WO2016011888A1 - 策略冲突解决方法以及装置 - Google Patents

策略冲突解决方法以及装置 Download PDF

Info

Publication number
WO2016011888A1
WO2016011888A1 PCT/CN2015/083379 CN2015083379W WO2016011888A1 WO 2016011888 A1 WO2016011888 A1 WO 2016011888A1 CN 2015083379 W CN2015083379 W CN 2015083379W WO 2016011888 A1 WO2016011888 A1 WO 2016011888A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
execution
rules
matrix
matching
Prior art date
Application number
PCT/CN2015/083379
Other languages
English (en)
French (fr)
Inventor
董雯霞
林程勇
丁万夫
李凤凯
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP15823978.0A priority Critical patent/EP3160083B1/en
Publication of WO2016011888A1 publication Critical patent/WO2016011888A1/zh
Priority to US15/410,092 priority patent/US10193755B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/19—Flow control; Congestion control at layers above the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0886—Fully automatic configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H04L41/5041—Network service management, e.g. ensuring proper service fulfilment according to agreements characterised by the time relationship between creation and deployment of a service
    • H04L41/5048—Automatic or semi-automatic definitions, e.g. definition templates

Definitions

  • the present application relates to the field of communications, and in particular, to a policy conflict resolution method and apparatus.
  • SDN Software Defined Network
  • IP routing used by traditional networks
  • OpenFlow can flexibly control network traffic and provide good innovation for core networks and applications.
  • the platform is the direction of future network architecture development.
  • the SDN generally includes two parts, a controller 110 and a forwarding device 120.
  • the controller 110 is connected to each of the forwarding devices 120 in the network, and the forwarding devices 120 in the network are topologically connected.
  • the controller 110 is responsible for centrally controlling the network. After receiving the control policy, the controller 110 generates a forwarding path according to the control policy, and generates a forwarding entry for each forwarding device 120. After receiving the forwarding entry, the forwarding device 120 matches and forwards the packet sent by the user terminal according to the received forwarding entry.
  • the daily work of the R&D department involves the confidentiality of the company.
  • the R&D department is strictly forbidden to access the external network and can only access the company's internal network. Therefore, the administrator may send a policy 1 to the controller for the nature of the R&D department.
  • the policy 1 acts on the forwarding device S0, and the forwarding device S0 forwards the packet of the user terminal that satisfies the policy 1 to other forwarding in the SDN.
  • the device is forwarded by other forwarding devices to the corresponding network, such as an external network or an internal network:
  • the administrator may issue a policy 2 to the controller for the nature of the pre-research team.
  • the policy 2 also acts on the forwarding device S0, and the packet of the user terminal that meets the policy 2 by the forwarding device S0 is forwarded to other forwarding devices in the SDN, and then forwarded by other forwarding devices to the corresponding network, such as an external network or an internal network:
  • Strategy 2 The pre-research team server cannot access the Secure Shell (SSH) service, and the pre-research team employees can access the external network through the forwarding device S2.
  • SSH Secure Shell
  • the pre-research team should have access to the external network.
  • the pre-research team is part of the R&D department, in Strategy 1, all R&D employees are prohibited from accessing the external network.
  • the controller 110 cannot process the information.
  • the controller 110 can only translate the policy with the highest priority into a forwarding entry and send it to the forwarding device S0, so that the forwarding device S0 only Forwards packets based on the policy with the highest priority.
  • the priority of the policy 1 issued by the R&D department is higher than that of the pre-research team. Therefore, the forwarding device S0 will only forward packets according to policy 1, but will not forward packets according to policy 2. I have been unable to access the external network.
  • the present application provides a policy conflict resolution method and apparatus, which can resolve policy conflicts.
  • a first aspect of the present application provides a policy conflict resolution method, the method comprising: receiving a first control policy and decomposing the first control policy into m first rules, and receiving a second control policy and The second control policy is decomposed into n second rules, where m, n are natural numbers, and the first control policy and the second control policy are both applied to the first forwarding device, the first rule and the second rule Each includes a matching field and an action; each of the first rules is inverted to obtain a first anti-rule, and each of the second rules is inverted to obtain a second anti-rule, and each of the first anti-rules is respectively The rule and each of the second anti-rules generate a corresponding first execution rule according to the rule synthesis principle, wherein the rule synthesis principle includes: a matching domain of the first anti-rule with the same matching domain type and a second anti-rule And a union between the matching domain of the first anti-rule and the matching domain of the second anti-rule, and the intersection of the action of the
  • inverting each of the first rules the matching field of the first rule is unchanged, and the action of the first rule is taken
  • inverting each of the second rules causes the matching field of the first rule to be unchanged, and the action of the first rule is negated.
  • each of the first anti-rules and each of the second anti-rules are respectively followed
  • the rule synthesizing principle generates a corresponding first execution rule, including: arranging each of the first anti-rules as elements and arranging according to a priority order of the first rule to form a first matrix, where the first matrix is a column matrix, Each of the second anti-rules is arranged as an element and arranged in a priority order of the second rule to form a second matrix, the second matrix is a row matrix, and the first matrix is multiplied by the second matrix to obtain a first execution rule matrix, the first anti-rule multiplied by each pair in the first execution rule matrix and the second anti-rule according to the rule synthesis principle to generate a corresponding first execution rule, where the first The priority of the first execution rule of the execution rule matrix is first arranged in the order of the columns of the matrix, and the same
  • the method further includes: adding a first matching rule as a priority The first rule having the lowest level; the decomposing into the n second rules further includes: adding a second matching rule as the second rule with the lowest priority; wherein, the first matching rule and the second matching rule The matching fields are all wildcards and the actions are discarded.
  • the remaining the first execution rule as the effective first execution rule includes: comparing the remaining ones If the matching domain of the first execution rule overlaps the matching domain of the other first execution rule, the first execution rule with the smaller matching domain is deleted; if the two firsts If the matching domain of the execution rule is the same, the first execution rule with the lower priority is deleted, and the first execution rule with the smaller matching domain and the first execution rule with the lower priority are deleted. Execute the rule as a valid first execution rule.
  • the method further includes: receiving a third control policy and decomposing the third control policy a k-th third rule, where k is a natural number, the third control policy and the first and second control policies are both applied to the first forwarding device; and each of the valid first execution rules is inverted Obtaining each first anti-execution rule, inverting each of the third rules to obtain each third anti-rule; taking each of the first anti-execution rules as elements and following the priority order of the first execution rule Arranging to form a third matrix, the third matrix is a column matrix, each of the third inverse rules is arranged as an element and arranged in order of priority of the third rule to form a fourth matrix, the fourth matrix is a row a matrix, the third matrix is multiplied by the fourth matrix to obtain a second execution rule matrix, and the first inverse execution rule multiplied by each pair of the second execution rule matrix and the third inverse respectively
  • the second aspect of the present application provides a policy conflict resolution apparatus, including: a receiving module, a synthesizing module, and a deleting module, where the receiving module is configured to receive a first control policy and decompose the first control policy into m first rules.
  • each of the first anti-rules and each of the second anti-rules respectively generate a corresponding first execution rule according to a rule synthesis principle, wherein the rule synthesis principle includes: the same type of matching domain Anti-regulation The union between the matching domain of the matching domain and the matching domain of the second anti-rule or the matching domain of the matching domain of the first anti-rule different from the matching domain type, and the action of the first anti-rule and the
  • the first rule is reversed, that is, the matching field of the first rule is unchanged, and the action of the first rule is reversed.
  • Inverting the second rule means that the matching field of the second rule is unchanged, and the action of the second rule is inverted.
  • the synthesizing module is further configured to use each of the first anti-rules as an element and according to the first
  • the priority order of the rules is arranged to form a first matrix
  • the first matrix is a column matrix
  • each of the second anti-rules is arranged as an element and arranged in a priority order of the second rule to form a second matrix
  • the second matrix is a row matrix
  • the first matrix is multiplied by the second matrix to obtain a first execution rule matrix
  • the second anti-rule generates a corresponding first execution rule according to the rule synthesis principle, wherein the first execution rule of the first execution rule matrix has priority of being arranged according to the column order of the matrix, and the same column is according to the row order of the matrix. arrangement.
  • the synthesizing module is further configured to: after the decomposing into the m first rule, add a new one The first matching rule is the first rule with the lowest priority; after the decomposing into the n second rules, a second matching rule is added as the second rule with the lowest priority; wherein the first matching rule and The matching fields of the second matching rule are all wildcards, and the actions are discarded.
  • the synthesizing module is further configured to compare each remaining two after deleting the invalid rule a matching domain of the execution rule, if the matching domain of one of the first execution rules covers the matching domain of the other first execution rule, the first execution rule with the smaller matching domain is deleted; if the matching of the two first execution rules If the domain is the same, the first execution rule with the lower priority level is deleted, and the first execution rule with the smaller matching domain and the first execution rule after the first execution rule with the lower priority are deleted are valid.
  • the first enforcement rule is further configured to compare each remaining two after deleting the invalid rule a matching domain of the execution rule, if the matching domain of one of the first execution rules covers the matching domain of the other first execution rule, the first execution rule with the smaller matching domain is deleted; if the matching of the two first execution rules If the domain is the same, the first execution rule with the lower priority level is deleted, and the first execution rule with the smaller matching domain and the first execution rule after the first execution rule with the lower priority are deleted are valid.
  • the first enforcement rule is further configured to
  • the receiving module is further configured to receive a third control policy and the third control policy Decomposed into k third rules, k is a natural number, the third control strategy and the first, the first The second control policy is applied to the first forwarding device, and the receiving module sends the k third rules to the synthesizing module; the synthesizing module is further configured to receive the k third rules, for each Determining the valid first execution rule to obtain each first anti-execution rule, inverting each of the third rules to obtain each third anti-rule, and using each of the first anti-execution rules as The elements are arranged in order of priority of the first execution rule to form a third matrix, the third matrix is a column matrix, and each of the third anti-rules is arranged as an element and arranged in order of priority of the third rule to constitute a fourth matrix, the fourth matrix is a row matrix, and the third matrix is multiplied by
  • the synthesizing module sends the synthesized second execution rule to the deleting module; the deleting module is further configured to receive the synthesized second execution rule, delete the invalid rule, and save each of the remaining second executions After the rule is reversed, the protocol is converted to the corresponding forwarding entry of the first forwarding device according to the protocol supported by the first forwarding device.
  • the first control strategy is decomposed into m first rules
  • the second control strategy is decomposed into n second rules
  • each first rule and the second rule are synthesized according to the rule synthesis principle. Since the rule synthesis principle uses the first execution rule with no intersection between the matching domain of the first anti-rule with the same matching domain type and the matching domain of the second anti-rule as an invalid rule, the invalid rule defined above is the first rule.
  • the second control strategy conflicts with the rule part. Therefore, by deleting the invalid rule with conflict, the conflict rule between the first control policy and the second control policy is avoided, that is, the policy conflict problem is solved, so that the first forwarding is
  • the second control strategy can also be executed by executing the first control strategy.
  • FIG. 1 is a schematic structural diagram of an implementation manner of a prior art software definition network
  • FIG. 3 is a flowchart of another embodiment of a policy conflict resolution method of the present application.
  • FIG. 4 is a schematic structural diagram of an embodiment of a policy conflict resolution apparatus of the present application.
  • FIG. 5 is a schematic structural diagram of an embodiment of a controller of the present application.
  • FIG. 2 is a flowchart of an implementation manner of a policy conflict resolution method according to the present application.
  • the execution body of each step in FIG. 2 may be a controller in the SDN, or may be a server in a collaboration layer in the SDN.
  • the following is an example of a controller as an execution subject, including:
  • the controller receives the first control policy and decomposes the first control policy into m first rules, and receives the second control policy and decomposes the second control policy into n second rules, where m, n is a natural number, and the first control policy and the second control policy are both applied to the first forwarding device, that is, the first forwarding device needs to forward the corresponding packet according to the first control policy, and also needs to be according to the second control.
  • the policy forwards the corresponding message.
  • Both the first rule and the second rule include a matching field and an action.
  • the controller receives the first control policy acting on the first forwarding device S0.
  • the R&D department server cannot access the external network, and all R&D department employees can access the company's internal network from the forwarding device S1”, wherein the IP of the R&D department employee The address is located on the network segment 10.0.0.0/8 (that is, the network segment 10.0.0.1 to 10.255.255.255).
  • the " ⁇ " indicates that the IP address of the R&D department server is 10.0.0.1, ⁇ is expressed as or, and port 80 is used to access the external network.
  • the network, -> ⁇ S1 ⁇ indicates that the device S1 is forwarded.
  • the first control strategy can be described as: SrcAddr: 10.0.0.0/8 ⁇ (SrcAddr:10.0.0.1 ⁇ DstPort:80)-> ⁇ S1 ⁇ .
  • the controller decomposes the first control strategy and obtains three first rules:
  • the R&D department server 10.0.0.1 cannot access the external network by forwarding device S1.
  • First rule A1 SrcAddr:10.0.0.1: ⁇ , where the content in ⁇ is empty, indicating that it is lost Abandon the meaning.
  • the discarding action in the present application does not perform all the actions in the control policy. For example, the action of the first control policy is to go to S1, and the discard action in the first rule obtained by the decomposition of the first control policy is not. Go to S1.
  • the controller receives the second control policy acting on the first forwarding device S0.
  • the pre-research group server cannot access the SSH service, and the pre-research team employee can access the external network through the forwarding device S2.
  • the IP address of the pre-research team employee is located.
  • the network segment 10.2.0.0/16 that is, the network segment 10.2.0.1 to 10.2.255.255
  • " ⁇ " indicates that the IP address of the pre-research server is 10.2.0.1
  • ⁇ is expressed as or
  • port 22 is used to access the SSH service. Therefore, the second control strategy can be described as: SrcAddr: 10.2.0.0/16 ⁇ (SrcAddr: 10.2.0.1 ⁇ DstPort:22)-> ⁇ S2 ⁇ .
  • the controller decomposes the second control strategy, and can obtain three second rules:
  • the pre-research server 10.2.0.1 cannot pass the forwarding device S2 to access the SSH service.
  • the second rule B1 SrcAddr: 10.2.0.1: ⁇ , where the content in ⁇ is empty, indicating the meaning of discarding.
  • the priority of the first rule is A1>A2>A3.
  • the priority of the second rule is B1>B2. >B3.
  • a matching rule with the lowest priority is added to both the first rule and the second rule.
  • the matching field of the matching rule is a wildcard and the action is discarded.
  • a first matching rule is added as the first rule A4:*: ⁇ , and the first rule indicates that any packet that does not match the matching domain of the first rules A1, A2, and A3 is discarded;
