《2016 - Real Time Network Policy Checking using Header Space Analysis》.pdf

Real Time Network Policy Checking using Header Space Analysis †∗ † † Peyman Kazemian , Michael Chang , Hongyi Zeng , George Varghese‡ † § , Nick McKeown , Scott Whyte †Stanford University, ‡ UC San Diego Microsoft Research, §Google Inc. † {kazemian, mchang91, hyzeng, nickm}@, ‡varghese@, §swhyte@ Abstract Recently, there has been growing interest in automat- ing network control using software-defined networks Network state may change rapidly in response to (SDNs). SDN separates the control plane from the for- customer demands, load conditions or configuration warding plane; a well-defined interface such as Open- changes. But the network must also ensure correctness Flow [11] lets the control plane write match, action conditions such as isolating tenants from each other and rules to switches. The controller controls the forward- from critical services. Existing policy checkers cannot ing state because it decides which rules to write to the verify compliance in real time because of the need to col- switches; and it observes the forwarding state because it lect “state” from the entire network and the time it takes was the sole creator. SDNs therefore present an oppor- to analyze this state. SDNs provide an opportunity in this tunity to automate the verification of correct forwarding respect as they provide a logically centralized view from behavior. This is the premise of