Composing software-defined networks

TLDR

Network management requires concurrent routing, monitoring, access control, and load balancing, and SDN enables these tasks via programmable packet rules, yet current SDN platforms lack robust modular application support. The paper proposes abstractions for composing independent modules to jointly manage network traffic. The authors define composition operators and a policy library, including parallel and sequential composition, an abstract topology that limits module visibility, and an abstract packet model with extensible virtual fields. These abstractions are implemented in Pyretic, a Python‑embedded domain‑specific language.

Abstract

Managing a network requires support for multiple concurrent tasks, from routing and traffic monitoring, to access control and server load balancing. Software-Defined Networking (SDN) allows applications to realize these tasks directly, by installing packet-processing rules on switches. However, today's SDN platforms provide limited support for creating modular applications. This paper introduces new abstractions for building applications out of multiple, independent modules that jointly manage network traffic. First, we define composition operators and a library of policies for forwarding and querying traffic. Our parallel composition operator allows multiple policies to operate on the same set of packets, while a novel sequential composition operator allows one policy to process packets after another. Second, we enable each policy to operate on an abstract topology that implicitly constrains what the module can see and do. Finally, we define a new abstract packet model that allows programmers to extend packets with virtual fields that may be used to associate packets with high-level meta-data. We realize these abstractions in Pyretic, an imperative, domain-specific language embedded in Python.