Towards Correct-by-Construction SDN

High-level SDN languages raise the level of abstraction in SDN programming from managing individual switches to programming network-wide policies. In this talk, we present Cocoon (for Correct by Construction Networking), an SDN programming language designed around the idea of iterative refinement. The network programmer starts with a high-level description of the desired network behavior, focusing on the service the network should provide to each packet, as opposed to how this service is implemented within the network fabric. The programmer then iteratively refines the top-level specification, adding details of the topology, routing, fault recovery, etc., until reaching a level of detail sufficient for the Cocoon compiler to generate an SDN application that manages network switches via the southbound interface (we currently support P4 [3]). We designed Cocoon with the following goals in mind: Correctness Cocoon uses the Corral model checker [6] to establish that each refinement correctly implements the behavior it refines, ensuring that behaviors specified at any refinement step hold on the resulting SDN application. Generality Cocoon enables a wide range of SDN applications, ranging from network virtualization, through softwaredefined IXPs, to home networks. Dynamism A Cocoon program specifies both data and control plane behavior, akin to languages like FlowLog [7], Maple [9], and VeriCon [2]. This is in contrast to languages such as NetKAT [1], which specify a snapshot of data plane behavior but rely on a general-purpose programming language to implement the control plane by emitting a stream of snapshots in response to network events. Flexibility Existing high-level languages rely on fixed compilation strategies in mapping the high-level network program to a switch-level implementation. Cocoon allows the programmer to specify how each high-level component is implemented and deployed, while automatically verifying the correctness of the implementation.