WO2023093710A1 - 一种网络配置方法及装置 - Google Patents

一种网络配置方法及装置 Download PDF

Info

Publication number
WO2023093710A1
WO2023093710A1 PCT/CN2022/133465 CN2022133465W WO2023093710A1 WO 2023093710 A1 WO2023093710 A1 WO 2023093710A1 CN 2022133465 W CN2022133465 W CN 2022133465W WO 2023093710 A1 WO2023093710 A1 WO 2023093710A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
network configuration
network
vpc
configuration
Prior art date
Application number
PCT/CN2022/133465
Other languages
English (en)
French (fr)
Inventor
杨永强
李�昊
曹婉悦
冀朝阳
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Publication of WO2023093710A1 publication Critical patent/WO2023093710A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0876—Aspects of the degree of configuration automation
    • H04L41/0886—Fully automatic configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0823—Configuration setting characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present application relates to the field of virtual network technology, and in particular to a network configuration method and device.
  • a virtual network is a network function resource pool formed by the abstraction of underlying physical network devices by cloud service providers. Tenants build their dedicated networks on the cloud by manipulating the network abstraction provided by the virtual network. Due to the difficulty in manually implementing the translation from intent to virtual network configuration, for example, the process of building a virtual network is complex, since the network abstraction provided to tenants by a virtual network is essentially just a virtualization of the low-level building blocks used to build a physical network version, which requires tenants to complete the conversion from network intent to low-level building blocks and complex reasoning about network scale, availability, and security; another example, the learning cost of virtual network configuration is high, due to the variety of network services provided by virtual networks , each service requires a lot of manual configuration workload, and the virtualized versions of these configurations as low-level building blocks require tenants to have detailed knowledge of underlying network concepts; With an in-depth understanding of the configuration resources of the virtual network, it is difficult to ensure the good performance of the configured virtual network or the reasonable use of configuration resources.
  • the current intent compilation in the network field needs to input the intent and network topology to the intent compiler to obtain the final network configuration.
  • private cloud, VPC)-based virtual network intent compilation
  • Embodiments of the present application provide a network configuration method and device for generating a VPC network through intent compilation.
  • the embodiment of the present application provides a network configuration method, which can be executed by a network configuration device, and the method includes: acquiring one or more user intentions, and the user intentions are used to indicate the network configuration in the virtual private cloud VPC network According to requirements and cloud service configuration requirements, determine the optimization goal of the VPC network, and then obtain the VPC network configuration plan according to one or more user intentions and optimization goals, and then call one or more cloud service application programming interface APIs according to the VPC network configuration plan , so that at least one management device that manages one or more cloud services configures one or more cloud services in the VPC network; wherein, the cloud service configuration requirements include configuration requirements of one or more cloud services.
  • the VPC network configuration scheme can also be obtained without determining the network topology, so that the automatic generation of the VPC network configuration can be realized.
  • the user intention includes one or more of the following: application program group identifier, port configuration information and service function type.
  • the service function type includes firewall and/or load balancing.
  • the above-mentioned one or more user intentions may include a first user intention and/or a second user intention, where the first user intention is used to indicate that the data is prohibited from being used by the first computer in the first device group.
  • the device flows to a second computing device in a second device group, the first device group including one or more first computing devices, the second device group including one or more second computing devices; the second user intent is used to indicate that the data is allowed From a third computing device in a third device group to a fourth computing device in a fourth device group, the third device group including one or more third computing devices, the fourth device group including one or more fourth computing devices .
  • the above-mentioned one or more user intentions are the user intentions of the blacklist system (that is, the first user intention)
  • it is possible to enable the user to reject only a small part of communication traffic or allow a small number of IP addresses/ports to access Declaration of intent becomes easier.
  • one or more user intentions mentioned above are all user intentions of the whitelist system (that is, the second user intention)
  • one or more user intentions mentioned above include the user intention of the whitelist system (the second user intention) and the user intention of the blacklist system (ie, the first user intention), these two types of user intentions coexist so that either The statement of user intent to allow only a small portion of traffic or to allow access to a few IP addresses/ports, or to deny only a small portion of traffic or to allow access to a small number of IP addresses/ports is very concise and easy.
  • acquiring the first user intention may include: providing a first configuration interface, the first configuration interface is configured to receive the first user intention uploaded by the user, and receive the first user intention uploaded by the user.
  • determining the optimization goal of the VPC network may include: providing a second configuration interface, the second configuration interface is used to receive the optimization goal uploaded by the user; and then, receiving the optimization goal uploaded by the user.
  • the optimization goal uploaded by the user can be obtained, so that the configured VPC network can meet the optimization goal.
  • the optimization objective includes minimum network overhead and/or minimum time delay, where the network overhead indicates the proportion of redundant data to source data during network transmission.
  • the configured VPC network can have the best network performance and the least overhead.
  • calling one or more cloud service application program interface APIs according to the VPC network configuration scheme includes: converting some/all of the VPC network configuration schemes into VPC network configuration instructions, and the VPC network configuration instructions conform to a or multiple cloud service API formats; then, send the VPC network configuration command to one or more cloud service management devices, so that the one or more cloud service management devices configure one or more cloud services in the VPC network .
  • the VPC network configuration scheme can be converted into an API format that can be recognized by the API invoked by the network configuration device, so that the network configuration scheme can be adapted to APIs of different manufacturers.
  • the vendor providing one or more cloud services and the vendor running the network configuration device may be the same vendor or different vendors.
  • the above method includes: merging one or more user intents to generate a global intent; obtaining network configuration according to one or more user intents and optimization goals
  • the scheme may include: obtaining a network configuration scheme according to the global intent and optimization goal.
  • the embodiment of the present application also provides a network configuration device, and the beneficial effect may refer to the description in the first aspect or any possible design of the first aspect, which will not be repeated here.
  • the network configuration device has the function of implementing the actions in the first aspect or the method example above.
  • the functions described above may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the structure of the device includes a communication unit and a processing unit, and these units can perform corresponding functions in the method example of the first aspect above. For details, refer to the detailed description in the method example, and details are not repeated here.
  • the embodiment of the present application also provides a computing device, the computing device includes a processor and a memory, and may also include a communication interface and a display screen, and the processor executes the program instructions in the memory to execute the above-mentioned The method provided by one aspect or any possible design of the first aspect.
  • the memory is coupled to the processor and holds program instructions and data.
  • the communication interface is used to communicate with other devices, for example, calling the API of the VPC network provided by the cloud service provider through the API docker.
  • the display screen is used to display a user interface of a diagram editor/browser to a user under the trigger of the processor.
  • the present application provides a computer-readable storage medium.
  • the computer-readable storage medium When the computer-readable storage medium is executed by a computing device, the computing device executes the aforementioned first aspect or any possible implementation of the first aspect. Methods.
  • a program is stored in the computer-readable storage medium.
  • the computer-readable storage medium includes but not limited to volatile memory, such as random access memory, and non-volatile memory, such as flash memory, hard disk drive (hard disk drive, HDD), solid state drive (solid state drive, SSD).
  • the present application provides a program product for a computing device
  • the program product for a computing device includes computer instructions, and when executed by a computing device, the computing device executes the aforementioned first aspect or any possible implementation of the first aspect method provided in the method.
  • the computer program product may be a software installation package, and if the method provided in the aforementioned first aspect or any possible implementation of the first aspect needs to be used, the computer program product may be downloaded and executed on a computing device. program product.
  • the present application also provides a chip, the chip is connected to the memory, and the chip is used to read and execute the software program stored in the memory, and execute the method provided in the aforementioned first aspect or any possible implementation of the first aspect .
  • Fig. 1 is the schematic diagram of the system architecture of the PGA model that the embodiment of the present application provides;
  • FIG. 2 is a schematic diagram of a strategy map provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an applicable system architecture provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an applicable system architecture provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a strategy map provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a network configuration method provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of user intentions provided by the embodiment of the present application.
  • FIG. 8 is a schematic diagram of a label hierarchical structure provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of user intentions of the whitelist system provided by the embodiment of the present application.
  • FIG. 10 is a schematic diagram of user intentions of the blacklist system provided by the embodiment of the present application.
  • FIG. 11 is a schematic diagram of a synthetic diagram corresponding to user intentions of the whitelist system provided by the embodiment of the present application.
  • FIG. 12 is a schematic diagram of a synthetic diagram corresponding to user intentions of the blacklist system provided by the embodiment of the present application.
  • FIG. 13 is a schematic diagram of the overall schematic diagram provided by the embodiment of the present application.
  • FIG. 14 is a schematic diagram of the generation process of the intent compiler provided by the embodiment of the present application.
  • FIG. 15 is a schematic diagram of VPC network configuration information provided by the embodiment of the present application.
  • FIG. 16 is a schematic diagram of a network configuration device provided in an embodiment of the present application.
  • FIG. 17 is a schematic diagram of a network configuration device provided by an embodiment of the present application.
  • VPC virtual private cloud
  • a virtual network is a computer network that includes at least part of a virtual network link, wherein a virtual network link does not include a physical connection between two computing devices, but is implemented through network virtualization.
  • User intent is the network requirement put forward by the user, which can be the function or state that the user expects the network to finally achieve.
  • Intents are a declarative strategy.
  • Intent compilation in the network field is to convert the expected network function or state achieved by the user into the corresponding network configuration and automatically deliver the configuration to the actual network foundation.
  • policy graph abstraction policy graph abstraction
  • PGA policy graph abstraction
  • Figure 1 is the system architecture of the PGA, as shown in Figure 1, the system architecture of the PGA includes a graph editor/browser and a graph synthesizer. Users, tenants, administrators, SDN applications, etc. can independently generate their respective policies in the form of graphs and submit them to the graph synthesizer through the user interface of PGA.
  • the user interface and graph synthesizer assist in the synthesis of policies with additional information from external services, such as label information.
  • the graph synthesizer will automatically synthesize the input graph into a conflict-free combined graph, that is, the synthesized graph.
  • conflicts/errors will be resolved or marked, and conflicts/errors will be reported to the user.
  • PGA can also propose Repair suggestion. Synthetic graphs can be actively or passively compiled into underlying configurations/rules. PGA's policy synthesis and underlying compilation methods are orthogonal.
  • the policy input into the PGA can be represented by a graph structure, and the graph structure represents: the communication allowed between network devices, and the traversal of the service function chain required for each communication.
  • the PGA model is a whitelist model, communication must be explicitly allowed, otherwise it will be implicitly denied.
  • each endpoint represents a device group (endpoint group, device group), the device group contains a group of endpoints, the endpoint is the smallest abstract unit in the strategy diagram, the endpoint is, for example, server, virtual machine, subnet, or end user.
  • a device group consists of all endpoints that meet the device group membership criteria.
  • a directed edge between two device groups is used to specify the communication allowed between the two device groups.
  • a directed edge itself consists of a classifier that matches packet header fields to represent security whitelist rules, and optionally, a service chain consisting of one or more sequences of network function boxes.
  • the two endpoints represent the device group employees (Employees) and the device group service department (Servers) respectively, and the policy shown in Figure 2 indicates that the device group Employees is allowed to send traffic to the device group Servers. Traffic must be sent using TCP port 80 or 34 or 7000 and must be served through the firewall.
  • policy graphs provide the flexibility to specify constraints on the allowed policy changes when a strategy graph is combined with any other strategy graph. Constraints can be specified for any pair of device groups in the policy graph.
  • the strategy map shown in FIG. 2 may be obtained through a web browser or an application interactive interface. This application does not limit the way of obtaining the strategy map.
  • the graph synthesizer merges the multiple strategy graphs, which can be divided into the following two steps:
  • the device groups of the input policy graph are transformed into globally disjoint device groups, forming a normalized device group.
  • the non-leaf node labels are replaced by the positive disjunctive normal form of their equivalent leaf node labels by using the label hierarchy structure, so that locally disjoint device groups are obtained.
  • Each conjunction is then queried against the label mapping to identify other potentially associated labels, and the query results are added to the conjunction. If there are any mutually exclusive labels in the obtained result, divide the conjunctive items accordingly, and continue the division process until any two items have no mutually exclusive labels, and finally the set of these conjunctive items is globally disjoint device group.
  • the device group D in the input strategy graph is normalized into device groups D 1 , D 2 ,...,D n . If there is a constraint on the source device group S and the destination device group D in the input strategy graph, then this constraint must be in the device group pair (S i , D j ) of the normalized strategy graph, Repeat above. Constraints may also need to be merged.
  • the edge strategy of the original input strategy graph is repeated and merged on the normalized device group.
  • S2 is the merging of normalized strategy graphs.
  • First the device groups in the final composite graph are the union of the device groups of all normalized strategy graphs.
  • constraints of the synthetic graph are the result of repetition and merging of the constraints of all independent normalized strategy graphs.
  • the composition of the constraints in the composite graph is similar to the constraint synthesis steps in the normalization of the input strategy graph, and will not be repeated here.
  • edge policies of all independent normalized policy graphs are repeated and merged according to the repeated and merged constraints.
  • the constraints between its source and destination device groups are first checked. This check determines whether the edge's classifier meets the constraints or needs to be narrowed to meet the constraints. . If a new edge passes this test with a non-empty surviving classifier, the new edge may be added or merged to an existing edge from the source device group to the destination device group.
