SDN Policy Verification via Graph Reachability Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Troubleshooting and verifying the functionality and efficiency of large-scale Software Defined Networks (SDNs) is challenging due to the complexity of manual analysis and reconfiguration, especially in cloud-based networks.
Innovation Solution
A method and system that convert network topologies into graphs, using a model checker to verify reachability properties of SDN policies by determining whether ports of switches are reachable by packets, thereby improving the efficiency and scalability of policy verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual analysis and reconfiguration methods are used for SDN verification, then troubleshooting can be performed, but the process becomes difficult and time-consuming in large-scale networks
Solution Approach 1:
The patent replaces manual mechanical analysis with an automated graph-based verification system. The system converts network topology into graphs and uses automated algorithms to verify SDN policy reachability, eliminating the need for manual analysis while improving both accuracy and speed of troubleshooting
Solution Approach 2:
The patent creates a graphical representation (copy) of the network topology that simplifies the verification process. Instead of analyzing the actual complex network directly, the system works with a simplified graph model that preserves the essential connectivity information needed for policy verification
2Reliability
If full topology analysis is performed for SDN policy verification, then complete verification is achieved, but the complexity increases significantly
Solution Approach 1:
The patent segments the network verification problem into two distinct parts: (1) converting the network topology into a graph representation, and (2) performing reachability analysis on the graph. This segmentation allows each part to be handled with appropriate techniques, reducing overall system complexity while maintaining verification completeness
Solution Approach 2:
The patent introduces a graph representation as an intermediary between the actual network topology and the verification process. This intermediary simplifies the complex topology into a manageable form that can be efficiently analyzed for policy reachability without requiring direct analysis of the full network complexity
Data Source
AI summary
A method may include receiving a network schema including switches, links connecting the switches, and a topology that maps the switches to the links. The switches may include ports. The method may further include receiving a software defined networking (SDN) policy including a function that modifies a state of a packet entering a switch, converting the topology to a graph including nodes corresponding to the switches, while searching the graph, determining, according to the function, whether a port of a switch corresponding to a node is reachable by the packet entering the switch, and in response to searching the graph, verifying a property of the SDN policy.