State Tracking Objects for Logical Network Policy Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network control systems, users cannot verify in real-time whether created networking and security policies are being enforced on managed forwarding elements (MFEs), leading to uncertainty about policy implementation.
Innovation Solution
The system tracks version information for configuration data of logical network entities by storing state tracking objects at the central network manager and propagating them to MFEs, allowing for comparison to ensure that MFEs implement the most recent desired state configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network control system propagates configuration data to MFEs asynchronously, then the policies are eventually enforced on the data plane, but users cannot verify when or if the policies have been enforced
Solution Approach 1:
The patent implements a feedback mechanism by propagating state tracking objects along with configuration data to MFEs. These objects contain version information that MFEs report back to the controller, enabling the system to verify whether policies have been enforced. The controller can query MFEs for their state tracking objects and compare versions to confirm policy enforcement status, thus resolving the verification problem.
Solution Approach 2:
The patent creates copies of state tracking objects from the controller and propagates them to MFEs. These copied objects serve as local references that MFEs can use to track and report their configuration state. The controller maintains the authoritative version and compares it with copies reported by MFEs to verify enforcement, enabling asynchronous operation with verifiable status.
2Measurement precision
If the system tracks version information for all logical network entities, then users can verify policy enforcement status, but the system complexity increases due to storing and managing state tracking objects
Solution Approach 1:
The patent segments the tracking system by distinguishing between propagated entities (which receive separate configuration data and state tracking objects) and contributing entities (which affect configuration but are not propagated separately). This segmentation reduces the number of state tracking objects that need to be managed individually, as contributing entities are tracked through their impact on propagated entities rather than through separate tracking objects.
Solution Approach 2:
The state tracking objects serve multiple functions: they track configuration versions, enable verification of policy enforcement, and provide a mechanism for asynchronous updates. This multi-functionality reduces the need for separate tracking mechanisms, simplifying the overall system while maintaining verification capabilities.
3Reliability
If the system propagates state tracking objects to all MFEs with configuration data, then verification of configuration consistency is enabled, but the communication overhead and data propagation volume increase
Solution Approach 1:
The patent extracts only the essential version information from the full configuration state and encapsulates it in compact state tracking objects. These extracted objects contain minimal necessary data (version identifiers) that enable verification without requiring propagation of entire configuration datasets, thus reducing data volume while maintaining verification capability.
Data Source
AI summary
Some embodiments provide a method for a central network manager that stores desired state information for multiple logical network entities for a logical network. The method stores (i) a desired state configuration for a logical network entity and (ii) a first state tracking object that identifies a version of the desired state configuration for at least the logical network entity. The method propagates to a set of managed forwarding elements (i) configuration data for the logical network entity and (ii) a second state tracking object for the logical network entity that identifies a version of the propagated configuration data. The first and second state tracking objects are compared to determine whether the propagated configuration data is based on the most recent desired state configuration.