Policy Graph Abstraction for SDN Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software-defined networking (SDN) systems require users to have knowledge of control application programming interfaces (APIs) and programming languages, making it difficult to program the network as a single system, especially for users who need to combine policies from different sources without conflicting or overlapping endpoint groups and policy boxes.
Innovation Solution
The policy graph abstraction (PGA) provides a high-level API and visual methodology using graph models and declarative languages to specify network policies, allowing users to create composite network policy graphs that can detect and resolve conflicts, and automatically compose modular sub-graphs from different users, without requiring knowledge of physical topology or endpoint addresses, using a policy graph composer that converts these graphs into control signals for the network controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users directly program network hardware using conventional SDN APIs and programming languages, then fine-grained control over network resources is achieved, but the complexity of programming and operating the network increases significantly
Solution Approach 1:
The patent introduces a visual policy specification interface as an intermediary layer between users and the underlying network hardware. This interface uses graph-based visual models to represent network policies, eliminating the need for users to directly program complex network hardware using low-level APIs. The visual interface translates high-level policy intentions into actionable network configurations, thereby reducing programming complexity while maintaining control capabilities.
Solution Approach 2:
The patent segments network policies into modular, reusable components that can be independently specified and combined. By breaking down complex network policies into smaller, manageable policy elements represented as graph nodes and edges, users can more easily understand, create, and modify individual policy components without being overwhelmed by the entire system's complexity.
2Productivity
If multiple users create policies independently without coordination, then each user can focus on their own objectives, but conflicts and overlaps between policies from different sources arise
Solution Approach 1:
The patent implements automated conflict detection mechanisms that provide feedback when policies from different users overlap or contradict. The system analyzes the graph-based policy representations to identify conflicts between endpoint groups, policy boxes, or policy rules, and notifies relevant users for resolution. This feedback loop maintains policy consistency while allowing independent policy creation.
Solution Approach 2:
The patent performs preliminary analysis and validation of policies during the specification phase, before deployment to the network. The system checks for potential conflicts and overlaps between policies from different sources in advance, allowing users to resolve issues before they affect network operation. This preliminary action prevents policy inconsistencies from reaching the network hardware.
3Measurement precision
If users need to understand physical topology and endpoint addresses to create network policies, then precise network control is achieved, but the barrier to entry and operational difficulty increase
Solution Approach 1:
The patent uses abstract graph-based representations that copy and represent network entities and their relationships without requiring users to directly manipulate physical topology details or endpoint addresses. The visual model creates simplified copies of network structures, allowing users to work with logical representations rather than physical details, thereby reducing the expertise barrier while maintaining policy precision.
4Adaptability or versatility
If conventional SDN systems require knowledge of control APIs and programming languages, then flexible network programming is achieved, but accessibility to non-expert users is reduced
Solution Approach 1:
The patent replaces the mechanical system of text-based programming and API calls with a visual, graph-based interaction model. Instead of requiring users to write code and invoke API commands, the system uses visual drag-and-drop or click-based interfaces to specify policies. This substitution maintains the flexibility and power of programmable networks while making them accessible to users without programming expertise.
Data Source
AI summary
Example implementations disclosed herein can be used to generate composite network policy graphs based on multiple network policy graphs input by network users that may have different goals for the network. The resulting composite network policy graph can be used to program a network so that it meets the requirements necessary to achieve the goals of at least some of the network users. In one example implementation, a method can include receiving multiple network policy graphs, generating composite endpoint groups based on relationships between endpoint groups and policy graph sources, generating composite paths based on the relationships between the endpoints and the network policy graphs, generating a composite network policy graph based on the composite endpoint groups and the composite paths, and analyzing the composite network policy graph to determine conflicts or errors.