(application programming interface，API)层141，业务层142，核心算法能力层143，配置数据的数据模型144、数据链路模型145以及南向采集模块146。
北向服务API层141，用于对外提供服务化RESTful(Representational State Transfer)接口供北向用户界面(user interface，UI)或者第三方应用调用。
业务层142，用于提供配置验证，数据链路验证以及用户扩展业务等功能。
上述配置验证用于对网络设备的配置数据进行验证，具体可以包括配置内容校验，多配置一致性校验、安全策略冗余或冲突验证、IP冲突检测、规划配置一致性检测等。
其中，配置内容校验，用于验证网络设备的配置数据内容是否符合设备规格/规范要求。
多配置一致性校验，用于验证网络中网络设备配置的多个配置数据是否一致。
安全策略冗余或冲突验证，用于验证网络中各个网络设备相关的安全策略是否存在冲突或者冗余的情况。
IP冲突检测，用于通过从不同的网络设备上获取配置数据，检测不同的网络设备上的配置数据是否具有相同的IP地址，如果具有相同的IP地址，那么就认为网络中存在IP冲突。
规划配置一致性检测，在数据通信网络(Data Communication Network，DCN)场景中，当零接触供应(Zero Touch Provisioning，ZTP)开局时会根据用户的需求生成一份规划配置，这个规划配置在下发到设备上之后，待配置生效之后需要验证下发的配置和网络设备上生效的配置是否一致，是否符合用户的规划意图。具体包括，比较规划配置数据和生成配置数据是否一样，以及基于生成的配置数据对全网的数据链路进行可达性验证，并将网络中数据链路的通断情况显示给用户。
针对这种验证规划配置一致性检测，还有一个场景，就是网络CDN节点选址是否最优的验证，用户规划的CDN节点是否是全网最优，在经过验证引擎验证之后更能给出一个结论或者相对于当前用户的规划更加合理高效的节点选址。
上述数据链路验证用于对网络中的数据链路进行验证，具体可以包括数据链路的可达性验证，数据链路的环路检查，数据链路的一致性检测以及数据链路的黑洞检查等。
其中，数据链路的可达性验证用于验证网络中某一数据链路的源网络设备到目标网络设备是否可达。数据链路的一致性检测，用于检测通过某一数据链路传输的数据包中的数据在传输之前与传输之后是否一致。数据链路的黑洞检查，用于检查网络中是否存在黑洞路由器。上述用户扩展功能用于支持用户根据需求扩充验证插件。通常包括需求模型以及结果模型，其中，需求模型用于用户自定义输入待验证的问题，结果模型用于返回验证结果。
核心算法能力层143，用于提供基础算法能力。通常包括配置校验算法、词语语法解析、路由/拓扑计算引擎，以及可满足性模理论(satisfiability modulo theories，SMT)求解器。
其中，配置校验算法用于对网络中网络设备的配置数据进行校验。即可以理解为，是上述业务层中的配置验证的基础算法。词语语法解析，用于将获取的配置数据的数据模型进行词语语法解析转换成为通用模型。路由/拓扑计算引擎，用于根据网络中网络设备的配置信息，以及网络中的拓扑结构计算中网络传输报文使用的路由转发表项。SMT求解器，在上述路由转发表项用一组一阶逻辑公式表示时，可以通过SMT求解器对网络中的数据链路进行验证。
配置数据的数据模型144，用于描述网络中网络设备的配置数据。通常包括从网络中采集的配置数据的数据模型，即已为网络中网络设备配置的配置数据的模型，以及待为网络中网络设备配置的配置数据的数据模型。
数据链路模型145，用于描述网络中数据链路的模型。例如可以是上述一组一阶逻辑公式。
南向采集模块146，用于采集网络中网络设备的配置数据。通常，上述南向采集模块可以配置有Netconf-Client，以便南向采集模块146可以基于Netconf采集网络中网络设备的配置数据。
需要说明的是，网络配置验证系统140可以部署在SDN控制器中，还可以单独的部署在服务器中，本申请实施例对此不做限定。
