## 3 Hybrid Protection Mechanism for SFC
### SFC Paths Installation  
Multiple SF chains with different policies can function together in a network, where traffic flows belong to one of these SF chains. The match fields of flow entries in ingress switch determine the assigned SFC of an incoming packet of a particular flow. The SDN controller installs these flow entries and alters the match fields dynamically through the OpenFlow protocol, which supports up to 44 different match fields [23]. The MPLS header is added to the matched packet, and it consists of an ordered stack of labels representing the assigned SFC. Each label in the stack identifies the corresponding SF through a unique ID, and these labels are used as match fields for traffic steering through SFC. HP-SFC proposed the use of multiple labels because a single-label-based traffic steering through all the SFC increases the required flow entries and reduces the path flexibility. The NSH is an example  
Figure 2: HP-SFC overlay and underlay networks’ architecture and system model. of single-label-based traffic steering where both the SPI and SI values must be updated for traffic detouring and SPI/SI combinations increase with the increase in SFC. The primary SFC path setup is initiated by the HPM by calculating the shortest path for \(s_{i1}\) that is from the ingress switch to the SFF with which \(f_{i1}\) is directly connected. In all the switches in the calculated shortest path, flow entries are installed with the match field as the top label \(l_{i1}\) in the stack \(L_{i}\). This process is repeated for all remaining segments in \(S_{i}\), and its completion results in the primary path setup for \(SFC_{i}\). The SFF plays an important role in traffic steering through \(SFC_{i}\) and requires three flow entries. The first flow entry in SFF has \(l_{ij}\) of directly connected \(f_{ij}\) as the match field and forwards the matched packets to \(f_{ij}\). Packets are processed at \(f_{ij}\) and are returned to the SFF where the second flow entry pops \(l_{ij}\) from \(L_{i}\). This makes \(l_{i(j+1)}\) of \(f_{i(j+1)}\) as the top label in \(L_{i}\), and the third flow entry forwards the packet towards \(f_{i(j+1)}\) using \(l_{i(j+1)}\) as the match field. The third flow entry in the SFF of \(f_{iM}\) is an exception, where the destination IP is used to forward the packet towards the destination, and this is because the packet has steered through all SFs in \(SFC_{i}\) and \(L_{i}\) is now empty. Similarly, switches in the path for \(s_{i(M+1)}\) use the destination IP as the match field to forward the traffic to \(D_{i}\). The HPM creates the backup paths by using \(SFC_{i}^{\prime}\); however, the process is different from primary path creation. The backup path for \(s_{i1}\) consists of two parts: the first part is the shortest path from the ingress switch to the SFF connected to \(f_{i1}^{\prime}\), and the second part is from there to the SFF of \(f_{i2}\). The flow entry match field for switches in the first part consists of \(l_{i1}^{\prime}\), and in the second part, it consists of \(l_{i2}\). Similarly, the backup path for \(s_{i2}\) initiates from the \(f_{i1}\) SFF and terminates at the \(f_{i3}\) SFF while passing through \(f_{i2}^{\prime}\). By repeating this process, the backup paths for each \(s_{ij}\) in \(SFC_{i}\) are created, and the SFFs' functionalities remain the same as in the primary path creation. The HPM in the SDN controller stores the primary and backup paths for the SFC, as shown in Figure 3. The underlay network shown in Figure 3 consists of \(SFC_{1}=\{f_{11},f_{i2}\}\), and it is the backup \(SFC_{1}^{\prime}=\{f_{11}^{\prime},f_{12}^{\prime}\}\), where Switch 1 (SW1) functions as the classifier and Switch 4 (SW4) connects to the destination. The flow tables of the SWs and SFFs in Figure 3 show the flow entries required to route traffic to the primary SFs \(\{f_{11},f_{12}\}\) and the backup SFs \(\{f_{11}^{\prime},f_{12}^{\prime}\}\) using their respective labels \(\{l_{11},l_{12}\}\) and \(\{l_{11}^{\prime},l_{12}^{\prime}\}\).