Good Network Updates for Bad Packets

Abstract

Networks are critical for the security of many computer systems. However, their complex and asynchronous nature often renders it difficult to formally reason about network behavior. Accordingly, it is challenging to provide correctness guarantees, especially during network updates.This paper studies how to update networks while maintaining a most basic safety property, Waypoint Enforcement (WPE): each packet is required to traverse a certain checkpoint (for instance, a firewall). Waypoint enforcement is particularly relevant in today's increasingly virtualized and software-defined networks, where new in-network functionality is introduced flexibly.We show that WPE can easily be violated during network updates, even though both the old and the new policy ensure WPE. We then present an algorithm WayUp that guarantees WPE at any time, while completing updates quickly. We also find that in contrast to other transient consistency properties, WPE cannot always be implemented in a waitfree manner, and that WPE may even conflict with LoopFreedom (LF). Finally, we present an optimal policy update algorithm OptRounds, which requires a minimum number of communication rounds while ensuring both WPE and LF, whenever this is possible.

Feasibility Analysis of the Algorithms: Secured and Efficient Routing Path Update in Software Defined Networking (SDN)

“…It also updates the existing switches in reverse flows while new route arrives from source to the waypoint node. This algorithm was proposed by Ludwig [7].…”

“…One approach to ensure transient consis-tency even in asynchronous environments is to employ smart scheduling algorithms. WAYUP [7] and PEACOCK [8] are two update scheduling algorithms to ensure reliable network updates. WAYUP [7] is based on security purpose whereas PEACOCK [8] is implemented to ensure loop-free networks in SDN.…”

Towards Transiently Secure Updates in Asynchronous SDNs

“…We have implemented the Wayup [5] and Peacock [4] algorithms 1 successfully in Mininet based on a Pythonbased Ryu SDN controller. and have been running our evaluations with respect to the update time of flow tables in OpenFlow switches (OVS) 2 .…”

“…Based on the update scheduling algorithms Wayup and Peacock presented in [5] and [4] respectively, we divide the policy updates from SDN controller to Open-Flow soft switches into rounds. Each round culminates in the SDN controller sending the barrier requests to each OpenFlow switch receiving updates in that round and receiving barrier replies for acknowledgement.…”

“…Once done with receiving all barrier replies, the SDN controller initiates the next round of policy update. Therefore, synchronicity and consistency is ensured avoiding out of order updates and ensuring waypoint enforcement [5], weak loop freedom [4]. More work on multiple policies can be found on [1] [3].…”