Visible to the public COCONUT: Seamless Scale-out of Network ElementsConflict Detection Enabled

TitleCOCONUT: Seamless Scale-out of Network Elements
Publication TypeConference Paper
Year of Publication2017
Conference NameEuroSys
Date Published04/2017
Conference LocationBelgrade, Serbia
Keywordsfirewall, IDS, network virtualization, scale-out, software-defined networking

A key use of software-defined networking is to enable scale-out of network data plane elements. Naively scaling networking elements, however, can cause incorrect security responses. For example, we show that an IDS system which operates correctly as a single network element can erroneously and permanently block hosts when it is replicated. Similarly, a scaled-out firewall can incorrectly block hosts.

In this paper, we provide a system, COCONUT, for seamless scale-out of network forwarding elements; that is, an SDN application programmer can program to what functionally appears to be a single forwarding element, but which may be replicated behind the scenes. To do this, we identify the key property for seamless scale out, weak causality, and guarantee it through a practical and scalable implementation of vector clocks in the data plane. We formally prove that COCONUT enables seamless scale out of networking elements, i.e., the user-perceived behavior of any COCONUT element implemented with a distributed set of concurrent replicas is provably indistinguishable from its singleton implementation. Finally, we build a prototype of COCONUT and experimentally demonstrate its correct behavior. We also show that its abstraction enables a more efficient implementation of seamless scale-out compared to a naive baseline.

This work was funded by the SoS lablet at the University of Illinois at Urbana-Champaign.

NotesAuthors: Soudeh Ghorbani, P. Brighten Godfrey (UIUC)
Citation Keynode-34301
Refereed DesignationRefereed