Safe, Efficient, and Robust SDN Updates by Combining Rule Replacements and Additions

Abstract

Disruption-free updates are a key primitive to effectively operate SDN networks and maximize the benefits of their programmability. In this paper, we study how to implement this primitive safely (with respect to forwarding correctness and policies), efficiently (in terms of consumed network resources) and robustly to unpredictable factors like delayed message delivery and processing. First, we analyze the fundamental limitations of prior proposals, which either (i) progressively replace initial flow rules with new ones, or (ii) instruct switches to maintain both initial and final rules. Second, we show that safe, efficient and robust updates can be achieved by leveraging a more general approach. We indeed unveil a dualism between rule replacements and additions, that opens new degrees of freedom for supporting SDN updates. Third, we demonstrate how to build upon this dualism. We propose FLIP, an algorithm that computes operational sequences combining the efficiency of rule replacements with the applicability of rule additions. FLIP identifies constraints on rule replacements and additions that independently prevent safety violations from occurring during the update. Then, it explores the solution space by swapping constraints that prevent the same safety violations, until it reaches a satisfiable set of constraints. Fourth, we perform extensive simulations, showing that FLIP can significantly outperform prior work: In the average case, it guarantees a much higher success rate than algorithms only based on rule replacements, and massively reduces the memory overhead needed by techniques solely using rule additions.

Fast Network Configuration in Software Defined Networking

“…In SDN, deploying a new configuration requires updating the corresponding rules in the flow tables of the switches. As observed in [9], the update time of a flow table tends to grow with the number of updated rules, as updates on a given switch must be performed sequentially to ensure consistency [4], [5], [6]. This observation implies that given a set F i of rules to be updated at switch i, the total update time at i, denoted by τ i , satisfies…”

“…It is widely recognized that flow configuration, i.e., the configuration of flow forwarding rules at the SDN switches, is critical for SDN operation. Configuration updates due to changed flows must be performed consistently and quickly to avoid congestion [1], [2], [3], delays [4], loops and policy violations [3], [5], [6]. In particular, the need to reestablish disrupted flows caused by failing links as the result of a failure, congestion or attack on the network infrastructure, motivates the requirement to perform fast network reconfiguration.…”

“…Previous works such as [4], [7], [8], [9] report different per-rule update times ranging from 10ms up to 400ms depending on different models. The deployment time of network-wide flow rules on a data-center sized topology is not negligible since rule updates in a single switch must be performed sequentially to ensure consistency of rules [4], [5], [6], while multiple switches can be updated in parallel [5], [6].…”

“…RELATED WORK The procedure of deploying flow rules on SDN switches has been discussed abundantly in the literature. The works in [2], [5], [6], [9], [12] focus on policy-preserving update procedures with different techniques.…”

“…The work of Vissicchio et al [5], [6] aims at finding a schedule of updates that prevents inconsistencies and policy violations. Their algorithm works very well for a single flow update, but makes the assumption that each flow is independent of other flows.…”