From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example:...

109
From Self-Verifying to Self-Adjusting Networks Stefan Schmid (University of Vienna, Austria)

Transcript of From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example:...

Page 1: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

From Self-Verifying to Self-Adjusting Networks

Stefan Schmid (University of Vienna, Austria)

Page 2: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

From Self-Verifying to Self-Adjusting Networks

Stefan Schmid et al., most importantly Jiri Srba (Aalborg University, Denmark) and Chen Avin (BGU, Israel)

Page 3: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Spectrum of Networking Research at Uni Vienna

Algorithms (e.g. virtual network embedding, e.g.,

SDN network updates)

Security (e.g., of virtual switches)

Machine learning (exploring…)

Formal method(hot now, e.g., WNetKAT)

Looking for PhD students, Summer interns, project partners, …

Page 4: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

E.g., Security Analysis of OVS ACM SOSR 2018 Best Paper

Page 5: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Virtual Switches are Complex, e.g.: (Unified) Packet Parsing

User

Kernel

VM VM VM

NIC

Virtual Switch

Ethernet

LLC

VLAN

MPLS

IPv4

ICMPv4

TCP

UDP

ARP

SCTP

IPv6

ICMPv6

IPv6 ND

GRE

LISP

VXLAN

PBB

IPv6 EXT HDR

TUNNEL-ID

IPv6 ND

IPv6 EXT HDR

IPv6HOPOPTS

IPv6ROUTING

IPv6Fragment

IPv6DESTOPT

IPv6ESP

IPv6 AH

RARP

IGMP

L2,L2.5,L3,L4

3

Page 6: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Virtual Switches are Complex, e.g.: (Unified) Packet Parsing

User

Kernel

VM VM VM

NIC

Virtual Switch

Ethernet

LLC

VLAN

MPLS

IPv4

ICMPv4

TCP

UDP

ARP

SCTP

IPv6

ICMPv6

IPv6 ND

GRE

LISP

VXLAN

PBB

IPv6 EXT HDR

TUNNEL-ID

IPv6 ND

IPv6 EXT HDR

IPv6HOPOPTS

IPv6ROUTING

IPv6Fragment

IPv6DESTOPT

IPv6ESP

IPv6 AH

RARP

IGMP

L2,L2.5,L3,L4

3

Page 7: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Compromising the Cloud

User

Kernel

Ctrl

Virtual Switch

User

Kernel

VM VM VM

Virtual SwitchUser

Kernel

VM VM VM

Virtual Switch

User

Kernel

VM VM VM

Virtual Switch

4

Page 8: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Compromising the Cloud

User

Kernel

Ctrl

Virtual Switch

User

Kernel

VM VM VM

Virtual SwitchUser

Kernel

VM VM VM

Virtual Switch

User

Kernel

VM VM VM

Virtual Switch

High priviledges

Attacker facing, complex parser

Logically centralized control

Collocated applications 4

Page 9: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

User

Kernel

Ctrl

Virtual Switch

User

Kernel

VM VM VM

Virtual SwitchUser

Kernel

VM VM VM

Virtual Switch

User

Kernel

VM VM VM

Virtual Switch

1

2

3

3

Compromising the Cloud

4

Page 10: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

E.g., Consistent Flow Rerouting for SDNPODC 2015, SIGMETRICS 2016, ICALP 2018

Page 11: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

w

s t

u v

Consistent Network Updates

6

Page 12: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Flow 1

w

s t

u v

Consistent Network Updates

6

Page 13: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Flow 1

Flow 2Can you find an update schedule?

w

s t

u v

Consistent Network Updates

6

Page 14: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Flow 1

Flow 2Can you find an update schedule?

w

s t

u v

e.g., cannot update red: congestion! Need toupdate blue first!

Consistent Network Updates

6

Page 15: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Schedule:1. red@w,blue@u,blue@v

w

s t

u v

1 1

1

Round 1: prepare

No flow! No flow!

No flow!

Consistent Network Updates

6

Page 16: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Schedule:1. red@w,blue@u,blue@v

w

s t

u v

1 1

1

2. blue@s

2

Round 2

flow! No flow!

No flow!