  • merging new edges first find the intersection of its classifier flow space and existing classifiers. For disjoint classifier spaces of new edges, both new edges and their function boxes can be added directly. For any intersecting classifier spaces, the intersecting space is divided into a set of matching subspaces according to the existing policies and the new policies to be combined. This allows us to merge an existing edge with a new edge for each subspace.
  • the composite graph and network topology can be input to the intent editor to obtain the final network configuration.
  • the virtual network does not have a predetermined network topology before compilation, so the PGA model can be implemented in the bottom layer. Only supports OpenFlow-enabled network devices in the SDN environment, and does not support VPC-based virtual networks.
  • the implementation of a VPC-based virtual network may be based on OpenStack Neutron, the VPC-based virtual network provides far more network component APIs than OpenStack Neutron, and even overlapping APIs have different parameters, so Even if PGA can support OpenStack Neutron, it cannot support VPC-based virtual networks.
  • This type of method is mainly used for the construction of the underlying network/physical network, and the premise of this type of network construction is that the network topology is relatively fixed. At present, there is no suitable method for constructing a VPC, and if this type of method is used, the topology of the VPC is flexible. Sex is not used. That is, the above method cannot be used to build a VPC network when the network topology is uncertain.
  • the technical problem to be solved in this application is exactly how to build a VPC network without depending on the network topology.
  • the embodiment of the present application provides a network configuration method, by obtaining one or more user intentions, the user intentions are used to indicate the network configuration requirements and cloud service configuration requirements in the virtual private cloud VPC network, and determine the optimization goal of the VPC network , and then obtain the VPC network configuration scheme according to one or more user intentions and optimization goals, and then call the application programming interface API of one or more cloud services according to the VPC network configuration scheme, so that at least one of the management one or more cloud services
  • the management device configures one or more cloud services in the VPC network.
  • the VPC network configuration scheme can also be obtained without determining the network topology, so that the automatic generation of the VPC network configuration can be realized.
  • the system architecture includes a network configuration device, a public cloud, and user accounts in the public cloud environment, where the public cloud can provide shared network resource services for user accounts, such as in the public cloud environment shown in Figure 3 There are 3 user accounts.
  • the user account 2 needs to create a VPC network, the user can upload one or more user intentions and optimization goals to the network configuration device on the user account 2.
  • the network configuration device can obtain the VPC network configuration solution according to one or more user intentions and optimization goals, and call the API of one or more cloud services on the public cloud through the API docker, such as cloud service 1 in Figure 3 API1 of cloud service 2 and API2 of cloud service 2, so that the VPC network configuration plan can be delivered to user account 2 through the management device that manages API1 of cloud service 1 and API2 of cloud service 2, and the configuration of one or Multiple cloud services.
  • the API docker such as cloud service 1 in Figure 3 API1 of cloud service 2 and API2 of cloud service 2
  • the VPC network configuration plan can be delivered to user account 2 through the management device that manages API1 of cloud service 1 and API2 of cloud service 2, and the configuration of one or Multiple cloud services.
  • FIG. 4 shows a schematic structural diagram of a network configuration device provided by the present application.
  • the network configuration device includes an intent synthesizer and an intent compiler.
  • the user intentions input by multiple users into the intention synthesizer are processed by the intention synthesizer to form a global intention.
  • the global intention in this embodiment of the present application may also be called a global conflict-free intention.
  • the global intent is then input into the intent compiler, and the intent compiler will directly deliver the corresponding virtual network configuration scheme to the user account after processing it, forming a VPC network that meets the global intent.
  • the intent synthesizer may include a graph editor/browser, a graph normalizer, and a graph synthesizer.
  • Multiple users independently input user intentions to the intent synthesizer in the form of graphs (or graph structures) through the graph editor/browser.
  • user intents input in the form of graphs (or graph structures) can also be is called a strategy graph, and the graph editor/browser then passes the input strategy graph to the graph normalizer.
  • the graph editor/browser can also receive external services, such as label information shown in Figure 8, and transmit the label information to the graph normalizer to assist in the normalization process of the input strategy graph.
  • Multiple independently input strategy graphs are processed by the graph normalizer to obtain multiple independent normalized strategy graphs.
  • the user intents input to the intent synthesizer include whitelisted user intents for declaring that data is allowed to flow from one device group (e.g., a third device group) to another device group (
  • the intent of the fourth device group for example, the strategy diagram in Figure 2 belongs to the intent of the whitelist system, which is used to declare that data is allowed to flow from the device group Employees to the device group Servers using ports 80, 34, and 7000, and the data must pass through Firewall service. This can make it easier for users to express their intention to allow only a small amount of communication or to allow access to a small number of IP addresses/ports.
  • the user intent input to the intent synthesizer includes a blacklist system of user intents for declaring denial/prohibition of data flow from a device group (e.g., a third device group) to The intent of another device group (for example, the fourth device group), for example, the policy diagram shown in FIG. 5 belongs to the intent of the blacklist system, and is used to declare that the rejection data is sent to the device group Servers by using port 445 from the device group all. This can make it easier for the user to express his intention to deny only a small part of communication or deny access to a small part of IP addresses/ports.
  • a blacklist system of user intents for declaring denial/prohibition of data flow from a device group (e.g., a third device group) to The intent of another device group (for example, the fourth device group), for example, the policy diagram shown in FIG. 5 belongs to the intent of the blacklist system, and is used to declare that the rejection data is sent to the device group Servers by using port 445 from the
  • the user intent input to the intent synthesizer may also include the user intent of the whitelist system and the user intent of the blacklist system, so that the user can not only allow a small part of communication or allow a small number of IP It becomes easier to express an intent to address/port access, and it becomes easier to express an intent to deny access to only a small portion of traffic or to deny access to a few malicious IP addresses/ports.
  • the graph normalizer After the graph normalizer processes multiple independent normalized strategy graphs, multiple independent normalized strategy graphs are input to the graph synthesizer, and the synthesizer will merge these independent normalized strategy graphs to form a global conflict-free composite graph. That is, global intent. Both the graph normalizer and the graph synthesizer may find policy conflicts during processing, and they will report these conflicts to the user in the form of logs and errors.
  • the aforementioned intent compilers include optimizing compilers and API dockers. After the global intent is output from the graph synthesizer in the intent synthesizer, the global intent is input to the optimizing compiler in the intent compiler, and the optimizing compiler compiles the global intent to generate a virtual network that can realize the global intent and optimize the virtual network
  • the VPC network configuration scheme used by resources Through the intent compiler, it is possible to automatically compile the global intent into a VPC network configuration plan and call one or more cloud service APIs through the API docker, so as to realize the delivery of the VPC network configuration plan to the user account and form a global intent. VPC network.
  • the embodiment of the present application provides a network configuration method, which can be applied to the network configuration device shown in FIG. 3 .
  • the method includes:
  • step 601 the network configuration device acquires one or more user intentions.
  • the user intent is used to indicate the network configuration requirements and cloud service configuration requirements in the virtual private cloud VPC network.
  • the cloud service configuration requirements include the configuration requirements of one or more cloud services, such as the requirements for configuring the instance corresponding to the application. For physical machines, virtual machines, containers, etc.
  • Network configuration requirements include configuration requirements such as communication relationships between application program groups, port setting information, and service function types.
  • the user intention may include one or more of the following contents: application program group identifier, port configuration information and service function type.
  • the service function includes firewall and/or load balancing.
  • the network configuration device may provide a first configuration interface, where the first configuration interface is used to receive the first user intent uploaded by the user, and then receive the first user intent uploaded by the user. intention.
  • One or more user intents may be input by the user into the intent synthesizer in the form of a graph (or graph structure) through a graph editor/browser, so that the input of intents is simple, visual and easy to understand for the user.
  • the user intention input in the form of a graph (or graph structure) can also be called a strategy graph.
  • the two ends of the strategy graph are respectively two device groups.
  • Each device group can include one or more computing devices.
  • Two devices Communication between groups is actually an interaction between applications located on two device groups respectively.
  • the two device groups are connected through directed edges, and the directed edges are used to indicate the communication control between the two connected device groups.
  • the communication control is, for example, allowing communication or denying communication.
  • employees Employees
  • service department Server
  • the directed edge between Employees and Servers represents the communication control between the two device groups
  • the directed edge may include an edge indicating the direction of communication (such as the arrow in Figure 2) and a classifier, and the classifier sets information for the port above the edge indicating the direction of communication, for example, the port shown in Figure 2 80, 34, 7000 etc.
  • the user intention may also include a service function chain, which is used to indicate the service function through which the communication flow between the device groups passes.
  • the service function is, for example, the firewall (firewall , FW), another example is load balancing.
  • the service function chain involved in the embodiment of the present application may also be called a function box.
  • At least one user intention includes a user intention of a whitelist system (such as a second user intention) and/or a user intention of a blacklist system (such as a first user intention), wherein the first user intention Used to indicate that data is prohibited from flowing from a first computing device in a first device group to a second computing device in a second device group, the first device group includes one or more first computing devices, and the second device group includes one or more a second computing device; the second user intent is used to indicate that data is allowed to flow from a third computing device in a third device group to a fourth computing device in a fourth device group, the third device group including one or more third computing devices devices, the fourth device group includes one or more fourth computing devices.
  • a whitelist system such as a second user intention
  • a blacklist system such as a first user intention
  • Fig. 7 is a schematic diagram of user intentions provided by the embodiment of the present application.
  • the first 4 intentions of the 7 user intentions are the user intentions of the whitelist system.
  • Marketing, Mktg flows to the device group customer relationship management (customer relationship management, CRM) communication traffic through port 7000
  • user intent 2 declares that data is allowed to flow from the device group Employees to the device group Servers through ports 80, 34, and 7000.
  • User intent 3 declares that data is allowed to flow from the device group headquarters (All) to the communication traffic of the device group web page (Web) through ports 80, 443, etc.
  • User intent 4 states that data is allowed to flow from device group All to the device group database through ports 80, 443, etc. (database, DB) communication flow. This can make it easier for the user to declare the user's intent to allow only a small amount of traffic or to allow access to a small number of IP addresses/ports.
  • the last three user intentions are the user intentions of the blacklist system, in which user intention 5 declares to reject the communication flow of data from the device group Internet (Internet) to the device group Employees, and user intention 6 declares to reject data from the device group
  • the communication traffic from the Internet to the device group Servers, the user intent 7 statement rejects the communication traffic from the device group All to the device group Servers through port 445. This can make it easier for the user to declare the user's intention to deny only a small part of the communication flow or a small part of the IP address/port access.
  • one or more user intentions in the above step 601 may all be user intentions of the whitelist system, or may all be user intentions of the blacklist system, or may include user intentions of the whitelist system and blacklists.
  • the user intent of the system the coexistence of the user intent of the two systems makes it very concise and easy to declare whether it is the intent to allow only a small part of communication traffic or a small part of IP address/port access, or the user intent to only deny a small part of communication traffic .
  • the user in addition to inputting one or more user intentions into the intention synthesizer, the user can also input at least one constraint set, the constraint set includes at least one constraint, and each constraint is used to indicate when one or more user intentions are combined Constraints on allowed policy changes between any two device groups.
  • the constraint set shown in FIG. 7 includes two constraints, namely: the constraint between the device group Mktg and the device group CRM, and the constraint between the device group Employees and the device group CRM.
  • constraints are included in the constraint between the device group Mktg and the device group CRM.
  • 7000 in the Match column indicates 7000 ports
  • the Add column is Y (indicating Yes)
  • the remove column is N (indicating No).
  • This constraint Indicates that during the synthesis of one or more user intents, it is allowed to add constraints on the communication traffic flowing from computing devices in device group Mktg to computing devices in device group CRM through port 7000, and it is not allowed to delete traffic flowing from device group Mktg to computing devices through port 7000.
  • This constraint indicates that it is not allowed to add during the synthesis process of one or more user intentions.
  • the constraint on the communication flow from the computing devices in the device group Mktg to the computing devices in the device group CRM through ports other than 7000 may be removed from the restriction on the communication traffic from the device group Mktg to the device group CRM through ports other than 7000.
  • step 602 the network configuration device determines the optimization target of the VPC network.
  • the network configuration device provides a second configuration interface, and the second configuration interface is used to receive the optimization goal uploaded by the user; and then, receive the optimization goal uploaded by the user.
  • the optimization goal may include minimum network overhead and/or minimum delay, where network overhead indicates the proportion of redundant data to source data during network transmission, and delay indicates data transmission from one end of the network to another The time required for one end.
  • Step 603 the network configuration device obtains a VPC network configuration solution according to the one or more user intentions and optimization goals.
  • the VPC network configuration scheme may include, but is not limited to, creating several VPCs, each VPC having several subnets, and routing between subnets.
  • the network configuration device may combine one or more user intentions to generate a global intention, and then obtain a VPC network configuration solution according to the global intention and the optimization goal.
  • the network configuration device normalizes one or more user intentions to obtain at least one normalized strategy graph, and the device groups included in the at least one normalized strategy graph are all globally disjoint device groups.
  • the network configuration apparatus may also acquire label information, where the label information includes a label hierarchical structure for representing the hierarchical relationship of all device groups in the device group set.
  • the label hierarchy shown in Figure 8 is represented by a tree structure, which is a data structure with a hierarchical relationship between elements, and the node at the top of the tree is called the root node, and the device group All in Figure 8 is the root Nodes are subdivided from the root node down into sub-nodes, among which sub-nodes that can be further subdivided are called non-leaf nodes, and when subdivided continuously until there are no more sub-nodes, they are leaf nodes.
