Explaining SDN Failures via Axiomatisations

Abstract

This work introduces a concept of explanations with respect to the violation of safe behaviours within software defined networks (SDNs) expressible in NetKAT. The latter is a network programming language that is based on a well-studied mathematical structure, namely, Kleene Algebra with Tests (KAT). Amongst others, the mathematical foundation of NetKAT gave rise to a sound and complete equational theory. In our setting, a safe behaviour is characterised by a NetKAT policy which does not enable forwarding packets from ingress to an undesirable egress. Explanations for safety violations are derived in an equational fashion, based on a modification of the existing NetKAT axiomatisation.

Explaining Safety Failures in NetKAT

“…Namely, in the context of the HbH policy p 1 + p 2 , packets at port 1 can reach port 4, and packets at port 3 can reach port 2. This violates the correctness properties in ( 6) and (11), respectively:…”

“…In [11] we introduced a concept of safety in NetKAT which, in short, refers to the impossibility of packets to travel from a given ingress to a specified hazardous egress, in the context of the so-called "port-based hop-by-hop" switch policies allowing only tests and port modifications. Then, we proposed a notion of safety failure explanation which, intuitively, represents the set of finite paths within the network, leading to the hazardous egress.…”