Consistent Network Updates

6

Page 17: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Schedule:1. red@w,blue@u,blue@v

w

s t

u v

1 1

1

2. blue@s

2

3. red@sRound 3

Capacity 2: ok!

3

No flow!

Consistent Network Updates

6

Page 18: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Schedule:1. red@w,blue@u,blue@v

w

s t

u v

1 1

1

2. blue@s

2

3. red@sRound 4

Capacity 2: ok!

3

4

4. blue@w

Consistent Network Updates

6

Page 19: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Schedule:1. red@w,blue@u,blue@v

w

s t

u v

1 1

1

2. blue@s

2

3. red@sRound 4

3

4

4. blue@w

Note: this (non-trivial) example was just a DAG,

without loops!

Consistent Network Updates

6

Page 20: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Flow 1

Flow 2

Block for a given flow: subgraph between two

consecutive nodes whereold and new route meet. w

s t

u v

Block Decomposition andDependency Graph

7

Page 21: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Block for a given flow: subgraph between two

consecutive nodes whereold and new route meet. w

s t

u v

Just one red block: r1

r1

Block Decomposition andDependency Graph

7

Page 22: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Block for a given flow: subgraph between two

consecutive nodes whereold and new route meet. w

s t

u v

Two blue blocks: b1 and b2

b1 b2

Block Decomposition andDependency Graph

7

Page 23: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

1

2

2

1 1

1

1

Block for a given flow: subgraph between two

consecutive nodes whereold and new route meet. w

s t

u v

Dependencies: update b2 after r1 after b1.

b1 b2r1

Block Decomposition andDependency Graph

7

Page 24: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

E.g., following up on HUJI…DSN 2017, CCR 2018

Page 25: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Local Fast Rerouting

• Failover without invoking controlplane

• Perfect resiliency: Schapira et al. (INFOCOM, ICALP, etc.)

• But what about load? Related tosymmetric block design theory(BIBDs) and distributed computing without communication!– Order in which to choose arborescences

Ctrl

9

Page 26: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Roadmap

• Networks are increasingly complex: a case for formal methods?

• Networks are increasingly flexible: a case for self-adjusting networks?

000

Page 27: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Managing Complex Networks is Hard for Humans

Page 28: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Human Errors

We discovered a misconfiguration on this pair of switches that caused what's called a“bridge loop” in the network.

A network change was […] executed incorrectly […] more “stuck” volumes and added more requests to the re-mirroring storm.

Service outage was due to a series of internal network events that corrupted router data tables.

Experienced a network connectivity issue […] interrupted the airline's flight departures, airport processing and reservations systems

Credits: Nate Foster

Datacenter, enterprise, carrier networks: mission-critical infrastructures.But even techsavvy companies struggle to provide reliable operations.

Page 29: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

G1 G2

C

A

D

B

X Y

P1 P2

G

E

H

F

Internet

Dat

ace

nte

r

Example: Keeping Track of (Flexible) Routes Under Failures

Example: BGP in Datacenter

Credits: Beckett et al. (SIGCOMM 2016): Bridging Network-wide Objectives and Device-level Configurations. 13

Page 30: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Dat

ace

nte

r

Internet

Credits: Beckett et al. (SIGCOMM 2016): Bridging Network-wide Objectives and Device-level Configurations.

G1 G2

C

A

D

B

X Y

P1 P2

G

E

H

F

Cluster with services that should be globally reachable.

Cluster with services that shouldbe accessible only internally.

Example: Keeping Track of (Flexible) Routes Under Failures

Example: BGP in Datacenter

13

Page 31: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Example: Keeping Track of (Flexible) Routes Under Failures

Example: BGP in Datacenter

Dat

ace

nte

r

InternetX and Y announce to Internet what is from

G* (prefix).

X and Y block what is from P*.

Credits: Beckett et al. (SIGCOMM 2016): Bridging Network-wide Objectives and Device-level Configurations.

G1 G2

C

A

D

B

X Y

P1 P2

G

E

H

F

13

Page 32: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Example: Keeping Track of (Flexible) Routes Under Failures

Example: BGP in Datacenter

Dat

ace

nte

r

InternetX and Y announce to Internet what is from

G* (prefix).

X and Y block what is from P*.