  • a second matching rule is used as the second rule B4:*: ⁇ , and the second rule indicates that any packet that does not match the matching domain of the second rules B1, B2, and B3 is discarded.
  • the controller inverts each of the first rules to obtain a first anti-rule, for each of the The second rule is inverted to obtain a second anti-rule, and each of the first anti-rules and each of the second anti-rules are respectively generated according to a rule synthesizing principle, wherein the rule synthesizing principle includes : the union between the matching domain of the first anti-rule and the matching domain of the second anti-rule by the matching domain of the first anti-rule of the matching domain type and the matching domain of the second anti-ruling And the intersection of the action of the first anti-rule and the action of the second anti-rule constitutes the first execution rule, and matches the matching domain of the first anti-rule with the same matching domain type and the matching domain of the second anti-rule The first execution rule without intersection is used as an invalid rule.
  • the controller inverts the above four first rules to obtain four first anti-rules.
  • the inversion of the first rule causes the matching field of the first rule to be unchanged, and the action of the first rule is inverted.
  • the set of all actions of the control strategy is the complete set of actions obtained by the decomposition of the control strategy, so that the action is reversed to execute the remaining actions of the control strategy except the action.
  • the action of the rule obtained by the control policy decomposition is ⁇ , that is, the discarding, that is, not performing all the actions in the control policy to which the rule belongs, so the inversion is all actions in the control policy to which the rule belongs. If the action of the first rule obtained by the first control strategy decomposition is ⁇ , the action is reversed, that is, all actions in the first control strategy are performed, that is, going to S1. details as follows:
  • the first anti-rule C1 SrcAddr: 10.0.0.1: ⁇ S1 ⁇ , where ⁇ S1 ⁇ indicates the meaning of going to S1.
  • the first anti-rule C4 *: ⁇ S1 ⁇ .
  • the controller inverts the above four second rules to obtain four second anti-rules.
  • the inversion of the second rule causes the matching field of the second rule to be unchanged, and the action of the second rule is inverted.
  • the action of the second rule is ⁇
  • the inverse is to perform all the actions in the second control strategy, that is, go to S2. details as follows:
  • the second anti-rule D1 SrcAddr: 10.2.0.1: ⁇ S2 ⁇ , where ⁇ S2 ⁇ indicates the meaning of going to S2.
  • the second anti-rule D2 DstPort: 22: ⁇ S2 ⁇ .
  • the second anti-rule D4 *: ⁇ S2 ⁇ .
  • each first anti-rule is the same as the priority of the corresponding first rule
  • the priority of each second anti-rule is the same as the priority of the corresponding second rule.
  • the controller combines the four first anti-rules C1, C2, C3, and C4 with the four second anti-rules D1, D2, D3, and D4 according to the rule synthesis principle to generate 16 first execution rules.
  • the priority of the first execution rule is sorted according to the priority of the two rules for synthesizing the first execution rule, and may be specifically defined as the priority of the first rule decomposed according to the first control strategy with higher priority. Sorting is performed.
  • the second control policies are decomposed according to the lower priority to obtain the priorities of the second rules. If the first execution rule is C1D1, C1D2, C2D1, C3D2, C3D4, C4D1, the priority order is C1D1>C1D2>C2D1>C3D2>C3D4>C4D1.
  • controller can implement all the first and second rule combinations in various ways.
  • the matrix multiplication is used to perform the two-two combination.
  • the controller arranges each of the first anti-rules as elements and according to a priority order of the first rule to form a first matrix.
  • the first matrix For the column matrix, each of the second anti-rules is taken as an element and arranged in order of priority of the second rule to form a second matrix
  • the second matrix For the row matrix.
  • the rule matrix of the control strategy with high priority is used as the column matrix.
  • the priority of the first control strategy is higher than that of the second control strategy. Therefore, the first matrix is used as the column matrix, and the second matrix is the row matrix.
  • the first rule and the second rule of each pair in the first execution rule generate a first execution rule according to the rule synthesis principle described above.
  • the rule synthesis principle includes: if the matching domain of the first anti-rule and the matching domain of the second anti-rule are of the same type, determining whether there is an intersection between the matching domain of the first anti-rule and the matching domain of the second anti-rule .
  • the rule of synthesizing the first anti-rule and the second anti-rule is an invalid rule; if the first matching domain of the first anti-rule is There is an intersection between the second matching domains of the second anti-rule Then, the intersection between the matching domain of the first anti-rule and the matching domain of the second anti-rule and the intersection of the action of the first anti-rule and the action of the second anti-rule constitute a valid first execution rule.
  • the rule synthesizing principle may further include: if the inverse of the intersection of the action of the first anti-rule and the action of the second anti-rule does not intersect, then the first anti-rule and the second anti-rule
  • the rules for rule composition are also used as invalid rules.
  • the intersection of the matching domain of the first anti-rule and the matching domain of the second anti-rule and the intersection of the action of the first anti-rule and the action of the second anti-rule constitute the first execution rule, and It does not mean that the first execution rule defines only the matching domain and the action.
  • the first and second rules include other parts in addition to the matching domain and the action, the first execution rule necessarily includes the corresponding other part, and The synthesis principle of the specific other parts can be taken as an intersection or a union.
  • the matching domain of the first anti-rule C1 is an IP
  • the address 10.0.0.1 the matching field of the second anti-rule D1 is an IP address 10.2.0.1.
  • C1D2 For C1D2, where the first anti-rule C1 is: SrcAddr: 10.0.0.1: ⁇ S1 ⁇ , the second anti-rule D2 is: DstPort: 22: ⁇ S2 ⁇ , the matching domain of the first anti-rule C1 is an IP address 10.0 .0.1, the matching domain of the second anti-rule D2 is a port address 22, and the two are different types. Therefore, C1D2 takes the union of the matching domain of the first anti-rule C1 and the matching domain of the second anti-rule D2 and The intersection of the action of the first inverse rule C1 and the action of the second inverse rule D2, C1D2 is 10.0.0.1, 22: ⁇ S1 ⁇ S2 ⁇ .
  • the second anti-rule D3 is: SrcAddr: 10.2.0.0/16:
  • the matching field of the first anti-rule C1 is an IP address 10.0.0.1
  • the matching field of the second anti-rule D3 is 10.2.0.0/16 (10.2.0.1 to 10.2.255.255)
  • the two types are the same, but the IP address is 10.0.
  • C1D4 where the first anti-rule C1 is: SrcAddr: 10.0.0.1: ⁇ S1 ⁇ , the second anti-rule D4 is: *: ⁇ S2 ⁇ , the matching domain of the first anti-rule C1 is an IP address 10.0.0.1
  • the matching field of the second anti-rule D4 is a wildcard *, the type between the two is the same, so C1D4 takes the first The intersection of the matching domain of the inverse rule C1 and the matching domain of the second inverse rule D4 and the intersection of the action of the first inverse rule C1 and the action of the second inverse rule D4, C1D4 is 10.0.0.1: ⁇ S1 ⁇ S2 ⁇ .
  • C2D1 For C2D1, where the first anti-rule C2 is: DstPort: 80: ⁇ S1 ⁇ , the second anti-rule D1 is: SrcAddr: 10.2.0.1: ⁇ S2 ⁇ , the matching domain of the first anti-rule C2 is a port address 80 The matching field of the second anti-rule D1 is an IP address 10.2.0.1, which is of a different type. Therefore, C2D1 takes the union of the matching domain of the first anti-rule C2 and the matching domain of the second anti-rule D1 and The intersection of the action of the first inverse rule C2 and the action of the second inverse rule D1, C2D1 is 10.2.0.1, 80: ⁇ S1 ⁇ S2 ⁇ .
  • the matching domain of the first anti-rule C2 is a port address 80
  • the matching field of the second anti-rule D2 is a port address 22.
  • C2D3 where the first anti-rule C2 is: DstPort: 80: ⁇ S1 ⁇ , the second anti-rule D3 is: SrcAddr: 10.2.0.0/16:
  • the matching field of the first anti-rule C2 is a port address 80, and the matching field of the second anti-rule D3 is 10.2.0.0/16 (10.2.0.1 to 10.2.255.255), and the types of the two are different, so C2D3 takes the first anti- The union of the matching field of the rule C2 and the matching domain of the second anti-rule D3 and the intersection of the action of the first anti-rule C2 and the action of the second anti-rule D3, C2D3 is 10.2.0.0/16, 80:
  • C2D4 For C2D4, where the first anti-rule C2 is: DstPort: 80: ⁇ S1 ⁇ , the second anti-rule D4 is: *: ⁇ S2 ⁇ , the matching domain of the first anti-rule C2 is a port address 80, and the second counter
  • the matching field of rule D4 is a wildcard *, and the types are the same between the two. Therefore, C2D4 takes the intersection of the matching domain of the first anti-rule C2 and the matching domain of the second anti-rule D4, and the action and anti-rule of the first anti-rule C2.
  • the intersection of the second action of D4, C2D4 is 80: ⁇ S1 ⁇ S2 ⁇ .
  • the matching field of the first anti-rule C3 is a network segment address of 10.0.0.0.0/8 (10.0.0.0 to 10.255.255.255), and the second anti-rule D1
  • the matching field is an IP address 10.2.0.1, the two types are the same, and the IP address 10.2.0.1 belongs to the network segment address 10.0.0.0.0/8 (10.0.0.0 to 10.255.255.255).
  • C3D1 takes the intersection of the matching domain of the first inverse rule C3 and the matching domain of the second inverse rule D1 and the intersection of the action of the first inverse rule C3 and the action of the second inverse rule D1, C3D1 is 10.2.0.1:
  • C3D2 For C3D2, where the first inverse rule C3 is: SrcAddr: 10.0.0.0/8: The second anti-rule D2 is: DstPort: 22: ⁇ S2 ⁇ , the matching field of the first anti-rule C3 is a network segment address of 10.0.0.0.0/8 (10.0.0.0 - 10.255.255.255), and the matching of the second anti-rule D2 The domain is a port address 22, and the types of the two are different. Therefore, C3D2 takes the union of the matching domain of the first anti-rule C3 and the matching domain of the second anti-rule D2, and the action of the first anti-rule C3 and the second anti-rule D2. The intersection of the actions, C3D2 is 10.0.0.0/8, 22:
  • the matching field of the first anti-rule C3 is a network segment address of 10.0.0.0.0/8 (10.0.0.0 to 10.255.255.255), and the matching field of the second anti-rule D3 is 10.2.0.0/16 (10.2.0.1 to 10.2.255.255).
  • C3D3 takes the first The intersection of the matching domain of the inverse rule C3 and the matching domain of the second inverse rule D3 and the intersection of the action of the first inverse rule C3 and the action of the second inverse rule D3, C3D3 is 10.2.0.0/16:
  • C3D4 where the first inverse rule C3 is: SrcAddr: 10.0.0.0/8:
  • the second anti-rule D4 is: *: ⁇ S2 ⁇
  • the matching field of the first anti-rule C3 is a network segment address of 10.0.0.0.0/8 (10.0.0.0 to 10.255.255.255)
  • the matching field of the second anti-rule D4 is The wildcard * is the same type between the two, so C3D4 takes the intersection of the matching domain of the first anti-rule C3 and the matching domain of the second anti-rule D4, and the action of the first anti-rule C3 and the action of the second anti-rule D4. Intersection, C3D4 is 10.0.0.0/8:
  • the matching field of the first anti-rule C4 is a wildcard *
  • the second anti- The matching field of rule D1 is an IP address 10.2.0.1, the two types are the same, and the IP address 10.2.0.1 belongs to the wildcard *, there is an intersection between the two, so C4D1 takes the matching domain of the first anti-rule C4 and the second anti-rule.
  • the intersection of the matching fields of D1 and the intersection of the actions of the first inverse rule C4 and the actions of the second inverse rule D1, C4D1 is 10.2.0.1: ⁇ S1 ⁇ S2 ⁇ .
  • C4D2 For C4D2, where the first anti-rule C4 is: *: ⁇ S1 ⁇ , the second anti-rule D2 is: DstPort: 22: ⁇ S2 ⁇ , the matching domain of the first anti-rule C4 is a wildcard *, and the second anti-rule D2
  • the matching field is a port address 22, and the two types are the same. Therefore, C4D2 takes the intersection of the matching domain of the first anti-rule C4 and the matching domain of the second anti-rule D2, and the action of the first anti-rule C4 and the second anti-rule.
  • the intersection of the actions of D2, C4D2 is 22: ⁇ S1 ⁇ S2 ⁇ .
  • C4D3 where the first anti-rule C4 is: *: ⁇ S1 ⁇ , the second anti-rule D3 is: SrcAddr: 10.2.0.0/16:
  • the matching field of the first anti-rule C4 is a wildcard *, and the matching field of the second anti-rule D3 is 10.2.0.0/16 (10.2.0.1 - 10.2.255.255), the two types are the same, so C4D3 takes the first anti-rule C4
  • the intersection of the matching field with the matching domain of the second anti-rule D3 and the intersection of the action of the first anti-rule C4 and the action of the second anti-rule D3, C4D3 is 10.2.0.0/16:
  • C4D4 For C4D4, where the first inverse rule C4 is: *: ⁇ S1 ⁇ , the second anti-rule D4 is: *: ⁇ S2 ⁇ , the matching domain of the first anti-rule C4 is a wildcard *, and the matching of the second anti-rule D4 The domain is a wildcard *, and the types are the same between the two. Therefore, C4D4 takes the intersection of the matching domain of the first anti-rule C4 and the matching domain of the second anti-rule D4, and the action of the first anti-rule C4 and the second anti-rule D4. The intersection of the actions, C4D4 is *: ⁇ S1 ⁇ S2 ⁇ .
  • the priority of the first execution rule is first arranged in the order of the columns of the matrix, and if the same column is arranged in the row order of the matrix.
  • the priority of the first execution rule in the first execution rule matrix is: first column>second column>third column>fourth column..., and the priority of the first execution rule in the same column: first Line > Second Line > Third Line > Fourth Line... Therefore, the first execution rule C1D1 has the highest priority level, the first execution rule C1D2 has the highest priority level, ..., the first execution rule C4D4 has the lowest priority level.
  • the controller deletes the invalid rule, and the remaining first execution rule is regarded as a valid first execution rule, and each of the valid first execution rules is inverted according to a protocol supported by the first forwarding device. The translation is converted into a corresponding forwarding entry of the first forwarding device.
  • C1D1 Since C1D1 is an invalid rule, C1D1 is deleted, so it is not necessary to invert C1D1.
  • C1D3 Since C1D3 is an invalid rule, C1D3 is deleted, so C1D3 does not need to be negated.
  • the matching field is unchanged, and the action is inverted, so that the inversion of the first execution rule is 10.2.0.1, 80: among them, Therefore, the inversion of the first execution rule can be simplified to 10.2.0.1, 80: ⁇ .
  • C2D2 Since C2D2 is an invalid rule, C2D2 is deleted, so C2D2 does not need to be negated.
  • the controller converts the inversion of the valid first execution rule in the first execution rule matrix into a corresponding forwarding entry according to the protocol supported by the first forwarding device S0, so that the first forwarding device S0 is in accordance with the forwarding table.
  • the forwarding entry may be a flow entry defined in the OpenFlow protocol, or may be a forwarding entry defined in other protocols, and is not specifically limited herein.
  • the priority of the forwarding entry is the same as the priority of the corresponding first execution rule, so that the first forwarding device S0 receives the packet, and the forwarding entry with the highest priority among the forwarding entries matching the packet. Forward the packet to other forwarding devices, such as S1 or S2.
  • the controller receives the third control policy and The third control strategy is decomposed into k third rules, and k is a natural number.
  • the above-mentioned effective first execution rule is inverted to obtain a first anti-execution rule
  • the third rule is inverted to obtain a third anti-rule.
  • the rule synthesis principle content is similar to the rule synthesis content described above: the first reverse execution of the intersection between the matching domain of the first anti-execution rule with the same matching domain type and the matching domain of the third anti-rule a union between the matching domain of the rule and the matching domain of the third anti-rule, and an intersection of the action of the first anti-execution rule and the action of the third anti-rule constitutes the second execution rule, and the matching domain type is the same
  • the second execution rule having no intersection between the matching domain of the first anti-execution rule and the matching domain of the third anti-rule is regarded as an invalid rule.
  • the specific process is similar to the above process, and will not be described here.
  • the second control policy is determined by decomposing the first control strategy into m first rules. Slightly decomposed into n second rules, and synthesize each first rule and second rule according to the rule synthesis principle, since the rule synthesis principle will match the matching field of the first anti-rule with the same match type and the second
  • the first execution rule with no intersection between the matching domains of the anti-rule is regarded as an invalid rule.
  • the invalid rule defined above is the rule part that causes the conflict between the first and second control policies, so the deletion of the invalid rule with conflicts is avoided.
  • the conflicting rule situation exists between the first control policy and the second control policy, that is, the policy conflict problem is solved, so that the first forwarding can perform both the first control policy and the second control policy.
  • FIG. 3 is a flowchart of an implementation manner of a policy conflict resolution method according to the present application.
  • This embodiment is the same as the steps 210 and 220 of the embodiment shown in FIG. 2, and the difference is that the step 230 specifically includes:
  • the controller deletes the invalid rule.
  • the controller compares the remaining matching fields of each of the two first execution rules. If the matching domain of one of the first execution rules covers the matching domain of another first execution rule, the first execution rule with a smaller matching domain is matched. If the matching fields of the two first execution rules are the same, the first execution rule with a lower priority level is deleted, and the first execution rule with the smaller matching domain and the first execution with the lower priority are executed. The first execution rule remaining after the rule is deleted is regarded as a valid first execution rule.