下文结合图3介绍本申请实施例的网络验证的方法，需要说明的是，该方法可以由图 1中的网络验证系统140执行，图3所示的方法涉及数据链路验证的方案，可以由网络验证系统中用于数据链路验证的模块配合执行，例如可以由数据链路验证、路由/拓扑计算引擎、以及数据链路模型145等模块配合执行。
图3是本申请实施例的网络验证方法的示意性流程图。图3所示的方法包括步骤310以及步骤320。
310，网络验证系统获取多个网络设备的配置数据，其中，配置数据的数据模型是通过与网络设备无关的通用数据建模语言描述的。
上述网络设备的配置数据可以包括网络设备的IP地址、子网掩码、网关、端口、物理地址以及防火墙(firewall)等。
上述多个网络设备的配置数据可以包括已经为网络设备配置的配置数据，还可以是待为网络设备配置的配置数据以及待为网络设备更新的配置数据。关于网络验证系统获取已配置的配置数据以及待配置的配置数据的具体方式在下文中详细介绍。
需要说明的是，若各个厂商的网络设备使用的配置数据的数据模型都是基于上述数据模型，则网络验证系统可以直接从网络设备中采集配置数据。若各个厂商的网络设备使用的配置数据的数据模型是与网络设备相关的数据模型，或者与厂商相关的数据模型，则需要将上述网络设备相关的数据模型，或者与厂商相关的数据模型转换成上述与网络设备无关的数据模型。其中，上述数据模型之间的转换过程可以由运维人员进行转换，再输入进上述网络验证系统。
上述数据模型的转换过程可以包括：若网络设备是依赖安全外壳(Secure Shell，SSH)协议的，则可以先将网络设备的厂商特性模型转换为基于SSH协议的通用模型，在将基于SSH协议的通用模型转换为本申请实施例的数据模型。若网络设备是支持Netconf协议的，则将网络设备中的配置数据由厂商特性BA(Binding-Aware)模型转换为BI YANG模型，再将BI(Binding-Independent)YANG模型转换为本申请实施例的数据模型。其中，BA模型是指使用根据YANG模型定义而自动生成的Java Bindings的插件(plugin)，BI模型是指使用文件对象模型(Document Object Model，DOM)格式的应用程序编程接口，(Application Programming Interface，API)不依赖Java Bindings的插件。
可选地，所述配置数据的数据模型包括所述配置数据的通用的数据属性以及所述配置数据的可扩展的数据属性。其中，可扩展的数据属性可以关联数据模型中未添加的数据属性或者网络设备私有属性，例如厂商私有属性等。通用的数据属性包括常用的数据属性。
可选地，通用的数据属性中包括对网络进行数据链路的验证所需的常用数据属性，或者通用的数据属性中包括对网络进行配置验证所需的常用数据属性。
本申请实施例使用的配置数据的数据模型与YANG模型的原理相似，但是通过配置数据的数据模型包含了对网络的数据链路进行验证的所需的配置数据，或者包含了对网络的配置进行验证的所需的配置数据，使得通过一个配置数据的数据模型可以获得数据链路验证，或者配置验证所需的配置数据，有利于简化获取配置数据的流程。避免了使用传统的YANG模型中不同类型的配置数据承载于不同的YANG模型中。例如，传统的YANG模型中访问控制列表和设备接口等配置数据使用单独的YANG模型。
图4是本申请实施例的配置数据的数据模型的组织形式的示意图。图4仅仅从便于理解的角度介绍本申请实施例的数据模型，而数据模型的真是逻辑结构请参见图5所示。图4所示的数据模型包括通用的数据属性410，以及可扩展的数据属性420。
其中，通用的数据属性410包括配置名称、设备类型、设备接口、设备IP地址、虚拟专用网路由转发表(virtual private network routing and forwarding table，vrf)、安全域、设备厂商等。
可扩展的数据属性420包括扩展价值属性以及扩展私有属性。其中，扩展价值数据可以理解为具有扩展价值的数据属性，即当前数据模型中未包含，但后续考虑添加至数据模型的数据属性，例如设备认证信息等。扩展私有属性包括设备相关的私有数据属性以及厂商私有的数据属性。
