Towards SDN Network Proofs — Taming a Complex System

Currently the SDN research community considers in-line dynamic network functions too complex for SDN, leading to calls to purge them from the forwarding plane. This paper introduces a comprehensive framework that tames this complexity and allows network administrators to deploy complex network functions into the SDN forwarding plane to provide enhanced and provable network properties. We first illustrate mapping complex network functions to a network to determine location and their sphere of influence. Through analysis we identify properties common to all network functions and we provide formalisms to specify the behaviour of a generic network function using typed functions, the basis of many modern programming languages. We extend this generic network function to demonstrate two types of firewall providing security properties and also demonstrate chaining which is the basis of Unified Threat Management firewalls and Deep Packet Inspection. This paper is a foundation for ongoing research into proving properties of black box implementations of network functions.