Authors: Mark Reitblatt, Nate Foster, Jennifer Rexford, Cole Schlesinger, David Walker Presenter: Byungkwon Choi Abstractions for Network Update INA

Upgrade  Reboot Traffic Flows Networks exist in a state of flux 2 / 26 SSH: Drop * reference: author’s slides

Virtual Machines Traffic Flows Networks exist in a state of flux 3 / 26 * reference: author’s slides

1-1 Example: Distributed Access Control 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1 F2, F3 Other: SSH: Any: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1, F2 F3 Other: SSH: Any: Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1 F2, F3 Other: SSH: Any: Order I F1 F2 F3 Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Other: SSH: Any: Order F1 F2 F3 F1, F2 F3 Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Any: Order F2 F3 F1, F2 F3 Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Any: Order F2 F3 F1, F2 F3 Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Any: Order F2 F3 F1, F2 F3 Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Any: Order F2 F3 F1, F2 F3 Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 4 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic Any: Order F2 F3 F1, F2 F3 Other: SSH: Example: Distributed Access Control * Design from author’s slide

1-1 Goal 5 / 26 Security Policy Before update During update After update

1-1 Valid Transition Plan 6 / Update I to forward all trusted traffic to F3, while continuing to forward untrusted to F1. 2. Wait until in-flight packets have been processed by F2 3. Update F2 to drop SSH packets 4. Update I to forward untrusted traffic to F2 also, while continuing to forward trusted traffic to F3.

1-1 Valid Transition Plan 6 / Update I to forward all trusted traffic to F3, while continuing to forward untrusted to F1. 2. Wait until in-flight packets have been processed by F2 3. Update F2 to drop SSH packets 4. Update I to forward untrusted traffic to F2 also, while continuing to forward trusted traffic to F3. Tedious and error-prone, Sometimes step-by-step is not possible to!

1-1 Prior Works 7 / 26 Consensus Routing Reliable BGP Graceful Migration Seamless Migration * reference: author’s slides

1-1 Prior Works 7 / 26 Consensus Routing Reliable BGP Graceful Migration Seamless Migration Limited to a specific protocol/set of properties, Increasing the complexity!

1-1 Network Update Abstractions 8 / 26 Tools for whole network update ; Preventing errors during update ; Preserving many properties ; Allowing the programmer to update the entire network in one fell swoop

1-1 Per-Packet Consistent Update 9 / 26 Each packet is processed with old or new configuration, but not a mixture of the two. Packet Old configurationNew configuration Mixture of the two or

1-1 Universal Property Preservation 10 / 26 Any property of a single packet’s path through the network - Trace Property - Universal Property Preservation If a trace property such as loop-freedom or access control holds of the network configurations before and after an update, It is guaranteed that a trace property holds of every trace generated throughout the update process. Per-packet consistent updates preserve all trace properties. - Theorem Loop freedom, access control, waypointing … - Examples of Trace Properties

1-1 2-Phase Update 11 / 26 - Algorithm (1) Installing new rules on internal switches, leaving old configuration in place (2) Installing edge rules on ingress switches that stamp with the new version number SSH Any: Other: SSH: F1 SSH Ingress SwitchInternal Switch

1-1 2-Phase Update in Action 12 / 26 F1 F2 F3 I F1 F2, F3 Other: SSH: Any:

1-1 2-Phase Update in Action 12 / 26 I F1 F2, F3 Other: SSH: Any: F1 F2 F3 Other: SSH: Any: Other: SSH:

1-1 2-Phase Update in Action 12 / 26 I SSH: Other: Any: F1 F2 F3 Other: SSH: Any: Other: SSH: F1, F2 F3

1-1 2-Phase Update in Action 12 / 26 I SSH: Other: F1 F2 F3 Other: SSH: Any: Other: SSH: F1, F2 F3

1-1 Atomic Update? 13 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1 F2, F3 Other: SSH: Any: SSH

1-1 Atomic Update? 13 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1 F2, F3 Other: SSH: Any: SSH

1-1 Atomic Update? 13 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1, F2 F3 Other: SSH: Any: Other: SSH: SSH

