Network Policy management is a tedious and laborious task because of scale and dynamic changes in the network. The advent of Softwarized Networks has led to a renewed interest in intent-based network policy management. Intent-based Networking provides a structured way of specifying the intent of policies which are automatically translated and compiled into network device configuration. While this top-down approach of policy intent to policy configuration has worked well for cloud-native infrastructures such as data centers, it has not seen much adoption in legacy networks. We believe one of the primary reasons for this is the semantic gap between policy intents and policy configurations. The problem is further exacerbated by the heterogeneity, scale-on-the-fly, fragmentation, and lack of structure in non-intent native networks. We introduce Policy Intent Inference (PII) System to bridge the semantic gap with its advanced inference layer that extracts the policy intents from policy configurations fragmented over disparate network devices. We adopt a bottom-up approach to extract all policies within network devices, abstract them into a structured data model, and with the use of clustering and information retrieval techniques, build an optimal solution to extract network-wide policy intents from the underlying network that eases policy management especially policy troubleshooting, reducing the configuration clutter and reducing the time taken to compile and resolve conflicts in policies.

We present Policy Graph Abstraction (PGA) that graphically expresses network policies and service chain requirements, just as simple as drawing whiteboard diagrams. Different users independently draw policy graphs that can constrain each other. PGA graph clearly captures user intents and invariants and thus facilitates automatic composition of overlapping policies into a coherent policy.

Software Defined Networking (SDN) and cloud automation enable a large number of diverse parties (network operators, application admins, tenants/end-users) and control programs (SDN Apps, network services) to generate network policies independently and dynamically. Yet existing policy abstractions and frameworks do not support natural expression and automatic composition of high-level policies from diverse sources. We tackle the open problem of automatic, correct and fast composition of multiple independently specified network policies. We first develop a high-level Policy Graph Abstraction (PGA) that allows network policies to be expressed simply and independently, and leverage the graph structure to detect and resolve policy conflicts efficiently. Besides supporting ACL policies, PGA also models and composes service chaining policies, i.e., the sequence of middleboxes to be traversed, by merging multiple service chain requirements into conflict-free composed chains. Our system validation using a large enterprise network policy dataset demonstrates practical composition times even for very large inputs, with only sub-millisecond runtime latencies.