  • the controller compares the matching fields of each of the two first execution rules remaining after the invalidation rule in the first execution rule matrix, and of course, only the matching domain has the same matching domain of every two first execution rules. Comparison.
  • the matching domain 10.0.0.1 of the first execution rule C1D4 that is, the matching domain of the first execution rule C1D2 is smaller. Therefore, the first execution rule C1D2 can be deleted; the matching domain of the first execution rule C3D1 is 10.2.0.1, and the matching domain 10.2.0.1, 80 of the first execution rule C2D1 is overwritten, that is, the matching domain of the first execution rule C2D1 is smaller. Therefore, the first execution rule C2D1 can be deleted. It is found that the matching domain of the first execution rule C3D1 is 10.2.0.1 and the matching domain 10.2.0.1 of the first execution rule C4D1, wherein the matching domains are the same, the matching conditions are all the same, or the matching conditions of both may be the same.
  • the port number, and one of the matching fields only includes the matching condition of the above port number, and the first execution rule C3D1 has a higher priority level, so the first execution rule C4D1 is deleted.
  • the matching domain of the first execution rule C3D3 is the same as the matching domain of the first execution rule C4D3.
  • the priority level of the first execution rule C3D3 is higher than the priority level of the first execution rule C4D3, so the first execution rule C4D3 is deleted.
  • the matching field of the first execution rule C4D2 is 22, including only the port number, and the matching field of the first execution rule C3D2 is 10.0.0.0/8, 22, which includes not only the port number but also the matching fields of the two, the first The priority level of the execution rule C3D2 is higher than the priority level of the first execution rule C4D2, so the first execution rule C4D2 is deleted.
  • R1:10.0.0.1: ⁇ means: The R&D department server cannot access the external network through S1.
  • the action ⁇ of R1 indicates that all actions that do not go to the first control policy do not go to S1.
  • the discarding action of the following rules is the same.
  • R3:80: ⁇ means: R&D department employees cannot access external networks through S1.
  • R5:10.0.0.0/8,22: ⁇ S1 ⁇ means: R&D department employees access the internal network from S1.
  • R6: 10.2.0.0/16: ⁇ S1, S2 ⁇ means: the pre-research team members access the external network from S2 and access the internal network from S1.
  • R7:10.0.0.0/8: ⁇ S1 ⁇ means: R&D department employees access the internal network from S1.
  • R8:*: ⁇ when the packet cannot match the matching field of the first execution rule R1 to R8, the packet is discarded.
  • the matching fields of each of the remaining two valid first execution rules are not completely overlapped, and the forwarding may be performed according to the priority of the conversion entry, thereby avoiding the occurrence of the conflict and further solving the conflict policy.
  • the controller converts each of the valid first execution rules into a forwarding entry corresponding to the first forwarding device according to a protocol supported by the first forwarding device.
  • the controller When the conflicting control policy further includes a third control policy, that is, the third control policy and the first and second control policies are both applied to the first forwarding device S0, the controller generates the first The rules are executed and converted into the corresponding forwarding entries of the first forwarding device S0.
  • FIG. 4 is a flowchart of an embodiment of a policy conflict resolution apparatus of the present application.
  • the policy conflict resolution device of this embodiment includes a receiving module 410, a synthesizing module 420, and a deleting module 430.
  • the receiving module 410 is configured to receive a first control policy and decompose the first control policy into m first rules, and receive a second control policy and decompose the second control policy into n second rules
  • m, n are natural numbers
  • the first control policy and the second control policy are both applied to the first forwarding device
  • the first rule and the second rule both include a matching domain and an action
  • the receiving module 410, the m first rule and the n second rule are sent to the synthesizing module 420;
  • the synthesizing module 420 is configured to receive the m first rules and the n second rules, and invert each of the first rules to obtain a first anti-rule, and take the second rule for each In order to obtain the second anti-rule, each of the first anti-rules and each of the second anti-rules respectively generate a corresponding first execution rule according to a rule synthesis principle, wherein the rule synthesis principle includes: matching The union between the matching domain of the first anti-rule of the same domain type and the matching domain of the second anti-rule, or the matching domain of the matching domain of the first anti-rule and the matching domain of the second anti-rule, and the An intersection of an action of the anti-rule and an action of the second anti-rule constitutes the first execution rule, and there is no intersection between the matching domain of the first anti-rule of the same matching domain type and the matching domain of the second anti-rule
  • the first execution rule is used as the invalid rule, and the synthesizing module 420 sends the synthe
  • the deleting module 430 is configured to receive the synthesized first execution rule, delete the invalid rule, and use the remaining first execution rule as a valid first execution rule, and each of the valid first execution rules After being inverted, the protocol is converted to the corresponding forwarding entry of the first forwarding device according to the protocol supported by the first forwarding device.
  • the synthesizing module 420 is further configured to: each of the first anti-rules as elements and are arranged according to a priority order of the first rule to form a first matrix, where the first matrix is a column matrix, and each The second anti-rule is arranged as an element and arranged according to a priority order of the second rule to form a second matrix, the second matrix is a row matrix, and the first matrix is multiplied by the second matrix to obtain a Executing a rule matrix, generating a first execution rule according to the rule synthesis principle by the first inverse rule multiplied by each pair in the first execution rule matrix, wherein the first execution rule The priority of the first execution rule of the rule matrix is first arranged in the order of the columns of the matrix, and the same columns are arranged in the order of the rows of the matrix.
  • the synthesizing module 420 is further configured to: after the decomposing into the m first rules, add a first matching rule as the first rule with the lowest priority; and decompose the n rules into the second rule. After that, a second matching rule is added as the second rule with the lowest priority.
  • the matching fields of the first matching rule and the second matching rule are all wildcards, and the actions are discarded.
  • the receiving module 410 is further configured to receive a third control policy and decompose the third control policy into k third rules, where k is a natural number, and the third control policy is related to the first The second control policy is applied to the first forwarding device, and the receiving module 410 sends the k third rules to the synthesizing module 420;
  • the inversion module 420 is further configured to receive the k third rules, invert each of the valid first execution rules to obtain each first anti-execution rule, and invert each of the third rules
  • each of the first anti-execution rules is arranged as an element and arranged according to a priority order of the first execution rule to form a third matrix
  • the third matrix is a column matrix
  • each piece The third anti-rule is arranged as an element and arranged according to a priority order of the third rule to form a fourth matrix
  • the fourth matrix is a row matrix
  • the third matrix is multiplied by the fourth matrix to obtain a second matrix Executing a rule matrix, respectively generating the first anti-execution rule multiplied by each pair in the second execution rule matrix and the third anti-rule according to the rule synthesis principle to generate a corresponding second execution rule
  • the rule synthesis principle further includes: a matching domain and a third anti-rule of the first anti-execution rule different from the matching domain of the first anti
  • the deleting module 430 is configured to receive the synthesized second execution rule, delete the invalid rule, and convert each remaining second execution rule to be converted according to a protocol supported by the first forwarding device to The forwarding device corresponding to the first forwarding device.
  • the policy conflict resolution device of the present embodiment is capable of executing the method as shown in FIG. 2.
  • the synthesizing module is further configured to compare the remaining matching fields of each of the two first execution rules after deleting the invalid rule, if the matching domain of one of the first execution rules covers another first execution rule If the matching domain of the first execution rule is the same, the first execution rule with the lower priority level is deleted, and the matching domain is smaller.
  • the first execution rule and the first execution rule remaining after the deletion of the lower priority first execution rule are regarded as valid first execution rules.
  • the conflicting control policy further includes a third control policy, that is, the third control policy and the first and second control policies are both applied to the first forwarding device S0
  • the device is generated by the process of the foregoing embodiment.
  • the second execution rule is converted into a corresponding forwarding entry of the first forwarding device S0, and details are not described herein.
  • the policy conflict resolution device of the present embodiment is capable of executing the method as shown in FIG.
  • the first control strategy is decomposed into m first rules
  • the second control strategy is decomposed into n second rules
  • each first rule and the second rule are synthesized according to the rule synthesis principle. Since the rule synthesis principle uses the first execution rule with no intersection between the matching domain of the first anti-rule with the same matching domain type and the matching domain of the second anti-rule as an invalid rule, the invalid rule defined above is the first rule.
  • the second control strategy conflicts with the rule part. Therefore, by deleting the invalid rule with conflict, the conflict rule between the first control policy and the second control policy is avoided, that is, the policy conflict problem is solved, so that the first forwarding is
  • the second control strategy can also be executed by executing the first control strategy.
  • FIG. 5 is a schematic structural diagram of an embodiment of a controller according to the present application.
  • the controller 500 of the present embodiment is a receiver 501, a processor 502, a transmitter 503, a memory 504, and a bus 505.
  • the receiver 501 is configured to receive the first control policy and the second control policy.
  • the processor 502 is configured to:
  • the policies all apply to the first forwarding device, and the first rule and the second rule both include a matching domain and an action;
  • the rule synthesis principle comprises: an intersection or matching between the matching domain of the first anti-rule with the same matching domain type and the matching domain of the second anti-rule a union between the matching domain of the first anti-rule of the domain type and the matching domain of the second anti-rule, and the intersection of the action of the first anti-rule and the action of the second anti-rule constitutes the first execution rule, And the first execution rule that has no intersection between the matching domain of the first anti-rule matching the same domain type and the matching domain of the second anti-rule is regarded as an invalid rule;
  • the sender 503 is configured to send the forwarding entry.
  • Memory 504 can include read only memory and random access memory and provides instructions and data to processor 502. A portion of the memory 504 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • Memory 504 stores the following elements, executable modules or data structures, or subsets thereof, or their extended sets:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 502 performs the above operations by calling an operation instruction stored in the memory 504, which can be stored in the operating system.
  • the processor 502 may also be referred to as a CPU (Central Processing Unit).
  • Memory 504 can include read only memory and random access memory and provides instructions and data to processor 502.
  • a portion of the memory 504 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the various components of the controller are coupled together by a bus system 505.
  • the bus system 505 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 505 in the figure.
  • Processor 502 may be an integrated circuit chip with signal processing capabilities. In reality In the present process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 502 or an instruction in the form of software.
  • the processor 502 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in memory 504, and processor 502 reads the information in memory 504 and, in conjunction with its hardware, performs the steps of the above method.
  • the processor 502 is further configured to: each of the first anti-rules as an element and are arranged according to a priority order of the first rule to form a first matrix, where the first matrix is a column matrix, and each of the The second anti-rule is arranged as an element and arranged according to a priority order of the second rule to form a second matrix, the second matrix is a row matrix, and the first matrix is multiplied by the second matrix to obtain a first execution a rule matrix, the first execution rule ruled by the first anti-rule and the second anti-rule multiplied by each pair in the first execution rule matrix according to the rule synthesis principle, wherein the first execution rule matrix
  • the priority of the first execution rule is first arranged in the order of the columns of the matrix, and the same columns are arranged in the order of the rows of the matrix.
  • the processor 502 is further configured to: after the decomposed into the m first rules, add a first matching rule as the first rule with the lowest priority; after the decomposing into the n second rules, A second matching rule is added as the second rule with the lowest priority.
  • the matching fields of the first matching rule and the second matching rule are all wildcards, and the actions are discarded.
  • the processor 502 is further configured to compare the remaining matching fields of each of the two first execution rules after deleting the invalid rule, if the matching domain of one of the first execution rules covers another first execution rule. If the matching domain is the same, the first execution rule with the smaller matching domain is deleted. If the matching domains of the two first execution rules are the same, the first execution rule with the lower priority is deleted, and the matching domain is smaller. An execution rule and the remaining lower priority first execution rule after deletion The first execution rule is used as a valid first execution rule.
  • the receiver 501 is further configured to receive a third control policy and decompose the third control policy into k third rules, where k is a natural number, and the third control policy is related to the first
  • the second control policy is applied to the first forwarding device.
  • the processor 502 is further configured to invert each valid first execution rule to obtain each of the first anti-execution rules, and take each third rule.
  • each of the first anti-execution rules is arranged as an element and arranged in a priority order of the first execution rule to form a third matrix, and the third matrix is a column matrix.
  • Each of the third anti-rules is arranged as an element and arranged in order of priority of the third rule to form a fourth matrix, the fourth matrix is a row matrix, and the third matrix is multiplied by the fourth matrix Obtaining a second execution rule matrix, respectively generating the first anti-execution rule multiplied by each pair in the second execution rule matrix and the third anti-rule according to the rule synthesis principle to generate a corresponding second execution rule, where , the rule synthesis principle
  • the method includes: matching between the matching domain of the first anti-execution rule and the matching domain of the third anti-rule by the matching domain of the first anti-execution rule of the same matching domain type and the matching domain of the third anti-rule a union of the first anti-execution rule and the third anti-rule action
  • the second execution rule that has no intersection between the matching fields of the rule is used as the invalid rule, and the invalid rule is deleted, and each of the remaining second execution rules is inverted, and then converted according to the protocol supported by the first
  • the first control strategy is decomposed into m first rules
  • the second control strategy is decomposed into n second rules
  • each first rule and the second rule are synthesized according to the rule synthesis principle. Since the rule synthesis principle uses the first execution rule with no intersection between the matching domain of the first anti-rule with the same matching domain type and the matching domain of the second anti-rule as an invalid rule, the invalid rule defined above is the first rule.
  • the second control strategy conflicts with the rule part. Therefore, by deleting the invalid rule with conflict, the conflict rule between the first control policy and the second control policy is avoided, that is, the policy conflict problem is solved, so that the first forwarding is
  • the second control strategy can also be executed by executing the first control strategy.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device implementations described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • Another point, shown or discussed The mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种策略冲突解决方法以及装置。所述方法包括：接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则；对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则；删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。通过上述方式，能够解决策略冲突。