可选地，所述配置数据的数据模型为树形结构。上述数据模型中的配置数据可以存储在该属性结构的节点中。
可选地，图4所示的数据模型的组织形式中，可扩展的数据属性对应可扩展的数据属性的配置数据的路径，该路径指向树形结构中存储可扩展的数据属性的配置数据的节点。例如，可扩展的数据属性为设备的认证信息，则图4所示的组织形式中，可扩展的数据属性可以对应设备认证信息的路径，该路径可以指向在树形结构中存储设备认证信息的节点。
下文结合图5介绍本申请实施例的配置数据的数据模型的逻辑结构的示意图。该数据模型具有树形化层次结构，因此，配置数据的数据模型又被称为“配置树”。配置树包括根节点501以及多个叶子节点502。
其中根节点501用于标识整棵配置树。叶子节点502用于承载数据模板中的所有的原子配置数据。承载有配置名称、设备类型、设备接口、设备IP地址、vrf、安全域、设备厂商等。
在本申请实施例中通过使用树形结构表示配置数据的数据模型，即使用与YANG模型相似的结构数据模型，使得配置数据的数据模型与Netconf协议之间的匹配程度，与YANG模型与Netconf协议之间的匹配程度相似，有利于基于Netconf协议推广上述配置数据的数据模型。
另一方面，由于本申请实施例的配置数据的数据模型的结构与YANG模型类型，因此可以借用YANG模型可以转化Netconf报文的性能，将本申请实施例的配置数据的数据模型与Netconf报文结合，应用与目前的网络中。上述将配置数据的数据模型转化为Netconf报文的过程可以称为“配置数据的数据模型的YANG化”。
320，所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备的拓扑结构，对所述多个网络设备之间的数据链路进行验证。
在本申请实施例中，网络验证系统可以基于与网络设备无关的通用数据建模语言描述的配置数据，以及网络的拓扑结构，对网络进行数据链路验证。有利于提高网络验证系统的扩展性。避免了传统的网络仿真软件中，提供针对每种网络设备的配置数据的模板，导致网络仿真软件的扩展性较差。
可选地，上述步骤320包括：所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，计算路由得到，所述多个网络设备的路由转发表项；所述网络验证系统根据所述多个网络设备的路由转发表项，对所述多个网络设备之间的数据链路进行验证。
本申请中，基于多个网络设备的配置数据直接生成路由转发表项，并基于路由转发表项对网络的数据链路进行验证，有利于简化得到路由转发表项的过程。避免了传输的数据 链路过程中，网络设备需要基于配置数据(例如，IP地址)进行路由学习，得到路由转发表项。
可选地，上述多个网络设备的路由转发表项可以通过多个一阶逻辑表达式表示。
具体地，可以通过多个一阶逻辑表达式表示网络中传输数据的路由转发表项，对网络的数据链路进行验证的过程，可以理解为将上述多个一阶逻辑表达式描述的路由转发表项作为传输报文的约束条件，再通过状态机模拟报文在网络中的传输状态，以对网络中的数据连链路进行验证。
如上文所述，上述网络设备的配置数据可以已为网络设备配置的配置数据，或者待为网络设备配置的配置数据。其中，基于已配置的配置数据的验证过程可以称为“事后验证”，基于待配置的配置数据或者待更新的配置数据的验证过程可以称为“事前验证”。
下文分别基于“事前验证”的场景以及“事后验证”的场景介绍本申请实施例的方法。
在“事后验证”的场景中，网络验证系统用于对网络中网络设备已配置的配置数据进行验证，下文结合图6介绍本申请实施例的方法。图6是本申请实施例的网络验证方法的示意性流程图，图6所示的方法包括步骤510至步骤540。
510，网络验证系统从网络(或者称“真实网络”)中采集多个网络设备的配置数据。
可选地，网络验证系统可以向网络设备发送Netconf获取(Netconf-get)请求，以从网络设备中获取配置数据。基于目前Netconf的规定，上述配置数据的格式为YANG模型。当然，网络验证系统还可以通过其他命令获取网络设备的配置数据，例如，上述网络支持虚拟系统(Virtual system，Vsys)功能的情况下，还可以通过Vsys中的配置数据获取命令(get-config)获取配置数据，本申请实施例对此不做限定。