Credits: Beckett et al. (SIGCOMM 2016): Bridging Network-wide Objectives and Device-level Configurations.

G1 G2

C

A

D

B

X Y

P1 P2

G

E

H

F

What can go wrong?

13

Page 33: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Example: Keeping Track of (Flexible) Routes Under Failures

Example: BGP in Datacenter

Dat

ace

nte

r

InternetX and Y announce to Internet what is from

G* (prefix).

X and Y block what is from P*.

Credits: Beckett et al. (SIGCOMM 2016): Bridging Network-wide Objectives and Device-level Configurations.

G1 G2

C

A

D

B

X Y

P1 P2

G

E

H

F

If link (G,X) fails and traffic from G is rerouted via Y and C to X: X announces (does not block) G and H

as it comes from C. (Note: BGP.)

13

Page 34: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

The Case for Automation!Role of Formal Methods?

Managing Complex Networks is Hard for Humans

Page 35: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Example: MPLS Networks

Default routing oftwo flows

• MPLS: forwarding based on top label of label stack

v1 v2 v3 v4

v5 v6 v7 v8

15

Page 36: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Default routing oftwo flows

• MPLS: forwarding based on top label of label stack

v1 v2 v3 v4

v5 v6 v7 v8

flow 1

flow 2

Example: MPLS Networks

15

Page 37: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

22

1020

1121

Default routing oftwo flows

• MPLS: forwarding based on top label of label stackpush swap swap pop

pop

Example: MPLS Networks

15

Page 38: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

2230|1130|21

1121

One failure: push 30: route around (v2,v3)

Fast Reroute Around 1 Failure

Default routing oftwo flows

• MPLS: forwarding based on top label of label stack

• For failover: push and pop label

12

22

1020

1121

31|1131|21

1020

16

Page 39: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

2230|1130|21

1121

One failure: push 30: route around (v2,v3)

Fast Reroute Around 1 Failure

Default routing oftwo flows

• MPLS: forwarding based on top label of label stack

12

22

1020

1121

Pop

Normal swap

• For failover: push and pop label

If (v2,v3) failed, push 30 and

forward to v6.

31|1131|21 16

Page 40: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

2230|1130|21

1121

One failure: push 30: route around (v2,v3)

Fast Reroute Around 1 Failure

Default routing oftwo flows

• MPLS: forwarding based on top label of label stack

12

22

1020

1121

Pop

Normal swap

• For failover: push and pop label

If (v2,v3) failed, push 30 and

forward to v6.

31|1131|21

What about multiple link failures?

16

Page 41: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

2 Failures: Push Recursively

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

22

1020

1121 12

22

1020

1121 12

22

30|1130|21

1121

31|1131|21

40|30|1140|30|21

30|1130|21

1121

31|1131|21

Original Routing

One failure: push 30: route around (v2,v3)

Two failures: first push 30: route

around (v2,v3)

Push recursively 40: route around (v2,v6)

Push 30

Push 40

1020

1121

pop pop 17

Page 42: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

22

1020

1121 12

22

1020

1121 12

22

30|1130|21

1121

31|1131|21

40|30|1140|30|21

30|1130|21

1121

31|1131|21

Original Routing

One failure: push 30: route around (v2,v3)

1020

1121

2 Failures: Push Recursively

Two failures: first push 30: route

around (v2,v3)

Push recursively 40: route around (v2,v6)

But masking links one-by-one can be inefficient:

(v7,v3,v8) could be shortcut to (v7,v8).

17

Page 43: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

v1 v2 v3 v4

v5 v6 v7 v8

in1

in2

out1

out2

12

22

1020

1121 12

22

1020

1121 12

22

30|1130|21

1121

31|1131|21

40|30|1140|30|21

30|1130|21

1121

31|1131|21

Original Routing

One failure: push 30: route around (v2,v3)

1020

1121

2 Failures: Push Recursively

Two failures: first push 30: route

around (v2,v3)

Push recursively 40: route around (v2,v6)

But masking links one-by-one can be inefficient:

(v7,v3,v8) could be shortcut to (v7,v8).

More efficient but also more complex:Cisco does not recommend using this option!

Also note: due to push, header size may grow arbitrarily!