Description

策略冲突解决方法以及装置
本申请要求于2014年7月21日提交中国专利局、申请号为CN 201410348832.2、发明名称为“策略冲突解决方法以及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，特别是涉及策略冲突解决方法以及装置。
背景技术
软件定义网络(Software Defined Network，SDN)是一种新型网络架构，与传统网络所采用的查找IP路由相比，SDN/OpenFlow能够实现网络流量的灵活控制，为核心网络及应用的创新提供良好的平台，是今后网络架构发展的方向。
如图1所示，SDN通常包括控制器110以及转发设备120两部分。控制器110分别与网络中的每一个转发设备120连接，网络中的转发设备120之间拓扑连接。控制器110负责对网络进行集中控制，即控制器110接收到控制策略后，根据控制策略生成转发路径，为各个转发设备120生成转发表项。转发设备120在接收到转发表项后，根据接收到的转发表项对用户终端发送的报文进行匹配和转发。
但是，在一些情况下，控制器110接收到的一些策略之间可能会存在冲突。
例如，研发部门的日常工作涉及到公司的机密，研发部门是严禁访问外部网络的，只能访问公司的内部网络。所以，管理员针对研发部门的性质，可能会给控制器下发策略1，该策略1作用于转发设备S0，由转发设备S0将满足策略1的用户终端的报文转发给SDN中的其他转发设备，再由其他转发设备转发到相应网络如外部网络或内部网络：
策略1：研发部门服务器不能访问外部网络，所有研发部门的员工可以从转发设备S1访问公司的内部网络。
同时，对于研发部门中的预研小组，他们必须访问外部网络才能进行资料收集工作。所以，管理员针对预研小组的性质，可能会给控制器下发策略2， 该策略2也作用于转发设备S0，由转发设备S0满足策略2的用户终端的报文转发给SDN中的其他转发设备，再由其他转发设备转发到相应网络如外部网络或内部网络：
策略2：预研小组服务器不能访问安全壳(Secure Shell，SSH)服务，预研小组员工可以通过转发设备S2访问外部网络。
从上面的两条策略可以分析出，按照设想，预研小组员工应该能访问外部网络。但是，实际上，由于预研小组是研发部门的一部分，在策略1中，是禁止所有的研发部门的员工访问外部网络的。控制器110接收到这两条冲突的控制策略后，控制器110无法进行处理，于是，控制器110只能将优先级别最高的策略转化为转发表项发送给转发设备S0，使得转发设备S0只根据优先级别最高的策略转发报文。针对研发部门下发的策略1优先级高于针对预研小组下发的策略2，所以，转发设备S0只会根据策略1转发报文，却不会根据策略2转发报文，导致预研小组一直无法访问外部网络。
发明内容
本申请提供一种策略冲突解决方法以及装置，能够解决策略冲突。
本申请第一方面提供一种策略冲突解决方法，所述方法包括：接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作；对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则；删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转 发设备相应的转发表项。
结合第一方面，本申请第一方面的第一种可能的实施方式中，对每条所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对每条所述第二规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反。
结合第一方面的第一种可能的实施方式，本申请第一方面的第二种可能的实施方式中，所述分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，包括：将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
结合第一方面的第二种可能的实施方式，本申请第一方面的第三种可能的实施方式中，所述分解成m条第一规则之后还包括：新增一条第一匹配规则作为优先级最低的第一规则；所述分解成n条第二规则之后还包括：新增一条第二匹配规则作为优先级最低的第二规则；其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
结合第一方面的第二种可能的实施方式，本申请第一方面的第四种可能的实施方式中，所述将剩余的所述第一执行规则作为有效第一执行规则包括：比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
结合第一方面的第二或四种可能的实施方式，本申请第一方面的第五种可能的实施方式中，所述方法还包括：接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备；对每条所述有效第一执行规则取反以 得到每条第一反执行规则，对每条所述第三规则取反以得到每条第三反规则；将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则；删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
本申请第二方面提供一种策略冲突解决装置，包括：接收模块、合成模块以及删除模块，所述接收模块用于接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作，所述接收模块将所述m条第一规则以及所述n条第二规则发送给所述合成模块；所述合成模块用于接收所述m条第一规则以及所述n条第二规则，对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，所述合成模块将合成的第一执行规则发送给所述删除模块；所述删除模块用于接收所述合成的第一执行规则，删除所述无效规 则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
结合第二方面，本申请第二方面的第一种可能的实施方式中，对所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对所述第二规则取反即令所述第二规则的匹配域不变、所述第二规则的动作取反。
结合第二方面的第一种可能的实施方式，本申请第二方面的第二种可能的实施方式中，所述合成模块还用于将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
结合第二方面的第二种可能的实施方式，本申请第二方面的第三种可能的实施方式中，所述合成模块还用于在所述分解成m条第一规则之后，新增一条第一匹配规则作为优先级最低的第一规则；在所述分解成n条第二规则之后，新增一条第二匹配规则作为优先级最低的第二规则；其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
结合第二方面的第二种可能的实施方式，本申请第二方面的第四种可能的实施方式中，所述合成模块还用于在删除所述无效规则之后，比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级别较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
结合第二方面的第二或四种可能的实施方式，本申请第二方面的第五种可能的实施方式中，所述接收模块还用于接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第 二控制策略均作用于所述第一转发设备，所述接收模块将所述k条第三规则发送给所述合成模块；所述合成模块还用于接收所述k条第三规则，对每条所述有效第一执行规则取反以得到每条第一反执行规则，对每条所述第三规则取反以得到每条第三反规则，将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则，所述合成模块将合成的第二执行规则发送给所述删除模块；所述删除模块还用于接收所述合成的第二执行规则，删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
上述方案中，通过将第一控制策略分解成m条第一规则，将第二控制策略分解成n条第二规则，并根据规则合成原则来将每条第一规则和第二规则进行合成，由于该规则合成原则会将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，上述定义的无效规则即为导致第一、第二控制策略冲突的规则部分，故通过将存在冲突的无效规则删除，避免了第一控制策略和第二控制策略间存在的冲突规则情况，即解决了策略冲突问题，使得第一转发既能执行第一控制策略也能执行第二控制策略。
附图说明
图1是现有技术软件定义网络一实施方式的结构示意图；
图2是本申请策略冲突解决方法一实施方式的流程图；
图3是本申请策略冲突解决方法另一实施方式的流程图；
图4是本申请策略冲突解决装置一实施方式的结构示意图；
图5是本申请控制器一实施方式的结构示意图。
具体实施方式
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、接口、技术之类的具体细节，以便透彻理解本申请。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施方式中也可以实现本申请。在其它情况中，省略对众所周知的装置、电路以及方法的详细说明，以免不必要的细节妨碍本申请的描述。
参阅图2，图2是本申请策略冲突解决方法一实施方式的流程图。图2中各步骤的执行主体可以是SDN中的控制器，也可以是SDN中的协同层中的服务器。下面以控制器作为执行主体来举例，包括：
210：控制器接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，即第一转发设备既需要根据第一控制策略转发相应报文，也需要根据第二控制策略转发相应报文。所述第一规则和第二规则均包括匹配域和动作。
下面以背景技术中提到的两条策略分别作为第一控制策略和第二控制策略为例进行说明。其中，分解原则是拆分成功能最小的策略原子，即拆封出来的规则不能再拆分为止。
控制器接收到作用于第一转发设备S0的第一控制策略“研发部门服务器不能访问外部网络，所有研发部门的员工可以从转发设备S1访问公司的内部网络”，其中，研发部门的员工的IP地址位于网段10.0.0.0/8(即网段10.0.0.1～10.255.255.255)，“\”表示除了，研发部门服务器的IP地址为10.0.0.1，∪表示为或者，端口80用于访问外部网络，->{S1}表示通过转发设备S1。所以，第一控制策略可描述为：SrcAddr：10.0.0.0/8\(SrcAddr：10.0.0.1∪DstPort：80)->{S1}。控制器对第一控制策略进行分解，可以得到三条第一规则：
(1)研发部门服务器10.0.0.1不能通过转发设备S1以访问外部网络。
第一规则A1：SrcAddr：10.0.0.1：{}，其中，{}中的内容为空，表示丢 弃的意思。其中，本申请中的丢弃即为不执行该控制策略中的所有动作，如第一控制策略的动作为去往S1，由第一控制策略的分解得到的第一规则中的丢弃动作则为不去往S1。
(2)研发部门员工不能通过转发设备S1以访问外部网络。
第一规则A2：DstPort：80：{}。
(3)研发部门员工通过转发设备S1访问内部网络。
第一规则A3：SrcAddr：10.0.0.0/8：{S1}，其中，{S1}表示去往S1。
控制器接收到作用于第一转发设备S0的第二控制策略“预研小组服务器不能访问SSH服务，预研小组员工可以通过转发设备S2访问外部网络”，其中，预研小组员工的IP地址位于网段10.2.0.0/16(即网段10.2.0.1～10.2.255.255)，“\”表示除了，预研服务器的IP地址为10.2.0.1，∪表示为或者，端口22用于访问SSH服务。所以，第二控制策略可描述为：SrcAddr：10.2.0.0/16\(SrcAddr：10.2.0.1∪DstPort：22)->{S2}。控制器对第二控制策略进行分解，可以得到三条第二规则：
(1)预研服务器10.2.0.1不能通过转发设备S2以访问SSH服务。
第二规则B1：SrcAddr：10.2.0.1：{}，其中，{}中的内容为空，表示丢弃的意思。
(2)预研员工不能通过转发设备S2以访问SSH服务。
第二规则B2：DstPort：22：{}
(3)预研员工从转发设备S2访问外部网络。
第二规则B3：SrcAddr：10.2.0.0/16：{S2}
可以理解的是，按照第一控制策略的描述可知，第一规则的优先级依序为A1>A2>A3；按照第二控制策略的描述可知，第二规则的优先级依序为B1>B2>B3。
为了达到完全覆盖的效果，可在第一规则和第二规则中均新增一条优先级最低的匹配规则，该匹配规则的匹配域为通配符，动作为丢弃。具体如新增一条第一匹配规则作为第一规则A4：*：{}，该第一规则表示：凡是没和第一规则A1、A2以及A3的匹配域匹配的报文都进行丢弃；新增一条第二匹配规则作为第二规则B4：*：{}，该第二规则表示：凡是没和第二规则B1、B2以及B3的匹配域匹配的报文都进行丢弃。
220：控制器对每条所述第一规则取反以得到第一反规则，对每条所述第 二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则。
控制器对上述四条第一规则取反以得到四条第一反规则。其中，对第一规则取反即令第一规则的匹配域不变、第一规则的动作取反。可以理解的是，控制策略的所有动作的集合即为该控制策略分解得到的动作的全集，故对其中动作取反即为执行该控制策略中除该动作外的剩余动作。对于控制策略分解得到的规则的动作为{}，即表示丢弃，即不执行该规则所属的控制策略中的所有动作，故取反为执行该规则所属的控制策略中的所有动作。如第一控制策略分解得到的第一规则的动作为{}，其动作取反即为执行第一控制策略中的所有动作即去往S1。具体如下：
第一反规则C1：SrcAddr：10.0.0.1：{S1}，其中，{S1}表示去往S1的意思。
第一反规则C2：DstPort：80：{S1}。
第一反规则C3：SrcAddr：10.0.0.0/8：
Figure PCTCN2015083379-appb-000001
其中，
Figure PCTCN2015083379-appb-000002
表示不去往S1的意思。
第一反规则C4：*：{S1}。
控制器对上述四条第二规则取反以得到四条第二反规则。其中，对第二规则取反即令第二规则的匹配域不变、第二规则的动作取反。同理，若第二规则的动作为{}，取反即为执行第二控制策略中的所有动作即去往S2。具体如下：
第二反规则D1：SrcAddr：10.2.0.1：{S2}，其中，{S2}表示去往S2的意思。
第二反规则D2：DstPort：22：{S2}。
第二反规则D3：SrcAddr：10.2.0.0/16：
Figure PCTCN2015083379-appb-000003
其中，
Figure PCTCN2015083379-appb-000004
表示不去往S2的意思。
第二反规则D4：*：{S2}。
其中，每条第一反规则的优先级与相应的第一规则的优先级相同，每条第二反规则的优先级与相应的第二规则的优先级相同。
控制器将四条第一反规则C1、C2、C3、C4分别与四条第二反规则D1、D2、D3、D4按照规则合成原则进行两两组合，生成16条第一执行规则。其中，第一执行规则的优先级按照合成该第一执行规则的两条规则的优先级进行排序，具体可定义为先按照优先级较高的第一控制策略分解得到的第一规则的优先级进行排序，当第一规则优先级相同再按照优先级较低的第二控制策略分解得到第二规则的优先级进行排列。如得到的第一执行规则为C1D1，C1D2，C2D1，C3D2，C3D4，C4D1，则优先级依序为C1D1>C1D2>C2D1>C3D2>C3D4>C4D1。
可以理解的是，控制器可采用各种方式实现所有第一、第二规则两两组合。下面，为使生成的第一执行规则的优先级按照矩阵元素顺序排列，采用矩阵相乘方式进行两两组合。
具体地，控制器将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵
Figure PCTCN2015083379-appb-000005
所述第一矩阵
Figure PCTCN2015083379-appb-000006
为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵
Figure PCTCN2015083379-appb-000007
所述第二矩阵
Figure PCTCN2015083379-appb-000008
为行矩阵。一般，将优先级高的控制策略的规则矩阵作为列矩阵，本例第一控制策略的优先级高于第二控制策略，故以第一矩阵为列矩阵，第二矩阵为行矩阵。
令所述第一矩阵与所述第二矩阵相乘，得到第一矩阵的每个第一规则和第二矩阵的每个第二规则的两两相乘组合构成第一执行规则矩阵：
Figure PCTCN2015083379-appb-000009
其中，第一执行规则中的每对相乘的第一规则与第二规则按照上述规则合成原则生成第一执行规则。该规则合成原则包括：如果第一反规则的匹配域与第二反规则的匹配域是同一种类型时，则判断第一反规则的匹配域与第二反规则的匹配域之间是否有交集。如果第一反规则的匹配域与第二反规则的匹配域之间没有交集时，该第一反规则和第二反规则合成的规则为无效规则；如果第一反规则的第一匹配域与第二反规则的第二匹配域之间存在交集 时，则由第一反规则的匹配域与第二反规则的匹配域之间的交集以及第一反规则的动作与第二反规则的动作的交集组成有效的第一执行规则。如果第一反规则的匹配域与第二反规则的匹配域不是同一种类型时，则由第一反规则的匹配域与第二反规则的匹配域的并集以及第一反规则的动作与第二反规则的动作的交集组成有效的第一执行规则。当然，在其他应用实施例中，该规则合成原则还可包括：若第一反规则的动作与第二反规则的动作的交集的取反没有交集，则将该第一反规则和第二反规则合成的规则也作为无效规则。
可以理解的是，上述由第一反规则的匹配域与第二反规则的匹配域的交集或并集以及第一反规则的动作与第二反规则的动作的交集组成第一执行规则，并不意味着第一执行规则限定只包括匹配域和动作，在第一、第二规则除匹配域和动作外还包括其他部分的实施例中，该第一执行规则也必然包括相应其他部分，而具体其他部分的合成原则可按照实际取其交集或并集。
具体地：
对于C1D1，其中，第一反规则C1为：SrcAddr：10.0.0.1：{S1}，第二反规则D1为：SrcAddr：10.2.0.1：{S2}，第一反规则C1的匹配域为一个IP地址10.0.0.1，第二反规则D1的匹配域为一个IP地址10.2.0.1，两者之间尽管是同一类型，但是两者之间没有交集，所以，C1D1为无效规则。
对于C1D2，其中，第一反规则C1为：SrcAddr：10.0.0.1：{S1}，第二反规则D2为：DstPort：22：{S2}，第一反规则C1的匹配域为一个IP地址10.0.0.1，第二反规则D2的匹配域为一个端口地址22，两者之间为不同类型，所以，C1D2取第一反规则C1的匹配域与第二反规则D2的匹配域的并集以及第一反规则C1的动作与第二反规则D2的动作的交集，C1D2为10.0.0.1,22：{S1∩S2}。
对于C1D3，其中，第一反规则C1为：SrcAddr：10.0.0.1：{S1}，第二反规则D3为：SrcAddr：10.2.0.0/16：
Figure PCTCN2015083379-appb-000010
第一反规则C1的匹配域为一个IP地址10.0.0.1，第二反规则D3的匹配域为10.2.0.0/16(10.2.0.1～10.2.255.255)，两者类型相同，但是，IP网址10.0.0.1与网段10.2.0.0/16之间没有任何交集，所以，C1D3为无效规则。
对于C1D4，其中，第一反规则C1为：SrcAddr：10.0.0.1：{S1}，第二反规则D4为：*：{S2}，第一反规则C1的匹配域为一个IP地址10.0.0.1，第二反规则D4的匹配域为通配符*，两者之间类型相同，所以，C1D4取第一 反规则C1的匹配域与第二反规则D4的匹配域的交集以及第一反规则C1的动作与第二反规则D4的动作的交集，C1D4为10.0.0.1：{S1∩S2}。
对于C2D1，其中，第一反规则C2为：DstPort：80：{S1}，第二反规则D1为：SrcAddr：10.2.0.1：{S2}，第一反规则C2的匹配域为一个端口地址80，第二反规则D1的匹配域为一个IP地址10.2.0.1，两者之间为不同类型，所以，C2D1取第一反规则C2的匹配域与第二反规则D1的匹配域的并集以及第一反规则C2的动作与第二反规则D1的动作的交集，C2D1为10.2.0.1,80：{S1∩S2}。
对于C2D2，其中，第一反规则C2为：DstPort：80：{S1}，第二反规则D2为：DstPort：22：{S2}，第一反规则C2的匹配域为一个端口地址80，第二反规则D2的匹配域为一个端口地址22，两者之间尽管是同一类型，但是两者之间没有交集，所以，C2D2为无效规则。
对于C2D3，其中，第一反规则C2为：DstPort：80：{S1}，第二反规则D3为：SrcAddr：10.2.0.0/16：
Figure PCTCN2015083379-appb-000011
第一反规则C2的匹配域为一个端口地址80，第二反规则D3的匹配域为10.2.0.0/16(10.2.0.1～10.2.255.255)，两者类型不同，所以，C2D3取第一反规则C2的匹配域与第二反规则D3的匹配域的并集以及第一反规则C2的动作与第二反规则D3的动作的交集，C2D3为10.2.0.0/16,80：
Figure PCTCN2015083379-appb-000012
对于C2D4，其中，第一反规则C2为：DstPort：80：{S1}，第二反规则D4为：*：{S2}，第一反规则C2的匹配域为一个端口地址80，第二反规则D4的匹配域为通配符*，两者之间类型相同，所以，C2D4取第一反规则C2的匹配域与第二反规则D4的匹配域的交集以及第一反规则C2的动作与反规则D4的第二动作的交集，C2D4为80：{S1∩S2}。
对于C3D1，其中，第一反规则C3为：SrcAddr：10.0.0.0/8：
Figure PCTCN2015083379-appb-000013
第二反规则D1为：SrcAddr：10.2.0.1：{S2}，第一反规则C3的匹配域为一个网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，第二反规则D1的匹配域为一个IP地址10.2.0.1，两者类型相同，而且IP地址10.2.0.1属于网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，两者之间存在交集，所以，C3D1取第一反规则C3的匹配域与第二反规则D1的匹配域的交集以及第一反规则C3的动作与第二反规则D1的动作的交集，C3D1为10.2.0.1：
Figure PCTCN2015083379-appb-000014
对于C3D2，其中，第一反规则C3为：SrcAddr：10.0.0.0/8：
Figure PCTCN2015083379-appb-000015
第二 反规则D2为：DstPort：22：{S2}，第一反规则C3的匹配域为一个网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，第二反规则D2的匹配域为一个端口地址22，两者类型不同，所以，C3D2取第一反规则C3的匹配域与第二反规则D2的匹配域的并集以及第一反规则C3的动作与第二反规则D2的动作的交集，C3D2为10.0.0.0/8,22：
Figure PCTCN2015083379-appb-000016
对于C3D3，其中，第一反规则C3为：SrcAddr：10.0.0.0/8：
Figure PCTCN2015083379-appb-000017
第二反规则D3为：SrcAddr：10.2.0.0/16：
Figure PCTCN2015083379-appb-000018
第一反规则C3的匹配域为一个网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，第二反规则D3的匹配域为10.2.0.0/16(10.2.0.1～10.2.255.255)，两者类型相同，且网段地址10.2.0.0/16(10.2.0.1～10.2.255.255)属于网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，所以，C3D3取第一反规则C3的匹配域与第二反规则D3的匹配域的交集以及第一反规则C3的动作与第二反规则D3的动作的交集，C3D3为10.2.0.0/16：
Figure PCTCN2015083379-appb-000019
对于C3D4，其中，第一反规则C3为：SrcAddr：10.0.0.0/8：
Figure PCTCN2015083379-appb-000020