520，网络验证系统获取多个网络设备的拓扑结构。
需要说明的是，上述拓扑结构可以是由用户手动向网络验证系统输入的，也可以是网络验证系统基于Netconf从网络中采集的，本申请实施例对此不做限定。
530，网络验证系统基于多个网络设备的拓扑结构、多个网络设备的配置数据，得到多个网络设备的路由转发表项。
540，网络验证系统根据多个网络设备的路由转发表项，对多个网络设备之间的数据链路进行验证。
在“事前验证”的场景中，网络验证系统用于对网络中网络设备已配置的配置数据进行验证，下文结合图7介绍本申请实施例的方法。图7是本申请实施例的网络验证方法的示意性流程图，图7所示的方法包括步骤610至步骤640。
610，网络验证系统获取待配置的配置数据或待更新的配置数据。
具体地，上述待配置的配置数据可以是待为一个网络设备配置的配置数据，或者待为多个网络设备配置的配置数据。上述待更新的配置数据可以是待为一个网络设备配置的配置数据，或者待为多个网络设备更新的配置数据。
通常，上述待配置的配置数据或者待更新的配置数据可以由网络中的控制器(例如，SDN控制器)为网络设备配置，网络验证系统可以在控制器为网络设备配置或更新上述配置数据之前，先基于待配置的配置数据或者待更新的配置数据进行数据链路的验证，确定在真实网络中使用上述待配置的配置数据或者待更新的配置数据是否合理。
可选地，控制器基于Netconf协议为网络设备配置配置数据，则网络验证系统从控制器中获取的待更新的配置数据或待配置的配置数据为YANG模型的。
620，网络验证系统获取多个网络设备的拓扑结构。
需要说明的是，上述拓扑结构可以是由用户手动向网络验证系统输入的，也可以是网络验证系统基于Netconf从网络中采集的，本申请实施例对此不做限定。
630，网络验证系统基于多个网络设备的拓扑结构、多个网络设备的配置数据，得到多个网络设备的路由转发表项。
640，网络验证系统根据多个网络设备的路由转发表项，对多个网络设备之间的数据链路进行验证。
基于上文的介绍，本申请实施例的网络验证系统还可以对上述待配置的配置数据，或者网络中已配置的配置数据对网络进行配置验证。即，所述多个网络设备的配置数据中包括第一网络设备的配置数据，图3所示的方法还包括：所述网络验证系统根据所述第一网络设备的配置数据，对所述第一网络设备进行配置验证，其中，配置验证是指对所述第一网络设备的配置数据的数据模型中的任意一个或多个数据属性进行验证。
上述第一网络设备可以是多个网络设备中的任意一个。在本申请实施例中，还可以使用上述方法同时验证多个网络设备的配置。由于验证方式与上文验证第一网络设备的配置的方式相类似，为了简洁，在此不再赘述。
同理，基于配置数据是已配置的配置数据还是待配置的配置数据可以分为“事后验证”以及“事前验证”的场景。在事前验证或者事后验证的场景中，配置数据的获取方式可以参见图6和图7中的介绍，为了简洁，在此不再赘述。
上文主要结合图6，图7介绍了本申请实施例的数据链路的验证过程，需要说明的是，承载于本申请实施例的配置数据的数据模型的配置数据还可以用于网络的配置验证，具体地配置验证类型可以参见图1中相关介绍，为了简洁，在此不再赘述。
需要说明的是，上述配置验证以及数据链路验证可以结合使用，也可以单独使用，本申请实施例对此不做限定。
可选地，上述配置验证的过程可以与上文图6以及图7所示的“事前验证”以及“事后验证”相结合。并且配置验证的过程可以在数据链路验证之后使用，也可以在数据链路之前使用，或者独立于数据链路验证单独使用。本申请实施例对此不作具体限定。
上文结合图1至图7介绍本申请实施例的方法，下文结合图8至图9介绍本申请实施例的装置。应理解，图8至图9可以执行图3、图6以及图7中的部分或全部步骤，为了简洁，在此不再赘述。
图8是本申请实施例的网络验证的装置的示意图，图8所示装置800包括输入输出模块810和处理模块820。