17

Page 44: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Failover Tables

Flow Table

Protected link Alternative

linkLabel

Forwarding Tables for Our Example

Version which does not mask links individually!

18

Page 45: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

MPLS Tunnels in Today‘s ISP Networks

19

Page 46: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Non-reachability: Is it ensured thattraffic originating from A neverreaches B?

• Waypoint ensurance: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., a firewall)?

A

B

C

Routers and switches storelist of forwarding rules, and

conditional failover rules.

20

Page 47: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Non-reachability: Is it ensured thattraffic originating from A neverreaches B?

• Waypoint ensurance: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., a firewall)?

Reachability?

A

B

C

20

Page 48: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Non-reachability: Is it ensured thattraffic originating from A neverreaches B?

• Waypoint ensurance: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., a firewall)?

A

B

C

No loops?

20

Page 49: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Policy: Is it ensured that traffic from A to B never goes via C?

• Waypoint ensurance: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., a firewall)?

A

B

C

Policy ok?

E.g. NORDUnet: no traffic via Iceland (expensive!).

20

Page 50: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Policy: Is it ensured that traffic from A to B never goes via C?

• Waypoint enforcement: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., intrusiondetection system or a firewall)?

A

B

C

Waypoint?

E.g. IDS

20

Page 51: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Responsibilities of a Sysadmin

Sysadmin responsible for:

• Reachability: Can traffic from ingressport A reach egress port B?

• Loop-freedom: Are the routes impliedby the forwarding rules loop-free?

• Policy: Is it ensured that traffic from A to B never goes via C?

• Waypoint enforcement: Is it ensuredthat traffic from A to B is alwaysrouted via a node C (e.g., intrusiondetection system or a firewall)?

A

B

C

E.g. IDS

… and everything even under multiple failures?!

k failures =

(𝑛𝑘) possibilities

20

Page 52: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

So what formal methods offer here?

A lot!INFOCOM 2018

Page 53: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

MPLS configurations, Segment Routing etc.

Pushdown Automatonand Prefix Rewriting

Systems Theory

Compilation

Interpretation

pX ⇒ qXXpX ⇒ qYXqY ⇒ rYY

rY ⇒ rrX ⇒ pX

What if...?!

Leveraging Automata-Theoretic Approach

22

Page 54: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Leveraging Automata-Theoretic Approach

MPLS configurations, Segment Routing etc.

Pushdown Automatonand Prefix Rewriting

Systems Theory

Compilation

Interpretation

pX ⇒ qXXpX ⇒ qYXqY ⇒ rYY

rY ⇒ rrX ⇒ pX

What if...?!

Use cases: Sysadmin issues queries to test certain properties, or do it on a regular basis automatically!

22

Page 55: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

• Network: a 7-tuple

Mini-Tutorial: A Network Model

Nodes

Links

Incoming interfaces

Outgoing interfaces

Set of labels in packet header

23

Page 56: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Interface function: maps outgoing interface to next hopnode and incoming interface to previous hop node

That is: and

Interface function

• Network: a 7-tuple

Mini-Tutorial: A Network Model

23

Page 57: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

• Network: a 7-tuple

Routing function: for each set of failed links , therouting function

defines, for all incoming interfaces and packet headers, outgoing interfaces together with modified headers.

Routing function

Mini-Tutorial: A Network Model

23

Page 58: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

out2out1

Packet routing sequence can be represented using sequence of tuples:

Routing in Network

• Example: routing (in)finite sequence of tuples

Node receives…

… on interface…

… packet withheader…

… forwards it tolive next hop…

… with new header..

… given that these links are down.

v1

h1

v2

h2 h3

in1 in2

24

Page 59: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Pop:

Push:

Swap:

Example Rules: Regular Forwarding on Top-Most Label

Push label on stack

Swap top of stack

Pop top of stack

25

Page 60: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Failover-Push:

Example Failover Rules

Emumerate all rerouting options

Failover-Swap:

Failover-Pop:

Example rewriting sequence:

Try default Try first backup Try second backup

Page 61: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

A Complex and Big Formal Language! Why Polynomial Time?!

• Arbitrary number k of failures: How can I avoidchecking all (𝑛

𝑘)many options?!