1-1 Atomic Update? 13 / 26 Security Policy SrcTrafficAction SSHDrop Non-SSHAllow AnyAllow F1 F2 F3 I Traffic F1, F2 F3 Other: SSH: Any: Other: SSH:

1-1 Correctness 14 / 26 Question: Is 2-Phase Update Per-Packet consistent update? Answer: YES ; Implementing per-packet consistent updates can be reduced to 2 blocks. Unobservable Update + One-touch Update = Per-packet Update 2-Phase Update = Per-packet update (1) Unobservable Update: ; An update that does not change the set of traces generated by a network. ; The 1 st step of 2-Phase Update is an unobservable update. (2) One-touch Update ; An update with the property that no packet can follow a path through the network that reaches an updated part of the switch rule space more than once ; The 2 nd step of 2-Phase Update is an one-touch update.

1-1 Verification 15 / 26 Old configurationNew configuration In order to verify whether configuration sticks to security policy, Programmer can turn any trace property checker into a verification engine. Security Policy Analyzer Security Policy Analyzer Verification Tools - Anteater[SIGCOMM `11] - Header Space Analysis [NSDI `12] - ConfigChecker [ICNP `09]

1-1 Optimized Mechanisms 16 / 26 The cost of installing a new configuration should be proportional to the size of the configuration change. - Update Proportionality - Cases for Optimizations (1) Extension: strictly adding paths (2) Retraction: strictly removing paths (3) Subset: affecting small # of paths * reference: author’s slides

1-1 Subset Optimization 17 / 26 F1 F2 F3 I F1 F2, F3 Other: SSH: Any:

1-1 Subset Optimization 17 / 26 I F1 F2, F3 Other: SSH: Any: F1 F2 F3 Other: SSH:

1-1 Subset Optimization 17 / 26 I F1 F2 Other: SSH: Any: F1 F2 F3 Other: SSH: F2

1-1 Subset Optimization 17 / 26 I F1 F2 Other: SSH: Any: F1 F2 F3 Other: SSH: F2

1-1 Implementation 18 / 26 Runtime - NOX Library - OpenFlow k lines of Python - Using VLAN tags for versions * reference: author’s slides

1-1 Evaluation 19 / 26 * reference: author’s slides

1-1 Experimental Results 20 / 26 * reference: Table 2 in the paper Results comparing 2-Phase Update(2PC) with their subset optimization(Subset) - Subset was more effective than 2PC with routing application. - Fewer improvements for the multicast example

1-1 Conclusion Update abstractions –Per-packet consistent update : Only one configuration adopted to each packet : Preserving all trace properties Mechanisms –2-Phase Update –Optimizations Network update without errors and in one fell swoop using an high-level abstract operation Network update without errors and in one fell swoop using an high-level abstract operation 21 / 26

1-1 Additional Problem: Excess of Link Capacity During traffic migration –Difficulty in synchronizing the changes to the flows –Could lead to severe congestion –Cannot be solved by 2-Phase Update mechanism 22 / 26

Constant: Current Traffic Distribution Variable: Target Traffic Distribution Variable: Intermediate Traffic Distribution Constraint: Congestion-free Constraint: Update Requirements Variable: Intermediate Traffic Distribution zUpdate: Updating with Zero Loss 23 / 26 * reference: author’s slides

zUpdate: Updating with Zero Loss 24 / 26

 Conclusion Switch and flow asynchronization can cause severe congestion during datacenter network(DCN) updates. We present zUpdate for congestion-free DCN updates Novel algorithms to compute update plan Practical implementation on commodity switches Evaluations in real DCN topology and update scenarios zUpdate: Updating with Zero Loss 25 / 26 * reference: author’s slides

How to know timing to conduct the 2 nd step of 2-Phase Update? ― Nothing to check whether the installation of new rules on internal switches has been done on or not What if a traffic distribution changes during the calculation? ― Is it possible too to update with zero loss at this time? Discussion 26 / 26 * reference: author’s slides

1-1 Thank you! Q & A