第二反规则D4为：*：{S2}，第一反规则C3的匹配域为一个网段地址10.0.0.0/8(10.0.0.0～10.255.255.255)，第二反规则D4的匹配域为通配符*，两者之间类型相同，所以，C3D4取第一反规则C3的匹配域与第二反规则D4的匹配域的交集以及第一反规则C3的动作与第二反规则D4的动作的交集，C3D4为10.0.0.0/8：
Figure PCTCN2015083379-appb-000021
对于C4D1，其中，第一反规则C4为：*：{S1}，第二反规则D1为：SrcAddr：10.2.0.1：{S2}，第一反规则C4的匹配域为通配符*，第二反规则D1的匹配域为一个IP地址10.2.0.1，两者类型相同，且IP地址10.2.0.1属于通配符*，两者存在交集，所以，C4D1取第一反规则C4的匹配域与第二反规则D1的匹配域的交集以及第一反规则C4的动作与第二反规则D1的动作的交集，C4D1为10.2.0.1：{S1∩S2}。
对于C4D2，其中，第一反规则C4为：*：{S1}，第二反规则D2为：DstPort：22：{S2}，第一反规则C4的匹配域为通配符*，第二反规则D2的匹配域为一个端口地址22，两者类型相同，所以，C4D2取第一反规则C4的匹配域与第二反规则D2的匹配域的交集以及第一反规则C4的动作与第二反规则D2的动作的交集，C4D2为22：{S1∩S2}。
对于C4D3，其中，第一反规则C4为：*：{S1}，第二反规则D3为：SrcAddr： 10.2.0.0/16：
Figure PCTCN2015083379-appb-000022
第一反规则C4的匹配域为通配符*，第二反规则D3的匹配域为10.2.0.0/16(10.2.0.1～10.2.255.255)，两者类型相同，所以，C4D3取第一反规则C4的匹配域与第二反规则D3的匹配域的交集以及第一反规则C4的动作与第二反规则D3的动作的交集，C4D3为10.2.0.0/16：
对于C4D4，其中，第一反规则C4为：*：{S1}，第二反规则D4为：*：{S2}，第一反规则C4的匹配域为通配符*，第二反规则D4的匹配域为通配符*，两者之间类型相同，所以，C4D4取第一反规则C4的匹配域与第二反规则D4的匹配域的交集以及第一反规则C4的动作与第二反规则D4的动作的交集，C4D4为*：{S1∩S2}。
上述第一执行规则矩阵中，第一执行规则的优先级则先按照矩阵的列顺序排列，若同列则按照矩阵的行顺序排列。如第一执行规则矩阵中第一执行规则的优先级为：第一列>第二列>第三列>第四列…，而对于位于同一列的第一执行规则的优先级则：第一行>第二行>第三行>第四行…。所以，第一执行规则C1D1的优先级别最高，第一执行规则C1D2的优先级别其次，……，第一执行规则C4D4的优先级别最低。
230：控制器删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
对剩余有效的第一执行规则取反的原则为令匹配域不变，动作取反，其中，
Figure PCTCN2015083379-appb-000024
Figure PCTCN2015083379-appb-000025
在上述第一执行规则矩阵中：
由于C1D1是无效规则，将C1D1删除，故不需对C1D1进行取反。
对C1D2(10.0.0.1,22：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反为10.0.0.1,22：
Figure PCTCN2015083379-appb-000026
其中，
Figure PCTCN2015083379-appb-000027
所以，第一执行规则的取反可简化为10.0.0.1,22：{}。
由于C1D3是无效规则，将C1D3删除，故不需对C1D3进行取反。
对C1D4(10.0.0.1：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反为10.0.0.1：
Figure PCTCN2015083379-appb-000028
其中，
Figure PCTCN2015083379-appb-000029
所以，第一执行规则的取反可简化为10.0.0.1：{}。
对于C2D1(10.2.0.1,80：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.1,80：
Figure PCTCN2015083379-appb-000030
其中，
Figure PCTCN2015083379-appb-000031
所以，第一执行规则的取反可简化为10.2.0.1,80：{}。
由于C2D2是无效规则，将C2D2删除，故不需对C2D2进行取反。
对C2D3(10.2.0.0/16.80：
Figure PCTCN2015083379-appb-000032
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.0/16,80：
Figure PCTCN2015083379-appb-000033
其中，
Figure PCTCN2015083379-appb-000034
所以，第一执行规则的取反可简化为10.2.0.0/16,80：{S2}。
对C2D4(80：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反80：
Figure PCTCN2015083379-appb-000035
其中，
Figure PCTCN2015083379-appb-000036
所以，第一执行规则的取反可简化为80：{}。
对于C3D1(10.2.0.1：
Figure PCTCN2015083379-appb-000037
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.1：
Figure PCTCN2015083379-appb-000038
其中，
Figure PCTCN2015083379-appb-000039
所以，第一执行规则的取反可简化为10.2.0.1：{S1}。
对C3D2(10.0.0.0/8,22：
Figure PCTCN2015083379-appb-000040
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.0.0.0/8,22：
Figure PCTCN2015083379-appb-000041
其中，
Figure PCTCN2015083379-appb-000042
所以，第一执行规则的取反可简化为10.0.0.0/8,22：{S1}。
对C3D3(10.2.0.0/16：
Figure PCTCN2015083379-appb-000043
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.0/16：
Figure PCTCN2015083379-appb-000044
其中，
Figure PCTCN2015083379-appb-000045
所以，第一执行规则的取反可简化为10.2.0.0/16：{S1,S2}。
对C3D4(10.0.0.0/8：
Figure PCTCN2015083379-appb-000046
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.0.0.0/8：
Figure PCTCN2015083379-appb-000047
其中，
Figure PCTCN2015083379-appb-000048
所以，第一执行规则的取反可简化为10.0.0.0/8：{S1}。
对C4D1(10.2.0.1：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.1：
Figure PCTCN2015083379-appb-000049
其中，
Figure PCTCN2015083379-appb-000050
所以，第一执行规则的取反可简化为10.2.0.1：{}。
对C4D2(22：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反22：
Figure PCTCN2015083379-appb-000051
其中，
Figure PCTCN2015083379-appb-000052
所以，第一执行规则的取反可简化为22：{}。
对C4D3(10.2.0.0/16：
Figure PCTCN2015083379-appb-000053
)进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反10.2.0.0/16：
Figure PCTCN2015083379-appb-000054
其中，
Figure PCTCN2015083379-appb-000055
所以，第一执行规则的取反可简化为10.2.0.0/16：{S2}。
对C4D4(*：{S1∩S2})进行取反，使得匹配域不变，动作取反，从而得到第一执行规则的取反*：
Figure PCTCN2015083379-appb-000056
其中，
Figure PCTCN2015083379-appb-000057
所以，第一执行规则的取反可简化为*：{}。
控制器将上述第一执行规则矩阵中的有效第一执行规则的取反根据第一转发设备S0支持的协议转化为相应的转发表项，以使第一转发设备S0在根据该转发表。转发表项可以是Openflow协议中定义的流表项，也可以是其它协议中定义的转发表项，此处不作具体限定。而且，转发表项的优先级与其相应的第一执行规则优先级顺序相同，使得第一转发设备S0接收到报文后，根据与该报文匹配的转发表项中优先级最高的转发表项将报文转发给其他转发设备，如S1或S2。
当冲突的控制策略还包括第三控制策略，即所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备S0时，控制器接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数。对上述有效第一执行规则取反以得到第一反执行规则，对第三规则取反以得到第三反规则。将第一反执行规则并按照第一执行规则的优先级顺序排列以构成第三矩阵
Figure PCTCN2015083379-appb-000058
所述第三矩阵
Figure PCTCN2015083379-appb-000059
为列矩阵，将第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵
Figure PCTCN2015083379-appb-000060
所述第四矩阵
Figure PCTCN2015083379-appb-000061
为行矩阵，令所述第三矩阵
Figure PCTCN2015083379-appb-000062
与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照类似于上述规则合成原则生成相应的第二执行规则，删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备S0支持的协议转化为所述第一转发设备S0相应的转发表项。其中，该规则合成原则内容类似于上述的规则合成内容：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则。其具体的过程与上述过程相类似，此处不展开赘述。
上述方案中，通过将第一控制策略分解成m条第一规则，将第二控制策 略分解成n条第二规则，并根据规则合成原则来将每条第一规则和第二规则进行合成，由于该规则合成原则会将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，上述定义的无效规则即为导致第一、第二控制策略冲突的规则部分，故通过将存在冲突的无效规则删除，避免了第一控制策略和第二控制策略间存在的冲突规则情况，即解决了策略冲突问题，使得第一转发既能执行第一控制策略也能执行第二控制策略。
参阅图3，图3是本申请策略冲突解决方法一实施方式的流程图。本实施方式与图2所示的实施方式的步骤210、220相同，其不同之处在于，步骤230具体包括：
310：控制器删除无效规则。
320：控制器比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级别较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
控制器对第一执行规则矩阵中的删除无效规则后剩余的每两条第一执行规则的匹配域进行比较，当然也可只将匹配域有相同的每两条第一执行规则的匹配域进行比较。其中两个匹配域的匹配条件越多且匹配条件相同则匹配域越小。如第一执行规则C1D2的匹配域为10.0.0.1,22，有两个匹配条件分别为IP地址为10.0.0.1和端口为22，第一执行规则C1D4的匹配域10.0.0.1，只有一个匹配条件且与C1D2的一个匹配条件相同，即第一执行规则C1D2的匹配域为10.0.0.1,22，被第一执行规则C1D4的匹配域10.0.0.1覆盖，即第一执行规则C1D2的匹配域较小，所以可删除第一执行规则C1D2；发现第一执行规则C3D1的匹配域为10.2.0.1，覆盖第一执行规则C2D1的匹配域10.2.0.1,80，即第一执行规则C2D1的匹配域较小，所以，可将第一执行规则C2D1删除。发现第一执行规则C3D1的匹配域为10.2.0.1与第一执行规则C4D1的匹配域10.2.0.1相同，其中匹配域相同即为匹配条件全部相同，或者还可为两者的匹配条件均包括相同的端口号，且其中一个匹配域只包括上述端口号的匹配条件，第一执行规则C3D1的优先级别较高，所以，删除第一执行规则C4D1。同理，发现第一执行规则C3D3的匹配域与第一执行规则C4D3的匹配域相同， 第一执行规则C3D3的优先级别高于第一执行规则C4D3的优先级别，所以，删除第一执行规则C4D3。发现第一执行规则C4D2的匹配域为22，只包括端口号，而第一执行规则C3D2的匹配域为10.0.0.0/8,22，不仅包括该端口号，则两者匹配域相同，第一执行规则C3D2的优先级别高于第一执行规则C4D2的优先级别，所以删除第一执行规则C4D2。
所以剩下的第一执行规作为有效第一执行规则，并取反得到：
R1：10.0.0.1：{}含义为：研发部门服务器不能通过S1访问外部网络。其中，由于匹配域10.0.0.1属于第一控制策略，即该规则R1属于第一控制策略，故R1的动作{}表示不去往第一控制策略的所有动作即不去往S1。下面规则的丢弃动作同理。
R2：10.2.0.0/16,80：{S2}含义为：预研小组员工从S2访问外部网络。
R3：80：{}含义为：研发部门员工不能通过S1访问外部网络。
R4：10.2.0.1：{S1}含义为：预研小组服务器通过S1访问内部网络。
R5：10.0.0.0/8,22：{S1}含义为：研发部门员工从S1访问内部网络。
R6：10.2.0.0/16：{S1,S2}含义为：预研小组员工从S2访问外部网络，从S1访问内部网络。
R7：10.0.0.0/8：{S1}含义为：研发部门员工从S1访问内部网络。
R8：*：{}含义为：当报文不能与第一执行规则R1至R8的匹配域匹配时，丢弃报文。
经过上述优化处理，剩余的每两个有效第一执行规则的匹配域均无完全重叠，且可按照转化表项的优先级执行转发，避免了冲突的发生，进一步解决了冲突策略。
330：控制器将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
当冲突的控制策略还包括第三控制策略，即所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备S0时，控制器如上一实施方式过程生成第二执行规则，并转化成第一转发设备S0相应的转发表项，此处不展开赘述。
本方案针对SDN上多应用、多用户出现策略冲突的情况下，用简洁明了的规则合成原则，定义完备的匹配项覆盖空间，并将造成冲突的无效规则删 除，解决了第一、第二控制策略间的冲突问题。同时，沿用优先级，可把规则的优先级和矩阵元素相结合，不破坏原有的策略优先级。同时，可优化发现匹配项覆盖问题和动作冲突问题，并解决这两个冲突，生成高效的无冲突的转发规则。
参阅图4，图4是本申请策略冲突解决装置一实施方式的流程图。本实施方式的策略冲突解决装置包括接收模块410、合成模块420以及删除模块430。
所述接收模块410用于接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作，所述接收模块410将所述m条第一规则以及所述n条第二规则发送给所述合成模块420；
所述合成模块420用于接收所述m条第一规则以及所述n条第二规则，对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，所述合成模块420将合成的第一执行规则发送给所述删除模块430；可选地，该规则合成原则还可包括：若第一反规则的动作与第二反规则的动作的交集的取反没有交集，则将该第一反规则和第二反规则合成的规则也作为无效规则。
所述删除模块430用于接收所述合成的第一执行规则，删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
可选地，对所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对所述第二规则取反即令所述第二规则的匹配域不变、 所述第二规则的动作取反。
可选地，所述合成模块420还用于将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
可选地，所述合成模块420还用于在所述分解成m条第一规则之后，新增一条第一匹配规则作为优先级最低的第一规则；在所述分解成n条第二规则之后，新增一条第二匹配规则作为优先级最低的第二规则。其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
可选地，所述接收模块410还用于接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备，所述接收模块410将所述k条第三规则发送给所述合成模块420；
所述取反模块420还用于接收所述k条第三规则，对每条所述有效第一执行规则取反以得到每条第一反执行规则，对每条所述第三规则取反以得到每条第三反规则，将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则，所述合成模块420将合成的第二执行规则发送给所述删除模块430；
所述删除模块430用于接收所述合成的第二执行规则，删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
本实施方式的策略冲突解决装置能够执行如图2所示的方法。
可选地，所述合成模块还用于在删除所述无效规则之后，比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级别较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
当冲突的控制策略还包括第三控制策略，即所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备S0时，所述装置如上一实施方式过程生成第二执行规则，并转化成第一转发设备S0相应的转发表项，此处不展开赘述。
本实施方式的策略冲突解决装置能够执行如图3所示的方法。
上述方案中，通过将第一控制策略分解成m条第一规则，将第二控制策略分解成n条第二规则，并根据规则合成原则来将每条第一规则和第二规则进行合成，由于该规则合成原则会将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，上述定义的无效规则即为导致第一、第二控制策略冲突的规则部分，故通过将存在冲突的无效规则删除，避免了第一控制策略和第二控制策略间存在的冲突规则情况，即解决了策略冲突问题，使得第一转发既能执行第一控制策略也能执行第二控制策略。
参阅图5，图5是本申请控制器一实施方式的结构示意图。本实施方式的控制器500接收器501、处理器502、发送器503、存储器504以及总线505。
接收器501用于接收第一控制策略以及第二控制策略。
处理器502用于：
将所述第一控制策略分解成m条第一规则，将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作；
对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则；
删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
发送器503用于将所述转发表项发送出去。
存储器504可以包括只读存储器和随机存取存储器，并向处理器502提供指令和数据。存储器504的一部分还可以包括非易失性随机存取存储器(NVRAM)。
存储器504存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集:
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
在本发明实施例中，处理器502通过调用存储器504存储的操作指令(该操作指令可存储在操作系统中)，来执行上述操作。
处理器502还可以称为CPU(Central Processing Unit，中央处理单元)。存储器504可以包括只读存储器和随机存取存储器，并向处理器502提供指令和数据。存储器504的一部分还可以包括非易失性随机存取存储器(NVRAM)。具体的应用中，控制器的各个组件通过总线系统505耦合在一起，其中总线系统505除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统505。
上述本发明实施例揭示的方法可以应用于处理器502中，或者由处理器502实现。处理器502可能是一种集成电路芯片，具有信号的处理能力。在实 现过程中，上述方法的各步骤可以通过处理器502中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器502可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器504，处理器502读取存储器504中的信息，结合其硬件完成上述方法的步骤。
可选地，对所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对所述第二规则取反即令所述第二规则的匹配域不变、所述第二规则的动作取反。
可选地，处理器502还用于将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
可选地，处理器502还用于在所述分解成m条第一规则之后，新增一条第一匹配规则作为优先级最低的第一规则；在所述分解成n条第二规则之后，新增一条第二匹配规则作为优先级最低的第二规则。其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
可选地，处理器502还用于在删除所述无效规则之后，比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级别较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的 第一执行规则作为有效第一执行规则。
可选地，所述接收器501还用于接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备；所述处理器502还用于对每条有效第一执行规则取反以得到每条所述第一反执行规则，对每条第三规则取反以得到每条所述第三反规则，将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则，删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
上述方案中，通过将第一控制策略分解成m条第一规则，将第二控制策略分解成n条第二规则，并根据规则合成原则来将每条第一规则和第二规则进行合成，由于该规则合成原则会将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，上述定义的无效规则即为导致第一、第二控制策略冲突的规则部分，故通过将存在冲突的无效规则删除，避免了第一控制策略和第二控制策略间存在的冲突规则情况，即解决了策略冲突问题，使得第一转发既能执行第一控制策略也能执行第二控制策略。
在本申请所提供的几个实施方式中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施方式仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论 的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施方式方案的目的。
另外，在本申请各个实施方式中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施方式所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (12)

