Verifying Composed Policy Graph Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intent-based management systems face challenges in verifying the correctness of composed policy graphs and troubleshooting network policy violations, as they cannot effectively check if the connectivity in the composed policy graph reflects the corresponding policies in input policy graphs, leading to potential errors and unintended communications between endpoints.
Innovation Solution
A method is introduced that involves dividing the composed policy graph into sub-graphs, selecting subsets with disjoint endpoint groups, and verifying connectivity to ensure that the composed policy graph accurately reflects the input policies, using an intent verification and troubleshooting system (IVT) with an intent verifier and troubleshooter to identify errors and provide reasoning for network states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If policy graphs are composed automatically without verification, then network management efficiency is improved, but correctness and reliability of policy composition deteriorates
Solution Approach 1:
The patent applies preliminary action by performing verification of the composed policy graph before it is deployed into the network. The verification process checks whether connectivity in the composed policy graph reflects the corresponding policies in the input policy graphs, ensuring correctness is established prior to deployment. This prevents erroneous policies from being applied to the network infrastructure.
2Reliability
If verification of composed policy graph is performed, then reliability is improved, but complexity of the system increases
Solution Approach 1:
The patent applies segmentation by dividing the verification process into distinct functional components: an intent verifier that checks policy correctness and an intent troubleshooter that diagnoses connectivity issues. The verification itself is segmented into checking individual policies and their compositions, making the complex verification task manageable and modular.
Solution Approach 2:
The patent introduces an intermediary verification system that acts as a mediator between the policy composition process and network deployment. This intermediary layer (the intent verifier and troubleshooter) checks policy correctness without requiring changes to the underlying network infrastructure or policy composition engine, thereby managing complexity through abstraction.
3Difficulty of detecting and measuring
If troubleshooting capabilities are added to verify connectivity, then ability to detect and measure policy violations is improved, but device complexity increases
Solution Approach 1:
The patent implements feedback by creating a closed-loop verification system where the intent troubleshooter receives connectivity status information, analyzes it against the verified policy graph, and provides diagnostic feedback about policy violations. This feedback mechanism enables automatic detection and measurement of connectivity issues without manual intervention.
Data Source
AI summary
Example method includes: receiving, by a network device, a plurality of input policy graphs and a composed policy graph associated with the input policy graphs; dividing the composed policy graph into a plurality of sub-graphs, each sub-graph comprising a plurality of edges and a plurality of source nodes and destination nodes that the edges are connected to; selecting a first subset of sub-graphs that include, as a source node, a disjoint part of an original source EPG for each input policy graph; identifying a second subset within the first subset of sub-graphs that include, as a destination node, a disjoint part of an original destination EPG for the each input policy graph; and verifying whether connectivity in the composed policy graph reflects a corresponding policy in the plurality of input policy graphs for each sub-graph in the second subset.