输入输出模块810，用于获取多个网络设备的配置数据，其中，配置数据的数据模型为与网络设备无关的通用数据建模语言描述的；
处理模块820，用于根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证。
可选地，作为一个实施例，所述处理模块820用于根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，计算路由得到所述多个网络设备的路由转发表项；以及根据所述路由转发表项，对所述多个网络设备之间的数据链路进行验证。
可选地，作为一个实施例，所述配置数据的数据模型包括所述配置数据的通用的数据属性以及所述配置数据的可扩展的数据属性，其中，所述通用的数据属性包括以下数据属 性中的一个或多个：配置名称、设备类型、设备接口、设备互联网协议地址IP地址或虚拟专用网络路由转发表vrf，所述可扩展的数据属性包括私有数据属性。
可选地，作为一个实施例，所述配置数据的数据模型为树形结构，所述数据模型中的可扩展的数据属性为存储所述可扩展的数据属性的路径，所述路径用于指向所述树形结构中存储所述可扩展的数据属性的节点。
可选地，作为一个实施例，所述多个网络设备的配置数据中包括第一网络设备的配置数据，所述处理模块820，还用于根据所述第一网络设备的配置数据，对所述第一网络设备进行配置验证，其中，配置验证是指对所述第一网络设备的配置数据的数据模型中的任意一个或多个数据属性进行验证。
可选地，作为一个实施例，所述配置数据为以下任一种：待配置的配置数据；已配置的配置数据；待更新的配置数据。
可选地，作为一个实施例，所述多个网络设备包括第二网络设备，所述通用数据建模语言为YANG模型，所述输入输出模块还用于：接收网络配置协议NetConf报文，所述NetConf报文中包括所述第二网络设备的配置数据，所述第二网络设备的配置数据用于对所述第二网络设备进行配置，或者对所述第二网络设备的配置进行更新。
在可选的实施例中，所述处理模块810可以为处理器920，所述输入输出模块820可以为输入/输出接口930，所述网络验证系统还可以包括存储器910，具体如图9所示。
图9是本申请实施例的另一网络验证系统的示意图。图9所示的网络验证系统900可以包括：存储器910、处理器920、通信接口930。其中，存储器910、处理器920、输入/输出接口930通过内部连接通路，例如总线，相连。该存储器910用于存储指令，该处理器920用于执行该存储器920存储的指令，通过该通信接口930接收输入的数据和信息，输出操作结果等。
可选地，上述网络验证系统900可以包括一个或者多个服务器，本申请实施例对此不作限定。
在实现过程中，上述方法的各步骤可以通过处理器920中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器910，处理器920读取存储器910中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
处理器920可以为中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
应理解，本申请实施例中，该存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。处理器的一部分还可以包括非易失性随机存取存储器。例如，处理器还可以存储设备类型的信息。
应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息 确定B。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够读取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital video disc，DVD))或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (11)

  1. 一种网络验证的方法，其特征在于，包括：
    网络验证系统获取多个网络设备的配置数据，其中，配置数据的数据模型是通过与网络设备无关的通用数据建模语言描述的；
    所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证。
  2. 如权利要求1所述的方法，其特征在于，所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，对所述多个网络设备之间的数据链路进行验证，包括：
    所述网络验证系统根据所述多个网络设备的配置数据，以及所述多个网络设备之间的拓扑结构，计算路由，得到所述多个网络设备的路由转发表项；
    所述网络验证系统根据所述多个网络设备的路由转发表项，对所述多个网络设备之间的数据链路进行验证。
  3. 如权利要求1或2所述的方法，其特征在于，所述数据模型包括通用数据属性以及可扩展数据属性，其中，所述通用数据属性包括以下数据属性中的一个或多个：配置名称、设备类型、设备接口、设备互联网协议地址IP地址或虚拟专用网络路由转发表，所述可扩展数据属性包括私有数据属性。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，所述多个网络设备的配置数据中包括第一网络设备的配置数据，所述方法还包括：
    所述网络验证系统根据所述第一网络设备的配置数据，对所述第一网络设备进行配置验证，其中，配置验证是指对所述第一网络设备的配置数据的数据模型中的任意一个或多个数据属性进行验证。
  5. 如权利要求1-4中任一项所述的方法，其特征在于，所述多个网络设备的配置数据包括：待配置的配置数据，已配置的配置数据，待更新的配置数据。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，所述多个网络设备包括第二网络设备，所述通用数据建模语言为YANG模型，所述网络验证系统获取网络中多个网络设备的配置数据，包括：
    所述网络验证系统接收网络配置协议NetConf报文，所述NetConf报文中包括所述第二网络设备的配置数据，所述第二网络设备的配置数据用于对所述第二网络设备进行配置，或者对所述第二网络设备的配置进行更新。
  7. 一种网络验证的装置，其特征在于，包括：
    输入输出模块，用于获取网络中多个网络设备的配置数据，其中，配置数据的数据模型为与网络设备无关的通用数据建模语言描述的；
    处理模块，用于根据所述多个网络设备的配置数据，以及所述多个网络设备的拓扑结构，对所述多个网络设备之间的数据链路进行验证。
  8. 如权利要求7所述的装置，其特征在于，所述处理模块，用于：
    根据所述多个网络设备的配置数据，以及所述多个网络设备的拓扑结构，计算路由得到，所述多个网络设备的路由转发表项；
    根据所述多个网络设备的路由转发表项，对所述多个网络设备之间的数据链路进行验 证。
  9. 如权利要求7或8所述的装置，其特征在于，所述配置数据的数据模型包括所述配置数据的通用的数据属性以及所述配置数据的可扩展的数据属性，其中，所述通用的数据属性包括以下数据属性中的一个或多个：配置名称、设备类型、设备接口、设备互联网协议地址IP地址或虚拟专用网络路由转发表，所述可扩展的数据属性包括私有数据属性。
  10. 如权利要求7-9中任一项所述的装置，其特征在于，所述多个网络设备的配置数据中包括第一网络设备的配置数据，
    所述处理模块，还用于根据所述第一网络设备的配置数据，对所述第一网络设备的进行配置验证，其中，配置验证是指对所述第一网络设备的配置数据的数据模型中的任意一个或多个数据属性进行验证。
  11. 一种计算机可读介质，其特征在于，所述计算机可读介质存储有程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行如权利要求1-6中任一项所述的方法。
PCT/CN2019/127244 2019-04-11 2019-12-21 网络验证的方法和装置 Ceased WO2020207051A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19924113.4A EP3890243B1 (en) 2019-04-11 2019-12-21 Method and apparatus for network verification
US17/360,028 US11909744B2 (en) 2019-04-11 2021-06-28 Network verification method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910290613.6 2019-04-11
CN201910290613.6A CN111835532B (zh) 2019-04-11 2019-04-11 网络验证的方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/360,028 Continuation US11909744B2 (en) 2019-04-11 2021-06-28 Network verification method and apparatus