• Even if we reduce to push-down automaton: simple operations such as emptiness testing orintersection on Push-Down Automata (PDA) iscomputationally non-trivial and sometimes evenundecidable!

k failures =

(𝑛𝑘) possibilities

27

Page 62: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

This is not how we will use the PDA!

• Arbitrary number k of failures: How can I avoidchecking all (𝑛

𝑘)many options?!

• Even if we reduce to push-down automaton: simple operations such as emptiness testing orintersection on Push-Down Automata (PDA) iscomputationally non-trivial and sometimes evenundecidable!

k failures =

(𝑛𝑘) possibilities

A Complex and Big Formal Language! Why Polynomial Time?!

27

Page 63: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

This is not how we will use the PDA!

• Arbitrary number k of failures: How can I avoidchecking all (𝑛

𝑘)many options?!

• Even if we reduce to push-down automaton: simple operations such as emptiness testing orintersection on Push-Down Automata (PDA) iscomputationally non-trivial and sometimes evenundecidable!

The words in our language are sequences of pushdown stack symbols, not the labels of transitions.

k failures =

(𝑛𝑘) possibilities

A Complex and Big Formal Language! Why Polynomial Time?!

27

Page 64: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Time for Automata Theory!

Julius Richard Büchi

1924-1984

Swiss logician

• Classic result by Büchi 1964: the set of all reachableconfigurations of a pushdown automaton a is regular set

• Hence, we can operate only on Nondeterministic Finite Automata (NFAs) when reasoning about the pushdown automata

• The resulting regular operations are all polynomial time

• Important result of model checking

28

Page 65: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Preliminary Tool and Query Language

Part 1: Parses queryand constructs Push-Down System (PDS)

• In Python 3

query processing flow

Part 2: Reachability analysis of constructed PDS

• Using Moped tool

29

Page 66: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

YES!(Gives witness!)

2 failures

Example: Traversal Testing With 2 Failures

Traversal test with k=2: Can traffic starting with [] go through s5, under up to k=2 failures?

push

push

stacksize!

pop

pop

Query: k=2 [] s1 >> s5 >> s7 []

30

Page 67: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

But What About Other Networks?!

Rules of general networks (e.g., SDN):

arbitrary header rewriting vsin x L* → out x L*

The clue: exploit the specific structure of MPLS rules.

(Simplified) MPLS rules:

prefix rewriting

in x L → out x OP

in out

h h’

where OP = {swap,push,pop}

Rules match the header h of packets arriving at in,

and define to which port out to forward as well as new header h’.

Page 68: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Roadmap

• Networks are increasingly complex: a case for formal methods?

• Networks are increasingly flexible: a case for self-adjusting networks?

000

Page 69: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Routing and TE:MPLS, SDN, etc. Flexible placement Flexible migration Topology reconfiguration

The new frontier!

Flexibility of communication networks

33

Page 70: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Routing and TE:MPLS, SDN, etc. Flexible placement Flexible migration Topology reconfiguration

t=1

Flexibility of communication networks 34

Page 71: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Routing and TE:MPLS, SDN, etc. Flexible placement Flexible migration Topology reconfiguration

t=2

Flexibility of communication networks 34

Page 72: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Routing and TE:MPLS, SDN, etc. Flexible placement Flexible migration Topology reconfiguration

t=2

Less resources and latency

Flexibility of communication networks 34

Page 73: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Routing and TE:MPLS, SDN, etc. Flexible placement Flexible migration Topology reconfiguration

t=2

Less resources and latency

Flexibility of communication networks 34

Page 74: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

What do self-adjusting networks offer?

