Enforcing network-wide policies in the presence of dynamic middlebox actions using flowtags

TLDR

Middleboxes provide key security and performance guarantees, but their dynamic traffic modifications complicate network management tasks such as access control, accounting, and diagnostics. The authors develop the FlowTags architecture to enable integration of middleboxes into SDN networks and leverage SDN benefits. FlowTags enhances middleboxes to export causal tags, while SDN controllers use FlowTags APIs to configure tag generation and consumption, thereby restoring packet‑origin bindings and enforcing policy‑mandated paths. The study demonstrates that minimally extending middleboxes with FlowTags is feasible, incurs low overhead compared to traditional SDN mechanisms, and enables promising verification and diagnosis capabilities.

Abstract

Middleboxes provide key security and performance guarantees in networks. Unfortunately, the dynamic traffic modifications they induce make it difficult to reason about network management tasks such as access control, accounting, and diagnostics. This also makes it difficult to integrate middleboxes into SDN-capable networks and leverage the benefits that SDN can offer.In response, we develop the FlowTags architecture. FlowTags-enhanced middleboxes export tags to provide the necessary causal context (e.g., source hosts or internal cache/miss state). SDN controllers can configure the tag generation and tag consumption operations using new FlowTags APIs. These operations help restore two key SDN tenets: (i) bindings between packets and their origins, and (ii) ensuring that packets follow policy-mandated paths.We develop new controller mechanisms that leverage FlowTags. We show the feasibility of minimally extending middleboxes to support FlowTags. We also show that FlowTags imposes low overhead over traditional SDN mechanisms. Finally, we demonstrate the early promise of FlowTags in enabling new verification and diagnosis capabilities.