FlowVer Versioning System for SDN State Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-Defined Networks (SDNs) face challenges in managing network state consistency and security due to the absence of mechanisms for concurrency and the presence of multiple local copies of network state, leading to redundancy and potential conflicts from unintentional or malicious changes.
Innovation Solution
A versioning system, referred to as FlowVer, is introduced to manage network state by maintaining an authoritative copy of flow configuration state and tracking metadata for each snapshot, allowing for incremental recording of changes and conflict resolution, ensuring state safety and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple local copies of network state are maintained by various applications, then network state availability and accessibility are improved, but redundancy and state inconsistency increase
Solution Approach 1:
The patent merges multiple distributed local copies of network state into a single centralized authoritative copy stored in a database. This consolidation eliminates redundancy while maintaining state availability through controlled access mechanisms. The centralized database serves as the single source of truth that all applications can access without creating conflicting local copies.
Solution Approach 2:
The patent introduces a state access mechanism that acts as an intermediary between applications and the network state. This mediator controls all read and write operations to the centralized database, ensuring that applications can access state information without directly manipulating local copies, thereby preventing inconsistency while maintaining availability.
2Adaptability or versatility
If multiple coexisting authors edit shared network state without concurrency mechanisms, then network state programmability is improved, but state inconsistency and conflicts increase
Solution Approach 1:
The patent implements feedback mechanisms through version control and conflict detection systems. When multiple authors edit network state, the system provides feedback about potential conflicts and state changes, allowing authors to adjust their operations to maintain consistency. The conflict detection system continuously monitors state modifications and alerts authors to inconsistencies.
Solution Approach 2:
The patent applies preliminary action through authorization mechanisms and conflict detection before state modifications are committed. The system checks for potential conflicts and validates authorization before allowing edits, preventing inconsistent states from being created in the first place rather than resolving them after occurrence.
3Ease of operation
If network state is made accessible without authorization mechanisms, then network state accessibility is improved, but security against malicious updates deteriorates
Solution Approach 1:
The patent introduces an authorization mechanism as an intermediary layer between applications and network state access. This mediator verifies credentials and permissions before allowing state modifications, enabling broad accessibility for legitimate users while blocking malicious updates. The authorization system does not restrict reading access but controls writing access selectively.
Solution Approach 2:
The patent applies preliminary anti-action by implementing authorization checks and conflict detection before state modifications can occur. The system proactively prevents malicious updates by verifying authorization credentials and detecting potential conflicts before they can corrupt the network state, rather than responding to security violations after they occur.
Data Source
AI summary
A versioning system for network state of a network includes: a server, configured to execute a versioning controller, the versioning controller being configured to communicate with a plurality of data plane devices of the network and store a plurality of network states in a local non-transitory memory corresponding to the server, wherein the plurality of network states stored in the local non-transitory memory include a current authoritative network state and a plurality of previous network states each corresponding to a modification of a flow within the network; and the plurality of data plane devices, configured to notify the server of flow modifications made by respective data plane devices and to receive the current authoritative network state from the server.