Virtual Network Reachability Verification Using Boolean Policy Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing complex network policies in virtual networks is difficult due to their scale and complexity, often leading to misconfigurations that inadvertently regress safety and availability, and traditional verification tools struggle with large numbers of network policy types.
Innovation Solution
Implementing a network verifier that translates network policies into Boolean logic formulas via an intermediate representation, constructing a network graph with nodes and edges, and using a solver to determine reachability between endpoints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional verification tools are used to check network policies, then verification capability is provided, but the tools struggle with large numbers of network policy types and complex configurations
Solution Approach 1:
The patent introduces an intermediate representation (IR) as a mediator between network policies and verification tools. The IR translates complex network policies into a standardized format that verification tools can process efficiently, resolving the contradiction between maintaining verification capability and handling policy complexity.
Solution Approach 2:
The patent segments network policies into discrete rules and translates them into structured IR representations. This segmentation allows verification tools to process individual rules independently rather than dealing with the entire complex policy set at once, improving scalability.
2Measurement precision
If manual inspection of network policies is performed, then configuration errors can be detected, but the process becomes unmanageable at scale
Solution Approach 1:
The patent replaces manual mechanical inspection with automated computational verification. The system automatically translates network policies into IR and uses verification tools to check configurations, eliminating the time cost of manual inspection while maintaining or improving detection precision.
Solution Approach 2:
The patent creates an intermediate representation copy of the network policies that can be analyzed without affecting the original configurations. This copying approach enables automated verification to be performed efficiently on the IR representation rather than requiring direct manual inspection of the actual policies.
3Adaptability or versatility
If configuration changes are made to virtual networks, then network functionality can be improved, but misconfigurations may inadvertently regress safety and availability
Solution Approach 1:
The patent performs verification of configuration changes before they are deployed to the actual network. By translating proposed changes into IR and verifying them in advance, the system prevents misconfigurations from reaching production, thus maintaining reliability while allowing configurability.
Solution Approach 2:
The patent applies preliminary anti-action by verifying configurations before deployment to prevent harmful misconfigurations. The verification process identifies potential safety and availability regressions before they can affect the actual network, counteracting the risks of configuration changes.
Data Source
AI summary
Techniques of network configuration verification are disclosed herein. One example process includes, upon receiving a query to determine whether a packet from a first endpoint is reachable to a second endpoint in a virtual network, identifying a network path between the first endpoint to the second endpoint in a network graph. The network graph has nodes representing corresponding enforcement points of network policies in the virtual network and edges connecting pairs of the nodes. The example process can also include generating compound function representing conjoined individual constraints of the network policies at each of the nodes in the network graph along the identified network path, compiling the generated compound function into a Boolean formula, and solving the compiled Boolean formula to determine whether an assignment of values to packet fields of the packet exists such that all the conjoined individual constraints of the compound function can be satisfied.