## 3 Hybrid Protection Mechanism for SFC  
### System Model and Architecture  
The proposed protection mechanism uses SR to design primary routing through SFC and backup paths in the underlay network for traffic detouring after the failure has occurred in \(SFC_{i}\in SFC\), where \(SFC=\{SFC_{1},SFC_{2},\ldots,SFC_{i},\ldots,SFC_{N}\}\). Each element in \(SFC\) is a set of ordered SFs, \(SFC_{i}=\{f_{i1},f_{i2},\ldots,f_{ij},\ldots,f_{iM}\}\). A Hybrid Protection Module (HPM) was added to the SDN controller to determine the segments \(S_{i}=\{s_{i1},s_{i2},\ldots,s_{ij},\ldots,s_{i(M+1)}\}\) of newly established \(SFC_{i}\). Segments \(\{s_{i1},\ldots,s_{iM}\}\) represent the corresponding SFs \(\{f_{i1},\ldots,f_{iM}\}\), and \(s_{i(M+1)}\) represents the last segment with no SF \((f_{iM},D_{i})\), where \(D_{i}\) is the destination of \(SFC_{i}\). The NFVO ensures that for each \(f_{ij}\), a backup SF \((f^{{}^{\prime}}_{ij}\in SFC^{{}^{\prime}}_{i})\) is deployed in the underlay network, where \(SFC^{{}^{\prime}}_{i}=\{f^{{}^{\prime}}_{i1},f^{{}^{\prime}}_{i2},\ldots,f^{{} ^{\prime}}_{ij},\ldots,f^{{}^{\prime}}_{iM}\}\). The HPM proactively calculates and adds the backup path for each segment in \(S_{i}\). Specifically, the backup path for \(s_{ij}\in S_{i}\) consists of the shortest path from \(f_{i(j-1)}\) to \(f_{i(j+1)}\) via \(f^{{}^{\prime}}_{ij}\).  
SR requires an additional header in a packet, which contains ordered labels in a stack \(L_{i}\), where \(L_{i}=\{l_{i1},l_{i2},\ldots,l_{ij},\ldots,l_{iM}\}\). Label \(l_{ij}\) represents a corresponding SF \(f_{ij}\), and traffic steering through \(SFC_{i}\) is performed based on \(L_{i}\). As a label represents a single SF, therefore \(L^{{}^{\prime}}_{i}=\{l^{{}^{\prime}}_{i1},l^{{}^{\prime}}_{i2},\ldots,l^{{} ^{\prime}}_{i^{\prime}},\ldots,l^{{}^{\prime}}_{iM}\}\) represents the ordered label stack for backup SFs in \(SFC^{{}^{\prime}}_{i}\). In conventional SFC, a dedicated classifier at the ingress edge of the underlay network classifies an incoming packet to a particular SFC and adds the NSH header. HP-SFC does not require a dedicated classifier, but instead uses ingress switch to classify the incoming packet based on the rules provided by the HPM and adds the MPLS header with the ordered labels' stack. In particular, the proposed HP-SFC handles the path creation in the underlay network after the placement of primary SFs and sets up the hybrid protection mechanism for SFC after the placement of backup SFs. Therefore, the creation of the VNF-FG and its embedding into the underlay network concerning the placement of SFs were out of the scope of this paper, and this is shown by the grey-colored MANO modules in Figure 2.  
The primary objectives of HP-SFC compared to conventional detouring methods in SFC are: (1) proactively calculate and store backup paths to eliminate path calculation and installation delays; (2) reduce the number of forwarding rules needed to configure the backup path while ensuring flexibility in path selection; and (3) reduce network bandwidth consumption by minimizing the exchange of control messages between the SDN controller and switches. To achieve these objectives, the HPM calculates the shortest path for each segment in SFC and generates complete primary and backup paths. Information about these paths is stored in the HPM for later processing when a failure notification is received from the switch. To detour traffic at the time of failure, the HPM matches the received failed link information with the stored paths and then appropriately modifies the flow entries. In particular, changes in two flow entries ensure that already entered traffic in the network and future SFC traffic take the pre-installed backup path.