  1. 一种策略冲突解决方法，其特征在于，所述方法包括：
    接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作；
    对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则；
    删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
  2. 根据权利要求1所述的方法，其特征在于，
    对每条所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对每条所述第二规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反。
  3. 根据权利要求2所述的方法，其特征在于，所述分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，包括：
    将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优 先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
  4. 根据权利要求3所述的方法，其特征在于，
    所述分解成m条第一规则之后还包括：新增一条第一匹配规则作为优先级最低的第一规则；
    所述分解成n条第二规则之后还包括：新增一条第二匹配规则作为优先级最低的第二规则；
    其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
  5. 根据权利要求3所述的方法，其特征在于，所述将剩余的所述第一执行规则作为有效第一执行规则包括：
    比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
  6. 根据权利要求3或5所述的方法，其特征在于，所述方法还包括：
    接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备；
    对每条所述有效第一执行规则取反以得到每条第一反执行规则，对每条所述第三规则取反以得到每条第三反规则；
    将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第 三反规则的匹配域之间没有交集的第二执行规则作为无效规则；
    删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
  7. 一种策略冲突解决装置，其特征在于，包括：接收模块、合成模块以及删除模块，
    所述接收模块用于接收第一控制策略并将所述第一控制策略分解成m条第一规则，以及，接收第二控制策略并将所述第二控制策略分解成n条第二规则，其中，m,n为自然数，所述第一控制策略和所述第二控制策略均作用于第一转发设备，所述第一规则和第二规则均包括匹配域和动作，所述接收模块将所述m条第一规则以及所述n条第二规则发送给所述合成模块；
    所述合成模块用于接收所述m条第一规则以及所述n条第二规则，对每条所述第一规则取反以得到第一反规则，对每条所述第二规则取反以得到第二反规则，分别将每条所述第一反规则与每条所述第二反规则按照规则合成原则生成相应的第一执行规则，其中，所述规则合成原则包括：由匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域间的交集或匹配域类型不同的第一反规则的匹配域与第二反规则的匹配域间的并集，以及第一反规则的动作与所述第二反规则的动作的交集组成所述第一执行规则，并将匹配域类型相同的第一反规则的匹配域与第二反规则的匹配域之间没有交集的第一执行规则作为无效规则，所述合成模块将合成的第一执行规则发送给所述删除模块；
    所述删除模块用于接收所述合成的第一执行规则，删除所述无效规则，并将剩余的所述第一执行规则作为有效第一执行规则，将每条所述有效第一执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
  8. 根据权利要求7所述的装置，其特征在于，
    对所述第一规则取反即令所述第一规则的匹配域不变、所述第一规则的动作取反，对所述第二规则取反即令所述第二规则的匹配域不变、所述第二规则的动作取反。
  9. 根据权利要求8所述的装置，其特征在于，所述合成模块还用于将每条所述第一反规则作为元素并按照第一规则的优先级顺序排列以构成第一矩 阵，所述第一矩阵为列矩阵，将每条所述第二反规则作为元素并按照第二规则的优先级顺序排列以构成第二矩阵，所述第二矩阵为行矩阵，令所述第一矩阵与所述第二矩阵相乘得到第一执行规则矩阵，将第一执行规则矩阵中每对相乘的所述第一反规则与所述第二反规则按照所述规则合成原则生成相应的第一执行规则，其中所述第一执行规则矩阵的第一执行规则的优先级为先按照矩阵的列顺序排列，同列的则按照矩阵的行顺序排列。
  10. 根据权利要求9所述的装置，其特征在于，所述合成模块还用于在所述分解成m条第一规则之后，新增一条第一匹配规则作为优先级最低的第一规则；在所述分解成n条第二规则之后，新增一条第二匹配规则作为优先级最低的第二规则；
    其中，所述第一匹配规则和第二匹配规则的匹配域均为通配符，动作均为丢弃。
  11. 根据权利要求9所述的装置，其特征在于，所述合成模块还用于在删除所述无效规则之后，比较剩余的每两条第一执行规则的匹配域，如果其中一条第一执行规则的匹配域覆盖另一条第一执行规则的匹配域，则将匹配域较小的第一执行规则删除；如果两条第一执行规则的匹配域相同，则将优先级别较低的第一执行规则删除，将所述匹配域较小的第一执行规则和所述优先级较低的第一执行规则删除后剩余的第一执行规则作为有效第一执行规则。
  12. 根据权利要求9或11所述的装置，其特征在于，
    所述接收模块还用于接收第三控制策略并将所述第三控制策略分解成k条第三规则，k为自然数，所述第三控制策略与所述第一、第二控制策略均作用于所述第一转发设备，所述接收模块将所述k条第三规则发送给所述合成模块；
    所述合成模块还用于接收所述k条第三规则，对每条所述有效第一执行规则取反以得到每条第一反执行规则，对每条所述第三规则取反以得到每条第三反规则，将每条所述第一反执行规则作为元素并按照第一执行规则的优先级顺序排列以构成第三矩阵，所述第三矩阵为列矩阵，将每条所述第三反规则作为元素并按照第三规则的优先级顺序排列以构成第四矩阵，所述第四矩阵为行矩阵，令所述第三矩阵与所述第四矩阵相乘得到第二执行规则矩阵，分别将第二执行规则矩阵中的每对相乘的所述第一反执行规则与所述第三反 规则按照所述规则合成原则生成相应的第二执行规则，其中，所述规则合成原则还包括：由匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域间的交集或匹配域类型不同的第一反执行规则的匹配域与第三反规则的匹配域间的并集，以及第一反执行规则的动作与所述第三反规则的动作的交集组成所述第二执行规则，并将匹配域类型相同的第一反执行规则的匹配域与第三反规则的匹配域之间没有交集的第二执行规则作为无效规则，所述合成模块将合成的第二执行规则发送给所述删除模块；
    所述删除模块还用于接收所述合成的第二执行规则，删除所述无效规则，并将剩余的每条所述第二执行规则取反后根据所述第一转发设备支持的协议转化为所述第一转发设备相应的转发表项。
PCT/CN2015/083379 2014-07-21 2015-07-06 策略冲突解决方法以及装置 WO2016011888A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15823978.0A EP3160083B1 (en) 2014-07-21 2015-07-06 Policy conflict resolution method and device
US15/410,092 US10193755B2 (en) 2014-07-21 2017-01-19 Policy conflict resolution method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410348832.2A CN104104615B (zh) 2014-07-21 2014-07-21 策略冲突解决方法以及装置
CN201410348832.2 2014-07-21