Toward entropy-proportional routingDISC 2017 (+ a BA), ANCS 2018, arXiv 2018

Page 75: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

A Brief History of Self-Adjusting Networks

Demand-Oblivious

Fixed

Demand-Aware

Fixed Reconfigurable

Focus on datacenters but more general…

36

Page 76: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Traditional Networks• Lower bounds and hard trade-offs,

e.g., degree vs diameter

• Usually optimized for the “worst-case” (all-to-all communication)

• Example, fat-tree topologies: provide full bisection bandwidth

Page 77: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Traditional Networks• Lower bounds and hard trade-offs,

e.g., degree vs diameter

• Usually optimized for the “worst-case” (all-to-all communication)

• Example, fat-tree topologies: provide full bisection bandwidth

Vision: DANs and SANs• DAN: Demand-Aware Network

– Statically optimized toward the demand

• SAN: Self-Adjusting Network

– Dynamically optimized toward the (time-varying) demand

TOR switches

Mirrors

Lasers

Page 78: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Empirical Motivation

Heatmap of rack-to-rack trafficProjecToR @ SIGCOMM 2016

• Real traffic pattners are far fromrandom: sparse structure

• Little to no communicationbetween certain nodes

A case for DANs!

• But also changes over time

A case for SANs!

Structure!

38

Page 79: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Empirical Motivation

Heatmap of rack-to-rack trafficProjecToR @ SIGCOMM 2016

• Real traffic pattners are far fromrandom: sparse structure

• Little to no communicationbetween certain nodes

A case for DANs!

• But also changes over time

A case for SANs!

Structure!

38

Page 80: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Analogous to Datastructures: Oblivious…

Demand-Oblivious

Fixed

• Traditional, fixed BSTs do not rely on anyassumptions on the demand

• Optimize for the worst-case

• Example demand:

1,…,1,3,…,3,5,…,5,7,…,7,…,log(n),…,log(n)

• Items stored at O(log n) from the root, uniformly and independently of theirfrequency

many many many many

Many requests for leaf 1…

… then for leaf 3…

many

39

Page 81: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand-Oblivious

Fixed

many many many many

Many requests for leaf 1…

… then for leaf 3…

• Traditional, fixed BSTs do not rely on anyassumptions on the demand

• Optimize for the worst-case

• Example demand:

1,…,1,3,…,3,5,…,5,7,…,7,…,log(n),…,log(n)

• Items stored at O(log n) from the root, uniformly and independently of theirfrequency

many

Amortized cost corresponds to max entropy of demand!

Analogous to Datastructures: Oblivious…

39

Page 82: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand-Aware

Fixed Reconfigurable

• Demand-aware fixed BSTs can takeadvantage of spatial locality of thedemand

• Optimize: place frequently accessedelements close to the root– Recall example demand:

1,…,1,3,…,3,5,…,5,7,…,7,…,log(n),…,log(n)

• E.g., Mehlhorn trees

• Amortized cost O(loglog n)

Amortized cost corresponds to empirical entropy of demand!

loglog n

… Demand-Aware …

40

Page 83: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand-Aware

Fixed Reconfigurable

• Demand-aware reconfigurable BSTs can additionally take advantage oftemporal locality

• By moving accessed element to theroot: amortized cost is constant, i.e., O(1)– Recall example demand:

1,…,1,3,…,3,5,…,5,7,…,7,…,log(n),…,log(n)

• Self-adjusting BSTs e.g., useful for implementing caches or garbagecollection

… Self-Adjusting!

41

Page 84: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Datastructures

Oblivious Demand-Aware Self-Adjusting

Lookup O(log n) Exploit spatial locality: empirical entropy O(loglog n)

Exploit temporal locality as well:

O(1)

42

Page 85: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Analogously for Networks

Oblivious DAN SAN

Const degree

(e.g., expander):

route lengths O(log n)

Exploit spatial locality: Route lengths depend on

conditional entropy of demand

Exploit temporal locality as well

43

Page 86: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Oblivious Networks…

Demand-Oblivious

Fixed

• Traditional, fixed networks (e.g. expander)

• Optimize for the worst-case

• Constant degree: communication partnersat distance O(log n) from each other, uniformly and independently of theircommunication frequency

• Example

demands:

44

Page 87: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Oblivious Networks…

• Traditional, fixed networks (e.g. expander)

• Optimize for the worst-case

• Constant degree: communication partnersat distance O(log n) from each other, uniformly and independently of theircommunication frequency

• Example

demands:

Conditional entropy constant:DANs would be much better!