Publications (1)

Publication Number Publication Date
WO2020207051A1 true WO2020207051A1 (zh) 2020-10-15

Family

ID=72750602

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/127244 Ceased WO2020207051A1 (zh) 2019-04-11 2019-12-21 网络验证的方法和装置

Country Status (4)

Country Link
US (1) US11909744B2 (zh)
EP (1) EP3890243B1 (zh)
CN (1) CN111835532B (zh)
WO (1) WO2020207051A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113408140A (zh) * 2021-06-30 2021-09-17 中国南方电网有限责任公司 电力通信网络扩容仿真验证方法、装置、设备和介质
CN114726717A (zh) * 2020-12-22 2022-07-08 华为技术有限公司 用于配置节点的方法和装置

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112532517B (zh) * 2020-11-05 2022-04-05 东北大学 基于领域特定语言实现ospf协议配置综合方案
CN112953768B (zh) * 2021-02-10 2023-02-24 中国工商银行股份有限公司 三层网络变更方案验证方法及系统
US11784883B2 (en) * 2021-03-30 2023-10-10 At&T Intellectual Property I, L.P. Automation agent for network equipment configuration
EP4423990A1 (en) * 2021-10-28 2024-09-04 Microsoft Technology Licensing, LLC Network configuration verification in computing systems
CN114448786B (zh) * 2021-12-27 2024-06-07 天翼云科技有限公司 一种网关配置处理方法、装置、系统及计算机设备
US12113708B2 (en) * 2022-03-25 2024-10-08 Arista Networks, Inc. Provisioning memory resources on flexible hardware platforms
WO2024021045A1 (en) * 2022-07-29 2024-02-01 Huawei Technologies Co., Ltd. System and method for improving efficiency of yang based configuration of devices
CN115941422B (zh) * 2022-10-19 2024-10-22 苏州浪潮智能科技有限公司 一种动态生成配置文件的方法、装置、交换机和存储介质
US12255778B2 (en) * 2022-12-24 2025-03-18 Nvidia Corporation Method and apparatus for deriving network configuration and state for physical network fabric simulation
JPWO2024176283A1 (zh) * 2023-02-20 2024-08-29
CN116614387B (zh) * 2023-06-14 2026-01-23 脸萌有限公司 基于网络拓扑的验证方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104065514A (zh) * 2014-07-02 2014-09-24 清华大学 一种基于netconf中继的家庭网络管理方法
CN106656792A (zh) * 2016-11-30 2017-05-10 中国人民解放军国防科学技术大学 一种基于sdn架构的bgp路由可信验证方法
WO2018231901A1 (en) * 2017-06-13 2018-12-20 Cisco Technology, Inc. Detecting and managing recurring patterns in device and service configuration data
CN109361550A (zh) * 2018-11-21 2019-02-19 国家计算机网络与信息安全管理中心 网络设备配置管理的方法、装置及设备

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7111270B2 (en) * 2003-02-26 2006-09-19 Intel Corporation Method and apparatus to adaptively validate a physical net routing topology of a substrate design
US7764702B2 (en) * 2007-12-19 2010-07-27 At&T Intellectual Property I, L.P. Method and apparatus for customer-controlled routing management
CN101894192B (zh) * 2010-07-19 2012-07-25 北京航空航天大学 Afdx网络设计与验证的仿真和演示系统及其仿真和演示方法
CN102075347B (zh) * 2010-11-18 2013-11-20 北京神州绿盟信息安全科技股份有限公司 一种安全配置核查设备和方法以及采用该设备的网络系统
WO2013007865A1 (en) * 2011-07-08 2013-01-17 Nokia Corporation Method and apparatus for authenticating subscribers to long term evolution telecommunication networks or universal mobile telecommunications system
US9923787B2 (en) * 2012-04-27 2018-03-20 International Business Machines Corporation Network configuration predictive analytics engine
US20150019193A1 (en) * 2013-07-14 2015-01-15 Qualcomm Technologies, Inc. Verification using generic protocol adapters
CN104065536A (zh) * 2014-07-02 2014-09-24 浪潮集团有限公司 基于uvm验证方法的以太网交换机fpga验证方法
CN105634787B (zh) * 2014-11-26 2018-12-07 华为技术有限公司 网络关键指标的评估方法、预测方法及装置和系统
CN104954166B (zh) * 2015-04-27 2019-03-12 北京交通大学 一种基于硬件的网络仿真系统及仿真方法
WO2018100437A1 (en) * 2016-11-30 2018-06-07 Telefonaktiebolaget Lm Ericsson (Publ) Policy based configuration in programmable access networks
US20170187577A1 (en) * 2017-03-14 2017-06-29 Nuviso Networks Inc System for configuring network devices
US10554483B2 (en) * 2017-05-31 2020-02-04 Cisco Technology, Inc. Network policy analysis for networks
CN107749807B (zh) * 2017-10-31 2020-07-28 江苏省未来网络创新研究院 一种面向nfv的网络功能验证方法及验证系统
CN108717362B (zh) * 2018-05-21 2022-05-03 北京晨宇泰安科技有限公司 一种基于可继承结构的网络设备配置系统及配置方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104065514A (zh) * 2014-07-02 2014-09-24 清华大学 一种基于netconf中继的家庭网络管理方法
CN106656792A (zh) * 2016-11-30 2017-05-10 中国人民解放军国防科学技术大学 一种基于sdn架构的bgp路由可信验证方法
WO2018231901A1 (en) * 2017-06-13 2018-12-20 Cisco Technology, Inc. Detecting and managing recurring patterns in device and service configuration data
CN109361550A (zh) * 2018-11-21 2019-02-19 国家计算机网络与信息安全管理中心 网络设备配置管理的方法、装置及设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3890243A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114726717A (zh) * 2020-12-22 2022-07-08 华为技术有限公司 用于配置节点的方法和装置
CN114726717B (zh) * 2020-12-22 2023-09-01 华为技术有限公司 用于配置节点的方法和装置
CN113408140A (zh) * 2021-06-30 2021-09-17 中国南方电网有限责任公司 电力通信网络扩容仿真验证方法、装置、设备和介质
CN113408140B (zh) * 2021-06-30 2023-12-12 中国南方电网有限责任公司 电力通信网络扩容仿真验证方法、装置、设备和介质