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/410,092 Continuation US10193755B2 (en) 2014-07-21 2017-01-19 Policy conflict resolution method and apparatus

Publications (1)

Publication Number Publication Date
WO2016011888A1 true WO2016011888A1 (zh) 2016-01-28

Family

ID=51672423

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/083379 WO2016011888A1 (zh) 2014-07-21 2015-07-06 策略冲突解决方法以及装置

Country Status (4)

Country Link
US (1) US10193755B2 (zh)
EP (1) EP3160083B1 (zh)
CN (1) CN104104615B (zh)
WO (1) WO2016011888A1 (zh)

Cited By (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10218572B2 (en) 2017-06-19 2019-02-26 Cisco Technology, Inc. Multiprotocol border gateway protocol routing validation
US10333787B2 (en) 2017-06-19 2019-06-25 Cisco Technology, Inc. Validation of L3OUT configuration for communications outside a network
US10333833B2 (en) 2017-09-25 2019-06-25 Cisco Technology, Inc. Endpoint path assurance
US10341184B2 (en) 2017-06-19 2019-07-02 Cisco Technology, Inc. Validation of layer 3 bridge domain subnets in in a network
US10348564B2 (en) 2017-06-19 2019-07-09 Cisco Technology, Inc. Validation of routing information base-forwarding information base equivalence in a network
US10411996B2 (en) 2017-06-19 2019-09-10 Cisco Technology, Inc. Validation of routing information in a network fabric
US10432467B2 (en) 2017-06-19 2019-10-01 Cisco Technology, Inc. Network validation between the logical level and the hardware level of a network
US10437641B2 (en) 2017-06-19 2019-10-08 Cisco Technology, Inc. On-demand processing pipeline interleaved with temporal processing pipeline
US10439875B2 (en) 2017-05-31 2019-10-08 Cisco Technology, Inc. Identification of conflict rules in a network intent formal equivalence failure
US10498608B2 (en) 2017-06-16 2019-12-03 Cisco Technology, Inc. Topology explorer
US10505816B2 (en) 2017-05-31 2019-12-10 Cisco Technology, Inc. Semantic analysis to detect shadowing of rules in a model of network intents
US10528444B2 (en) 2017-06-19 2020-01-07 Cisco Technology, Inc. Event generation in response to validation between logical level and hardware level
US10536337B2 (en) 2017-06-19 2020-01-14 Cisco Technology, Inc. Validation of layer 2 interface and VLAN in a networked environment
US10547509B2 (en) 2017-06-19 2020-01-28 Cisco Technology, Inc. Validation of a virtual port channel (VPC) endpoint in the network fabric
US10547715B2 (en) 2017-06-16 2020-01-28 Cisco Technology, Inc. Event generation in response to network intent formal equivalence failures
US10554483B2 (en) 2017-05-31 2020-02-04 Cisco Technology, Inc. Network policy analysis for networks
US10554493B2 (en) 2017-06-19 2020-02-04 Cisco Technology, Inc. Identifying mismatches between a logical model and node implementation
US10554477B2 (en) 2017-09-13 2020-02-04 Cisco Technology, Inc. Network assurance event aggregator
US10560328B2 (en) 2017-04-20 2020-02-11 Cisco Technology, Inc. Static network policy analysis for networks
US10560355B2 (en) 2017-06-19 2020-02-11 Cisco Technology, Inc. Static endpoint validation
US10567228B2 (en) 2017-06-19 2020-02-18 Cisco Technology, Inc. Validation of cross logical groups in a network
US10567229B2 (en) 2017-06-19 2020-02-18 Cisco Technology, Inc. Validating endpoint configurations between nodes
US10572495B2 (en) 2018-02-06 2020-02-25 Cisco Technology Inc. Network assurance database version compatibility
US10574513B2 (en) 2017-06-16 2020-02-25 Cisco Technology, Inc. Handling controller and node failure scenarios during data collection
US10581694B2 (en) 2017-05-31 2020-03-03 Cisco Technology, Inc. Generation of counter examples for network intent formal equivalence failures
US10587456B2 (en) 2017-09-12 2020-03-10 Cisco Technology, Inc. Event clustering for a network assurance platform
US10587621B2 (en) 2017-06-16 2020-03-10 Cisco Technology, Inc. System and method for migrating to and maintaining a white-list network security model
US10587484B2 (en) 2017-09-12 2020-03-10 Cisco Technology, Inc. Anomaly detection and reporting in a network assurance appliance
US10616072B1 (en) 2018-07-27 2020-04-07 Cisco Technology, Inc. Epoch data interface
US10623259B2 (en) 2017-06-19 2020-04-14 Cisco Technology, Inc. Validation of layer 1 interface in a network
US10623264B2 (en) 2017-04-20 2020-04-14 Cisco Technology, Inc. Policy assurance for service chaining
US10623271B2 (en) 2017-05-31 2020-04-14 Cisco Technology, Inc. Intra-priority class ordering of rules corresponding to a model of network intents
US10644946B2 (en) 2017-06-19 2020-05-05 Cisco Technology, Inc. Detection of overlapping subnets in a network
US10652102B2 (en) 2017-06-19 2020-05-12 Cisco Technology, Inc. Network node memory utilization analysis
US10659298B1 (en) 2018-06-27 2020-05-19 Cisco Technology, Inc. Epoch comparison for network events
US10673702B2 (en) 2017-06-19 2020-06-02 Cisco Technology, Inc. Validation of layer 3 using virtual routing forwarding containers in a network
US10686669B2 (en) 2017-06-16 2020-06-16 Cisco Technology, Inc. Collecting network models and node information from a network
US10693738B2 (en) 2017-05-31 2020-06-23 Cisco Technology, Inc. Generating device-level logical models for a network
US10700933B2 (en) 2017-06-19 2020-06-30 Cisco Technology, Inc. Validating tunnel endpoint addresses in a network fabric
US10797951B2 (en) 2014-10-16 2020-10-06 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
US10805160B2 (en) 2017-06-19 2020-10-13 Cisco Technology, Inc. Endpoint bridge domain subnet validation
US10812315B2 (en) 2018-06-07 2020-10-20 Cisco Technology, Inc. Cross-domain network assurance
US10812336B2 (en) 2017-06-19 2020-10-20 Cisco Technology, Inc. Validation of bridge domain-L3out association for communication outside a network
US10812318B2 (en) 2017-05-31 2020-10-20 Cisco Technology, Inc. Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment
US10826788B2 (en) 2017-04-20 2020-11-03 Cisco Technology, Inc. Assurance of quality-of-service configurations in a network
US10826770B2 (en) 2018-07-26 2020-11-03 Cisco Technology, Inc. Synthesis of models for networks using automated boolean learning
US10873509B2 (en) 2018-01-17 2020-12-22 Cisco Technology, Inc. Check-pointing ACI network state and re-execution from a check-pointed state
US10904101B2 (en) 2017-06-16 2021-01-26 Cisco Technology, Inc. Shim layer for extracting and prioritizing underlying rules for modeling network intents
US10904070B2 (en) 2018-07-11 2021-01-26 Cisco Technology, Inc. Techniques and interfaces for troubleshooting datacenter networks
US10911495B2 (en) 2018-06-27 2021-02-02 Cisco Technology, Inc. Assurance of security rules in a network
US11019027B2 (en) 2018-06-27 2021-05-25 Cisco Technology, Inc. Address translation for external network appliance
US11044273B2 (en) 2018-06-27 2021-06-22 Cisco Technology, Inc. Assurance of security rules in a network
US11102053B2 (en) 2017-12-05 2021-08-24 Cisco Technology, Inc. Cross-domain assurance
US11121927B2 (en) 2017-06-19 2021-09-14 Cisco Technology, Inc. Automatically determining an optimal amount of time for analyzing a distributed network environment
US11150973B2 (en) 2017-06-16 2021-10-19 Cisco Technology, Inc. Self diagnosing distributed appliance
US11218508B2 (en) 2018-06-27 2022-01-04 Cisco Technology, Inc. Assurance of security rules in a network
US11258657B2 (en) 2017-05-31 2022-02-22 Cisco Technology, Inc. Fault localization in large-scale network policy deployment
US11283680B2 (en) 2017-06-19 2022-03-22 Cisco Technology, Inc. Identifying components for removal in a network configuration
US11343150B2 (en) 2017-06-19 2022-05-24 Cisco Technology, Inc. Validation of learned routes in a network
US11469986B2 (en) 2017-06-16 2022-10-11 Cisco Technology, Inc. Controlled micro fault injection on a distributed appliance
US11645131B2 (en) 2017-06-16 2023-05-09 Cisco Technology, Inc. Distributed fault code aggregation across application centric dimensions

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104104615B (zh) * 2014-07-21 2017-07-07 华为技术有限公司 策略冲突解决方法以及装置
WO2016197301A1 (zh) * 2015-06-08 2016-12-15 华为技术有限公司 Nfv系统中的策略协调方法和装置
CN105245400A (zh) * 2015-09-16 2016-01-13 江苏省未来网络创新研究院 一种sdn服务链应用有效性的检测方法
CN106656591A (zh) * 2016-12-15 2017-05-10 西安电子科技大学 一种软件定义网络中多应用间的规则冲突检测与消除方法
JP6805196B2 (ja) * 2018-02-23 2020-12-23 日本電信電話株式会社 ポリシー競合解消システム及びポリシー競合解消方法
CN110417568B (zh) * 2018-04-28 2021-10-26 华为技术有限公司 Nfv策略协商方法及系统
CN110650023A (zh) * 2018-06-26 2020-01-03 中国移动通信有限公司研究院 策略规则处理方法及装置、功能网元及存储介质
CN109302409A (zh) * 2018-10-31 2019-02-01 锐捷网络股份有限公司 Acl访问控制策略的分析方法、装置、设备及存储介质
CN112822699B (zh) * 2019-11-15 2022-09-02 华为技术有限公司 执行意图的方法及装置
CN113959069B (zh) * 2021-10-20 2023-05-09 青岛海信日立空调系统有限公司 空调系统
CN114039853B (zh) * 2021-11-15 2024-02-09 天融信雄安网络安全技术有限公司 一种检测安全策略的方法、装置、存储介质和电子设备
CN114338246B (zh) * 2022-03-14 2022-06-07 章和技术(广州)有限公司 一种防火墙策略审计方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070245018A1 (en) * 2006-04-12 2007-10-18 International Business Machines Corporation Dynamic access control in a content-based publish/subscribe system with delivery guarantees
CN101339591A (zh) * 2008-08-29 2009-01-07 中国科学院软件研究所 一种xacml策略规则检测方法
CN102957697A (zh) * 2012-10-26 2013-03-06 上海交通大学 一种多域间基于rbac模型的访问控制策略合成方法
CN103516550A (zh) * 2013-09-29 2014-01-15 国家计算机网络与信息安全管理中心 一种面向大规模包分类规则集的规则冲突检测方法及系统
CN104104615A (zh) * 2014-07-21 2014-10-15 华为技术有限公司 策略冲突解决方法以及装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6393473B1 (en) * 1998-12-18 2002-05-21 Cisco Technology, Inc. Representing and verifying network management policies using collective constraints
US7505463B2 (en) * 2004-06-15 2009-03-17 Sun Microsystems, Inc. Rule set conflict resolution
US8345688B2 (en) * 2010-02-23 2013-01-01 Google Inc. System and method for managing flow of packets
CN102215212B (zh) * 2010-04-02 2016-02-10 中兴通讯股份有限公司 一种安全策略的冲突处理方法、架构及统一转换器
EP2630749B1 (en) * 2010-10-22 2019-01-30 Hewlett-Packard Enterprise Development LP Distributed network instrumentation system
US8655824B1 (en) * 2011-03-07 2014-02-18 The Boeing Company Global policy framework analyzer
CN102760076B (zh) * 2012-06-05 2015-01-21 华为技术有限公司 一种系统的策略冲突处理方法及策略冲突处理系统
JP5813252B2 (ja) * 2012-12-03 2015-11-17 ▲ホア▼▲ウェイ▼技術有限公司 ポリシー処理方法およびネットワークデバイス
US9258243B2 (en) * 2013-05-10 2016-02-09 Cisco Technology, Inc. Symmetric service chain binding

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070245018A1 (en) * 2006-04-12 2007-10-18 International Business Machines Corporation Dynamic access control in a content-based publish/subscribe system with delivery guarantees
CN101339591A (zh) * 2008-08-29 2009-01-07 中国科学院软件研究所 一种xacml策略规则检测方法
CN102957697A (zh) * 2012-10-26 2013-03-06 上海交通大学 一种多域间基于rbac模型的访问控制策略合成方法
CN103516550A (zh) * 2013-09-29 2014-01-15 国家计算机网络与信息安全管理中心 一种面向大规模包分类规则集的规则冲突检测方法及系统
CN104104615A (zh) * 2014-07-21 2014-10-15 华为技术有限公司 策略冲突解决方法以及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3160083A4 *

