The system contains 3f+1 controller replicas plus switch-side clients/proxies, with authenticated replica messages and BFT-SMaRt's total-order execution.

1. threat model

   Byzantine control and data planes

   defined

   The adversary actively corrupts up to f controller components and arbitrarily many switches, allowing message injection, replay, modification, arbitrary requests/replies, or silence.

   Controller and switch adversary model
2. assumption

   Replication assumptions

   assumed

   Correctness relies on BFT-SMaRt's communication and quorum assumptions, deterministic replicas, authenticated messages (MACs in the prototype), direct client-to-replica communication, and at most f faulty replicas.

   BFT-SMaRt protocol and assumptions · Security analysis and quorum reasoning

A per-switch proxy translates OpenFlow Packet_In requests into BFT client requests and translates the agreed response back into Packet_Out or Flow_Mod messages.

1. component

   SimpleBFT and BeaconBFT

   implemented

   The authors integrate OpenFlowJ and Beacon with BFT-SMaRt, respectively, and evaluate both as learning-switch controllers with four replicas for f=1.

   Proxy architecture and two controller prototypes · Mininet experiment and flow-setup results

The paper combines quorum-based fault-tolerance reasoning with performance evidence from a proof-of-concept prototype.

1. claim

   Single-fault tolerance in tested configuration

   analytically supported conditional

   With four controller replicas, no one compromised replica can make a client accept an unsolicited or incorrect action because the client requires two identical replies and consensus quorums remain available.

   Security analysis and quorum reasoning
2. claim

   Measured flow-setup cost

   experimentally supported

   SimpleBFT reports 59.3 flow modifications/s versus OpenFlowJ's 106.9 (about 1.8× slower); BeaconBFT reports 87.0 versus Beacon's 550.6 (about 6.3× slower).

   Mininet experiment and flow-setup results

Evidence consists of architecture diagrams, quorum analysis inherited from BFT-SMaRt, two implementations, and comparative Mininet flow-setup measurements.

1. evidence

   Mininet proof-of-concept

   reported not reproduced

   The test uses 64 hosts and 63 switches in a binary tree, a reactive empty-table workload, four controller replicas, and flow setup duration, delay, and rate metrics; no fault-injection result is reported.

   Mininet experiment and flow-setup results

The source explicitly treats the implementation as a proof of concept and says it is not ready for large-scale networks with tens of thousands of flow changes per second.

1. limitation

   No adversarial or large-scale validation

   evaluation limitation

   The reported experiment measures benign throughput in Mininet; it does not inject Byzantine faults, test recovery/view change, measure geographic distribution, or demonstrate production traffic scale.

   Mininet experiment and flow-setup results · Future work, scale boundary, and conclusion
2. limitation

   Proxy and serialization costs

   implementation limitation

   Each switch depends on a paired proxy, and BFT-SMaRt's total ordering removes much of Beacon's parallel advantage; the paper proposes integrated switches, batching, and speculative/coarser consensus as future work.

   Proxy architecture and two controller prototypes · Mininet experiment and flow-setup results · Future work, scale boundary, and conclusion