A lightweight protocol for consistent policy update on software-defined networking with multiple controllers

Abstract

Network-policy updates have to be committed in a consistent way on distributed-controller software-defined networking. Otherwise, the network may experience unexpected transitory configuration states, which compromise the performance, the security or, even, the correct operation. In this paper, we propose a scheme that provides consistent policy updates without rule conflicts and transitory states. The main contributions are: (i) a protocol that serializes policy update commitments to provide consistency; (ii) a consensus interface proposal that facilitates controller agreements about the network configuration version; and (iii) an algorithm for checking if a new policy is an update, a refinement, or if it conflicts with already installed policies. We prove that our protocol achieves a global order for all policy updates and that our algorithm correctly composes all policies. Simulation results using real network topologies show that the proposed distributed policy update scheme achieves a per-packet consistent configuration with a low control message overhead.

Introduction

Network management engages in a continuous specification of network policies that includes traffic engineering and chaining of middleboxes and network functions (Medhat et al., 2017; Han et al., 2015; Reitblatt et al., 2012). The paradigm of Software-Defined Networking (SDN) simplifies the network management as it decouples the logically centralized control plane from the distributed data plane (Levin et al., 2012; Cui et al., 2013). Control applications lie at the control plane and access a global network view, which allows defining high-level network policies that encode the expected behavior of the network (Canini et al., 2015; Akhunzada et al., 2016). Moreover, controller translates the policies into forwarding rules that configure the data plane behavior. In SDN, flow-table configurations of individual switches running on the data plane express the forwarding rules.

The network controller realization as a centralized server implies challenges to security, performance, and scalability of the network (Levin et al., 2012). On the other hand, handling policy updates on the SDN control plane is a challenge on distributed computing, in which the proper operation of the network depends on consistently reasoning about concurrent policy updates and the interaction between all applied policies on the network (Reitblatt et al., 2012; Canini et al., 2015; Brandt et al., 2016; Zhang et al., 2018).

In this paper, we propose a lightweight protocol for handling policy updates on Software-Defined Networking with a distributed control plane. The main idea is to timely achieve consensus between controllers on the deployment order of the new policies on the network. The network has to react to a policy update request in a short time lapse to be compliant with the next-generation networking requirements (I et al., 2016; Taleb et al., 2016). When concomitant policy updates arrive at different controllers, they have to agree about the installation order of all updates, and if a new update does not conflict with others. Hence, our main contributions are threefold:

• A lightweight consistency protocol that serializes commitment of concurrent policy updates launched by different controllers,

• An abstract consensus interface, in which controllers agree with the most current version of the network configuration,

• A simple algorithm for checking if a new policy is an update, a refinement, or if it conflicts with other policies already installed on the network.

In preliminary works,³ we first introduced the idea of a policy update scheme for distributed control plane, in which we assume the consistency model of per-packet consistent configuration update (Han et al., 2015; Reitblatt et al., 2012; Canini et al., 2015). In this paper, we extend the policy update scheme for resisting to Byzantine faults and, also, we show the protocol convergence overhead under different fault probabilities. A per-packet consistent update is the one that a single version of the network configuration processes every in-transit packet on the network, the previous or the updated configuration, but never more than one configuration. Unlike other proposals, which consider an abstract consensus interface among the controllers (Canini et al., 2015) or a single centralized controller (Reitblatt et al., 2012; McGeer, 2012; Katta et al., 2013), we propose a lightweight consistency protocol to achieve consensus among distributed controllers as part of the policy update scheme. We prove the correctness of our proposed consistency protocol through a formal model. Our analyses show that our proposal achieves a consistent configuration in two round-trip times (RTT), with a minimum number of control messages on the network.

The remainder of the paper is as follows. In Section 2, we present the related work. Section 3 discusses the challenges of updating policies on SDN with a distributed control plane. In Section 4, we propose our consistency protocol for policy updates on software-defined networking with distributed control. Our simulation and analytical results are discussed in Section 5. Section 6 concludes the paper.