Cited By (97)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11824719B2 (en) 2014-10-16 2023-11-21 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
US11811603B2 (en) 2014-10-16 2023-11-07 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
US11539588B2 (en) 2014-10-16 2022-12-27 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
US10797951B2 (en) 2014-10-16 2020-10-06 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
US11178009B2 (en) 2017-04-20 2021-11-16 Cisco Technology, Inc. Static network policy analysis for networks
US10623264B2 (en) 2017-04-20 2020-04-14 Cisco Technology, Inc. Policy assurance for service chaining
US10560328B2 (en) 2017-04-20 2020-02-11 Cisco Technology, Inc. Static network policy analysis for networks
US10826788B2 (en) 2017-04-20 2020-11-03 Cisco Technology, Inc. Assurance of quality-of-service configurations in a network
US10439875B2 (en) 2017-05-31 2019-10-08 Cisco Technology, Inc. Identification of conflict rules in a network intent formal equivalence failure
US10581694B2 (en) 2017-05-31 2020-03-03 Cisco Technology, Inc. Generation of counter examples for network intent formal equivalence failures
US10505816B2 (en) 2017-05-31 2019-12-10 Cisco Technology, Inc. Semantic analysis to detect shadowing of rules in a model of network intents
US11411803B2 (en) 2017-05-31 2022-08-09 Cisco Technology, Inc. Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment
US11303531B2 (en) 2017-05-31 2022-04-12 Cisco Technologies, Inc. Generation of counter examples for network intent formal equivalence failures
US11258657B2 (en) 2017-05-31 2022-02-22 Cisco Technology, Inc. Fault localization in large-scale network policy deployment
US10623271B2 (en) 2017-05-31 2020-04-14 Cisco Technology, Inc. Intra-priority class ordering of rules corresponding to a model of network intents
US10554483B2 (en) 2017-05-31 2020-02-04 Cisco Technology, Inc. Network policy analysis for networks
US10951477B2 (en) 2017-05-31 2021-03-16 Cisco Technology, Inc. Identification of conflict rules in a network intent formal equivalence failure
US10812318B2 (en) 2017-05-31 2020-10-20 Cisco Technology, Inc. Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment
US10693738B2 (en) 2017-05-31 2020-06-23 Cisco Technology, Inc. Generating device-level logical models for a network
US10547715B2 (en) 2017-06-16 2020-01-28 Cisco Technology, Inc. Event generation in response to network intent formal equivalence failures
US11102337B2 (en) 2017-06-16 2021-08-24 Cisco Technology, Inc. Event generation in response to network intent formal equivalence failures
US10904101B2 (en) 2017-06-16 2021-01-26 Cisco Technology, Inc. Shim layer for extracting and prioritizing underlying rules for modeling network intents
US11150973B2 (en) 2017-06-16 2021-10-19 Cisco Technology, Inc. Self diagnosing distributed appliance
US10574513B2 (en) 2017-06-16 2020-02-25 Cisco Technology, Inc. Handling controller and node failure scenarios during data collection
US10498608B2 (en) 2017-06-16 2019-12-03 Cisco Technology, Inc. Topology explorer
US11463316B2 (en) 2017-06-16 2022-10-04 Cisco Technology, Inc. Topology explorer
US10587621B2 (en) 2017-06-16 2020-03-10 Cisco Technology, Inc. System and method for migrating to and maintaining a white-list network security model
US11469986B2 (en) 2017-06-16 2022-10-11 Cisco Technology, Inc. Controlled micro fault injection on a distributed appliance
US11563645B2 (en) 2017-06-16 2023-01-24 Cisco Technology, Inc. Shim layer for extracting and prioritizing underlying rules for modeling network intents
US10686669B2 (en) 2017-06-16 2020-06-16 Cisco Technology, Inc. Collecting network models and node information from a network
US11645131B2 (en) 2017-06-16 2023-05-09 Cisco Technology, Inc. Distributed fault code aggregation across application centric dimensions
US10873506B2 (en) 2017-06-19 2020-12-22 Cisco Technology, Inc. Validation of a virtual port channel (VPC) endpoint in the network fabric
US10432467B2 (en) 2017-06-19 2019-10-01 Cisco Technology, Inc. Network validation between the logical level and the hardware level of a network
US10652102B2 (en) 2017-06-19 2020-05-12 Cisco Technology, Inc. Network node memory utilization analysis
US10333787B2 (en) 2017-06-19 2019-06-25 Cisco Technology, Inc. Validation of L3OUT configuration for communications outside a network
US10673702B2 (en) 2017-06-19 2020-06-02 Cisco Technology, Inc. Validation of layer 3 using virtual routing forwarding containers in a network
US10623259B2 (en) 2017-06-19 2020-04-14 Cisco Technology, Inc. Validation of layer 1 interface in a network
US11750463B2 (en) 2017-06-19 2023-09-05 Cisco Technology, Inc. Automatically determining an optimal amount of time for analyzing a distributed network environment
US10700933B2 (en) 2017-06-19 2020-06-30 Cisco Technology, Inc. Validating tunnel endpoint addresses in a network fabric
US11736351B2 (en) 2017-06-19 2023-08-22 Cisco Technology Inc. Identifying components for removal in a network configuration
US10805160B2 (en) 2017-06-19 2020-10-13 Cisco Technology, Inc. Endpoint bridge domain subnet validation
US10341184B2 (en) 2017-06-19 2019-07-02 Cisco Technology, Inc. Validation of layer 3 bridge domain subnets in in a network
US10812336B2 (en) 2017-06-19 2020-10-20 Cisco Technology, Inc. Validation of bridge domain-L3out association for communication outside a network
US11595257B2 (en) 2017-06-19 2023-02-28 Cisco Technology, Inc. Validation of cross logical groups in a network
US11570047B2 (en) 2017-06-19 2023-01-31 Cisco Technology, Inc. Detection of overlapping subnets in a network
US10348564B2 (en) 2017-06-19 2019-07-09 Cisco Technology, Inc. Validation of routing information base-forwarding information base equivalence in a network
US10862752B2 (en) 2017-06-19 2020-12-08 Cisco Technology, Inc. Network validation between the logical level and the hardware level of a network
US11558260B2 (en) 2017-06-19 2023-01-17 Cisco Technology, Inc. Network node memory utilization analysis
US10873505B2 (en) 2017-06-19 2020-12-22 Cisco Technology, Inc. Validation of layer 2 interface and VLAN in a networked environment
US10218572B2 (en) 2017-06-19 2019-02-26 Cisco Technology, Inc. Multiprotocol border gateway protocol routing validation
US10880169B2 (en) 2017-06-19 2020-12-29 Cisco Technology, Inc. Multiprotocol border gateway protocol routing validation
US10567229B2 (en) 2017-06-19 2020-02-18 Cisco Technology, Inc. Validating endpoint configurations between nodes
US10411996B2 (en) 2017-06-19 2019-09-10 Cisco Technology, Inc. Validation of routing information in a network fabric
US11469952B2 (en) 2017-06-19 2022-10-11 Cisco Technology, Inc. Identifying mismatches between a logical model and node implementation
US10567228B2 (en) 2017-06-19 2020-02-18 Cisco Technology, Inc. Validation of cross logical groups in a network
US10972352B2 (en) 2017-06-19 2021-04-06 Cisco Technology, Inc. Validation of routing information base-forwarding information base equivalence in a network
US10644946B2 (en) 2017-06-19 2020-05-05 Cisco Technology, Inc. Detection of overlapping subnets in a network
US10437641B2 (en) 2017-06-19 2019-10-08 Cisco Technology, Inc. On-demand processing pipeline interleaved with temporal processing pipeline
US11438234B2 (en) 2017-06-19 2022-09-06 Cisco Technology, Inc. Validation of a virtual port channel (VPC) endpoint in the network fabric
US11063827B2 (en) 2017-06-19 2021-07-13 Cisco Technology, Inc. Validation of layer 3 bridge domain subnets in a network
US11102111B2 (en) 2017-06-19 2021-08-24 Cisco Technology, Inc. Validation of routing information in a network fabric
US10528444B2 (en) 2017-06-19 2020-01-07 Cisco Technology, Inc. Event generation in response to validation between logical level and hardware level
US10560355B2 (en) 2017-06-19 2020-02-11 Cisco Technology, Inc. Static endpoint validation
US11405278B2 (en) 2017-06-19 2022-08-02 Cisco Technology, Inc. Validating tunnel endpoint addresses in a network fabric
US11121927B2 (en) 2017-06-19 2021-09-14 Cisco Technology, Inc. Automatically determining an optimal amount of time for analyzing a distributed network environment
US11343150B2 (en) 2017-06-19 2022-05-24 Cisco Technology, Inc. Validation of learned routes in a network
US11153167B2 (en) 2017-06-19 2021-10-19 Cisco Technology, Inc. Validation of L3OUT configuration for communications outside a network
US10554493B2 (en) 2017-06-19 2020-02-04 Cisco Technology, Inc. Identifying mismatches between a logical model and node implementation
US11303520B2 (en) 2017-06-19 2022-04-12 Cisco Technology, Inc. Validation of cross logical groups in a network
US10547509B2 (en) 2017-06-19 2020-01-28 Cisco Technology, Inc. Validation of a virtual port channel (VPC) endpoint in the network fabric
US11283680B2 (en) 2017-06-19 2022-03-22 Cisco Technology, Inc. Identifying components for removal in a network configuration
US11283682B2 (en) 2017-06-19 2022-03-22 Cisco Technology, Inc. Validation of bridge domain-L3out association for communication outside a network
US10536337B2 (en) 2017-06-19 2020-01-14 Cisco Technology, Inc. Validation of layer 2 interface and VLAN in a networked environment
US11038743B2 (en) 2017-09-12 2021-06-15 Cisco Technology, Inc. Event clustering for a network assurance platform
US10587484B2 (en) 2017-09-12 2020-03-10 Cisco Technology, Inc. Anomaly detection and reporting in a network assurance appliance
US11115300B2 (en) 2017-09-12 2021-09-07 Cisco Technology, Inc Anomaly detection and reporting in a network assurance appliance
US10587456B2 (en) 2017-09-12 2020-03-10 Cisco Technology, Inc. Event clustering for a network assurance platform
US10554477B2 (en) 2017-09-13 2020-02-04 Cisco Technology, Inc. Network assurance event aggregator
US10333833B2 (en) 2017-09-25 2019-06-25 Cisco Technology, Inc. Endpoint path assurance
US11102053B2 (en) 2017-12-05 2021-08-24 Cisco Technology, Inc. Cross-domain assurance
US10873509B2 (en) 2018-01-17 2020-12-22 Cisco Technology, Inc. Check-pointing ACI network state and re-execution from a check-pointed state
US11824728B2 (en) 2018-01-17 2023-11-21 Cisco Technology, Inc. Check-pointing ACI network state and re-execution from a check-pointed state
US10572495B2 (en) 2018-02-06 2020-02-25 Cisco Technology Inc. Network assurance database version compatibility
US10812315B2 (en) 2018-06-07 2020-10-20 Cisco Technology, Inc. Cross-domain network assurance
US11374806B2 (en) 2018-06-07 2022-06-28 Cisco Technology, Inc. Cross-domain network assurance
US11902082B2 (en) 2018-06-07 2024-02-13 Cisco Technology, Inc. Cross-domain network assurance
US10659298B1 (en) 2018-06-27 2020-05-19 Cisco Technology, Inc. Epoch comparison for network events
US11044273B2 (en) 2018-06-27 2021-06-22 Cisco Technology, Inc. Assurance of security rules in a network
US10911495B2 (en) 2018-06-27 2021-02-02 Cisco Technology, Inc. Assurance of security rules in a network
US11218508B2 (en) 2018-06-27 2022-01-04 Cisco Technology, Inc. Assurance of security rules in a network
US11019027B2 (en) 2018-06-27 2021-05-25 Cisco Technology, Inc. Address translation for external network appliance
US11888603B2 (en) 2018-06-27 2024-01-30 Cisco Technology, Inc. Assurance of security rules in a network
US11909713B2 (en) 2018-06-27 2024-02-20 Cisco Technology, Inc. Address translation for external network appliance
US11805004B2 (en) 2018-07-11 2023-10-31 Cisco Technology, Inc. Techniques and interfaces for troubleshooting datacenter networks
US10904070B2 (en) 2018-07-11 2021-01-26 Cisco Technology, Inc. Techniques and interfaces for troubleshooting datacenter networks
US10826770B2 (en) 2018-07-26 2020-11-03 Cisco Technology, Inc. Synthesis of models for networks using automated boolean learning
US10616072B1 (en) 2018-07-27 2020-04-07 Cisco Technology, Inc. Epoch data interface

Also Published As

Publication number Publication date
CN104104615A (zh) 2014-10-15
US20170134233A1 (en) 2017-05-11
EP3160083B1 (en) 2019-12-25
EP3160083A1 (en) 2017-04-26
CN104104615B (zh) 2017-07-07
EP3160083A4 (en) 2017-06-28
US10193755B2 (en) 2019-01-29

Similar Documents

Publication Publication Date Title
WO2016011888A1 (zh) 策略冲突解决方法以及装置
US10742624B2 (en) Sentinel appliance in an internet of things realm
US7653754B2 (en) Method, system and protocol that enable unrestricted user-level access to a network interface adapter
US8289981B1 (en) Apparatus and method for high-performance network content processing
US10404674B1 (en) Efficient memory management in multi-tenant virtualized environment
CN107873129B (zh) 用于不受管理的设备的安全服务
US20160226916A1 (en) Creating and managing a network security tag
US8528092B2 (en) System, method, and computer program product for identifying unwanted activity utilizing a honeypot device accessible via VLAN trunking
US20190370216A1 (en) Remote memory access using memory mapped addressing among multiple compute nodes
US11588734B2 (en) Systems for providing an LPM implementation for a programmable data plane through a distributed algorithm
US20230261873A1 (en) Verifiable computation for cross-domain information sharing
Li et al. DrawerPipe: A reconfigurable pipeline for network processing on FPGA-based SmartNIC
US7992206B1 (en) Pre-scanner for inspecting network traffic for computer viruses
Joslyn et al. High performance hypergraph analytics of domain name system relationships
US9515929B2 (en) Traffic data pre-filtering
US10877911B1 (en) Pattern generation using a direct memory access engine
US9378784B1 (en) Security device using high latency memory to implement high update rate statistics for large number of events
KR20020051599A (ko) 분산 컴퓨팅 환경에서의 보안 정책 시스템 및 그 방법
Álvarez et al. Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
Fukuhara et al. Implementation of content-based anonymization edge router on netfpga
Wu et al. The design and implementation of database audit system framework
US20150101035A1 (en) Duplicating packets efficiently within a network security appliance
Chen et al. Role-based access control for memory security on Network-on-Chips
US11838267B2 (en) Distributed identity-based firewall policy evaluation
US20230385493A1 (en) Redacting network-on-chip functionality in a system-on-chip architecture

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15823978

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015823978

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015823978

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE