WO2023134377A1 - Network configuration method, device and system - Google Patents

Abstract

Disclosed are a network configuration method, device and system. A user only needs to express a service requirement for a target network to a network configuration device, and the network configuration device can configure the target network to meet the service requirement of the user. According to the network configuration device, one or more potential intentions of the user are mined according to a service intention, and configuration information and an evaluation result in each potential intention are displayed to the user, which is beneficial to helping the user to more completely express the service requirement. The target network is configured according to a target potential intention selected from the one or more potential intentions, so that the service requirement of the user can be more accurately implemented, thereby being beneficial to improving the satisfaction of the user for a configuration result.

Description

A network configuration method, device and system

This application claims the priority of the Chinese patent application with the application number 202210051104.X and the title of the invention "a method and device for network configuration" submitted to the State Intellectual Property Office of China on January 17, 2022, and, in 2022 The priority of the Chinese patent application with the application number 202210441018.X and the title of the invention "a network configuration method, device and system" filed with the State Intellectual Property Office of China on April 25, the entire contents of which are incorporated in this application by reference .

technical field

The present application relates to the field of computer technology, and in particular to a network configuration method, device and system.

Background technique

The intent-driven network system is an emerging network technology, which allows end users and network administrators not to pay attention to the implementation details of the network technology, but only needs to express the business requirements for a certain network, and then realize the corresponding configuration of the network, so as to Fulfill the business requirement. For example, the user only needs to input the business intent used to express the business requirement to the system, and the system can automatically realize the corresponding configuration of the network. However, the intent-driven network system is still in the initial stage of the industry, and there are still many problems that need to be solved. For example, the configuration results of the system for the network are often difficult to accurately realize the business needs of users.

Contents of the invention

The present application provides a network configuration method, device and system, which are used to more accurately realize service requirements of users.

In a first aspect, the present application provides a network configuration method, the network configuration method can be applied to an intent-driven network system, and the system can include a network configuration device and one or more networks. The following describes the network configuration method by taking a target network in one or more networks as an example, and the target network may include one or more network devices. When the user wishes to execute the target service on the target network, the network configuration device can acquire the user's service intention. Because it is difficult for users to understand the network information of the target network, it is usually difficult to fully express their business needs in the business intentions they input. In the method provided in the first aspect, the network configuration device can mine one or more potential intentions of the user according to the service intention, and each potential intention includes configuration information (referred to as configuration information) and evaluation results (referred to as evaluation results). The configuration information is different in different potential intents, but each potential intent is used to realize the business intent. Each evaluation result indicates the impact on services in the target network (including the target service and/or one or more services other than the target service in the target network) after the configuration information in the corresponding latent intent takes effect.

Selecting one or more potential intentions (referred to as target potential intentions) from the potential intentions mined by the network configuration device is equivalent to helping users express service requirements more completely. Since the target potential intention is the business intention mined on the basis of the initial business intention, it can more completely express the user's business needs. Therefore, the network configuration device configures the target network according to the configuration information of the target potential intention, which is conducive to more accurate Realize the user's business needs, which is conducive to improving the user's satisfaction with the configuration results.

Optionally, each of the one or more potential intents includes a business intent and can be used to realize the business intent. That is to say, each latent intent is the perfection of business intent, which can describe a business more completely. In this way, the same as the business intent, the target latent intent selected from one or more latent intents can be used to describe the target business, and the difference from the business intent is that the target latent intent is conducive to a more complete description of the target business, so that It is beneficial to more accurately express the business needs of users.

Optionally, the target potential intention may be determined according to the user's operation on the target interface, and the target interface may include description information and evaluation information of each potential intention in one or more potential intentions. The description information of each potential intent is used to describe all or part of the configuration information of the corresponding potential intent, and the evaluation information of each potential intent is used to describe all or part of the evaluation results of the corresponding potential intent.

Optionally, the description information of each potential intent is used to describe configuration information (referred to as differentiated configuration information) that is different between the corresponding configuration information and the configuration information of other potential intents in the one or more potential intents. In this way, it is convenient for the user to clarify the difference between configuration information with different potential intentions.

Optionally, the evaluation information of each potential intent is used to describe a difference evaluation result, and the difference evaluation result is used to evaluate the impact of the difference configuration information on services in the target network. In this way, it is convenient for the user to understand the impact of the difference in the configuration information of different potential intentions on the service in the target network, which is conducive to the user to select a better part or all of the potential intentions from one or more potential intentions as the target potential intention to configure the target network.

Optionally, each of the one or more potential intentions is an n-level potential intention, the target potential intention is an n-level target potential intention, and one or more i-level potential intentions are based on i-1 level The target potential intention is determined, the i-1 level target potential intention is determined from one or more i-1 level potential intentions, and one or more level 1 potential intentions are determined based on the business intention, wherein, n is a positive integer greater than 1, and i is any positive integer greater than 1 and less than or equal to n.

The latent intention of the i-level target can be understood as including the potential intention of the i-1 level target, and it is perfected on the basis of the potential intention of the i-1 level target. Hierarchical and multiple mining of potential intentions is conducive to obtaining a more complete target potential intention to express the user's business needs, thereby helping to accurately realize the user's business needs.

Optionally, the i-1 level target potential intention may be determined according to the user's operation on the i-1 level interface, and the i-1 level interface may include each potential intention in one or more i-1 level potential intentions description and evaluation information. The description information of each i-1 level potential intent is used to describe all or part of the configuration information of the corresponding i-1 level potential intent, and the evaluation information of each i-1 level potential intent is used to describe the corresponding i-1 level potential intent Full or partial assessment results. Similarly, the above-described target interface including one or more potential intentions (that is, n-level potential intentions) can be understood as an n-level interface.

Optionally, the description information of each potential intent at level i-1 is used to describe configuration information (referred to as differentiated configuration information) between the corresponding configuration information and configuration information of other potential intents in one or more potential intents. In this way, it is convenient for the user to clarify the difference between configuration information with different potential intentions.

