CrossCheck: Input Validation for WAN Control Systems#

Alexander Krentsel (UC Berkeley and Google), Rishabh Iyer (UC Berkeley), Isaac Keslassy (Technion and UC Berkeley), Bharath Modhipalli (Google), Sylvia Ratnasamy (UC Berkeley and Google), Anees Shaikh, Rob Shakir (Google)

• Why: WAN outages increasingly trace to bad inputs to the SDN controller (telemetry bugs, corrupted state) rather than bad control logic. CrossCheck guards that interface — a class of failure most validation work ignores.
• What: A shadow validation system for SDN-WAN controller inputs. Four weeks in a production WAN: it caught the single invalid-input incident that occurred with 0% false positives; simulation shows detection of demand perturbations as small as 5% at 100% accuracy, and zero false positives with up to 30% corrupted telemetry.
• How: Cross-validates controller inputs (demands, topology, telemetry) against consistency constraints before they drive TE decisions, alerting operators pre-outage rather than post-mortem.
• Where applicable: Google-scale WAN operator deployment; the pre-deployment shadow-mode evaluation pattern is what makes the 0%-FP claim credible. Concept transfers to any SDN-controlled WAN (or even large DCN controller) with telemetry-driven inputs.