skip to main content
10.1145/2716281.2836092acmconferencesArticle/Chapter ViewAbstractPublication PagesconextConference Proceedingsconference-collections
research-article

Alpaca: compact network policies with attribute-carrying addresses

Published:01 December 2015Publication History

ABSTRACT

In enterprise networks, policies (e.g., QoS or security) are often defined based on the categorization of hosts along dimensions such as the organizational role of the host (faculty vs. student), and department (engineering vs. sales). While current best practices (VLANs) help when hosts are categorized along a single dimension, policy may often need to be expressed along multiple orthogonal dimensions. In this paper, we make three contributions. First, we argue for Attribute-Carrying IPs (ACIPs), where the IP address allocation process in enterprises considers attributes of a host along all policy dimensions. ACIPs enable flexible policy specification in a manner that may not otherwise be feasible owing to the limited size of switch rule-tables. Second, we present Alpaca, algorithms for realizing ACIPs under practical constraints of limited-length IP addresses. Our algorithms can be applied to different switch architectures, and we provide bounds on their performance. Third, we demonstrate the importance and viability of ACIPs on data collected from real campus networks.

References

  1. M. Yu, J. Rexford, X. Sun, S. G. Rao, and N. Feamster, "A survey of virtual LAN usage in campus networks," IEEE Communications Magazine, vol. 49, no. 7, pp. 98--103, 2011.Google ScholarGoogle ScholarCross RefCross Ref
  2. "Production quality, multilayer open virtual switch." http://openvswitch.org/.Google ScholarGoogle Scholar
  3. M. Casado, M. J. Freedman, J. Pettit, J. Luo, N. Gude, N. McKeown, and S. Shenker, "Rethinking enterprise network control," IEEE/ACM Trans. Netw., vol. 17, no. 4, pp. 1270--1283, 2009. Google ScholarGoogle ScholarDigital LibraryDigital Library
  4. S. K. Fayazbakhsh, L. Chiang, V. Sekar, M. Yu, and J. C. Mogul, "Enforcing Network-Wide Policies in the Presence of Dynamic Middlebox Actions using FlowTags," in NSDI, 2014. Google ScholarGoogle ScholarDigital LibraryDigital Library
  5. N. McKeown, T. Anderson, H. Balakrishnan, G. M. Parulkar, L. L. Peterson, J. Rexford, S. Shenker, and J. S. Turner, "OpenFlow: enabling innovation in campus networks," ACM SIGCOMM CCR, vol. 38, no. 2, pp. 69--74, 2008. Google ScholarGoogle ScholarDigital LibraryDigital Library
  6. P. Bosshart, D. Daly, G. Gibb, M. Izzard, N. McKeown, J. Rexford, C. Schlesinger, D. Talayco, A. Vahdat, G. Varghese, and D. Walker, "P4: Programming protocol-independent packet processors," ACM SIGCOMM CCR, vol. 44, no. 3, pp. 87--95, 2014. Google ScholarGoogle ScholarDigital LibraryDigital Library
  7. P. Bosshart, G. Gibb, H.-S. Kim, G. Varghese, N. McKeown, M. Izzard, F. Mujica, and M. Horowitz, "Forwarding metamorphosis: Fast programmable match-action processing in hardware for SDN," in ACM SIGCOMM, 2013. Google ScholarGoogle ScholarDigital LibraryDigital Library
  8. R. Ozdag, "Intel®Ethernet Switch FM6000 Series-Software Defined Networking," Intel Corporation, 2012.Google ScholarGoogle Scholar
  9. M. Appelman and M. D. Boer, "Performance analysis of OpenFlow hardware," tech. rep., University of Amsterdam, Feb 2012. http://www.delaat.net/rp/2011-2012/p18/report.pdf.Google ScholarGoogle Scholar
  10. D. Y. Huang, K. Yocum, and A. C. Snoeren, "High-fidelity switch models for software-defined network emulation," in ACM HotSDN, 2013. Google ScholarGoogle ScholarDigital LibraryDigital Library
  11. T. Benson, A. Akella, and D. A. Maltz, "Mining policies from enterprise network configuration," in ACM IMC, 2009. Google ScholarGoogle ScholarDigital LibraryDigital Library
  12. X. Jin, L. E. Li, L. Vanbever, and J. Rexford, "SoftCell: Scalable and flexible cellular core network architecture," in ACM CoNEXT, 2013. Google ScholarGoogle ScholarDigital LibraryDigital Library