Optionally, the evaluation information of each i-1 level potential intent is used to describe a difference evaluation result, and the difference evaluation result is used to evaluate the impact of the difference configuration information on services in the target network. In this way, it is convenient for the user to understand the impact of the difference in the configuration information of different i-1 level potential intentions on the service in the target network, thereby facilitating the user to select a better part or all of the i-1 level potential intentions from one or more i-1 level potential intentions. Level 1 latent intent serves as the target latent intent to configure the target network.

Optionally, the i-1 level target potential intention is determined according to an evaluation result corresponding to one or more potential intentions of the business intention. Selecting the target potential intent for configuring the target network according to the evaluation result of each potential intent is beneficial to improving the completion effect of the target service.

Optionally, the evaluation result includes service evaluation indicators, and the service evaluation indicators include one or more of the following indicators: cost, network health, network performance, network maintainability, and other service impacts. Obtaining the evaluation results of each potential intent from the dimensions of multiple service evaluation indicators is conducive to more comprehensively determining the impact of each potential intent on the business in the target network, thereby helping to further improve the completion effect of the target business.

Optionally, the evaluation result further includes a recommendation index, and the recommendation index indicates the recommendation level of the potential intention corresponding to the evaluation result, so as to help the user select the configuration information with better completion effect of the corresponding target service and avoid selecting the corresponding The configuration information with the worst completion effect of the target business is conducive to ensuring the completion effect of the target business while satisfying the individual needs of users.

Optionally, the configuration information is descriptive information on configuration schemes, which is convenient for users to understand the configuration schemes in each potential intention.

Optionally, the determining one or more potential intentions according to the service intention includes: determining one or more potential intentions of the service intention according to the state information of the target network and the service intention, the target The state information of the network includes static information and dynamic information, the static information includes topology information and/or configuration information of the target network, and the dynamic information includes forwarding information of the target network and/or network information in the target network device performance. Combining the status information of the target network to mine potential intentions is conducive to obtaining more accurate configuration information for realizing business intentions, and is conducive to more accurate evaluation of each configuration information, which facilitates the configuration effect of the target network.

Optionally, the determining one or more potential intentions according to the business intention includes: determining the one or more potential intentions according to a machine learning model and the business intention, the machine learning model is based on multiple historical Business intents and potential intents selected for each of the plurality of historical business intents are trained. Learning historical business intentions and potential intentions selected for each historical business intention through the machine learning module is conducive to determining the target potential intention that meets the user's preference based on the historical selection for the input business intention, thereby helping to accurately realize the user's business needs.

The second aspect provides a network configuration device, including: an acquisition module, configured to acquire a service intent, where the business intent is used to describe a target service; an intent management module, configured to determine one or more potential intents according to the service intent, Each potential intent in the one or more potential intents includes configuration information and an evaluation result, the configuration information is used to realize the service intent, and the evaluation result indicates that the configuration information will be effective in the target network Service impact; a configuration module configured to configure the target network according to configuration information of target potential intentions, where the target potential intentions are potential intentions determined in the one or more potential intentions.

Optionally, each of the one or more potential intentions is an n-level potential intention, the target potential intention is an n-level target potential intention, and one or more i-level potential intentions are based on i-1 level The target potential intention is determined, the i-1 level target potential intention is determined from one or more i-1 level potential intentions, and one or more level 1 potential intentions are determined based on the business intention, wherein, n is a positive integer greater than 1, and i is any positive integer greater than 1 and less than or equal to n.

Optionally, the target potential intention is determined according to an evaluation result corresponding to one or more potential intentions of the business intention.

Optionally, the evaluation result includes service evaluation indicators, and the service evaluation indicators include one or more of the following indicators: cost, network health, network performance, network maintainability, and other service impacts.

Optionally, the evaluation result further includes a recommendation index, and the recommendation index indicates a recommendation level of a potential intention corresponding to the evaluation result.

Optionally, the configuration information is description information of a configuration scheme.

Optionally, the intent management module is configured to determine one or more potential intents of the business intent according to state information of the target network and the business intent, where the state information of the target network includes static information and dynamic information, the static information includes topology information and/or configuration information of the target network, and the dynamic information includes forwarding information of the target network and/or performance of network devices in the target network.

Optionally, the intent management module is configured to: determine the one or more potential intents according to a machine learning model and the business intent, the machine learning model is based on multiple historical business intents and the multiple historical The latent intents selected for each historical business intent in the business intent are trained.

A third aspect provides a computing device, including a memory and a processor, the memory stores codes, the processor is configured to execute the codes, and when the codes are executed, the computing device performs the first Aspect or a method in any possible implementation of the first aspect.

A fourth aspect provides a computer storage medium, the computer storage medium stores a computer program, and when the program is executed by a computer, the computer implements the method described in the first aspect or any possible implementation manner of the first aspect. method.

A fifth aspect provides a computer program product, the computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the first aspect or any possible implementation manner of the first aspect. Methods.

A sixth aspect provides a network system, including a target network and the network configuration apparatus according to the second aspect or any possible implementation manner of the second aspect.

A seventh aspect provides a chip including one or more processors. A part or all of the processor is used to read and execute the computer program stored in the memory, so as to execute the above-mentioned method in the first aspect or any possible implementation manner of the first aspect.

Description of drawings

Figure 1-1 exemplarily shows a possible structure and network configuration method of an intent-driven network system;

Figure 1-2 exemplarily shows a possible structure of the target network in the intent-driven network system;

Figures 1-3 exemplarily show a possible input interface of business intent;

Figures 1-4 exemplarily show a possible configuration result of the intent-driven network system on the target network;

Fig. 2 schematically shows another possible structure and network configuration method of the intent-driven network system;

Figure 3-1 exemplarily shows a possible interface indicating the user's potential intention to supplement;

Figure 3-2 exemplarily shows another possible configuration result of the intent-driven network system on the target network;

Figure 4-1 exemplarily shows a schematic diagram of potential intention mining with business intentions as potential intentions of level 0 targets;

Figure 4-2 exemplarily shows another possible structure of the target network in the intent-driven network system;

Figure 4-3 exemplarily shows a possible interface indicating the user's supplementary level 1 potential intention;

Figure 4-4 exemplarily shows a possible interface indicating the user's supplementary level 2 potential intention;

Figure 5-1 exemplarily shows another possible structure and network configuration method of the intent-driven network system;

Figure 5-2 exemplarily shows a possible structure of the configuration module and a possible method of configuring the target network;

FIG. 6 schematically shows a possible architecture of an intent-driven network system;

FIG. 7 exemplarily shows a possible structure of a computing device.

Detailed ways

Figure 1-1 exemplarily shows a possible structure of an intent-driven network system. The system may include network configuration devices, target networks and users. In this system, the user only needs to express the service intention of the target network to the network configuration device, and the network configuration device can configure the target network accordingly. The target network includes one or more network devices. This application does not limit the type of network equipment, and this application does not limit the type of target network and the scale of network equipment. For example, the target network may be as shown in Figure 1-2. Referring to Figure 1-2, the target network includes the data center site, site 1, and site 2.

Continuing to refer to FIG. 1-1 , in a possible example, the network configuration device may include an acquisition module and a configuration module, the acquisition module may acquire a service intent for expressing a service requirement, and the configuration module may configure a target network according to the service intent.

Assuming that the target network is as shown in Figure 1-2, as an example, the user can enter the service intent "Site 1, data center site, enable traffic" on the interface shown in Figure 1-3. This service intent indicates that the user needs to enable the Business requirements for traffic between data center sites. The configuration module can send configuration data to the target network, and the network device corresponding to the target network receives the configuration data and implements the service function corresponding to the configuration data, and completes the establishment of a link between site 1 and the data center site to open site 1 to the data center site. Traffic between central sites. Referring to Figure 1-4, the target network can establish an Internet link between Site 1 and the data center site according to the configuration data.

Users express business needs by entering business intent. Limited by the user's professionalism and limited cognition of the target network, the business intent entered by the user is usually difficult to fully express the business requirements, and the business intent is often vague or its context contains implicit intent (or latent intent ). Continuing with the example where the service intent indicates that traffic between site 1 and the data center site is enabled, the user may specifically select a link with better network experience to enable traffic. It can be seen that the business intent may not be able to fully express the business requirements. The configuration module configures the target network according to the business intent, which may not meet the user's potential intent. The configuration result deviates greatly from the user's expected business requirements, which restricts the promotion of the intent-driven network system. application.

Referring to FIG. 2, in another possible example, the network configuration device may include an acquisition module, an intention management module, and a configuration module. The acquisition module may acquire business intentions for expressing business requirements, and the intention management module may mine potential Intent to help users express business needs more completely, and the configuration module configures the target network according to the target potential intention, which is conducive to meeting the business needs of users more accurately.

Different modules in the network configuration device can be connected to each other for data transmission. Each module in the network configuration device may be a software module, or a hardware module, or partly a software module and partly a hardware module. The above structure of the network configuration device is merely an example and should not be construed as a specific limitation, and various modules in the network configuration device can be added, reduced or combined as required.

The following describes the network configuration method of the present application with reference to FIG. 2 .

Referring to FIG. 2, the network configuration method of the present application may include steps S201-S203.

S201. Obtain a business intention;

The obtaining module may obtain a service intent, which is used to describe the target service, and optionally, to indicate that the target service is executed on the target network.

This application does not limit the type of target service, for example, service provisioning, security policy change, network expansion, automatic inspection, automatic fault analysis and processing, network self-optimization, etc.

This application does not limit the content of the business intent, as long as the business intent can express the target business. Taking service provisioning as an example, the service intent may, for example, indicate the provisioning of traffic between site 1 and the data center site.

The present application does not limit the manner in which the acquiring module acquires the business intention. For example, referring to FIG. 2 , the business intention may provide the user with an input interface, and acquire the business intention input by the user through the input interface. Or, for example, the user can input business intentions to other devices, and the acquisition module obtains business intentions through other devices.

S202. Determine one or more potential intentions according to the business intention;

The intent management module can acquire the business intent from the acquisition module, and determine one or more potential intents according to the business intent, and each potential intent includes corresponding configuration information and evaluation results. From this, the underlying intent of the target is then determined for configuring the target network. The following describes the functions of the intent management module from three aspects: configuration information, evaluation results, and target potential intent.

1) Regarding configuration information.

The configuration information in each potential intent is used to implement the business intent. The configuration information indicates to configure the target network.

The present application does not limit the type of configuration information, for example, the configuration information may indicate a configuration scheme or configuration parameters. Continuing with the example of the business intention indicating the opening of the traffic between site 1 and the data center site, the configuration scheme indicated by the configuration information of a potential intent (denoted as potential intent a) can be as follows: An Internet link.

Configuration information in different potential intents may be different. Continuing with the example of the business intention indicating the opening of the traffic between site 1 and the data center site, assuming that the target network also supports the establishment of multi-protocol label switching (MPLS) leased lines, another potential intent different from potential intent a The configuration scheme indicated by the configuration information (denoted as potential intent b) may be to establish an MPLS-A leased line between site 1 and the data center site. Optionally, the configuration scheme indicated by the configuration information of another potential intent (denoted as potential intent c) different from potential intent a and potential intent b may be to establish an MPLS-B between site 1 and the data center site Dedicated line.

In order to facilitate the user to understand the configuration information in the potential intention, the configuration information may be user-oriented, for example, the configuration information may be description information of a configuration scheme. As an example, potential intent a, potential intent b, and potential intent c can be shown in item 1, item 2, and item 3 shown in Figure 3-1, respectively. The configuration information of potential intent a is "MPLS-A private line", and the potential The configuration information of intent b is "MPLS-B leased line", and the configuration information of potential intent c is "Internet link".

The intent management module can mine one or more potential intents according to the business intent. This application does not limit the method for the intent management module to determine the configuration information in the potential intent. The method will be described later with an example, which will not be expanded here.

2) Regarding the evaluation results.

The evaluation result in each potential intent indicates the impact on services in the target network after the configuration information in the corresponding potential intent takes effect. Services in the target network include target services and other services.

This application does not limit the specific content of the evaluation result, for example, the evaluation result includes service evaluation indicators. The intent management module can perform multi-dimensional evaluation on the configuration information of one or more potential intents of the business intent. For example, the service evaluation index may include but not limited to one or more of the following indexes: cost, network health, network performance, network maintainability, and other service impacts.

This application does not limit the content of the evaluation results of the business evaluation indicators. For example, the evaluation result of the cost may be a specific value or level (such as high, medium, low) of the cost of the package. For example, the evaluation result of the network health degree may include specific values or grades (for example, high, medium, low) of the network security comprehensive score and/or service impact scope and the like. For example, the evaluation result of network performance may include specific values or levels (such as high, medium, low) of delay and/or jitter and/or packet loss rate of the target network. For example, network maintainability may include network reliability, where the evaluation result of network reliability may include a specific value of one or more of network connectivity reliability, network capacity reliability, and network performance reliability or Level (e.g. high, medium, low). For example, the evaluation result of impact on other services may be a specific value or level (such as high, medium, low) of impact on services other than the target service in the target network.

This application does not limit the evaluation method of the above service evaluation indicators by the intent management module. For example, in the process of evaluating the configuration information in each potential intent, the intent management module can determine the evaluation result of the corresponding service evaluation index through the evaluation algorithm or evaluation platform corresponding to the service evaluation index. Combined with the required input of the evaluation algorithm, obtain the required network status information (for example, through the southbound collection interface of the platform), and then give specific evaluation results through the evaluation algorithm.

For example, the input of the evaluation algorithm corresponding to the cost can be the user package selection and parameters (such as the selection of the dedicated line package for overlay network service activation), according to the calculation standard of the service package. For example, the input of the evaluation algorithm corresponding to network health is network security logs, vulnerability scanning data, network monitoring KPI data, security event data, etc., and the network security health evaluation is performed through the network security platform. For example, the evaluation method corresponding to network performance can be to measure end-to-end network performance indicators in real time through end-side tools (such as ping), or to directly measure service Packets get the detection method of performance parameters such as the real packet loss rate and delay of the network, and perform end-to-end statistics on network performance. For example, the input of the evaluation algorithm corresponding to network reliability may include network networking, network device status, link status, device storage capacity, and device computing capacity, etc., based on the mathematics of network connectivity reliability, capacity reliability, and performance reliability. The model evaluates network reliability through simulation, network calculation algorithms, and approximate algorithms.

Optionally, the evaluation result may also include evaluation results of other indicators. For example, the other index may be a recommendation index, and the evaluation result of the recommendation index may, for example, indicate a recommendation level (eg, high, medium, low) of the configuration information in the corresponding potential intent.

Continuing to take the business intent instruction to activate the traffic between site 1 and the data center site as an example, potential intent a, potential intent b, and potential intent c can be shown in item 1, item 2, and item 3 in Figure 3-1, respectively. , the evaluation results of potential intent a include the evaluation results of "MPLS-A private line" in package price, bandwidth, link performance, and system recommendation items, and the evaluation results of potential intent b include the evaluation results of "MPLS-B private line" In the evaluation results of package price items, bandwidth items, link performance items and system recommendation items, the evaluation results of potential intention c include the package price items, bandwidth items, link performance items and system recommendation degrees of "Internet links" Item evaluation results.

3) About the potential intention of the target.

After the intention management module determines one or more potential intentions of the business intention, the target potential intention can be determined among the one or more potential intentions. One or more potential intentions are one or more candidate potential intentions that are mined and identified based on business intentions. Among these candidate potential intentions, there are business intentions that can meet the user's target business. The business intent of the business is called the target underlying intent. The present application does not limit the candidate potential intentions to be all potential intentions mined by the intention management module, and the following will introduce the one or more potential intentions with an example of a method for determining one or more potential intentions.

The present application does not limit the manner in which the intention management module determines the potential intention of the target. For example, the intention management module may automatically determine the potential intention of the target. Optionally, the intent management module may determine the target potential intent according to evaluation results corresponding to one or more potential intents of the business intent. For example, the intent management module can train a machine learning model to learn user feedback on historical business intent to determine the target potential intent of the business intent.

For example, the intention management module may provide the user with one or more potential intentions, and determine the target potential intention according to the user's input operation. Assuming that the user selects potential intent a, the intent management module may determine potential intent a as the target potential intent. Optionally, the user may determine the target potential intention according to the evaluation results corresponding to one or more potential intentions of the business intention. Optionally, the user's selection operation on potential intentions can be used as the user's selection feedback on one or more potential intentions, which can be used to improve the machine learning model in the intention management module. After multiple feedback learning, the intention management module can have The ability for a user to automatically determine the underlying intent of a target.

The present application does not limit the intention management module to directly provide potential intentions to the user. For example, the intention management module may provide potential intentions to the user through the acquisition module, and acquire user input operations to determine the target potential intentions.

The present application does not limit the intention management module to provide the user with all of one or more potential intentions. Optionally, the intention management module may provide a part of the one or more potential intentions to the user. For example, the intent management module may first provide potential intent a to the user. If the user selects potential intent a, the intent management module will not continue to provide other potential intents (such as potential intent b) to the user. If the user does not select potential intent a, the intent The management module can continue to provide other potential intents to the user, such as providing potential intent b.

In order to facilitate the user to understand the configuration information in the potential intention, the configuration information may be user-oriented, for example, the configuration information may be description information of a configuration scheme. The present application does not limit the form of providing potential intentions to the user, for example, it may interact with the user through text or icons or optional dialog boxes.

Continuing with the example of business intent indicating the traffic between site 1 and the data center site, the intent management module can provide users with potential intent a, potential Intent b and potential intent c. The user can select a potential intent according to the evaluation result in the potential intent, and the intent management module can obtain the user's selection operation. Assuming that the user's selection operation is shown in Figure 3-1, the intent management module can determine the configuration scheme corresponding to the MPLS-B leased line as the target potential intent.

S203. Configure the target network according to the configuration information of the target potential intent;

After the intent management module determines the potential intent of the target, the configuration module configures the target network according to the configuration information of the potential intent of the target.

The present application does not limit the manner in which the configuration device configures the target network. For example, the configuration module generates and sends corresponding network configuration data to the target network based on the potential intention of the target. Taking the configuration scheme corresponding to the MPLS-B leased line as the target potential intention as an example, the corresponding network configuration data can indicate to establish a border gateway protocol (border gateway protocol, BGP)/MPLS network interconnection between site 1 and the data center site. The connection agreement (internet protocol, IP) virtual private network (virtual private network, VPN) dedicated line, the bandwidth of the dedicated line chooses the elastic bandwidth of 300M-500M.

Referring to Figure 3-2, after the target network receives the network configuration data, an MPLS-B dedicated line can be established between site 1 and the data center site. The dedicated line is used to transmit traffic between site 1 and the data center site.

Above, configure the target network according to the target latent intention mined in step S202, the configuration result can not only meet the initial business intention, but also meet the user's potential intention, thus helping to reduce the deviation between the configuration result and the user's expected business demand, Thereby, it is beneficial to improve the user experience.

The following example introduces a method for the intent management module to determine the configuration information of each potential intent in one or more potential intents according to the business intent.

S202 mentioned above that the intent management module can determine one or more potential intents according to the business intent. This application does not limit the one or more potential intentions to one potential intention mining based on business intentions. Optionally, the intention management module may perform two or more potential intention mining based on business intentions to determine the one or more potential intentions. Multiple potential intents from which to determine the target potential intent for configuring the target network.

For example, the intention management module can mine one or more configuration elements to be supplemented or selected (called level 1 configuration elements) based on business intentions (which can be understood as potential intentions of level 0 targets). Each level 1 configuration element and business intent together form a level 1 potential intent, that is, the intent management module can obtain one or more level 1 potential intents. Afterwards, the intent management module can automatically or according to the user's instructions determine a level 1 target potential intent as the basis for the next mining. By analogy, the intent management module can mine one or more i-level configuration elements to be supplemented or selected based on the potential intention of the i-1 level target, and each i-level configuration element and the i-1 level target potential intention together form a Level i potential intent. Afterwards, the intent management module can automatically or according to the user's instructions determine a potential intent of an i-level target as the basis for the next mining. By analogy, the intent management module can mine one or more n-level configuration elements to be supplemented or selected based on the n-1 level target potential intention, and each n-level configuration element and n-1 level target potential intention together form a n-level potential intent. Afterwards, the intent management module can automatically or according to the user's instructions determine an n-level target potential intent as the basis for the next mining, until the potential intent cannot be mined. n is a positive integer greater than 1, correspondingly, i is a positive integer greater than or equal to 1 and less than or equal to n.

The configuration element in the i-level latent intention may refer to a configuration scheme or a configuration strategy or a configuration parameter for realizing the i-1 level target potential intention. Continuing to take the business intent (that is, the potential intent of the 0-level target) as an example indicating the traffic between the provisioning site 1 and the data center site, the intent management module mines three level 1 configuration elements based on the business intent, respectively, the link type is MPLS -A leased line, the link type is MPLS-B leased line and the link type is Internet link, the corresponding three level 1 potential intentions respectively indicate to establish an MPLS-A leased line between site 1 and the data center site, and establish an MPLS-A leased line at site 1 Establish an MPLS-B leased line with the data center site and an Internet link between site 1 and the data center site.

Assuming that the intention management module cannot obtain further configuration elements based on n-level target potential intention mining, then the configuration information in the n-level target latent intention can be used as the configuration information for configuring the target network. That is to say, at this time, the latent intention of the n-level target is equivalent to the latent intention of the target introduced above, and one or more latent intentions of the n-level are equivalent to one or more latent intentions introduced above.

Fig. 4-1 exemplarily shows a schematic diagram of mining potential intentions with business intentions as potential intentions of level 0 targets. Referring to Fig. 4-1, the intent management module can determine two potential intents of level 1 (marked as 11 and 12 respectively) based on the potential intention of level 0 target (marked as 01).

If the level 1 potential intention corresponding to 11 is selected as the level 1 target potential intention, then the intention management module can continue to mine three level 2 potential intentions based on the level 1 potential intention corresponding to 11 (denoted as 21, 22 and 23 respectively). Referring to Figure 4-1, after selecting any one of the potential intentions of the second-level target as the potential intention of the second-level target, the potential intention cannot be further mined, that is, the business intention, the potential intention of the first-level target corresponding to 11, and the potential intention of the second-level target It has been possible to fully describe the user's intention for the target business.

If the level 1 potential intention corresponding to 12 is selected as the level 1 target potential intention, then the intention management module can continue to mine two level 2 potential intentions based on the level 1 potential intention corresponding to 12 (denoted as 24 and 25 respectively). Referring to Figure 4-1, if you choose the level 2 potential intention corresponding to 24 as the potential intention of the level 2 target, the potential intention cannot be further explored, that is, the business intention, the potential intention of the level 1 target corresponding to 12 and the level 2 target corresponding to 24 Potential intent can fully describe the user's intention for the target business.

If the level 2 potential intention corresponding to 25 is selected as the potential intention of the level 2 target, one level 3 potential intention can be continuously mined (denoted as 31). Referring to Figure 4-1, if you choose the level 3 potential intention corresponding to 31 as the basis, you cannot continue to further explore the potential intention, that is, the business intention, the potential intention of the level 1 target corresponding to 12, the potential intention of the level 2 target corresponding to 25, and the potential intention of the level 2 target corresponding to 31 The corresponding level 3 target potential intention can fully describe the user's intention for the target business.

Figure 4-2 to Figure 4-4 illustrate an application scenario. The following describes the multiple excavation process shown in Figure 4-1 with reference to Figure 4-1 to Figure 4-3.

Suppose the target network is as shown in Figure 4-2. Referring to FIG. 4-2 , the target network includes an application cluster 401 , a switch 402 , a firewall 403 , a core network 404 , a big data analysis cluster 405 , a switch 406 , and a firewall 407 connected by wired or wireless means. Wherein, the application cluster may include application node 4011 , application node 4012 and application node 4013 , and the big data analysis cluster 405 may include data node 4051 , data node 4052 and data node 4053 .

The service intent may indicate to allow the traffic between the application node 4011 and the data node 4051 to pass. Assume that the intent management module mines two level-1 configuration elements based on the business intent, which are user-application group-based security policies and quintuple-based security policies. Combined with the business intent, the intent management module can determine two level 1 potential intents, wherein the configuration information in the level 1 potential intent corresponding to 11 indicates adding a user-application group-based security policy rule in the firewall 403 and firewall 407 respectively, 12 The configuration information in the corresponding level 1 potential intent indicates adding a quintuple-based security policy rule on the firewall 403 and the firewall 407 respectively.

The intent management module can separately evaluate the configuration information in the two level 1 potential intents, and obtain an evaluation result in each level 1 potential intent. The intent management module can automatically select a level 1 potential intention as the mining basis according to the evaluation results, or provide the user with these two level 1 potential intentions through the interface shown in Figure 4-3 (called a level 1 interface), and through the The interface obtains the user's selection operation on the level 1 latent intent. Referring to FIG. 4-3 , for simplicity of the interface, the Level 1 interface only shows the difference between two Level 1 potential intents. Assuming that the user's selection operation is shown in Figure 4-3, the intent management module can determine the level 1 potential intent corresponding to 11 as the basis for the next mining.

Assume that the intent management module can mine three second-level configuration elements to be supplemented by the user based on the first-level potential intent corresponding to 11, which are user group name, application group name, and execution action. Combined with the level 1 potential intent corresponding to 11, the level 2 potential intent corresponding to 21 indicates adding a security policy rule based on the user-application group in the firewall 403 and firewall 407 respectively, and the user group name is the name set by the user; the level 2 corresponding to 22 Add a user-application group-based security policy rule to the firewall 403 and firewall 407 respectively in the potential intent indication, and the application group name is the name set by the user; the level 2 potential intent indication corresponding to 23 adds a user-based -Applies the group's security policy rules and executes the action set for the user.

The intent management module may, for example, provide the user with the interface shown in Figure 4-4 (referred to as a 2-level interface) to provide the user with these 3 2-level potential intentions, and request to obtain all or part of the configuration elements to be supplemented through this interface , to identify target level 2 latent intent. Referring to Fig. 4-4, for interface simplicity, the Level 2 interface only shows the differences between the three Level 2 potential intents. Assuming that after the user enters content in the input box corresponding to each configuration element, the intention management module can determine that the potential intentions of the second-level target include the second-level potential intentions corresponding to 21, 22, and 23. Level 2 target potential intention indication adds a user-application group-based security policy rule in firewall 403 and firewall 407 respectively, and the user group name is "financial application class", the application group name is "financial data class", and the execution action is Let go and set this scheme as the default scheme.

Assuming that the intent management module cannot further dig out other potential intentions based on the potential intentions of the 2-level target, then the 2-level target potential intent is equivalent to the target potential intent used to configure the target network introduced earlier, and 21, 22, and 23 correspond to 2 A level potential intent is equivalent to one or more potential intents described above.

After the configuration device configures the target network according to the potential intention of the target, the following security policy rules can be added to the firewall 403 and the firewall 407 respectively: (untrust, trust, financial application type, any, financial data type, permit). Among them, "untrust" indicates the source security zone of the opened traffic, "trust" indicates the destination security zone, "financial application category" indicates the source user group, "financial data category" indicates the destination user group, and "permit" indicates that the execution policy of the traffic is release. Pass.

Optionally, in the process of mining potential intentions based on the potential intentions of level i-1, the intention management module may preprocess the potential intentions of level i-1. For example, the intent management module can obtain the state information of the target network, and convert the i-1 level potential intent into a corresponding network intent according to the state information of the target network. Taking the i-1 level potential intent indicating the traffic between the application node 4011 and the data node 4051 as an example, the network intent may indicate that a security policy is configured on the firewall 403 and the firewall 407 to allow the traffic.

The status information of the target network includes static information and dynamic information, the static information includes topology information and/or configuration information of the target network, and the dynamic information includes forwarding information of the target network and/or performance of network devices in the target network.

This application does not limit the technical means adopted by the intention management module to mine potential intentions of level i. For example, the intention management module can mine potential intentions of level i based on potential intentions of level i-1 through machine learning methods or knowledge graph methods. Taking the machine learning method as an example, the intent management module can train a machine learning model based on multiple historical business intents and potential intents selected for each of the multiple historical business intents, and then determine One or more underlying intents of the business intent. Optionally, the input of the machine learning module may also include state information of the target network.

Through the above mining of potential intentions, it is beneficial for users to continue to express their implicit intentions other than their business intentions, such as user-preferred configuration schemes, configuration parameter supplements, scene scope supplements, and expert decision-making schemes that the system cannot handle, etc., which is conducive to improving configuration. the accuracy of the results. The intent management module not only prompts users with possible hidden configuration information, but also informs users of the multi-dimensional evaluation results of each configuration information, recommends data and information that users care about, and provides users with better solution references.

FIG. 2 only exemplarily shows a system to which the above-mentioned method example is applicable, and is not limiting. For example, the system may include more devices and/or users and/or networks. Wherein, the network configuration device may include more modules or units. For example, referring to FIG. 5-1 , on the basis of the modules shown in FIG. 2 , the configuration module may include a verification unit and a configuration unit.

The verification unit can perform simulation verification on the latent intention of the target. For example, the verification unit constructs a mirror emulation network corresponding to the target network according to the network information, and configures the mirror emulation network according to the configuration information of the potential intention of the target. If the configured mirror simulation network satisfies the verification conditions, it is determined that the target's potential intention has passed the verification, and if the configured mirror simulation network does not meet the verification conditions, it is determined that the target's potential intention has not passed the verification. There are many kinds of verification conditions, which are not specifically limited in this application. For example, assuming that the potential intention of the target is used to indicate the opening of a certain service flow, the verification conditions may include: the transmission path of the service flow in the mirror simulation network is optimal The path, and/or, the transmission of the service flow in the mirror emulation network meets security compliance.

If the latent intention of the target passes the verification, the verification unit may send the latent intention of the target to the configuration unit, and the configuration unit configures the target network according to the latent intention of the target. Optionally, if the latent intent of the target fails the verification, the verification unit may repair the latent intent of the target, and the latent intent of the target after repair can pass the verification, and the configuration module configures the target network according to the latent intent of the target after repair.

Optionally, referring to FIG. 5-2, the verification unit may include a simulation verification subunit, a fault analysis subunit, and a network decision subunit.

Among them, the simulation verification subunit collects the configuration information of the network equipment through the southbound interface, and verifies the specific network intent (such as connectivity verification). If the simulation result shows that the three layers are disconnected, report the fault information to the fault analysis subunit.

The fault analysis subunit diagnoses the fault of the current networking according to the input fault information, and outputs the corresponding repair intention (for example, for the service flow of the AB path, The firewall security policy) is fed back to the network decision-making subunit.

The network decision-making sub-unit recommends the corresponding repair strategy according to the input repair intention; on the one hand, the decision-making sub-unit outputs the repair strategy to the simulation verification sub-unit, and analyzes the correctness of the repair strategy through incremental simulation; on the other hand, the decision-making sub-unit The repair strategy is input into the configuration synthesis subunit, and the corresponding network configuration is generated by the configuration unit.

The configuration module can preset corresponding configuration schemes for different business configuration scenarios, including default configuration schemes and schemes that meet user preferences. The configuration module automatically generates the network configuration according to the input restoration intention and combined with the user stock configuration. The final configuration module sends the repair configuration to the network device through the southbound interface to complete the automatic closed-loop of the fault.

The present application does not limit the underlying implementation manner of the system shown in FIG. 2 or FIG. 5-1 or FIG. 5-2 , for example, the system may be implemented using the architecture shown in FIG. 6 . The architecture shown in Figure 6 can be a typical architecture in a financial user's intelligent operation and maintenance scenario, mainly including three layers: application layer, network service engine layer and entity layer. Among them, the application layer is based on the PaaS (platform as a service) platform to connect with the network service engine to provide users with network service capabilities. Optionally, the acquisition module shown in Figure 5-1 may be implemented by a PaaS platform. Users face the application scenarios and arrange and design the network services. Users include the application support team and the site reliability engineer (SRE) team. The network service engine layer, as the network service provider center, provides various service engine capabilities by defining interface specifications and docking with the application layer in the northbound direction; in addition, the network service engine connects with network devices and software defined networks (software defined networks) through the southbound adaptation tool platform. network, SDN) controller, cloud platform or analyzer, to realize the ability to collect state information of the target network, and to deliver the configuration to the target network.

Referring to FIG. 6 , the network service engine includes an intent network planning engine, a simulation verification engine, a fault analysis engine, a network decision engine, and a configuration synthesis engine. Optionally, the intent network planning engine may be used to implement the function of the intent management module, for example, the intent network planning engine is used to implement the function of the intent management module in step S202 in the embodiment corresponding to FIG. 2 . The simulation verification engine, fault analysis engine and network decision engine are respectively used to realize the functions of the simulation verification subunit, fault analysis subunit and network decision subunit in the verification unit. The configuration synthesis engine can be used to realize the configuration module or the configuration module in the configuration module The function of the unit, for example, the configuration synthesis engine is used to realize the function of the configuration module in step S203 in the embodiment corresponding to FIG. 2 , or is used to realize the function of the configuration unit in FIG. 5-1 or FIG. 5-2 .

In order to better implement the above solution of the present application, related equipment for implementing the above solution is also provided below.

Please refer to FIG. 7 for details. FIG. 7 is a schematic structural diagram of a computing device provided by an embodiment of the present application. As shown in FIG. 7, the computing device 7 includes: a processor 701 and a memory 702, and the processor 701 and the memory 702 are connected to each other , optionally, the processor 701 and the memory 702 may be connected to each other through an internal bus 703 .

The processor 701 may be composed of one or more general-purpose processors, such as a central processing unit (central processing unit, CPU), or a combination of a CPU and a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.

The memory 702 can include a volatile memory (volatile memory), such as a random access memory (random access memory, RAM); the memory 702 can also include a non-volatile memory (non-volatile memory), such as a read-only memory (read-only memory). only memory, ROM), flash memory (flash memory), hard disk (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); the memory 702 may also include a combination of the above types.

The bus 703 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus, etc.

Optionally, the computing device 7 may include a communication interface 704, and the processor 701 is connected to the communication interface 702. For example, as shown in FIG. 7, the processor 701 and the communication interface 702 are connected through a bus.

The memory 702 stores computer instructions, and the processor 701 can execute steps S201 to S203 by executing these computer instructions. For specific implementation manners, reference may be made to the corresponding content above, and details are not repeated here.

The present application also provides a network system. The network system may include, for example, the network configuration device and the target network shown in FIG. 2, or, for example, include the network configuration device and the target network as shown in FIG. 6 shows the application layer, network service engine and entity layer.

