SDN Policy Conflict Resolution via Rule Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networking (SDN) systems face challenges in resolving policy conflicts between control policies, leading to incomplete execution of intended network access rules, where conflicting policies result in only the highest-priority policy being enforced, preventing access as intended by lower-priority policies.
Innovation Solution
The method involves decomposing control policies into rules, applying a rule synthesis principle that identifies and deletes invalid rules with no intersection between negation rules of the same type, allowing both conflicting policies to be executed by generating valid execution rules and converting them into forwarding entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the controller converts only the highest priority policy into a forwarding entry, then policy conflict resolution is simplified, but lower priority policies cannot be executed
Solution Approach 1:
The controller segments the policy execution process into multiple stages: first converting the highest priority policy into a forwarding entry, then converting lower priority policies that do not conflict with already converted policies. This segmentation allows incremental policy execution rather than all-or-nothing conversion, resolving the contradiction between simplicity and completeness.
Solution Approach 2:
The controller performs preliminary conflict detection before converting lower priority policies. By checking whether a lower priority policy conflicts with already converted higher priority policies beforehand, the controller can selectively convert only non-conflicting policies, ensuring execution completeness while maintaining operational simplicity.
2Productivity
If the controller converts all policies into forwarding entries, then policy execution completeness is improved, but system complexity increases
Solution Approach 1:
The controller performs preliminary conflict detection as a preparatory step before converting lower priority policies. This preliminary action identifies which policies can be safely converted without causing conflicts, allowing the controller to convert only necessary policies rather than all policies, thus reducing processing complexity while maintaining execution completeness.
Solution Approach 2:
The controller applies different processing quality to different policies: higher priority policies undergo full conversion, while lower priority policies undergo selective conversion based on conflict detection results. This local quality approach optimizes resource allocation and reduces overall system complexity by avoiding unnecessary conversions.
3Ease of operation
If the forwarding device forwards packets according to only one policy, then forwarding simplicity is maintained, but network access flexibility is reduced
Solution Approach 1:
The forwarding device maintains multiple forwarding entries corresponding to different priority policies rather than a single forwarding entry. Each forwarding entry handles specific traffic patterns defined by its corresponding policy, allowing the device to segment traffic handling into distinct rules that can be applied in priority order, thus maintaining simplicity while increasing flexibility.
Solution Approach 2:
The forwarding device dynamically selects which forwarding entry to apply based on packet matching and policy priority. Rather than statically applying one policy, the device adapts its forwarding behavior by evaluating packets against multiple forwarding entries and selecting the appropriate one, providing network access flexibility while keeping individual forwarding operations simple.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
This application discloses a policy conflict resolution method and apparatus. The method includes: receiving a first control policy and decomposing the first control policy into m first rules, and receiving a second control policy and decomposing the second control policy into n second rules; performing negation on each first rule to obtain a first negation rule, performing negation on each second rule to obtain a second negation rule, and generating a corresponding first execution rule by using each first negation rule and each second negation rule according to a rule synthesis principle; and deleting the invalid rule, using a remaining one of the first execution rules as a valid first execution rule, performing negation on each valid first execution rule, and converting, according to a protocol supported by the first forwarding device, each valid first execution rule on which negation has been performed into a corresponding forwarding entry of the first forwarding device. A policy conflict can be resolved in the foregoing manner.