  • the following device groups are non-leaf nodes: tenants (Tenant), Employees, Servers, applications (APPs), Mktg; the following device groups are leaf nodes: Internet, Other Employees, CRM, Other Servers, Web, DB, Mktg1 and Mktg2.
  • the two device groups that the user intends to include may both be non-leaf nodes or both may be leaf nodes, or one device group may be a non-leaf node and the other device group may be a leaf node.
  • S1 convert one or more device groups intended to be included by the user and belonging to non-leaf nodes in the label hierarchy into device groups of leaf nodes equivalent to the device groups of non-leaf nodes in the label hierarchy .
  • all device groups belonging to non-leaf nodes (ie combined tags) in one or more user intents in the label hierarchy are converted into disjunctive normal forms of their corresponding leaf nodes, that is, globally disjoint device group forms.
  • the device group S in the input strategy graph is transformed into normalized device groups S 1 , S 2 ,...,S m
  • the device group D in the input strategy graph is normalized into device groups D 1 , D 2 ,...,D n .
  • the device group Mktg in the user intent 1 shown in Figure 7 corresponds to the non-leaf node Mktg in the hierarchical structure shown in Figure 8, which can be transformed into
  • the leaf nodes corresponding to the non-leaf node Mktg shown are: device group Mktg1 and device group Mktg2
  • the device group Employees in user intention 2 corresponds to the non-leaf node Employees in the hierarchical structure shown in Figure 8, which can be converted to
  • the leaf nodes corresponding to the non-leaf node Employees shown in the figure are: device group Mktg1, device group Mktg2, and device group Other Employees.
  • the device group Servers in user intent 2 corresponds to the non-leaf node Servers in the hierarchical structure shown in Figure 8, which can be converted to As shown in Figure 8, the leaf nodes corresponding to the non-leaf node Servers: device group CRM, device group Other Servers, and the device groups corresponding to the leaf nodes in the hierarchical structure shown in Figure 8 in Figure 7 do not need to be converted, so that
  • the user intents of the whitelist system shown in FIG. 9 correspond to global disjoint device groups.
  • the device group Employees in the user intent 5 shown in Figure 7 corresponds to the non-leaf node Employees in the hierarchical structure shown in Figure 8, which can be converted to The leaf nodes corresponding to the non-leaf node Employees shown in Figure 8: device group Mktg1, device group Mktg2, and device group Other Employees, and the device group Servers in user intent 6 and user intent 7 correspond to non-leaf nodes in the hierarchical structure shown in Figure 8.
  • the leaf node Servers can be converted to the leaf nodes corresponding to the non-leaf node Servers as shown in Figure 8: device group CRM, device group Other Servers, and the device group corresponding to the leaf node in the hierarchical structure shown in Figure 8 in Figure 7 No conversion is required, so that the global disjoint device groups corresponding to the user intentions of the blacklist system as shown in FIG. 10 are obtained.
  • device group S has an edge to device group D in the original strategy graph, then the original edge will be in the device group (S i , D j ) of the normalized strategy graph, Repeat above. Any edge on (G,H) is merged with (S,D) to inherit overlap. This merging is governed by the resulting constraints. For example, for the policy diagram shown in Figure 7 to allow data to flow from the device group Employees to the directed edge between the device group Servers through ports 80, 34, and 7000, it is necessary to convert the device group Mktg1 to the device group Mktg1 as shown in Figure 9.
  • the above normalization process may also equivalently repeat and merge the constraints in the policy graph into globally disjoint device groups, that is, step S3 is included.
  • the constraint between the device group Mktg and the device group CRM shown in Figure 7 since the device group Mktg is converted into two device groups Mktg1 and Mktg2, the constraints between the device group Mktg and the device group CRM need to be repeated respectively Between the device group Mktg1 and the device group CRM and between the device group Mktg2 and the device group CRM as shown in FIG. 9 . Since the equipment group Employees and the equipment group CRM are still their own equipment groups after conversion, the constraint between the equipment group Employees and the equipment group CRM only needs to be repeated once between the equipment group Employees and the equipment group CRM.
  • Process 2 Merge at least one normalized strategy graph to generate global intent.
  • the at least one normalized policy graph may be merged according to constraints repeated on each device group included in the at least one normalized strategy graph to generate a global intent.
  • the process of merging normalized policy graphs can be performed in a graph synthesizer as shown in FIG. 4 .
  • the normalized strategy graph corresponding to the user intention of the whitelist system as shown in Figure 9 is merged to obtain the composite graph corresponding to the user intent of the whitelist system as shown in Figure 11.
  • the device group included in the composite graph is all whitelist The union of device groups in the normalized policy graph corresponding to the user intent of the list system.
  • the synthetic graph corresponding to the user intentions of the whitelist system shown in FIG. 11 and the user intentions of the blacklist system shown in FIG. 12 are combined to obtain the global intentions shown in FIG. 13 .
  • an edge of a single normalized strategy graph is added to the composite graph, the constraints between its source device group and destination device group are first checked. This check determines whether the edge classifier meets the constraints or needs to be Narrow down to fit the constraints. If a new edge passes this test with a non-empty surviving classifier, it may be added or merged to an existing edge from the source to destination device set.
  • merging new edges first find the intersection of its classifier flow space and existing classifiers. For disjoint classifier spaces of new edges, both new edges and their function boxes can be added directly. For any intersecting classifier spaces, the intersecting space is divided into a set of matching subspaces according to the existing policies and the new policies to be combined.
  • the intent synthesizer supports automatic merging of multiple input user intents, thus supporting multiple users to independently input multiple local intents without the user needing to consider the merging of global intents, which can reduce user burden.
  • the intent synthesizer as shown in FIG. 4 inputs the global intent to the intent compiler. Then, the VPC network configuration scheme is obtained by the intention compiler in the network configuration device according to the global intention and the optimization goal.
  • the mapping method of these configurations to physical resources, and the virtual configuration of physical resources There may be differences in specific methods, performance limitations of physical resources, and overhead of physical resources.
  • the compilation of the above-mentioned PGA from the synthetic graph to the virtual network configuration only guarantees that one intention corresponds to one configuration, and does not take into account
  • the relationship between the virtual network configuration and the underlying physical resources that implement these configurations and the resulting optimization problem that is, how to choose the configuration scheme of the virtual network so that the compiled network has good performance and low overhead.
  • step 603 before step 603, that is, before obtaining the VPC network configuration solution according to the one or more user intentions and optimization goals, the obtained one or more user intentions, optimization goals, and Constraints of VPC network resources to generate an optimization model.
  • constraints are optional.
  • the constraints on the VPC network resources may include, but are not limited to, the limit on the number of VPC configurations, the limit on the number of security groups, and the limit on the number of ACLs. If constraints are used when generating the optimization model, overloading of the equipment carrying the upper-level configuration can be avoided.
  • the optimizing compiler may also consider supporting user-defined compilation preferences, such as pursuing the least overhead or using the most common configuration, and then designing and implementing corresponding compilation algorithms for different preference settings.
  • the VPC network configuration scheme as shown in FIG. 15 is output.
  • the VPC network configuration scheme may include but not It is limited to subnet division rules, security group division rules, access control list (access control list, ACL) rules, source address translation (source network address translation, SNAT) rules and destination network address translation (destination network address translation DNAT) shown in Figure 15 rules etc.
  • Step 604 the network configuration device invokes the application program interface API of one or more cloud services according to the VPC network configuration scheme, so that at least one management device managing one or more cloud services configures one or more cloud services in the VPC network.
  • each cloud service corresponds to a management device.
  • a cloud service can include one or more APIs.
  • the cloud services that can be provided by the public cloud include APIs of services such as VPC, virtual machine, container, firewall, and load balancing.
  • the network configuration device can call the API of the VPC service;
  • the network configuration device may call the API of the virtual machine service.
  • the network configuration device can convert some/all of the VPC network configuration solutions into VPC network configuration instructions, and the VPC network configuration instructions conform to the requirements of one or more cloud services. API format, and then, send the VPC network configuration instruction to one or more cloud service management devices, so that the one or more cloud service management devices configure one or more cloud services for the VPC network.
  • the network configuration device can call the API of one or more cloud services provided by the public cloud through the API docker according to the VPC network configuration plan, and the API docker can convert the VPC network configuration plan into different API formats.
  • VPC network configuration instructions and then manage one or more management devices corresponding to cloud services to deliver the VPC network configuration plan to the user account.
  • the management device is configured in the VPC network of the user account.
  • One or more cloud services are provided by the API docker according to the VPC network configuration plan.
  • the API docker calls the API of the VPC network provided by the cloud service provider to automatically send the VPC network configuration information to the user account of the VPC network, and generates a VPC network that can realize the global intent without determining the network
  • the VPC network configuration scheme can also be obtained, so that the automatic generation of the VPC network configuration can be realized.
  • the embodiment of the present application also provides a network configuration device, which can be used to realize the functions of the network configuration device in the above method embodiment, so it can also realize the above method embodiment have beneficial effects.
  • a network configuration apparatus 1600 includes a communication unit 1601 and a processing unit 1602 .
  • the communication unit 1601 is used to obtain one or more user intentions, wherein the user intention is used to indicate network configuration requirements and cloud service configuration requirements in the virtual private cloud VPC network, and the cloud service configuration requirements include one or more cloud service configuration requirements.
  • the configuration requirements of the VPC network; the processing unit 1602 is used to determine the optimization goal of the VPC network; according to one or more user intentions and optimization goals, obtain the VPC network configuration scheme; according to the VPC network configuration scheme, call one or more cloud service applications An interface API, so that at least one management device that manages one or more cloud services configures one or more cloud services in the VPC network.
  • the one or more user intentions include a first user intention, where the first user intention is used to indicate that data is prohibited from flowing from the first computing device in the first device group to the computer in the second device group.
  • a second computing device the first device group includes one or more first computing devices, and the second device group includes one or more second computing devices.
  • the communication unit 1601 is specifically configured to: provide a first configuration interface, and the first configuration interface is configured to receive the first user intention uploaded by the user; and receive the first user intention uploaded by the user.
  • the communication unit 1601 is specifically configured to: provide a second configuration interface, and the second configuration interface is configured to receive the optimization goal uploaded by the user; and receive the optimization goal uploaded by the user.
  • the optimization goal includes minimum network overhead and/or minimum time delay, where the network overhead indicates the proportion of redundant data to source data during network transmission.
  • the processing unit 1602 is specifically configured to: convert some/all of the VPC network configuration schemes into VPC network configuration instructions, and the VPC network configuration instructions conform to the API format of one or more cloud services; the communication unit 1601, specifically for: sending a VPC network configuration instruction to one or more cloud service management devices, so that the one or more cloud service management devices configure one or more cloud services for the VPC network.
  • the vendor that provides one or more cloud services and the vendor that runs the network configuration device are the same vendor.
  • the processing unit 1602 is further configured to: combine one or more user intentions to generate a global intention; and obtain a VPC network configuration solution according to the global intention and the optimization goal.
  • each functional unit in each embodiment of the present application It can be integrated in one processing unit, or physically exist separately, or two or more units can be integrated in one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .
  • the embodiment of the present application also provides a network configuration device 1700, which can be used to implement the functions of the network configuration device in the foregoing method embodiments.
  • the network configuration apparatus 1700 may include a memory 1701 and a processor 1702 , and may optionally further include a bus system, and the memory 1701 and the processor 1702 may be connected through the bus system.
  • the above processor 1702 may be a chip.
  • the processor 1702 may be a field programmable gate array (field programmable gate array, FPGA), may be an application specific integrated circuit (ASIC), may also be a system chip (system on chip, SoC), or It can be a central processor unit (CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (micro controller) unit, MCU), it can also be a programmable controller (programmable logic device, PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processing circuit
  • microcontroller micro controller
  • MCU microcontroller
  • PLD programmable logic device
  • each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1702 or instructions in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor 1702 .
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory 1701, and the processor 1702 reads the information in the memory 1701, and completes the steps of the above method in combination with its hardware.
  • the processor 1702 in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory 1701 in this embodiment of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM direct memory bus random access memory
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computing device, including a memory and at least one processor; the memory is used to store computer instructions; the at least one processor is used to execute the memory stored computer instructions, so that the computing device executes the methods in the above method embodiments.
  • the present application also provides a computer-readable storage medium on which a computer program or instruction is stored.
  • the computing device executes the method described in the above-mentioned embodiment. Methods.
  • the present application also provides a computer program product, which enables the computing device to execute the methods in the foregoing method embodiments when the computer reads and executes the computer program product.
  • the present application also provides a chip, including at least one processor and an interface; the interface is used to provide program instructions or data for the at least one processor; the at least one processor uses To execute the program line instructions, so that the methods in the above method embodiments are executed.
  • the chip may further include a memory, the memory stores instructions, the processor is used to execute the instructions stored in the memory, and when the instructions are executed, the processor uses to implement the methods in the aforementioned embodiments.
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on the computer, the processes or functions according to the embodiments of the present invention will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive (SSD).
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage media may be any available media that can be accessed by a computer.
  • computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or may be used to carry or store information in the form of instructions or data structures desired program code and any other medium that can be accessed by a computer.
  • Any connection can suitably be a computer-readable medium.
  • the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave
  • coaxial cable , fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave
  • disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disc, and blu-ray disc, where discs usually reproduce data magnetically, and discs Lasers are used to optically reproduce the data. Combinations of the above should also be included within the scope of computer-readable media.

