NetGen: synthesizing data-plane configurations for network policies

Abstract

Networks are hard to maintain. When the physical network changes or when policies, most importantly security properties change, it is hard to change the network while maintaining all other existing policies. We study the problem of network change synthesis, where given a current network and a desired change for it expressed as a high-level policy, we automate the process of synthesizing changes in the data-plane configuration so that the policy is met. We develop a new language that allows the user to express desired reroutings and, given such a policy and a current network, we design a novel synthesis engine based on abstraction and constraint-solving that can find (minimal) changes to the current network that satisfies the policy. We report on a preliminary implementation of our technique that shows that we can effectively and efficiently synthesize changes in large networks.