ISSN 1000-1239 CN 11-1777/TP

• 信息安全 •

### 基于MapReduce的OpenFlow网络属性验证技术

1. (解放军信息工程大学 郑州 450001) (河南省信息安全重点实验室(解放军信息工程大学) 郑州 450001) (liuyi9582@126.com)
• 出版日期: 2016-11-01
• 基金资助:
国家“八六三”高技术研究发展计划基金项目(2012AA012704)；郑州市科技领军人才项目(131PLJRC644) This work was supported by the National High Technology Research and Development Program of China (863 Program) (2012AA012704) and Zhengzhou Science and Technology Talents Project (131PLJRC644).

### MapReduce-Based Network Property Verification Technique for OpenFlow Network

Liu Yi, Lei Cheng, Zhang Hongqi, Yang Yingjie

1. (PLA Information Engineering University, Zhengzhou 450001) (Henan Key Laboratory of Information Security (PLA Information Engineering University), Zhengzhou 450001)
• Online: 2016-11-01

Abstract: Aimed at the problem of configuration errors of flow tables resulting from automatic change of data-plane state by software in OpenFlow network, a MapReduce-based network property verification technique is proposed. Firstly, by exploiting the separation of logic control from data forwarding in OpenFlow network, a novel technical framework providing non-real-time and real-time verification is designed. Further, on the basis of the advantage of parallel computing in MapReduce, a non-real-time verification algorithm is presented, which can verify network properties in parallel in two phases. In Map phase, it slices network into equivalence classes. In Reduce phase, it builds network forwarding graph with switch port predicates and conducts network reachability analysis. Meanwhile, with the help of atomic predicates, it can not only eliminate the redundancy of the set of switch port predicates, but also convert highly computation-intensive operations on predicates to those on sets of integers, speeding up computation of network reachability further. Based on it, a real-time verification algorithm is proposed. According to different network update events, it applies different changes to the results of non-real-time verification in order to incrementally verify properties. Finally, theoretical analysis and experimental results show the low time and storage overhead of the proposed technique. Additionally, its effect on the time of building TCP connection is also analyzed.