Packet Processing Rule Versioning for SDN Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software Defined Networking (SDN) systems, particularly with OpenFlow, ensuring consistency in packet processing across evolving packet processing tables is challenging due to the potential for inconsistency between old and new rules during flow modifications, which can lead to probabilistic security guarantees rather than hard guarantees.
Innovation Solution
Implementing a versioning system where each packet processing table entry has a valid version range, with a current version assigned to packets, ensuring only valid entries are matched based on their version range, and purging rules once all packets with a version number are processed, thus preventing mixtures of old and new rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If atomic flow table transactions are implemented to ensure consistency, then security guarantees are improved, but device complexity increases
Solution Approach 1:
The flow table modification process is segmented into distinct phases: adding flow entries with future version numbers, incrementing the version number to commit changes, and removing obsolete entries. This segmentation allows packets to be assigned a version number that guarantees they will only match flow entries valid for that version, providing atomicity without requiring complex transaction mechanisms in the datapath.
Solution Approach 2:
Flow entries are added to the flow table in advance with their version number set to a future value (current version + 1). This preliminary action allows the version number to be incremented and committed before packets need to match these entries, ensuring that packets see a consistent view of the flow table without requiring the datapath to implement complex atomic transaction logic.
2Reliability
If flow table modifications are performed with inconsistency window minimized, then packet processing consistency is improved, but loss of time increases
Solution Approach 1:
The system uses periodic version number increments to commit flow table modifications. Each flow entry is associated with a version number range, and the version number is incremented periodically when modifications are committed. This periodic action creates discrete consistency windows where packets are guaranteed to see a consistent set of rules, eliminating the continuous inconsistency window that would otherwise exist during flow table modifications.
Data Source
AI summary
Some embodiments provide a method for a managed forwarding element that processes packets through a set of packet processing tables by matching rules in the tables. The method receives an update that requires modification to at least one of the packet processing tables. Each rule in the packet processing tables is assigned a range of packet processing table versions in which the rule is valid for processing packets. The method modifies the packet processing tables according to the received update by at least one of (i) modifying the range of packet processing table versions in which an existing rule is valid to end after a current packet processing table version and (ii) adding a new rule with a range of valid packet processing table versions that begins with a next packet processing table version. The method increments the current version of the packet processing tables to commit the modifications.