  13. P. Zave and J. Rexford, "The design space of network mobility," in Recent Advances in Networking. ACM SIGCOMM, 2013.Google ScholarGoogle Scholar
  14. E. Nordström, D. Shue, P. Gopalan, R. Kiefer, M. Arye, S. Ko, J. Rexford, and M. J. Freedman, "Serval: An end-host stack for service-centric networking," in USENIX NSDI, 2012. Google ScholarGoogle ScholarDigital LibraryDigital Library
  15. C. R. Meiners, A. X. Liu, and E. Torng, "TCAM Razor: A systematic approach towards minimizing packet classifiers in TCAMs," IEEE/ACM Trans. Netw., vol. 18, pp. 490--500, Apr 2010. Google ScholarGoogle ScholarDigital LibraryDigital Library
  16. C. R. Meiners, A. X. Liu, and E. Torng, "Bitweaving: A non-prefix approach to compressing packet classifiers in TCAMs," IEEE/ACM Trans. Netw., vol. 20, pp. 488--500, Apr 2012. Google ScholarGoogle ScholarDigital LibraryDigital Library
  17. R. McGeer and P. Yalagandula, "Minimizing rulesets for TCAM implementation," in IEEE INFOCOM, 2009.Google ScholarGoogle Scholar
  18. R. Draves, C. King, S. Venkatachary, and B. Zill, "Constructing optimal IP routing tables," in IEEE INFOCOM, 1999.Google ScholarGoogle Scholar
  19. S. Suri, T. Sandholm, and P. R. Warkhede, "Compressing two-dimensional routing tables," Algorithmica, vol. 35, no. 4, pp. 287--300, 2003.Google ScholarGoogle ScholarCross RefCross Ref
  20. D. L. Applegate, G. Calinescu, D. S. Johnson, H. Karloff, K. Ligett, and J. Wang, "Compressing rectilinear pictures and minimizing access control lists," in ACM-SIAM SODA, pp. 1066--1075, 2007. Google ScholarGoogle ScholarDigital LibraryDigital Library
  21. O. Rottenstreich and I. Keslassy, "On the code length of TCAM coding schemes," in IEEE ISIT, 2010.Google ScholarGoogle Scholar
  22. O. Rottenstreich, I. Keslassy, A. Hassidim, H. Kaplan, and E. Porat, "Optimal In/Out TCAM encodings of ranges," IEEE/ACM Trans. Netw., 2015. Google ScholarGoogle ScholarDigital LibraryDigital Library
  23. K. Kogan, S. I. Nikolenko, O. Rottenstreich, W. Culhane, and P. Eugster, "Exploiting order independence for scalable and expressive packet classification," IEEE/ACM Trans. Netw., 2015. Google ScholarGoogle ScholarDigital LibraryDigital Library
  24. O. Rottenstreich and J. Tapolcai, "Lossy compression of packet classifiers," in ACM/IEEE ANCS, 2015. Google ScholarGoogle ScholarDigital LibraryDigital Library
  25. C. R. Meiners, A. X. Liu, E. Torng, and J. Patel, "Split: Optimizing space, power, and throughput for TCAM-based classification," in ACM/IEEE ANCS, 2011. Google ScholarGoogle ScholarDigital LibraryDigital Library
  26. R. Wei, Y. Xu, and H. J. Chao, "Block permutations in boolean space to minimize TCAM for packet classification," in IEEE INFOCOM, 2012.Google ScholarGoogle Scholar
  27. O. Rottenstreich, M. Radan, Y. Cassuto, I. Keslassy, C. Arad, T. Mizrahi, Y. Revah, and A. Hassidim, "Compressing forwarding tables for datacenter scalability," IEEE Journal on Selected Areas in Communications (JSAC), vol. 32, no. 1, pp. 138 -- 151, 2014.Google ScholarGoogle ScholarCross RefCross Ref
  28. O. Rottenstreich, A. Berman, Y. Cassuto, and I. Keslassy, "Compression for fixed-width memories," in IEEE ISIT, 2013.Google ScholarGoogle Scholar
  29. S. Donovan and N. Feamster, "NetAssay: Providing new monitoring primitives for network operators," in ACM HotNets, 2014.Google ScholarGoogle Scholar

Recommendations

Comments

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Sign in
  • Published in

    cover image ACM Conferences
    CoNEXT '15: Proceedings of the 11th ACM Conference on Emerging Networking Experiments and Technologies
    December 2015
    483 pages
    ISBN:9781450334129
    DOI:10.1145/2716281

    Copyright © 2015 ACM

    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    • Published: 1 December 2015

    Permissions

    Request permissions about this article.

    Request Permissions

    Check for updates

    Qualifiers

    • research-article

    Acceptance Rates

    Overall Acceptance Rate198of789submissions,25%

PDF Format

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader