Policy conflict resolution method and apparatus

Patent metadata

Field	Value
Publication number	US-10193755-B2
Application number	US-201715410092-A
Country	US
Kind code	B2
Filing date	Jan 19, 2017
Priority date	Jul 21, 2014
Publication date	Jan 29, 2019
Grant date	Jan 29, 2019

Abstract

This application discloses a policy conflict resolution method which includes receiving a first control policy and decomposing the first control policy into m first rules, and receiving a second control policy and decomposing the second control policy into n second rules. The method also includes performing negation on each first rule to obtain a first negation rule, performing negation on each second rule to obtain a second negation rule, and generating a corresponding first execution rule by using each first negation rule and each second negation rule according to a rule synthesis principle. Additionally, the method includes deleting an invalid rule, using a remaining one of the first execution rules as a valid first execution rule, performing negation on each valid first execution rule, and converting, according to a protocol supported by a first forwarding device, each valid first execution rule on which negation has been performed into a corresponding forwarding entry of the first forwarding device.

First claim

What is claimed is:

1. A method comprising:
receiving, by a processor, a first control policy;
decomposing the first control policy into m first rules;
receiving, by the processor, a second control policy;
decomposing the second control policy into n second rules, wherein m and n are natural numbers, wherein both the first control policy and the second control policy act on a first forwarding device, and wherein the first rules and the second rules each comprise a matching field and an action;
performing negation on the first rules to obtain first negation rules;
performing negation on the second rules to obtain second negation rules;
generating a corresponding first execution rule using the first negation rules and the second negation rules according to a rule synthesis principle, wherein the rule synthesis principle comprises forming the first execution rule using an intersection between a matching field of a first negotiation rule of the first negotiation rules and a second negotiation rule of the second negotiation rules that are of a same matching field type or a union between a matching field of the first negation rule and a matching field of the second negation rule that are of different matching field types, and an intersection between an action of the first negation rule and an action of the second negation rule;
detecting an invalid rule in response to determining that there is no intersection between the matching field of the first negation rule and the matching field of the second negation rule that are of the same matching field type;
deleting the invalid rule;
using remaining first execution rules as valid first execution rules;
performing negation on the valid first execution rules; and
converting, according to a protocol supported by the first forwarding device, the valid first execution rules on which negation has been performed into a corresponding forwarding entry of the first forwarding device.

2. The method according to claim 1 , wherein performing negation on the first rules comprises keeping the matching field of the first rules unchanged and performing negation on the action of the first rules, and wherein performing negation on the second rules comprises keeping the matching field of the second rule unchanged and performing negation on the action of the second rules.

3. The method according to claim 2 , wherein generating the corresponding first execution rule using the first negation rules and the second negation rules according to a rule synthesis principle comprises:
using the first negation rules as an elements and performing arrangement according to a priority sequence of the first rules to constitute a first matrix, wherein the first matrix is a column matrix;
using the second negation rules as elements and performing arrangement according to a priority sequence of the second rules to constitute a second matrix, wherein the second matrix is a row matrix;
multiplying the first matrix by the second matrix to obtain a first execution rule matrix; and
generating, according to the rule synthesis principle, the corresponding first execution rule using pairs of the first negation rule and the second negation rule that are multiplied and that are in the first execution rule matrix, wherein priorities of the first execution rules of the first execution rule matrix are sorted according to a column sequence of the first execution rule matrix, and wherein priorities of first execution rules in a same column are sorted according to a row sequence of the first execution rule matrix.

4. The method according to claim 3 , further comprising:
adding a first matching rule as a first rule whose priority is the lowest, after decomposing the first control policy into m first rules; and
adding a second matching rule as a second rule whose priority is the lowest, after decomposing the second control policy into n second rules, wherein matching fields of the first matching rule and the second matching rule are both wildcard characters, and wherein actions of the first matching rule and the second matching rule are both discarding.

5. The method according to claim 3 , wherein using the remaining first execution rules as valid first execution rules comprises:
comparing matching fields of pairs of remaining first execution rules;
deleting the first execution rule whose priority is relatively low, in response to the matching fields of the pairs of first execution rules being the same; and
using a remaining one of the first execution rules as the valid first execution rule after deleting the first execution rule.

6. The method according to claim 3 , wherein using the remaining first execution rules as valid first execution rules comprises:
comparing matching fields of pairs of remaining first execution rules;
deleting the first execution rule of a pair of the pairs of remaining first execution rules whose matching field is relatively small; and
using a remaining one of the first execution rules as the valid first execution rule after deleting the first execution rule.

7. The method according to claim 3 , wherein the method further comprises:
receiving a third control policy;
decomposing the third control policy into k third rules, wherein k is a natural number, and wherein the third control policy and the first and second control policies all act on the first forwarding device;
performing negation on the valid first execution rules to obtain first negation execution rules,
performing negation on the third rules to obtain third negation rules;
using the first negation execution rules as an elements and performing arrangement according to a priority sequence of the first execution rules to constitute a third matrix, wherein the third matrix is a column matrix;
using the third negation rule as an element and performing arrangement according to a priority sequence of the third rules to constitute a fourth matrix, wherein the fourth matrix is a row matrix;
multiplying the third matrix by the fourth matrix to obtain a second execution rule matrix;
generating, according to the rule synthesis principle, a corresponding second execution rule using pairs of the first negation execution rule and the third negation rule that are multiplied and that are in the second execution rule matrix, wherein the rule synthesis principle comprises forming the second execution rule using an intersection between a matching field of a first negation execution rule and a matching field of a third negation rule that are of a same matching field type or a union between a matching field of a first negation execution rule and a matching field of a third negation rule that are of different matching field types, and an intersection between an action of the first negation execution rule and an action of the third negation rule;
detecting an invalid rule using a second execution rule, wherein there is no intersection between the matching field of the first negation execution rule and the matching field of the third negation rule that are of the same matching field type;
deleting the invalid rule;
performing negation on the remaining second execution rules; and
converting, according to the protocol supported by the first forwarding device, each remaining second execution rule on which negation has been performed into a corresponding forwarding entry of the first forwarding device.

8. An apparatus comprising:
a processor; and
a non-transitory computer readable storage medium storing a program for execution by the processor, the program including instructions to:
receive a first control policy;
decompose the first control policy into m first rules;
receive a second control policy;
decompose the second control policy into n second rules, wherei

Assignees

• Huawei Tech Co Ltd

Inventors

• Dong Wenxia
• Lin Chengyong
• Ding Wanfu
• Li Fengkai

Classifications

• H04L41/0886

  Fully automatic configuration · CPC title

• H04L41/5048

  Automatic or semi-automatic definitions, e.g. definition templates · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L45/56

  Routing software · CPC title

• H04L47/19 Primary

  at layers above the network layer (network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60) · CPC title