SDN Flow Rule Verification Module for Policy Invariant Checking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networks (SDNs) face challenges in ensuring that high-level policies are properly implemented in the data plane, with potential conflicts and misconfigurations arising from multiple applications or users programming the network simultaneously, leading to violations of network invariants.
Innovation Solution
A verification module is introduced to receive flow rules from the SDN controller, match them against locally cached network invariants, and generate alarms for policy violations, while also building a cache of network invariants to enhance efficiency and prevent slowdowns, ensuring that high-level policies are correctly implemented in the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple applications or users program the network simultaneously, then network functionality and service diversity are improved, but network configuration conflicts and policy violations increase
Solution Approach 1:
The patent introduces a verification module as an intermediary between the SDN controller and the data plane. This module intercepts flow rules before they are installed, verifies them against cached network invariants, and prevents violations. The verification module acts as a mediator that allows multiple applications to program the network while ensuring policy compliance, thus resolving the contradiction between network versatility and policy reliability.
2Reliability
If all possible network invariants are cached initially, then verification completeness is improved, but system startup time and operational efficiency deteriorate
Solution Approach 1:
The patent applies preliminary action by caching essential network invariants in advance during system initialization, but not all possible invariants. The verification module starts with a core set of cached invariants and dynamically loads additional ones as needed during operation. This approach ensures verification completeness for critical policies while maintaining operational efficiency by avoiding the overhead of caching and processing all possible invariants upfront.
3Measurement precision
If a verification module checks all flow rules against all possible invariants, then policy violation detection accuracy is improved, but processing time and system performance deteriorate
Solution Approach 1:
The verification module implements partial action by checking flow rules against a selective subset of cached network invariants rather than all possible invariants. The module determines which invariants are relevant to each flow rule and only performs matching against those. This approach maintains high detection accuracy for policy violations while significantly reducing processing time by avoiding unnecessary comparisons with irrelevant invariants.
4Speed
If network invariants are cached locally, then verification speed is improved, but memory usage and cache management complexity increase
Solution Approach 1:
The patent extracts and caches only the essential network invariants locally in the verification module, separating critical verification data from the complete set of possible invariants. The module extracts relevant invariant information needed for common verification scenarios and stores it locally for fast access. This approach improves verification speed by having readily available cached data while managing cache complexity through selective extraction of only the most important invariants.
Data Source
AI summary
Example implementations relate to determining whether network invariants are violated by flow rules to be implemented by the data plane of a network. In an example, a verification module implemented on a device receives a flow rule transmitted from an SDN controller to a switch, the flow rule relating to an event. The module determines whether the flow rule matches any of a plurality of network invariants cached in the device. If determined that the flow rule matches one of the plurality of network invariants, the verification module determines whether the flow rule violates the matched network invariant. If determined that the flow rule does not match any of the plurality of network invariants, the verification module (1) reports the event associated with the flow rule to a policy management module, (2) receives a new network invariant related to the event from the policy management module, and (3) determines whether the flow rule violates the new network invariant. The verification module generates an alarm if determined that the flow rule violates any of the network invariants.