Atomic Address Objects for Intent-Based Network Policy Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network verification solutions struggle to effectively verify intent-based policies in stateful networks, particularly due to the inability to model temporal relations and support large-scale problems, leading to incorrect instantiation of policies and inefficiencies in debugging and verification processes.
Innovation Solution
The introduction of atomic address objects, which group individual network devices based on shared processing rules and properties, enables efficient intent-based policy verification by representing packet processing as set membership checks and temporal modeling, reducing the number of queries needed to verify reachability and accuracy in stateful networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If individual network devices are verified separately, then verification coverage is complete, but verification complexity and time consumption increase significantly
Solution Approach 1:
The patent combines multiple individual device verifications into a single atomic address object verification. By merging the verification of source devices, destination devices, and intermediate devices into one unified atomic address object, the system achieves complete verification coverage while significantly reducing verification time and complexity.
2Measurement precision
If detailed packet processing rules are modeled for each device, then verification accuracy improves, but computational complexity increases
Solution Approach 1:
The patent transforms the verification approach by changing parameters from individual device-level details to atomic address object-level abstractions. By modifying the verification parameters to work with aggregated atomic address objects rather than individual device configurations, the system maintains verification accuracy while reducing computational complexity.
3Reliability
If stateful network functions are verified with temporal relations, then policy verification correctness improves, but the verification model complexity increases
Solution Approach 1:
The patent introduces atomic address objects as intermediary abstractions between individual devices and the verification system. These atomic address objects serve as mediators that encapsulate temporal relations and stateful behavior, allowing the verification system to maintain correctness while avoiding direct complexity from temporal modeling of individual devices.
4Ease of manufacture
If existing verification solutions are used, then implementation is straightforward, but they cannot effectively verify large-scale stateful networks
Solution Approach 1:
The patent segments the network verification problem into atomic address objects that can be independently verified. By dividing the large-scale network into manageable atomic units representing groups of devices with similar characteristics, the system can effectively verify large-scale stateful networks while maintaining implementation feasibility through standardized verification procedures.
Data Source
AI summary
Example method includes: receiving a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule and an action to be performed by a network function on a network packet in response to the rule being matched; identifying a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions; creating an atomic address object representing the identified set of header address spaces; and verifying the plurality of intent-based network policies using the atomic address object.