Data Plane Verification Layer for Network Invariant Checking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer networks face challenges in managing their complexity and heterogeneity, leading to undetected vulnerabilities and performance issues due to the scale and dynamic nature of deployed networks, which results in service disruptions, security breaches, and performance degradation.
Innovation Solution
A data plane verification layer is introduced between network controllers and devices, monitoring and verifying packet-forwarding rules in real-time to ensure network invariants, using equivalence classes and forwarding graphs to pinpoint affected areas and prevent rule violations, thereby ensuring network correctness and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network verification is performed across the entire network, then measurement precision of network invariants is improved, but loss of time increases due to the scale and complexity of the network
Solution Approach 1:
The patent divides the network verification process into two distinct phases: offline verification that computes equivalence classes and forwarding graphs in advance, and real-time verification that only checks affected equivalence classes when rules change. This segmentation allows comprehensive verification accuracy while minimizing real-time overhead by verifying only relevant portions of the network state.
Solution Approach 2:
The patent performs preliminary computation of equivalence classes and forwarding graphs during an offline phase before actual network operation. This preliminary action prepares verification data structures in advance, so that when rule modifications occur, the system only needs to perform quick checks on affected classes rather than re-verifying the entire network, thus reducing verification time while maintaining precision.
2Reliability
If real-time verification is implemented for every rule modification, then reliability of network operation is improved, but device complexity increases due to the verification layer and processing requirements
Solution Approach 1:
The patent introduces a verification layer that acts as an intermediary between the SDN controller and network devices. This intermediary intercepts rule modifications, performs verification using pre-computed equivalence classes and forwarding graphs, and only allows validated rules to proceed. This approach ensures network reliability while isolating complexity within the verification layer, protecting the core control plane and data plane devices from direct complexity exposure.
3Measurement precision
If comprehensive network monitoring is performed to detect all vulnerabilities, then measurement precision of network state is improved, but loss of time increases due to analyzing all packet-forwarding rules
Solution Approach 1:
The patent applies local quality by making the verification process adaptive to rule modifications: when a rule changes, only the specific equivalence classes affected by that change are verified, rather than re-verifying all classes. This localized verification approach maintains high detection accuracy for vulnerabilities while significantly reducing analysis time by focusing computational resources only on relevant portions of the network state.
Data Source
AI summary
A network-wide verification system may be adapted with a data plane verification layer positioned between a set of multiple network devices and a controller in network communication with the devices, where the controller is configured to transmit packet-forwarding rules to the devices. The data plane verification layer monitors network rule modifications, such as monitoring modifications initiated by the network devices and/or by the controller, and verifies the validity of invariants of the monitored network according to multiple stored network invariants. The verification may be executed on parts of the network taking actions that are capable of being influenced by a new rule modification. The network invariants include conditions expected to be upheld in valid network operation as related to packet routing and the packet-forwarding rules.