Safely and Automatically Updating In-Network ACL Configurations with Intent Language
Bingchuan Tian, Xinyi Zhang, Ennan Zhai, Hongqiang Harry Liu, Qiaobo Ye,
Chunsheng Wang, Xin Wu, Zhiming Ji, Yihong Sang, Ming Zhang, Da Yu, Chen Tian,
Haitao Zheng, Ben Y. Zhao.
Proceedings of ACM SIGCOMM
[Full Text in PDF Format, 1.1MB]
In-network Access Control List (ACL) is an important technique in ensuring network-wide
connectivity and security. As cloud-scale WANs today constantly evolve in size and complexity,
in-network ACL rules are becoming increasingly more complex. This presents a great challenge
to the updating process of ACL configurations: network operators are frequently required to
update "tangled" ACL rules across thousands of devices to meet diverse business requirements,
and even a single ACL misconfiguration may lead to network disruptions. Such increasing
challenges call for an automated system to improve the efficiency and correctness of ACL
updates. This paper presents Jinjing, a system that aids Alibaba's network operators in
automatically and correctly updating ACL configurations in Alibaba's global WAN. Jinjing
allows the operators to express in a declarative language, named LAI, their update intent
(e.g., ACL migration and traffic control). Then, Jinjing automatically synthesizes ACL update
plans that satisfy their intent. At the heart of Jinjing, we develop a set of novel
verification and synthesis techniques to rigorously guarantee the correctness of update plans.
In Alibaba, our operators have used Jinjing to efficiently update their ACLs and have thus
prevented significant service downtime.