Distributed Network Verification Using Binary Decision Diagrams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network verification techniques face challenges in scalability and real-time verification due to their reliance on centralized computing systems, which can lead to time delays and security concerns.
Innovation Solution
A fully or partially distributed approach to network verification, where each network device generates its own device model and is responsible for local updates, reducing the need for centralized data collection and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized computing system is used to perform network verification, then verification coverage can be comprehensive, but scalability is limited and time delays occur
Solution Approach 1:
The patent divides the centralized verification system into distributed verification modules deployed across multiple network devices. Each device performs verification independently, eliminating the single-point bottleneck and enabling linear scalability as network size increases.
Solution Approach 2:
The system transitions from a single centralized verification dimension to multiple parallel verification dimensions distributed across the network. This dimensional shift allows simultaneous verification operations on different network segments, dramatically improving throughput and scalability.
2Reliability
If a centralized computing system collects data from all network devices, then complete network verification is achieved, but time delay increases
Solution Approach 1:
Verification modules are pre-deployed on network devices and continuously monitor network state. When verification is needed, the data is already prepared and available locally, eliminating the time-consuming data collection phase inherent in centralized approaches.
Solution Approach 2:
Each network device performs verification operations autonomously using its own computational resources and local data. This self-service capability eliminates dependency on centralized data collection and processing, dramatically reducing verification latency.
3Measurement precision
If detailed configuration information is communicated to a centralized system, then verification accuracy is improved, but security is compromised
Solution Approach 1:
The patent extracts only the essential verification-relevant data from device configurations, leaving sensitive detailed configuration information local to each device. This selective extraction maintains verification accuracy while minimizing security exposure by not transmitting unnecessary sensitive data.
Solution Approach 2:
A cryptographic intermediary layer processes and verifies configuration data locally before transmission. This intermediary mechanism ensures that verification accuracy is maintained through proper validation while security is preserved by preventing direct exposure of detailed configuration information.
Data Source
AI summary
Methods and systems for partially or fully distributed network verification are described. In partially distributed network verification, each network device generates a respective device-level binary decision diagram (BDD) representing the logical behavior of the respective network device for a network property of interest. The device-level BDDs from each network device are received by a verification service that performs verification by generating an input BDD representing an input header space, and applies each device-level BDD in a logical path from a source device to a destination device, and reports the output BDD. In fully distributed network verification, each network device is responsible for calculating a device-specific output BDD by applying a device-specific BDD, which represents the logical behavior of the network device, to a device-specific input BDD.