Abstract

一种网络配置方法及装置，其中方法包括：获取一个或多个用户意图，用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，确定VPC网络的优化目标，然后根据一个或多个用户意图和优化目标，获得VPC网络配置方案，之后根据VPC网络配置方案调用一个或多个云服务的应用程序接口API，以使得管理一个或多个云服务的至少一个管理装置为VPC网络中配置一个或多个云服务；其中，云服务配置需求包括一个或多个云服务的配置需求。在获取一个或多个用户意图后，不需要确定网络拓扑结构的情况下也可以获取VPC网络配置方案，从而可以实现VPC网络配置的自动生成。

Description

一种网络配置方法及装置
相关申请的交叉引用
本申请要求在2021年11月23日提交中华人民共和国知识产权局、申请号为202111397164.9、发明名称为“一种数据处理方法和计算机”的中国专利申请的优先权，其全部内容通过引用结合在本申请中；本申请要求在2022年03月29日提交中华人民共和国知识产权局、申请号为202210319796.1、申请名称为“一种网络配置方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及虚拟网络技术领域，尤其涉及一种网络配置方法及装置。
背景技术
虚拟网络是云服务商将底层物理网络设备抽象形成的网络功能资源池，租户通过操纵虚拟网络所提供的网络抽象来构建它们在云上的专属网络。由于人工实现从意图到虚拟网络配置之间的转换存在困难，例如，虚拟网络的构建过程十分复杂，由于虚拟网络提供给租户的网络抽象本质上只是用于构建物理网络的低级构建块的虚拟化版本，这就要求租户自己完成从网络意图到低级构建块的转换以及关于网络规模、可用性和安全性的复杂推理；又例如，虚拟网络配置的学习成本高，由于虚拟网络提供的网络服务纷繁错杂，每种服务都需要大量的手工配置工作量，且这些配置作为低级构建块的虚拟化版本需要租户具有底层网络概念的详细知识；又例如，虚拟网络的合理配置难以被保证，由于租户难以对虚拟网络的配置资源有深入了解，难以保证配置的虚拟网路性能良好或对配置资源的合理使用，这会为未来问题的出现埋下隐患，不仅影响租户的使用体验，也增加了云服务商为解决问题投入的成本。所以需要针对虚拟网络环境进行意图编译替代人工实现，即以用户以意图的形式所给出的期望网络实现的功能或达到的状态作为输入，将其转换为相应的网络配置并自动将配置下发至实际网络基础设施的过程。
目前的网络领域的意图编译需要向意图编译器输入意图以及网络拓扑结构，才能得到最终的网络配置，但是，虚拟网络在编译前并不存在既定的网络拓扑，所以无法实现以虚拟私有云(virtual private cloud，VPC)为主的虚拟网络的意图编译。
发明内容
本申请实施例提供一种网络配置方法及装置，用以实现通过意图编译方式生成VPC网络。
第一方面，本申请实施例提供一种网络配置方法，该方法可以由网络配置装置执行，该方法包括：获取一个或多个用户意图，用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，确定VPC网络的优化目标，然后根据一个或多个用户意图和优化目标，获得VPC网络配置方案，之后根据VPC网络配置方案调用一个或多个云服务的应用程序接口API，以使得管理一个或多个云服务的至少一个管理装置为VPC网络中配 置一个或多个云服务；其中，云服务配置需求包括一个或多个云服务的配置需求。
通过上述方法，在获取一个或多个用户意图后，不需要确定网络拓扑结构的情况下也可以获取VPC网络配置方案，从而可以实现VPC网络配置的自动生成。
在一种可能的设计中，用户意图包括下述的一种或多种：应用程序群组标识、端口配置信息和服务功能类型。其中，服务功能类型包括防火墙和/或负载均衡。
在一种可能的设计中，上述一个或多个用户意图可以包括第一用户意图和/或第二用户意图，其中，第一用户意图用于指示禁止数据由第一设备组中的第一计算设备流向第二设备组中的第二计算设备，第一设备组包括一个或多个第一计算设备，第二设备组包括一个或多个第二计算设备；第二用户意图用于指示允许数据由第三设备组中的第三计算设备流向第四设备组中的第四计算设备，第三设备组包括一个或多个第三计算设备，第四设备组包括一个或多个第四计算设备。
通过上述方法，在上述一个或多个用户意图均为黑名单体系的用户意图(即第一用户意图)的情况下，可以使得用户对于仅拒绝少部分通信流量或是允许少数IP地址/端口访问的意图的声明变得更容易。在上述一个或多个用户意图均为白名单体系的用户意图(即第二用户意图)的情况下，可以使得用户对于仅允许少部分通信流量或是允许少数IP地址/端口访问的用户意图的声明变得更容易。在上述一个或多个用户意图包括白名单体系的用户意图(第二用户意图)和黑名单体系的用户意图(即第一用户意图)的情况下，这两种类型的用户意图共存使得无论是仅允许小部分通信流量或是允许少数IP地址/端口访问的用户意图，还是仅拒绝小部分通信流量或是允许少数IP地址/端口访问的用户意图的声明都十分简洁、容易。
在一种可能的设计中，获取第一用户意图，可以包括：提供第一配置接口，第一配置接口用于接收用户上传的第一用户意图，接收用户上传的第一用户意图。
在一种可能的设计中，确定VPC网络的优化目标，可以包括：提供第二配置接口，第二配置接口用于接收用户上传的优化目标；然后，接收用户上传的优化目标。通过该设计，获取到用户上传的优化目标，可以使得配置的VPC网络符合优化目标。
在一种可能的设计中，优化目标包括网络开销最小和/或时延最小，其中，网络开销指示在网络传输过程中冗余数据占源数据的比例。通过该设计，可以使得配置的VPC网络的网络性能最好以及开销最小。
在一种可能的设计中，根据VPC网络配置方案调用一个或多个云服务的应用程序接口API，包括：将部分/全部的VPC网络配置方案转换为VPC网络配置指令，VPC网络配置指令符合一个或多个云服务的API格式；然后，将VPC网络配置指令发送至一个或多个云服务的管理装置，以使得一个或多个云服务的管理装置为VPC网络中配置一个或多个云服务。通过该设计，可以将VPC网络配置方案转换为网络配置装置调用的API可以识别的API格式，从而使得网络配置方案可适配不同厂商的API。
在一种可能的设计中，提供一个或多个云服务的厂商和运行网络配置装置的厂商可以为同一厂商，也可以为不同厂商。
在一种可能的设计中，在获取一个或多个用户意图后，上述方法包括：将一个或多个用户意图进行合并，生成全局意图；根据一个或多个用户意图和优化目标，获得网络配置方案，可以包括：根据全局意图和优化目标，获得网络配置方案。通过该设计，可以支持用户输入多个独立的用户意图，不需要用户考虑多个用户意图的合并，网络配置装置可以 自动实现对多个用户意图的合并，从而可以减轻用户负担。
第二方面，本申请实施例还提供了一种网络配置装置，有益效果可以参见第一方面或第一方面的任一可能的设计中的描述此处不再赘述。该网络配置装置具有实现上述第一方面或的方法实例中行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述装置的结构中包括通信单元和处理单元，这些单元可以执行上述第一方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第三方面，本申请实施例还提供了一种计算设备，所述计算设备包括处理器和存储器，还可以包括通信接口以及显示屏，所述处理器执行所述存储器中的程序指令执行上述第一方面或第一方面任一可能的设计提供的方法。所述存储器与所述处理器耦合，其保存程序指令和数据。所述通信接口，用于与其他设备进行通信，例如通过API对接器调用云服务商提供的VPC网络的API。所述显示屏用于在所述处理器的触发下向用户显示图编辑器/浏览器的用户界面。
第四方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质被计算设备执行时，所述计算设备执行前述第一方面或第一方面的任意可能的实现方式中提供的方法。该计算机可读存储介质中存储了程序。该计算机可读存储介质包括但不限于易失性存储器，例如随机访问存储器，非易失性存储器，例如快闪存储器、硬盘(hard disk drive，HDD)、固态硬盘(solid state drive，SSD)。
第五方面，本申请提供了一种计算设备程序产品，所述计算设备程序产品包括计算机指令，在被计算设备执行时，所述计算设备执行前述第一方面或第一方面的任意可能的实现方式中提供的方法。该计算机程序产品可以为一个软件安装包，在需要使用前述第一方面或第一方面的任意可能的实现方式中提供的方法的情况下，可以下载该计算机程序产品并在计算设备上执行该计算机程序产品。
第六方面，本申请还提供一种芯片，芯片与存储器相连，芯片用于读取并执行存储器中存储的软件程序，执行前述第一方面或第一方面的任意可能的实现方式中提供的方法。
附图说明
图1为本申请实施例提供的PGA模型的系统架构示意图；
图2为本申请实施例提供的策略图的示意图；
图3为本申请实施例提供的适用的系统架构示意图；
图4为本申请实施例提供的适用的系统架构示意图；
图5为本申请实施例提供的策略图的示意图；
图6为本申请实施例提供的一种网络配置方法流程示意图；
图7为本申请实施例提供的用户意图示意图；
图8为本申请实施例提供的标签层级架构示意图；
图9为本申请实施例提供的白名单体系的用户意图示意图；
图10为本申请实施例提供的黑名单体系的用户意图示意图；
图11为本申请实施例提供的白名单体系的用户意图对应的合成图示意图；
图12为本申请实施例提供的黑名单体系的用户意图对应的合成图示意图；
图13为本申请实施例提供的全局意图示意图；
图14为本申请实施例提供的意图编译器的生成过程示意图；
图15为本申请实施例提供的VPC网络配置信息示意图；
图16为本申请实施例提供的网络配置装置示意图；
图17为本申请实施例提供的网络配置装置示意图。
具体实施方式
在对本申请实施例提供的一种网络配置方法进行说明之前，先对本申请实施例涉及的概念进行说明：
(1)虚拟私有云(virtual private cloud，VPC)，为云服务器、云容器、云数据库等资源构建隔离的、用户自主配置和管理的虚拟网络环境，提升用户云上资源的安全性，简化用户的网络部署。
(2)虚拟网络(virtual network)，是一种包含至少部分是虚拟网络链接的计算机网络，其中，虚拟网络链接是在两个计算设备间不包含物理连接，而是通过网络虚拟化来实现。
(3)用户意图(user intent)，是用户所提出的网络需求，可以是用户期望网络最终实现的功能或是达到的状态。意图是一种声明式的策略。
(4)网络领域的意图编译，是以用户以意图的形式所给出的期望网络实现的功能或达到的状态作为输入，将其转换为相应的网络配置并自动将配置下发至实际网络基础设施的一类方法。
本申请中的“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的“至少一个”是指一个或者多个。多个，是指两个或两个以上。“至少一个”、“任意一个”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
目前，由于人工实现从意图到虚拟网络配置之间的转换存在困难，所以需要针对网络环境进行意图编译替代人工实现，下面介绍一种可以实现网络领域的意图编译的具体方式。
通过策略图抽象(policy graph abstraction，PGA)模型实现多个用户意图合成从而生成全局意图，其中，PGA模型允许用户以图的形式简单且独立地表达网络策略，并对独立输入的多个策略进行自动合成，并在此过程中检测和解决策略冲突。
图1为PGA的系统架构，如图1所示，该PGA的系统架构包括图编辑/浏览器和图合成器。用户、租户、管理员、SDN应用等可独立地以图的形式生成他们各自的策略并通过PGA的用户界面将其提交给图合成器。用户界面和图合成器利用来自外部服务的附加信息(例如标签信息)协助策略的合成。图合成器会自动地将输入图合成为一个无冲突的组合图，即合成图，在合成过程中会解决或标记冲突/错误，并向用户报告冲突/错误，可选的，PGA还可以提出修复建议。合成图可被主动或被动地编译成底层配置/规则。PGA的策略合成和底层的编译方法是正交的。
其中，输入PGA的策略可以使用图结构表示，该图结构表示：网络设备间允许的通信，以及每次通信所需的服务功能链的遍历。PGA模型是一个白名单模型，必须显式允许通信，否则会隐式拒绝。
在使用图结构表示的策略图中包括两个端点，每个端点代表一个设备组(endpoint group，设备组)，该设备组包含一组端点，端点是策略图中的最小抽象单元，端点例如为服务器、虚拟机、子网或最终用户。一个设备组由满足设备组成员资格条件的所有端点组成。两个设备组之间的有向边则被用来指定两个设备组之间允许的通信。有向边本身由一个匹配数据包头域来表示安全白名单规则的分类器组成，可选地，还具有由一个或多个网络功能盒序列所组成的服务链。
[根据细则91更正 13.02.2023]　
如图2所示的策略图中，两个端点分别代表设备组雇员(Employees)和设备组服务部(Servers)，在图2所示的策略表示允许设备组Employees向设备组Servers发送流量，该流量必须使用TCP端口80或34或7000发送，且必须通过防火墙服务。另外，策略图还可以灵活地指定在策略图与任何其他策略图组合时所允许的策略更改的约束。可以为策略图中任何的设备组对指定约束。
需要说明的是，如图2所示的策略图可以是通过网页浏览器或者应用的交互界面等方式获得的。本申请不对策略图的获取方式进行限制。
在多个策略图输入至图合成器之后，图合成器对多个策略图进行合并，可以分为以下两个步骤进行：
S1，对输入策略图的规范化。
首先，根据输入的标签层级架构以及标签映射将输入策略图的设备组转换为全局不相交的设备组的形式，形成了规范化的设备组。具体来说，利用标签层级架构将非叶子节点标签替换为与其等价的叶子节点标签的正析取范式的形式，这样就得到了局部不相交的设备组。然后根据标签映射查询每一个合取项以识别其他潜在的关联标签，将查询到的结果添加到合取项中。如果得到的结果中有任何互斥的标签，就相应地对该合取项进行划分，持续该划分过程直到任意两项均没有互斥的标签，最终这些合取项的集合即为全局不相交的设备组。
然后，将输入的策略图的约束在规范化设备组上进行重复和合并。
具体来说，假设原始输入策略图中的设备组S被转换成了规范化的设备组S 1,S 2,…,S m,输入策略图的设备组D被规范化为设备组D 1,D 2,…,D n。如果在输入策略图中对源设备组S和目的设备组D有约束，那么这约束就要在规范化策略图的设备组对(S i,D j),
Figure PCTCN2022133465-appb-000001
Figure PCTCN2022133465-appb-000002
上重复。约束还可能需要被合并。如果原始输入策略图有设备组对(G,H)的约束，并且这个设备组对与设备组对(S,D)有重叠，那么为(G,H)指定的任何约束都必须与(S,D)的约束合并以便构成规范化设备组间继承了重叠的约束。合并时还会检测冲突，并为操作员标记这样的错误。
最后，遵照上一步得到的约束将原输入策略图的边策略在规范化设备组上进行重复和合并。
具体来说，如果设备组S在原始策略图中有到设备组D的边，那么原始边将会在规范化策略图的设备组(S i,D j),
Figure PCTCN2022133465-appb-000003
上重复。(G,H)上的任何边都要与(S,D)上的合并以继承重叠。这种合并由上步得到的约束控制。
S2，是对规范化策略图的合并。
首先最终合成图中的设备组是所有规范化策略图的设备组的并集。
然后合成图的约束是所有独立规范化策略图的约束的重复和合并的结果，合成图中约束的合成和在对输入策略图的规范化中进行的约束合成步骤类似，此处不再赘述。
最后，根据重复和合并后的约束，重复和合并的所有独立规范化策略图的边策略。
在将单个规范化策略图的边添加到合成图中时，首先检查其源设备组和目的设备组之间的约束，这一检查决定了边的分类器是否符合约束或者需要被缩小范围以便符合约束。如果一条新边以非空的幸存分类器通过了这个测试，那么这条新边可能会被添加或合并到从源设备组到目的设备组的现有边。在合并新边时，首先找到其分类器流空间和已有分类器的交集。对于新边的不相交分类器空间，新边及其功能盒都可被直接添加。对于任何相交的分类器空间，依据已有的策略和新的要合并的策略，将相交空间划分为一组匹配的子空间。这允许我们为每个子空间合并一条现有边和新边。
通过上述PGA模型得到合成图后，可以将合成图以及网络拓扑结构输入至意图编辑器，得到最终的网络配置，但是虚拟网络在编译前并不存在既定的网络拓扑，所以PGA模型可以实现在底层仅支持SDN环境下启用OpenFlow的网络设备，并不支持以VPC为主的虚拟网络。虽然以VPC为主的虚拟网络的实现可能是基于OpenStack Neutron的，但以VPC为主的虚拟网络所提供的网络组件API远多于OpenStack Neutron，且即便是重叠的API其参数也有所不同，所以PGA即使能支持OpenStack Neutron也无法支持以VPC为主的虚拟网络。
这类方法主要用于底层网络/物理网络的构建，而这类网络的构建前提是网络拓扑相对固定，目前没有合适的构建VPC的方法，而如果使用这类方法的话，VPC的拓扑结构的灵活性就没有使用到。也即，在不确定网络拓扑的情况下，上述方法无法用于构建VPC网络。
本申请要解决的技术问题也正是，如何在不依据网络拓扑结构的情况下，构建VPC网络。
为此，本申请实施例提供一种网络配置方法，通过获取一个或多个用户意图，用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，确定VPC网络的优化目标，然后根据一个或多个用户意图和优化目标，获得VPC网络配置方案，之后根据VPC网络配置方案调用一个或多个云服务的应用程序接口API，以使得管理一个或多个云服务的至少一个管理装置为VPC网络中配置一个或多个云服务。通过该方法，在获取一个或多个用户意图后，不需要确定网络拓扑结构的情况下也可以获取VPC网络配置方案，从而可以实现VPC网络配置的自动生成。
下面提供本申请实施例使用的系统架构。
如图3所示，该系统架构包括网络配置装置、公有云以及在公有云环境中的用户账户，其中，公有云可以为用户账户提供共享网络资源服务，例如图3所示的公有云环境中有3个用户账户。
当需要在公有云上创建VPC网络时，例如用户账户2需要创建VPC网络，用户可以在用户账户2上向网络配置装置上传一个或多个用户意图以及优化目标。
然后，网络配置装置可以根据一个或多个用户意图和优化目标，获得VPC网络配置方案，并通过API对接器调用公有云上的一个或多个云服务的API，例如图3中的云服务1的API1和云服务2的API2，从而实现通过管理云服务1的API1和云服务2的API2的管理装置向用户账户2下发VPC网络配置方案，并在下发过程中完成VPC网络中配置一个或多个云服务。
基于图3所示的系统架构，图4示出了本申请提供的网络配置装置的结构示意图， 如图4所示，网络配置装置包括意图合成器和意图编译器。首先，多个用户分别输入到意图合成器中的用户意图，经过意图合成器的处理后形成全局意图，本申请实施例中的全局意图又可称为全局无冲突意图。然后，该全局意图随后被输入到意图编译器，意图编译器对其进行处理后会直接将相应的虚拟网络配置方案下发到用户账户中，形成满足全局意图的VPC网络。
其中，意图合成器可以包括图编辑器/浏览器、图规范化器、以及图合成器。多个用户独立地通过图编辑器/浏览器以图(或图结构)的形式向意图合成器输入用户意图，本申请实施例中，以图(或图结构)的形式输入的用户意图也可以称为策略图，然后，图编辑器/浏览器将输入的策略图传输至图规范化器。此外，图编辑/浏览器还可以接收外部服务，例如图8所示的标签信息，并将标签信息传输至图规范化器，以协助对输入的策略图的规范化过程。多个独立输入的策略图经过图规范化器的处理后，得到多个独立的规范化策略图。
在一些实施例中，输入到意图合成器的用户意图包括白名单体系的用户意图，白名单体系的意图为用于声明允许数据由一个设备组(例如第三设备组)流向另一个设备组(例如第四设备组)的意图，例如图2中的策略图属于白名单体系的意图，用于声明允许数据由设备组Employees使用80、34、7000等端口流向设备组Servers，且这些数据必须经过防火墙服务。这样可以使得用户对于仅允许少部分通信或是允许少数IP地址/端口访问的意图的表达变得更容易。
在又一些实施例中，输入到意图合成器的用户意图包括黑名单体系的用户意图，黑名单体用户系的意图为用于声明拒绝/禁止数据由一个设备组(例如第三设备组)流向另一个设备组(例如第四设备组)的意图，例如图5所示的策略图属于黑名单体系的意图，用于声明拒绝数据由设备组all使用端口445信向设备组Servers。这样可以使得用户对于仅拒绝少部分通信或是拒绝少部分IP地址/端口访问的意图的表达变得更容易。
在其它一些实施例中，输入到意图合成器的用户意图也可以包括白名单体系的用户意图和黑名单体系的用户意图，这样可以使得用户不仅对于用户对于仅允许少部分通信或是允许少数IP地址/端口访问的意图的表达变得更容易，而且对于仅拒绝少部分通信或是拒绝少数恶意IP地址/端口访问的意图的表达也变得更容易。
在图规范化器处理得到多个独立的规范化策略图之后，多个独立的规范化策略图输入至图合成器，合成器会对这些独立的规范化策略图进行合并，形成一个全局无冲突的合成图，即全局意图。无论是图规范化器还是图合成器都可能在处理过程中发现策略冲突，此时发现策略冲突它们会以日志和错误的形式向用户报告这些冲突。
上述意图编译器包括优化编译器和API对接器。从意图合成器中的图合成器输出全局意图之后，将全局意图输入至意图编译器中的优化编译器，优化编译器对全局意图进行编译，生成能够实现全局意图的、且优化了对虚拟网络资源使用的VPC网络配置方案。通过意图编译器可以实现对于将全局意图自动编译为VPC网络配置方案并通过API对接器调用一个或多个云服务的API，从而实现将VPC网络配置方案下发至用户账户，形成能够实现全局意图的VPC网络。
基于上述内容，本申请实施例提供的一种网络配置方法，该方法可以应用于如图3所示的网络配置装置。如图6所示，该方法包括：
步骤601，网络配置装置获取一个或多个用户意图。
其中，用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，云服务配置需求包括一个或多个云服务的配置需求，例如配置应用程序对应的实例的需求，实例可以为物理机、虚拟机和容器等。网络配置需求包括应用程序群组之间的通信关系、端口设置信息和服务功能类型等的配置需求。
本申请实施例中，用户意图可以包括下述的一种或多种内容：应用程序群组标识、端口配置信息和服务功能类型。其中，服务功能包括防火墙和/或负载均衡。
一种可能的实施方式中，网络配置装置可以提供第一配置接口，其中，第一配置接口用于接收用户上传的所述第一用户意图，然后，接收所述用户上传的所述第一用户意图。
一个或多个用户意图可以是用户通过图编辑器/浏览器以图(或图结构)的形式输入到意图合成器中的，从而使得意图的输入对于用户来说简单、形象且易于理解。以图(或图结构)的形式输入的用户意图也可以称为策略图，策略图的两端为分别为两个设备组，每个设备组中可以包括一个或多个计算设备，两个设备组之间的通信实际上是分别位于两个设备组上的应用程序之间的交互。两个设备组之间通过有向边连接，有向边用于指示连接的两个设备组之间的通信控制，通信控制例如为允许通信或拒绝通信。
例如图2所示的策略图中，以雇员(Employees)和服务部(Servers)代表用户意图中两个设备组，以Employees和Servers之间的有向边表示两个设备组之间的通信控制。其中，有向边可以包括具有指示通信方向的边(如图2中的箭头)和分类器，分类器为具有指示通信方向的边上方的端口设置信息，例如为图2中所示的表示端口的80、34、7000等。
可选的，用户意图中还可以包括服务功能链，服务功能链用于指示设备组之间的通信流量经过的服务功能，服务功能例如图2中所示的在有向边上的防火墙(firewall，FW)，又例如负载均衡。本申请实施例中涉及的服务功能链又可称为功能盒。
在一种可能的实施方式中，至少一个用户意图包括白名单体系的用户意图(例如第二用户意图)和/或黑名单体系的用户意图(例如第一用户意图)，其中，第一用户意图用于指示禁止数据由第一设备组中的第一计算设备流向第二设备组中的第二计算设备，第一设备组包括一个或多个第一计算设备，第二设备组包括一个或多个第二计算设备；第二用户意图用于指示允许数据由第三设备组中的第三计算设备流向第四设备组中的第四计算设备，第三设备组包括一个或多个第三计算设备，第四设备组包括一个或多个第四计算设备。
图7为本申请实施例提供的用户意图示意图，如图7所示，7个用户意图中前4个意图为白名单体系的用户意图，例如，用户意图1声明允许数据由设备组市场部(marketing，Mktg)通过7000端口流向设备组客户关系管理(customer relationship management，CRM)的通信流量，用户意图2声明允许数据由设备组Employees通过80、34、7000等端口流向设备组Servers的通信流量，用户意图3声明允许数据由设备组总部(All)通过80、443等端口流向设备组网页(Web)的通信流量，用户意图4声明允许数据由设备组All通过80、443等端口流向设备组数据库(database，DB)的通信流量。这样可以使得用户对于仅允许少部分通信流量或是允许少数IP地址/端口访问的用户意图的声明变得更容易。
在图7中，后3个用户意图为黑名单体系的用户意图，其中，用户意图5声明拒绝数据由设备组互联网(Internet)流向设备组Employees的通信流量，用户意图6声明拒绝数据由设备组Internet流向设备组Servers的通信流量，用户意图7声明拒绝数据由设备组All通过端口445流向设备组Servers的通信流量。这样可以使得用户对于仅拒绝少部分通 信流量或是少部分IP地址/端口访问的用户意图的声明变得更容易。
本申请实施例中，上述步骤601中的一个或多个用户意图可以均为白名单体系的用户意图，也可以均为黑名单体系的用户意图，也可以包括白名单体系的用户意图和黑名单体系的用户意图，这两种体系的用户意图共存使得无论是仅允许小部分通信流量或是少部分IP地址/端口访问的意图还是仅拒绝小部分通信流量的用户意图的声明都十分简洁、容易。
本申请实施例中，用户除了向意图合成器中输入一个或多个用户意图，还可以输入至少一个约束集合，约束集合包括至少一个约束，每个约束用于指示一个或多个用户意图合并时任两个设备组间所允许的策略更改的约束。
例如，如图7所示的约束集中包括2个约束，分别为：设备组Mktg与设备组CRM之间的约束、以及设备组Employees与设备组CRM之间的约束。
在设备组Mktg与设备组CRM之间的约束中包括两个约束，其中一个约束中Match列中7000表示7000端口，Add列为Y(表示Yes)，remove列为N(表示No)，这个约束指示在一个或多个用户意图合成过程中允许添加由设备组Mktg中的计算设备通过端口7000流向设备组CRM中的计算设备的通信流量的约束，且不允许删除由设备组Mktg通过端口7000流向设备组CRM的通信流量的约束；另一个约束中*表示除7000端口以外的其它端口，Add列为N，remove列为Y，这个约束指示在一个或多个用户意图合成过程中不允许添加由设备组Mktg中的计算设备通过除7000外的端口流向设备组CRM中的计算设备的通信流量的约束，可以删除由设备组Mktg通过除7000外的端口流向设备组CRM的通信流量的约束。
在设备组Other Employees与设备组CRM之间的约束中包括一个约束，其中*表示任意端口，Add列为N，remove列为Y，这个约束指示在一个或多个用户意图合成过程中不允许添加从设备组Employees的任何端口流向设备组CRM的所有通信流量，可以删除从设备组Employees的任何端口流向设备组CRM的所有通信流量的约束。
步骤602，网络配置装置确定VPC网络的优化目标。
一种可能的实施方式中，网络配置装置提供第二配置接口，第二配置接口用于接收用户上传的优化目标；然后，接收用户上传的优化目标。
本申请实施例中，优化目标可以包括网络开销最小和/或时延最小，其中，网络开销指示在网络传输过程中冗余数据占源数据的比例，时延指示数据从网络的一端传输到另一端所需要的时间。
步骤603，网络配置装置根据所述一个或多个用户意图和优化目标，获得VPC网络配置方案。
此处，VPC网络配置方案可以包括但不限于创建几个VPC、每个VPC有几个子网以及子网之间的路由。
一种可能的实现方式中，在步骤601之后，网络配置装置可以将一个或多个用户意图进行合并，生成全局意图，然后根据全局意图和优化目标，获得VPC网络配置方案。
下面介绍将所述一个或多个用户意图进行合并，生成全局意图的实现过程。
过程一，网络配置装置对一个或多个用户意图进行规范化，得到至少一个规范化策略图，至少一个规范化策略图中包括的设备组均为全局不相交的设备组。
在过程一之前，网络配置装置还可以获取标签信息，标签信息包括用于表示设备组集合中的所有设备组的层级关系的标签层级架构。如图8所示的标签层级架构以树形结构表 示，树形结构为各个元素之间具有分层关系的数据结构，树的最顶端的节点称为根节点，图8中设备组All为根节点，从根节点往下细分为子节点，其中可以继续细分的子节点称为非叶子节点，当不断细分直到不再有子节点时为叶子节点。例如图8中以下设备组为非叶子节点：租户(Tenant)、Employees、Servers、应用(APPs)、Mktg；以下设备组为叶子节点：Internet、Other Employees、CRM、Other Servers、Web、DB、Mktg1以及Mktg2。
用户意图包括的两个设备组可以均为非叶子节点，也可以均为叶子节点，也可以一个设备组为非叶子节点，另一个设备组为叶子节点。
上述过程一可以通过以下步骤S1和S2实现：
S1，根据标签信息，将一个或多个用户意图包括的、且属于标签层级架构中非叶子节点的设备组，转换为标签层级架构中与非叶子节点的设备组等价的叶子节点的设备组。
首先，将一个或多个用户意图当中所有在标签层级架构中属于非叶子节点(即组合标签)的设备组全部转换为其相应叶子结点的析取范式，即全局不相交的设备组形式。假设输入的策略图中的设备组S被转换成了规范化的设备组S 1,S 2,…,S m，输入策略图的设备组D被规范化为设备组D 1,D 2,…,D n。
结合图7和图8说明白名单体系的用户意图规范化过程，图7中所示用户意图1中的设备组Mktg对应图8所示的层级架构中的非叶子节点Mktg，可以转换为如图8所示的非叶子节点Mktg对应的叶子节点：设备组Mktg1和设备组Mktg2，用户意图2中的设备组Employees对应图8所示的层级架构中的非叶子节点Employees，可以转换为如图8所示的非叶子节点Employees对应的叶子节点：设备组Mktg1、设备组Mktg2以及设备组Other Employees，用户意图2中的设备组Servers对应图8所示的层级架构中的非叶子节点Servers，可以转换为如图8所示的非叶子节点Servers对应的叶子节点：设备组CRM、设备组Other Servers，而图7中对应图8所示的层级架构中的叶子节点的设备组不需要转换，从而得到如图9所示的白名单体系的用户意图对应的全局不相交的设备组。
结合图7、图8以及图10说明黑名单体系的用户意图规范化过程，图7中所示用户意图5中的设备组Employees对应图8所示的层级架构中的非叶子节点Employees，可以转换为图8所示的非叶子节点Employees对应的叶子节点：设备组Mktg1、设备组Mktg2以及设备组Other Employees，用户意图6和用户意图7中的设备组Servers对应图8所示的层级架构中的非叶子节点Servers，可以转换为如图8所示的非叶子节点Servers对应的叶子节点：设备组CRM、设备组Other Servers，而图7中对应图8所示的层级架构中的叶子节点的设备组不需要转换，从而得到如图10所示的黑名单体系的用户意图对应的全局不相交的设备组。
S2，将一个或多个用户意图中属于非叶子节点的设备组对应的有向边，重复到标签层级架构中与非叶子节点的设备组等价的叶子节点的设备组上，得到至少一个用户意图对应的至少一个规范化策略图。
例如，设备组S在原始策略图中有到设备组D的边，那么原始边将会在规范化策略图的设备组(S i,D j),
Figure PCTCN2022133465-appb-000004
上重复。(G,H)上的任何边都要与(S,D)上的合并以继承重叠。这种合并由得到的约束控制。例如，对于图7所示策略图中允许数据由设备组Employees通过端口80、34和7000流向设备组Servers之间的有向边，需要在如图9所示的转换后的设备组Mktg1到设备组CRM，设备组Mktg2到设备组CRM，设备组Other Employees到设备组CRM，设备组Mktg1到设备组Other Servers，设备组Mktg2到设 备组Other Servers，设备组Other Employees到设备组Other Servers之间进行重复，从而得到如图9所示的白名单体系的用户意图对应的规范化策略图。
对于图7所示策略图中拒绝数据由设备组Internet流向设备组Employees的有向边，需要在如图10所示的设备组Internet到设备组Mktg1，设备组Internet到设备组Mktg2以及设备组nternet到设备组Other Employees之间重复。对于拒绝数据由设备组Internet流向设备组Servers的有向边，需要在如图10所示的设备组Internet到设备组CRM、以及设备组Internet到设备组Other Servers之间重复，从而得到如图10所示的黑名单体系的用户意图对应的规范化策略图。
在一种可能的实施方式中，上述规范化过程还可以将策略图中的约束等价地重复和合并到全局不相交的设备组之间，即包括步骤S3。
S3，将所述至少一个用户意图包括的、且属于标签层级架构中非叶子节点的设备组上的约束，重复到所述至少一个规范化策略图中与所述非叶子节点等价的至少一个叶子节点的设备组上；将所述至少一个用户意图包括的、且属于标签层级架构中叶子节点的设备组上的约束重复到所述至少一个规范化策略图中所述叶子节点的设备组上。
例如，输入的策略图中对源设备组S和目的设备组D有约束，那么这约束就要在规范化策略图的设备组对(S i,D j),
Figure PCTCN2022133465-appb-000005
上重复。约束还可能需要被合并。如果原始输入策略图有设备组对(G,H)的约束，并且这个设备组对(G,H)与设备组对(S,D)有重叠，那么为设备组对(G,H)指定的任何约束都必须与设备组对(S,D)的约束合并，以便构成规范化设备组间继承重叠的约束。合并时还会检测冲突，并为操作员标记这样的冲突错误。
例如图7中所示的设备组Mktg和设备组CRM之间的约束，由于设备组Mktg被转换成了两个设备组Mktg1和Mktg2，设备组Mktg和设备组CRM之间的约束需要被分别重复到如图9所示的设备组Mktg1和设备组CRM之间以及设备组Mktg2和设备组CRM之间。而设备组Employees和设备组CRM由于转换过后仍是各自设备组，所以该设备组Employees和设备组CRM之间的约束只需在设备组Employees和设备组CRM之间重复一次。
在得到至少一个规范化策略图之后，可以执行下述过程二。
过程二，将至少一个规范化策略图进行合并，生成全局意图。
在一种可能的实施方式中，可以根据重复到所述至少一个规范化策略图包括的各个设备组上的约束，对所述至少一个规范化策略图进行合并，生成全局意图。
对规范化策略图进行合并的过程可以在如图4所示的图合成器中执行。首先对如图9所示的白名单体系的用户意图对应的规范化策略图进行合并，得到如图11所示的白名单体系的用户意图对应的合成图，该合成图包括的设备组是所有白名单体系的用户意图对应的规范化策略图中设备组的并集。对如图10所示的黑名单体系的用户意图对应的规范化策略图进行合并，得到如图12所示的黑名单体系的用户意图对应的合成图，该合成图包括的设备组是所有黑名单体系的用户意图对应的规范化策略图中的设备组的并集。之后，再将图11所示的白名单体系的用户意图对应的合成图和如图12所示的黑名单体系的用户意图进行合并，得到如图13所示的全局意图。
需要说明的是，在将单个规范化策略图的边添加到合成图当中时，首先检查其源设备组和目的设备组之间的约束，这一检查决定了边的分类器是否符合约束或者需要被缩小范围以便符合约束。如果一条新边以非空的幸存分类器通过了这个测试，那么他可能会被添加或合并到从源到目的设备组的现有边。在合并新边时，首先找到其分类器流空间和已有 分类器的交集。对于新边的不相交分类器空间，新边及其功能盒都可被直接添加。对于任何相交的分类器空间，依据已有的策略和新的要合并的策略，将相交空间划分为一组匹配的子空间。这允许我们为每个子空间合并一条现有边和新边。例如，在对第一个和第二个白名单规范化策略图进行合并时，由于第一个规范化策略图不允许添加从设备组Mktg1和设备组Mktg2到设备组CRM除7000端口外的通信流量，且对于设备组Other Employees到设备组CRM的任何通信流量都不允许添加，所以第二个规范化策略图中相应的边被舍去。之后，对于黑白名单合成图的合成与单独的黑白名单合成图合并过程类似。
上述实施例中，意图合成器支持对输入的多个用户意图进行自动合并，因此支持多个用户独立地输入多个局部意图而无需用户去考虑全局意图的合并，可以减轻用户负担。
在得到全局意图之后，如图4所示的意图合成器将全局意图输入至意图编译器。然后，由网络配置装置中的意图编译器根据全局意图和优化目标，获得VPC网络配置方案。
由于以VPC为主的虚拟网络中存在一种用户意图有多种实现方式的情况，而不同的实现方式对应着不同的底层物理资源，这些配置到物理资源的映射方式、物理资源实现虚拟配置的具体方式、物理资源的性能限制以及物理资源的开销等都可能存在差异，例如上述PGA对于合成图到虚拟网络配置的编译仅保证了以一种意图固定对应一种配置的方式，并未考虑到虚拟网络配置与底层具体实现这些配置的物理资源间的关系及由此引发的优化问题，即如何选择虚拟网络的配置方案使得编译得到的网络性能良好且开销较小。为解决这个优化问题，如图14所示，首先形成编译优化的模型，并以模型为指导设计实现相应算法来完成优化，该算法就是优化编译器的核心部分，以使优化编译器的编译结果能够在对应实现用户意图的基础上保障网络性能和开销。
一种可能的实施方式中，在步骤603之前，即根据所述一个或多个用户意图和优化目标，获得VPC网络配置方案之前，还可以根据获取到的一个或多个用户意图、优化目标以及VPC网络资源的约束条件，生成优化模型。其中，约束条件是可选的。VPC网络资源的约束条件可以包括但不限于VPC配置的数量限制、安全组的数量限制、ACL的数量限制。如果在生成优化模型时采用约束条件，可以避免承载上层配置的设备超负荷运行。
在其它一些实施例中，优化编译器还可以考虑支持用户自定义编译偏好，例如追求开销最小或某种常用配置的使用量最多等，然后为不同的偏好设置设计实现相应的编译算法。
在一个示例中，将上述图13所示全局意图输入至意图编译器中的优化编译器之后，输出例如图15所示的VPC网络配置方案，在实际应用中，VPC网络配置方案可以包括但不限于图15所示的子网划分规则、安全组划分规则、访问控制列表(access control list，ACL)规则、源地址转换(source network address translation，SNAT)规则以及目的地址转换(destination network address translationDNAT)规则等。
步骤604，网络配置装置根据VPC网络配置方案调用一个或多个云服务的应用程序接口API，以使得管理一个或多个云服务的至少一个管理装置为VPC网络中配置一个或多个云服务。其中，每一个云服务都对应有一个管理装置。一个云服务可以包括一个或多个API。
例如公有云可以提供的云服务包括VPC、虚拟机、容器、防火墙以及负载均衡等服务的API，示例的，例如根据VPC网络配置方案确定需要创建VPC，则网络配置装置可以调用VPC服务的API；又例如根据VPC网络配置方案确定需要创建虚拟机，则网络配置装置可以调用虚拟机服务的API。
由于不同云服务厂商的API可能不同，可能会有某些厂商的API可以识别VPC网络 配置方案的语言，而有些厂商的API可以识别不了VPC网络配置方案的语言，为了使VPC网络配置方案可以适用于多种厂商的API，一种可实现上述步骤604的方式中，网络配置装置可以将部分/全部的VPC网络配置方案转换为VPC网络配置指令，VPC网络配置指令符合一个或多个云服务的API格式，然后，将VPC网络配置指令发送至一个或多个云服务的管理装置，以使得一个或多个云服务的管理装置为VPC网络中配置一个或多个云服务。
在该方式中，网络配置装置可以根据VPC网络配置方案，通过API对接器调用公有云提供的一个或多个云服务的API，API对接器可以将VPC网络配置方案分别转换成符合不同API格式的VPC网络配置指令，然后，管理一个或多个云服务分别对应的管理装置将VPC网络配置方案下发至用户账户，下发VPC配置方案的过程中管理装置为用户账户的VPC网络中配置所述一个或多个云服务。
在该实施方式中，API对接器调用云服务商提供的VPC网络的API可以自动将VPC网络配置信息下发至所述VPC网络的用户账户，生成能够实现全局意图的VPC网络，不需要确定网络拓扑结构的情况下也可以获取VPC网络配置方案，从而可以实现VPC网络配置的自动生成。
基于与上述方法实施例同一技术构思，本申请实施例还提供一种网络配置装置，该网络配置装置可以用于实现上述方法实施例中网络配置装置的功能，因此也能实现上述方法实施例所具备的有益效果。
示例性地，如图16所示，网络配置装置1600包括通信单元1601和处理单元1602。其中，通信单元1601，用于获取一个或多个用户意图，其中，用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，云服务配置需求包括一个或多个云服务的配置需求；处理单元1602，用于确定VPC网络的优化目标；根据一个或多个用户意图和优化目标，获得VPC网络配置方案；根据VPC网络配置方案，调用一个或多个云服务的应用程序接口API，以使得管理一个或多个云服务的至少一个管理装置为VPC网络中配置一个或多个云服务。
在一种可能的实施方式中，一个或多个用户意图包括第一用户意图，其中，第一用户意图用于指示禁止数据由第一设备组中的第一计算设备流向第二设备组中的第二计算设备，第一设备组包括一个或多个第一计算设备，第二设备组包括一个或多个第二计算设备。
在一种可能的实施方式中，通信单元1601，具体用于：提供第一配置接口，第一配置接口用于接收用户上传的第一用户意图；接收用户上传的第一用户意图。
在一种可能的实施方式中，通信单元1601，具体用于：提供第二配置接口，第二配置接口用于接收用户上传的优化目标；接收用户上传的优化目标。
在一种可能的实施方式中，优化目标包括网络开销最小和/或时延最小，其中，网络开销指示在网络传输过程中冗余数据占源数据的比例。
在一种可能的实施方式中，处理单元1602，具体用于：将部分/全部的VPC网络配置方案转换为VPC网络配置指令，VPC网络配置指令符合一个或多个云服务的API格式；通信单元1601，具体用于：将VPC网络配置指令发送至一个或多个云服务的管理装置，以使得一个或多个云服务的管理装置为VPC网络中配置一个或多个云服务。
在一种可能的实施方式中，提供一个或多个云服务的厂商和运行网络配置装置的厂商为同一厂商。
在一种可能的实施方式中，处理单元1602，还用于：将一个或多个用户意图进行合并， 生成全局意图；根据全局意图和优化目标，获得VPC网络配置方案。
上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
基于同一技术构思，本申请实施例还提供一种网络配置装置1700，可以用于实现上述方法实施例中网络配置装置的功能。
如图17所示，网络配置装置1700可以包括存储器1701和处理器1702，可选地，还可以包括总线系统，存储器1701和处理器1702可以通过总线系统相连。
应理解，上述处理器1702可以是一个芯片。例如，该处理器1702可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器1702中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器1702中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1701，处理器1702读取存储器1701中的信息，结合其硬件完成上述方法的步骤。
应注意，本申请实施例中的处理器1702可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介 质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器1701可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算设备，包括存储器和至少一个处理器；所述存储器，用于存储计算机指令；所述至少一个处理器，用于执行所述存储器存储的计算机指令，以使得所述计算设备执行上述方法实施例中的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读存储介质，其上存储有计算机程序或指令，当该计算机程序或指令被执行时，以使得计算设备执行上述方法实施例中的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，当计算机读取并执行计算机程序产品时，以使得计算设备执行上述方法实施例中的方法。
根据本申请实施例提供的方法，本申请还提供一种芯片，包括至少一个处理器和接口；所述接口，用于为所述至少一个处理器提供程序指令或者数据；所述至少一个处理器用于执行所述程序行指令，以使得上述方法实施例中的方法被执行。
在一种可能的设计中，所述芯片还可以包括存储器，所述存储器中存储有指令，所述处理器用于执行所述存储器上存储的指令，当所述指令被执行时，所述处理器用于执行前述实施例中的方法。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载或执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘(solid state drive，SSD)。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括RAM、ROM、EEPROM、CD-ROM或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。此外。任何连接可以适当的成为计算机可读介质。例如，如果软件是使用同轴电缆、光纤光缆、双绞线、数字用户线(DSL)或者诸如红外线、无线电和微波之类的无线技术从网站、服务器或者其他远程源传输的，那么同轴电缆、光纤光缆、双绞线、DSL或者诸如红外线、无线和微波之类的无线技术包括在所属介质的定影中。如本申请所使用的，盘(Disk)和碟(disc)包括压缩光碟(CD)、激光碟、光碟、数字通用光碟(DVD)、软盘和蓝光光碟，其中盘通常磁性的复制数据，而碟则用激光来光学的复制数据。上面的组合也应当包括在计算机可读介质的保护范围之内。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (18)

  1. 一种网络配置方法，其特征在于，所述方法应用于网络配置装置，所述方法包括：
    获取一个或多个用户意图，其中，所述用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，所述云服务配置需求包括一个或多个云服务的配置需求；
    确定所述VPC网络的优化目标；
    根据所述一个或多个用户意图和所述优化目标，获得VPC网络配置方案；
    根据所述VPC网络配置方案调用所述一个或多个云服务的应用程序接口API，以使得管理所述一个或多个云服务的至少一个管理装置为所述VPC网络中配置所述一个或多个云服务。
  2. 如权利要求1所述的方法，其特征在于，所述一个或多个用户意图包括第一用户意图，其中，所述第一用户意图用于指示禁止数据由第一设备组中的第一计算设备流向第二设备组中的第二计算设备，所述第一设备组包括一个或多个所述第一计算设备，所述第二设备组包括一个或多个所述第二计算设备。
  3. 如权利要求2所述的方法，其特征在于，获取所述第一用户意图，包括：
    提供第一配置接口，所述第一配置接口用于接收用户上传的所述第一用户意图；
    接收所述用户上传的所述第一用户意图。
  4. 如权利要求1至3中任一所述的方法，其特征在于，所述确定所述VPC网络的优化目标，包括：
    提供第二配置接口，所述第二配置接口用于接收用户上传的所述优化目标；
    接收所述用户上传的所述优化目标。
  5. 如权利要求1至4中任一所述的方法，其特征在于，所述优化目标包括网络开销最小和/或时延最小，其中，网络开销指示在网络传输过程中冗余数据占源数据的比例。
  6. 如权利要求1至5任一所述的方法，其特征在于，所述根据所述VPC网络配置方案调用所述一个或多个云服务的应用程序接口API，包括：
    将部分/全部的所述VPC网络配置方案转换为VPC网络配置指令，所述VPC网络配置指令符合所述一个或多个云服务的API格式；
    将所述VPC网络配置指令发送至所述一个或多个云服务的管理装置，以使得所述一个或多个云服务的管理装置为所述VPC网络中配置所述一个或多个云服务。
  7. 如权利要求1至6中任一所述的方法，其特征在于，提供所述一个或多个云服务的厂商和运行所述网络配置装置的厂商为同一厂商。
  8. 如权利要求1至7中任一所述的方法，其特征在于，所述获取一个或多个用户意图后，所述方法包括：
    将所述一个或多个用户意图进行合并，生成全局意图；
    所述根据所述一个或多个用户意图和所述优化目标，获得所述VPC网络配置方案，包括：
    根据所述全局意图和所述优化目标，获得所述VPC网络配置方案。
  9. 一种网络配置装置，其特征在于，所述装置包括:
    通信单元，用于获取一个或多个用户意图，其中，所述用户意图用于指示虚拟私有云VPC网络中的网络配置需求和云服务配置需求，所述云服务配置需求包括一个或多个云服 务的配置需求；
    处理单元，用于确定所述VPC网络的优化目标；根据所述一个或多个用户意图和所述优化目标，获得VPC网络配置方案；根据所述VPC网络配置方案，调用所述一个或多个云服务的应用程序接口API，以使得管理所述一个或多个云服务的至少一个管理装置为所述VPC网络中配置所述一个或多个云服务。
  10. 如权利要求9所述的装置，其特征在于，所述一个或多个用户意图包括第一用户意图，其中，所述第一用户意图用于指示禁止数据由第一设备组中的第一计算设备流向第二设备组中的第二计算设备，所述第一设备组包括一个或多个所述第一计算设备，所述第二设备组包括一个或多个所述第二计算设备。
  11. 如权利要求10所述的装置，其特征在于，通信单元，具体用于：
    提供第一配置接口，所述第一配置接口用于接收用户上传的所述第一用户意图；
    接收所述用户上传的所述第一用户意图。
  12. 如权利要求9至11中任一所述的装置，其特征在于，所述通信单元，具体用于：
    提供第二配置接口，所述第二配置接口用于接收用户上传的所述优化目标；
    接收所述用户上传的所述优化目标。
  13. 如权利要求9至12中任一所述的装置，其特征在于，所述优化目标包括网络开销最小和/或时延最小，其中，网络开销指示在网络传输过程中冗余数据占源数据的比例。
  14. 如权利要求9至13任一所述的装置，其特征在于，所述处理单元，具体用于：
    将部分/全部的所述VPC网络配置方案转换为VPC网络配置指令，所述VPC网络配置指令符合所述一个或多个云服务的API格式；
    通信单元，具体用于：
    将所述VPC网络配置指令发送至所述一个或多个云服务的管理装置，以使得所述一个或多个云服务的管理装置为所述VPC网络中配置所述一个或多个云服务。
  15. 如权利要求9至14中任一所述的装置，其特征在于，提供所述一个或多个云服务的厂商和运行所述网络配置装置的厂商为同一厂商。
  16. 如权利要求9至15中任一所述的装置，其特征在于，所述处理单元，还用于：
    将所述一个或多个用户意图进行合并，生成全局意图；
    根据所述全局意图和所述优化目标，获得所述VPC网络配置方案。
  17. 一种计算设备，其特征在于，包括存储器和至少一个处理器；
    所述存储器用于存储计算机程序；
    所述处理器用于执行所述存储器中存储的计算机程序，实现如权利要求1～8中任一项所述的方法。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，当所述计算机程序在计算装置上运行时，使得所述计算装置执行如权利要求1～8中任一项所述的方法。
PCT/CN2022/133465 2021-11-23 2022-11-22 一种网络配置方法及装置 WO2023093710A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202111397164.9 2021-11-23
CN202111397164 2021-11-23
CN202210319796.1 2022-03-29
CN202210319796.1A CN116155737A (zh) 2021-11-23 2022-03-29 一种网络配置方法及装置