The network configuration method provided in this application can be specifically executed by a chip in a computing device, the chip includes: a processing unit and a communication unit, the processing unit can be, for example, a processor, and the communication unit can be, for example, an input/output interface, a pin or a circuit wait. The processing unit may execute the computer-executable instructions stored in the storage unit, so that the chip in the computing device executes the above-mentioned method example. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit can also be a storage unit located outside the chip in the wireless access device end, such as a read-only memory (read-only memory, ROM) Or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), etc.

The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, part or all of any one of the above-mentioned method embodiments can be realized. step. Computer-readable storage media can be any available media that can be accessed by a general purpose or special purpose computer.

An embodiment of the present invention also provides a computer program, the computer program includes instructions, and when the computer program is executed by a computer, the computer can execute some or all of the steps of any method embodiment.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units or modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be Incorporation may either be integrated into another system, or some features may be omitted, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

The "A and/or B" mentioned in this application can be understood as including "A and B" and "A or B". The "plurality" mentioned in this application can be understood as two or more than two. Ordinal numerals such as "1", "2", "3", "4", "5" and "6" in this application are used to distinguish multiple objects, and are not used to limit the order of multiple objects.

Claims (20)

1. A network configuration method, characterized in that, comprising:

   Acquiring business intent, which is used to describe the target business;

   Determine one or more potential intents based on the business intent, each of the one or more potential intents includes configuration information and an evaluation result, the configuration information is used to achieve the business intent, and the evaluation result Indicate the impact on services in the target network after the configuration information takes effect;

   Configure the target network according to the configuration information of the target potential intent, the target potential intent is a potential intent determined in the one or more potential intents, the business intent and the target potential intent indicate that the target network is in the target network Execute the target business.
2. The method according to claim 1, wherein the target potential intention is determined according to evaluation results corresponding to one or more potential intentions of the business intention.
3. The method according to claim 1 or 2, wherein the evaluation results include service evaluation indicators, and the service evaluation indicators include one or more of the following indicators: cost, network health, network performance, network maintainability sex, other business impacts.
4. The method according to any one of claims 1 to 3, wherein the evaluation result further includes a recommendation index, and the recommendation index indicates a recommendation level of a potential intention corresponding to the evaluation result.
5. The method according to any one of claims 1 to 4, wherein the configuration information is description information of a configuration scheme.
6. The method according to claim 1, wherein said determining one or more potential intentions according to said business intentions comprises:

   Determine one or more potential intentions of the business intention according to the status information of the target network and the business intention, the status information of the target network includes static information and dynamic information, the static information includes the status information of the target network Topology information and/or configuration information, where the dynamic information includes forwarding information of the target network and/or performance of network devices in the target network.
7. The method according to claim 1, wherein said determining one or more potential intentions according to said business intentions comprises:

   The one or more potential intents are determined based on a machine learning model that is based on a plurality of historical business intents and the potential intent selected for each of the plurality of historical business intents and the business intent Intentionally trained.
8. The method according to any one of claims 1 to 7, wherein each potential intention in the one or more potential intentions is an n-level potential intention, and the target potential intention is an n-level target potential intention , one or more i-level potential intentions are determined based on i-1 level target potential intentions, and the i-1 level target potential intentions are determined from one or more i-1 level potential intentions, one or more The level 1 potential intention is determined based on the business intention, wherein, n is a positive integer greater than 1, and i is any positive integer greater than 1 and less than or equal to n.
9. A network configuration device, characterized in that it comprises:

   An acquisition module, configured to acquire a business intent, where the business intent is used to describe the target business;

   An intent management module, configured to determine one or more potential intents according to the business intent, each of the one or more potential intents includes configuration information and evaluation results, and the configuration information is used to realize the business Intention, the evaluation result indicates the impact on services in the target network after the configuration information takes effect;

   A configuration module, configured to configure the target network according to configuration information of target potential intentions, where the target potential intentions are potential intentions determined in the one or more potential intentions.
10. The device according to claim 9, wherein the target potential intention is determined according to an evaluation result corresponding to one or more potential intentions of the business intention.
11. The device according to claim 9 or 10, wherein the evaluation results include service evaluation indicators, and the service evaluation indicators include one or more of the following indicators: cost, network health, network performance, network maintainability sex, other business impacts.
12. The device according to any one of claims 9 to 11, wherein the evaluation result further includes a recommendation index, and the recommendation index indicates a recommendation level of a potential intent corresponding to the evaluation result.
13. The device according to any one of claims 9 to 12, wherein the configuration information is description information of a configuration scheme.
14. The device according to claim 9, wherein the intention management module is configured to determine one or more potential intentions of the service intention according to the state information of the target network and the service intention, and the target The state information of the network includes static information and dynamic information, the static information includes topology information and/or configuration information of the target network, and the dynamic information includes forwarding information of the target network and/or network information in the target network device performance.
15. The device according to claim 9, wherein the intent management module is used for:

    The one or more potential intents are determined based on a machine learning model that is based on a plurality of historical business intents and the potential intent selected for each of the plurality of historical business intents and the business intent Intentionally trained.
16. The device according to any one of claims 9 to 15, wherein each potential intention in the one or more potential intentions is an n-level potential intention, and the target potential intention is an n-level target potential intention , one or more i-level potential intentions are determined based on i-1 level target potential intentions, and the i-1 level target potential intentions are determined from one or more i-1 level potential intentions, one or more The level 1 potential intention is determined based on the business intention, wherein, n is a positive integer greater than 1, and i is any positive integer greater than 1 and less than or equal to n.
17. A computing device, characterized in that it includes a memory and a processor, the memory stores codes, the processor is configured to execute the codes, and when the codes are executed, the computing device performs the The method described in any one of 1 to 8.
18. A computer storage medium, characterized in that the computer storage medium stores a computer program, and when the program is executed by a computer, the computer implements the method according to any one of claims 1 to 8.
19. A computer program product, characterized in that the computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the method according to any one of claims 1 to 8.
20. A network system, characterized by comprising one or more network devices in the target network and the network configuration device according to any one of claims 9 to 16.

Images