Conflict detection and resolution methods and apparatuses
AssigneeHuawei Technologies Co., Ltd.
InventorsJinming LI, Donghui WANG
Life of this patent
Estimating the term…
Abstract
Conflict detection and resolution methods and apparatuses relate to the field of communications technologies. The conflict detection method includes: acquiring, by a controller, a flow path of a data flow on a network, where the flow path is used to indicate a path along which the data flow reaches an address in a destination address range from an address in a source address range through at least two intermediate nodes on the network, a first flow table rule is added to or deleted from flow tables of the at least two intermediate nodes, and the first flow table rule is any flow table rule; and determining, by the controller, whether a conflict exists according to an address range of the flow path and an address range of a security policy.
Claims28
A conflict detection method, wherein the method comprises:
- acquiring, by a controller, a flow path of a data flow on a network, wherein the flow path is used to indicate a path along which the data flow reaches an address in a destination address range from an address in a source address range through at least two intermediate nodes on the network, a first flow table rule is added to or deleted from flow tables of the at least two intermediate nodes, and the first flow table rule is any flow table rule;
- and
- determining, by the controller, whether a conflict exists according to an address range of the flow path and an address range of a security policy.
A conflict resolution method, comprising:
- determining, by a controller, a first intermediate node on a flow path;
- in a case in which a conflict is caused by an added flow table rule, adding, by the controller, the added flow table rule to the first intermediate node;
- setting, by the controller, a priority of the added flow table rule to be highest, so that when the data flow is at the first intermediate node, the added flow table rule is first executed;
- and
- setting, by the controller, an operation state of the added flow table rule to discarding, to control the first intermediate node to discard the data flow.
A conflict detection apparatus, comprising:
- an acquiring unit, wherein the acquiring unit is configured to acquire a flow path of a data flow on a network, wherein the flow path is used to indicate a path along which the data flow reaches an address in a destination address range from an address in a source address range through at least two intermediate nodes on the network, a first flow table rule is added to or deleted from flow tables of the at least two intermediate nodes, and the first flow table rule is any flow table rule;
- and
- a first determining unit, wherein the first determining unit is configured to determine whether a conflict exists according to an address range of the flow path and an address range of a security policy.
Dependencies are inferred from the claim text.