Publications (1)

Publication Number Publication Date
WO2023093710A1 true WO2023093710A1 (zh) 2023-06-01

Family

ID=86372486

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/133465 WO2023093710A1 (zh) 2021-11-23 2022-11-22 一种网络配置方法及装置

Country Status (2)

Country Link
CN (1) CN116155737A (zh)
WO (1) WO2023093710A1 (zh)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103428025A (zh) * 2012-05-25 2013-12-04 中兴通讯股份有限公司 一种管理虚拟网络服务的方法、装置和系统
CN108989110A (zh) * 2018-07-20 2018-12-11 浪潮电子信息产业股份有限公司 一种vpc网络模型的构建方法及其相关设备
CN109245916A (zh) * 2018-08-15 2019-01-18 西安电子科技大学 一种意图驱动的云化接入网系统及方法
CN111817870A (zh) * 2019-04-10 2020-10-23 瞻博网络公司 基于意图的网络感知网络设备软件升级调度
US10862749B1 (en) * 2017-07-21 2020-12-08 Vmware, Inc. Systems for and methods of network management and verification using intent inference
US10922423B1 (en) * 2018-06-21 2021-02-16 Amazon Technologies, Inc. Request context generator for security policy validation service
CN112437065A (zh) * 2020-11-12 2021-03-02 安徽大学 Sdn环境下基于图形表示的策略冲突检测及解决方法
CN112953778A (zh) * 2021-03-17 2021-06-11 北京交通大学 智融标识网络中基于意图驱动的服务编排系统和方法

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103428025A (zh) * 2012-05-25 2013-12-04 中兴通讯股份有限公司 一种管理虚拟网络服务的方法、装置和系统
US10862749B1 (en) * 2017-07-21 2020-12-08 Vmware, Inc. Systems for and methods of network management and verification using intent inference
US10922423B1 (en) * 2018-06-21 2021-02-16 Amazon Technologies, Inc. Request context generator for security policy validation service
CN108989110A (zh) * 2018-07-20 2018-12-11 浪潮电子信息产业股份有限公司 一种vpc网络模型的构建方法及其相关设备
CN109245916A (zh) * 2018-08-15 2019-01-18 西安电子科技大学 一种意图驱动的云化接入网系统及方法
CN111817870A (zh) * 2019-04-10 2020-10-23 瞻博网络公司 基于意图的网络感知网络设备软件升级调度
CN112437065A (zh) * 2020-11-12 2021-03-02 安徽大学 Sdn环境下基于图形表示的策略冲突检测及解决方法
CN112953778A (zh) * 2021-03-17 2021-06-11 北京交通大学 智融标识网络中基于意图驱动的服务编排系统和方法

Also Published As

Publication number Publication date
CN116155737A (zh) 2023-05-23

Similar Documents

Publication Publication Date Title
CN110612702B (zh) 针对不一致的意图规范检查
US11178009B2 (en) Static network policy analysis for networks
JP2021526275A (ja) Ｓｄｄｃのためのポリシー制約フレームワーク
US11470001B2 (en) Multi-account gateway
CN103946834B (zh) 虚拟网络接口对象
US7995498B2 (en) Method and system for providing configuration of network elements through hierarchical inheritance
US20180063194A1 (en) Policy definition and enforcement for a network virtualization platform
US20170262649A1 (en) Policy storage using syntax graphs
US7710900B2 (en) Method and system for providing network management based on defining and applying network administrative intents
US11303520B2 (en) Validation of cross logical groups in a network
EP3788755B1 (en) Accessing cloud resources using private network addresses
US11153167B2 (en) Validation of L3OUT configuration for communications outside a network
CN111684439B (zh) 网络保证数据库版本兼容性
US20200014597A1 (en) Network validation between the logical level and the hardware level of a network
US11546227B2 (en) Optimized detection of network defect exposure in network environment
US20200235992A1 (en) Detection of overlapping subnets in a network
US10382265B1 (en) Reversible yang-based translators
CN110785963A (zh) 从网络收集网络模型和节点信息
US9571352B2 (en) Real-time automated virtual private network (VPN) access management
US20210021471A1 (en) Techniques for managing virtual networks
US20150288655A1 (en) Neighbor lookup operations in a network node
US10785056B1 (en) Sharing a subnet of a logically isolated network between client accounts of a provider network
US20200162467A1 (en) System and method for migrating existing access control list policies to intent based policies and vice versa
WO2023093710A1 (zh) 一种网络配置方法及装置
US11354491B1 (en) Systems and methods for improved data modeling and translation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897793

Country of ref document: EP

Kind code of ref document: A1