Demand-Oblivious

Fixed

44

Page 88: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

… DANs …

• Demand-aware fixed networks cantake advantage of spatial locality

• Optimize: place frequentlycommunicating nodes close

• O(1) routes for our demands:

Demand-Aware

Fixed Reconfigurable

45

Page 89: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand-Aware

Fixed Reconfigurable• Demand-aware reconfigurable networks can additionally takeadvantage of temporal locality

• By moving communicatingelements close

… SANs!

Page 90: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand matrix: joint distribution

Sources

Destinations

DAN (of constant degree)

design

Diving a Bit Deeper: DANWorkload: can be seen

as graph as well.

46

Page 91: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand matrix: joint distribution

Sources

Destinations

DAN (of constant degree)

design

Much from 4 to 5.

Makes sense to add link!

Diving a Bit Deeper: DAN

46

Page 92: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand matrix: joint distribution

Sources

Destinations

DAN (of constant degree)

design

1 communicates to many.

Bounded degree: route to 7 indirectly.

Diving a Bit Deeper: DAN

46

Page 93: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

DAN: Relationship to…

Sparse, low-distortion graph spanners – Similar: keep distances in a „compressed

network“ (few edges)

– But: • We only care about path length between

communicating nodes, not all node pairs

• We want constant degree

• Not restricted to subgraph but can have„additional links“ (like geometric spanners)

extra link

degree

don‘t care about 4-6

Page 94: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

DAN: Relationship to…

Minimum Linear Arrangement (MLA)– MLA: map guest graph to line (host graph) so

that sum of distances is minimal

– DAN similar: if degree bound = 2, DAN is line orring (or sets of lines/rings)

– But unlike “graph embedding problems“• The host graph is also subject to optimization

• Does this render the problem simpler or harder?

2

31

4

5

Page 95: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand matrix: joint distribution

Sources

Destinations

DAN (of constant degree)

design

4 and 6 don’t communicate…

… but “extra” link stillmakes sense: not a

subgraph.

Diving a Bit Deeper: DAN

46

Page 96: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Lower Bound: Idea• Proof idea (EPL=Ω(HΔ(Y|X))):

• Build optimal Δ-ary tree for each source i: entropy lower bound known on EPL known for binary trees (Mehlhorn 1975 for BST but proof does not need search property)

• Consider union of all trees

• Violates degree restriction but valid lower bound

48

Page 97: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Do this in both dimensions:

Ω(HΔ(X|Y))

D

EPL ≥ Ω(max{HΔ(Y|X), HΔ(X|Y)})

Ω(HΔ(Y|X))

Lower Bound: Idea

49

Page 98: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

(Tight) Upper Bounds: Algorithm Idea

v

uw

h

u v w

high-high• Idea: construct per-node optimal tree– BST (e.g., Mehlhorn)

– Huffman tree

– Splay tree (!)

• Take union of trees but reduce degree– E.g., in sparse distribution:

leverage helper nodes between two “large” (i.e., high-degree) nodes

50

Page 99: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Example: Self-Adjusting Network (SANs) Trees

t=1 t=2

1 4

2

5

7

4

7

5

2

1

adjust

Challenges: How to minimize reconfigurations?How to keep network locally routable?

New connection!

000SplayNet: Towards Locally Self-Adjusting Networks. TON 2016.

Page 100: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SAN Idea 1: SplayNet• Idea: Binary Search Tree (BST) network

• Supports local routing

– Left child, right child, upward?

• Search preserving reconfigurations like splay trees: zig, zigzag, zigzag

• But splay only to Least Common Ancestor (LCA)

19

415

22

181 7

312

8

10

LCA

SplayNet

Page 101: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SAN Idea 1: SplayNet

SplayNetConcurrent Self-Adjusting Distributed Tree Networks

19

15 22

18

4

1 7

3 8

10

LCA

• Idea: Binary Search Tree (BST) network

• Supports local routing

– Left child, right child, upward?

• Search preserving reconfigurations like splay trees: zig, zigzag, zigzag

• But splay only to Least Common Ancestor (LCA)

Page 102: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SAN Idea 1: SplayNet

SplayNet

12

19

4

15 22

18

1

7

3 8

10

LCA

• Idea: Binary Search Tree (BST) network

• Supports local routing

– Left child, right child, upward?

• Search preserving reconfigurations like splay trees: zig, zigzag, zigzag

• But splay only to Least Common Ancestor (LCA)

Page 103: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SplayNet: Properties

I=[1..8]

23

25

21

4

1 7

v 8

10

18

19 22

I‘=[9..25]

WI(v)= 𝑢 ∈ I′𝑤 𝑢, 𝑣 + 𝑤(𝑣, 𝑢)

Cost(TI, WI)=[ 𝑢,𝑣 ∈ I(𝑑 𝑢, 𝑣 + 1)𝑤(𝑢, 𝑣) ] + DI∗WI

(DI distances of nodes in I from root of TI )

1. Define: flow out of interval I

2. Cost of a given tree TI on I:

3. Dynamic program over intervals

Decouple costto ouside: distance to

root of TI only

Choose optimal root and add dist

to root

Property 1: Optimal static network can be computed in polynomial-time (dynamic programming)

– Unlike unordered tree?

Page 104: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SplayNet: Properties

Property 2: Provides amortized cost and amortized throughput guarantees

Rotations can happen concurrently:

independent clusters

Analysis more challenging: potential function sum no longer telescopic. One

request can “push-down” another.

SplayNet: concurrent

Splay tree: requests one after another

Page 105: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SplayNet: Properties

Property 3: Converges to optimal network under specific demands

Cluster scenario: SplayNet will converge to state where path between cluster nodes only

includes cluster nodes

Non-crossing matching scenario: SplayNet will converge to state where all communication pairs

are adjacent

Page 106: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

SplayNet: Improved Lower BoundsInterval Cuts Bound Edge Expansion Bound

• Let cut W(S) be weight of edges in cut (S,S’) for a given S

• Define a distribution wS (u) according to the weights to all possible nodes v:

• Define entropy of cut and src(S),dst(S) distributions accordingly: :

• Conductance entropy is lower bound:

I𝑗𝑙𝑗 𝑙

I𝑗𝑙𝑗 𝑙

cutout(I𝑗𝑙)

cutin(I𝑗𝑙)

Cost = Ω(maximinj,l H(cutout(I𝑗𝑙)))

Cost = Ω(maximinj,l H(cutin(I𝑗𝑙)))

Page 107: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Demand-Oblivious

Fixed

Unknown

Demand-Aware

Fixed Reconfigurable

Sequence Generator Offline Online

Awareness

Topology

Input

AlgorithmOFF ONSTAT GENOBL

Uncharted Space

Toward Demand-Aware Networking: A Theory for Self-Adjusting Networks. ArXiv 2018.

Can compare to staticor dynamic baseline!

51

Page 108: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Roadmap

• Networks are increasingly complex: a case for formal methods?

• Networks are increasingly flexible: a case for self-adjusting networks?

000

Thank you!

Page 109: From Self-Verifying to Self-Adjusting Networksstefan/huji18.pdf · 2018. 7. 10. · Example: Keeping Track of (Flexible) Routes Under Failures Example: BGP in Datacenter er Internet

Further Reading

Demand-Aware Network Designs of Bounded DegreeChen Avin, Kaushik Mondal, and Stefan Schmid.31st International Symposium on Distributed Computing (DISC), Vienna, Austria, October 2017.Characterizing the Algorithmic Complexity of Reconfigurable Data Center ArchitecturesKlaus-Tycho Foerster, Monia Ghobadi, and Stefan Schmid.ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS), Ithaca, New York, USA, July 2018.SplayNet: Towards Locally Self-Adjusting NetworksStefan Schmid, Chen Avin, Christian Scheideler, Michael Borokhovich, Bernhard Haeupler, and Zvi Lotker.IEEE/ACM Transactions on Networking (TON), Volume 24, Issue 3, 2016.Polynomial-Time What-If Analysis for Prefix-Manipulating MPLS NetworksStefan Schmid and Jiri Srba.37th IEEE Conference on Computer Communications (INFOCOM), Honolulu, Hawaii, USA, April 2018.WNetKAT: A Weighted SDN Programming and Verification LanguageKim G. Larsen, Stefan Schmid, and Bingtian Xue.20th International Conference on Principles of Distributed Systems (OPODIS), Madrid, Spain, December 2016.

See also references on slides!