Verifying intents in stateful networks using atomic address objects
AssigneeHewlett Packard Enterprise Development LP
InventorsPuneet Sharma, Huazhe Wang
Life of this patent
Estimating the term…
Abstract
Example method includes: receiving a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule and an action to be performed by a network function on a network packet in response to the rule being matched; identifying a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions; creating an atomic address object representing the identified set of header address spaces; and verifying the plurality of intent-based network policies using the atomic address object.
Claims22
A method comprising:
- receiving, by a network device, a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule associated with a network intent defined using logical terms and an action to be performed by a network function on a network packet in response to the rule being matched, and further wherein the network comprises an intent-based stateful network and the network function comprises a stateful processing of the network packet;
- identifying, by the network device, a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions;
- creating, by the network device, an atomic address object representing the identified set of header address spaces;
- and
- verifying, by the network device, the plurality of intent-based network policies using the atomic address object.
A network device comprising at least:
- a memory;
- a processor executing instructions in the memory to:
- receive a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule associated with a network intent defined using logical terms and an action to be performed by a network function on a network packet in response to the rule being matched, and further wherein the function comprises a stateful processing of the network packet;
- identify a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions;
- create an atomic address object representing the identified set of header address spaces;
- and
- verify the plurality of intent-based network policies using the atomic address object.
A non-transitory machine-readable storage medium encoded with instructions executable by a processor of a computing device, the non-transitory machine-readable storage medium comprising instructions to:
- receive a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule based on a network intention and an action to be performed by a network function on a network packet in response to the rule being matched, and further wherein the network comprises an intent-based stateful network and the network function comprises a stateful processing of the network packet;
- identify a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions;
- create an atomic address object representing the identified set of header address spaces;
- and
- verify the plurality of intent-based network policies using the atomic address object.
Dependencies are inferred from the claim text.