Systems for and methods of network management and verification using intent inference

Patent metadata

Field	Value
Publication number	US-10862749-B1
Application number	US-201816041598-A
Country	US
Kind code	B1
Filing date	Jul 20, 2018
Priority date	Jul 21, 2017
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

A system for managing a network using intent inference includes a network interface that is configured to obtain device information regarding a plurality of hardware devices within a data communication network. A processor is configured to infer intended packet handling behavior of a plurality of the devices. A network verification system models packet handling behavior of the devices within the network and compares the inferred intended behavior to the modeled packet handling behavior. The system can take action in response to the results of the comparison, which can include initiating a configuration change to one or more of the hardware devices of the data communication network.

First claim

What is claimed is:

1. A system for managing a network using intent inference, comprising:
a network interface configured to obtain device information regarding a plurality of hardware devices within a data communication network wherein the device information is obtained by performing one or more of the following:
sending queries to the devices and receiving responses from the devices;
monitoring traffic communicated within the data communication network by the devices; and
sending queries to a database having device information stored therein and receiving responses;

a processor configured to infer functional roles of the devices by applying role inference rules to the obtained device information and to infer intended packet handling behavior or intended device configuration of the devices by applying intent inference rules to the inferred functional roles of the devices;
a data storage system in which the inferred functional roles of the devices and the inferred intended packet handling behavior of the devices are stored;
a network verification system comprising a non-transitory computer-readable storage medium storing instructions that, when executed by at least one processing device, are to:
determine modeled packet handling behavior of the devices within the data communication network using a computer-implemented model of the data communication network;
compare the inferred intended packet handling behavior to the modeled packet handling behavior; and
initiate a configuration change to one or more of the devices in response to said comparison of the inferred intended packet handling behavior to the modeled packet handling behavior.

2. The system according to claim 1 , wherein the management system is configured to change packet handling behavior of one or more of the devices in response to said initiation of a configuration change.

3. The system according to claim 1 , wherein a system external to the management system is configured to change packet handling behavior of one or more of the devices in response to said initiation of a configuration change.

4. The system according to claim 1 , wherein the processor is configured to: examine object information regarding a plurality of objects of the data communication network, apply role inference rules to the obtained object information to determine the roles of objects in the data communication network, and create labels associating objects with the identified roles.

5. The system according to claim 4 , wherein the processor is further configured to apply a confidence level to the labels.

6. The system according to claim 4 , wherein the data communication network comprises a multi-tier layered network and said applying role inference rules comprises:
identifying and labelling interfaces in the data communication network;
identifying and labelling device types in the data communication network;
identifying and labelling access devices in the data communication network; and
identifying and labelling access layers in the data communication network.

7. The system according to claim 4 , wherein said applying role inference rules further comprises identifying and labelling redundancy groups.

8. The system according to claim 4 , wherein said identifying and labelling interfaces comprises identifying physical ports at the edge of the data communication network.

9. The system according to claim 1 , wherein the data communication network comprises a leaf-spine network and said applying role inference rules comprises inferring roles of devices within the leaf-spine network.

10. The system according to claim 1 , wherein said applying role inference rules comprises inferring roles from network traffic.

11. The system according to claim 1 , wherein said applying role inference rules comprises inferring network regions.

12. The system according to claim 1 , wherein said applying role inference rules employs machine learning to classify objects into roles.

13. The system according to claim 1 , wherein the processor is configured to obtain device information from a model for inferring functional roles of the devices.

14. The system according to claim 1 , wherein said intent inference rules comprise one or more of the following: a reachability rule; a multiple path availability rule; an access control consistency rule; a data flow consistency rule; a device configuration consistency rule; and a network segmentation rule.

15. The system according to claim 1 , wherein the processor is configured to obtain device information from a model for inferring intended packet handling behavior of the devices.

16. The system according to claim 1 , wherein the network management system is configured to display graphically a depiction of the data communication network.

17. The system according to claim 1 , wherein the network management system is configured to display graphically one or more paths in the data communication network.

18. The system according to claim 1 , wherein the network verification system is configured to display graphically results of said comparison of the inferred intended packet handling behavior to the modeled packet handling behavior.

19. The system according to claim 18 , wherein the network verification system is configured to display graphically at least a portion of the data communication network for which the modeled packet handling behavior is not consistent with the inferred intended packet handling behavior.

20. The system according to claim 1 , wherein the intended behavior comprises actual intended behavior as input by a user.

21. The system according to claim 1 , wherein the intent inference rules include at least one rule that is user-selectable or user-modifiable.

22. A system for managing a network using intent inference, comprising:
a network interface configured to obtain device information from a plurality of hardware devices within a data communication network wherein the device information is obtained by performing one or more of the following:
sending queries to the devices and receiving responses from the devices; and
monitoring traffic communicated within the data communication network by the devices;

a processor in network communication with the devices via the network interface, wherein the processor is configured to infer functional roles of the devices by applying role inference rules to the obtained device information and to infer intended packet handling behavior or intended device configuration of the devices by applying intent inference rules to the inferred functional roles of the devices;
a data storage system in which the inferred functional roles of the devices and the intended packet handling behavior of the devices are stored; and
a network verification system comprising a non-transitory computer-readable storage medium storing instructions that, when executed by at least one processing device, are to:
determine modeled packet handling behavior of the devices within the data communication network using a computer-implemented model of the data communication network; and
compare the intended packet handling behavior to the modeled packet handling behavior; and
store results of said comparison in a database.

23. The system according to claim 22 , wherein the system is configured to provide an accept or reject notification in response to said comparison of the inferred intended packet handling behavior to the modeled packet handling behavior, thereby allo

Assignees

• Veriflow Systems Inc
• Vmware Inc

Inventors

• Kiyak Firat
• Subramanian Giri Prashanth
• Awan Sajid
• Caesar Matthew Chapman
• Godfrey Philip Brighten
• Wycklendt Matthew Paul

Classifications

• H04L45/22

  Alternate routing · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0813 Primary

  characterised by the conditions triggering a change of settings · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title