Also Published As

Publication number Publication date
US20210329004A1 (en) 2021-10-21
EP3890243A1 (en) 2021-10-06
CN111835532A (zh) 2020-10-27
US11909744B2 (en) 2024-02-20
EP3890243B1 (en) 2026-02-25
CN111835532B (zh) 2022-04-05
EP3890243A4 (en) 2022-03-30

Similar Documents

Publication Publication Date Title
US11909744B2 (en) Network verification method and apparatus
US9628339B1 (en) Network testbed creation and validation
CN112311606B (zh) 一种用于构建虚实解耦仿真网络的方法
CN118802568B (zh) 网络孪生方法、系统、装置、设备、介质及程序产品
US8683028B2 (en) Generic multi-layer provisioning service management layer systems and methods
CN110247784A (zh) 确定网络拓扑结构的方法和装置
CN108667638B (zh) 一种网络业务配置方法及网络管理设备
CN113408139B (zh) 电力通信网络路径控制仿真验证方法、装置、设备和介质
CN114553752B (zh) 基于仿真软件的网络性能测试方法、装置和计算机设备
WO2020062959A1 (zh) 配置数据的方法及装置
CN111490893B (zh) 一种网络转发模型的建立方法、装置及系统
CN114422010A (zh) 一种基于网络虚拟化的卫星通信仿真平台的协议测试方法
CN114584354B (zh) 一种网络安全实训平台的构建方法及系统
US12149441B2 (en) Determining flow paths of packets through nodes of a network
CN116601928B (zh) 用于分布式网络验证的方法和系统
JP2016541202A (ja) ソフトウェア定義ネットワークにおけるオフラインクエリ
CN110855457A (zh) 生成网络模型以及配置网络的方法、设备
KR20190103682A (ko) 통신 시스템에서 네트워크 서비스에 기초하여 네트워크 디바이스를 제어하기 위한 장치 및 방법
WO2020233217A1 (zh) 传送网子切片的创建方法、装置、系统及存储介质
US10200445B2 (en) Method for analyzing performance of network application program in software defined networking environment, apparatus therefor, and computer program therefor
CN117061366B (zh) 一种支持网络设备融合管理的方法及试验系统
Zichao et al. Ethernet topology discovery for virtual local area networks with incomplete information
US11438237B1 (en) Systems and methods for determining physical links between network devices
CN119496706B (zh) 一种网络优化方法、装置、介质及产品
Rivera et al. Dynamically creating custom SDN high-speed network paths for big data science flows

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19924113

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019924113

Country of ref document: EP

Effective date: 20210628

NENP Non-entry into the national phase

Ref country code: DE

WWG Wipo information: grant in national office

Ref document number: 2019924113

Country of ref document: EP