## 3 Hybrid Protection Mechanism for SFC
### Traffic Detouring in the Case of Failure  
Routing in HP-SFC is based on labels, where a single label is used within a segment (i.e., except for the last segment). A segment may consist of multiple links in the underlay network, but logically, they behave as a single link as they all use the same label to forward the traffic. This implies that failure of any link within a segment can be treated as the failure of the whole segment and requires traffic detouring around the whole segment. This approach resembles local failure recovery from the SFC perspective, albeit with one difference, which is that after bypassing the failed segment through the backup SF, the traffic is not forwarded to the starting point of the next segment. Instead, the next segment is updated with a new shortest path from the backup SF to the next SF. For example, in Figure 3, after \(f_{12}^{\prime}\), the traffic is forwarded to SW4 instead of SFF2. This approach also resembles global failure recovery from the segment perspective, where a completely new backup path is used. The port down message of the OpenFlow protocol is utilized to recognize a failure in the underlay network. Switches connected on either side of the failed link detect that the status of the failed link port has changed to down & and send a port down message to the SDN controller &. The HPM receives the port down messages and extracts the switch and port IDs from each message to identify the failed link based on the underlay network topology &. The identification of the failed link allows the HPM to determine the affected SFC \(SFC_{E}=\{SFC_{1},SFC_{2},\ldots,SFC_{k},\ldots,SFC_{Q}\}\) and its failed segments by going through the previously stored path information of all SFCs in the system, where \(SFC_{E}\subseteq SFC\) and \(O\) is the total number of affected SFC. Regardless of the failure location in the segment \(s_{kj}\) of \(SFC_{k}\), the whole \(s_{kj}\) is considered to have failed, and first of all, the HPM stops traffic forwarding to \(s_{kj}\) by updating the out port of the forwarding flow entry in the SFF of \(f_{k(j-1)}\) (i.e., the starting point of \(s_{kj}\)) towards the backup path \(\circled{\textcircled{\textcircled{\textcircled{\textcircled{\textcircled{\textcircled{ \textcircled{\text{\textcircled{\  
of \(s_{2}\), and after the failure, the packets are detoured to \(f_{2}^{\prime}\). The flow table configurations for traversing the packet through the \(SFC_{1}\) primary path are detailed in following steps. 1. SW1 flow entry to add an MPLS header with label stack \(L_{1}\) to the incoming packet;
2. SW1 flow entry to match the top label (\(l_{11}\)) in the stack and forward the packet to SFF1;
3. SFF1 flow entry to match the top label (\(l_{11}\)) in the stack and forward the packet to \(f_{1}\);
4. SFF1 flow entry to remove the top label (\(l_{11}\)) in the stack of the packet that is received back from \(f_{1}\);
5. SFF1 flow entry to match the new top label (\(l_{12}\)) in the stack and forward the packet towards SFF2;
6. SFF2 flow entry to match the top label (\(l_{12}\)) in the stack and forward the packet to \(f_{2}\);
7. SFF2 flow entry to remove the top label (\(l_{12}\)) in the stack of the packet that is received from \(f_{2}\);
8. SFF2 flow entry to match the destination IP of the packet and forward the packet to SW4, as there is no remaining label in the stack. Along with the primary path setup, the flow table configurations for setting up the backup path are as follows:  
1. SFF1 flow entry to match the label \(l_{12}^{\prime}\) and forward the packet to SW2;
2. SW2 flow entry to match top label (\(l_{12}^{\prime}\)) in the stack and forward the packet SFF4;
3. SFF4 flow entry to match the top label (\(l_{12}^{\prime}\)) in the stack and forward the packet to \(f_{2}^{\prime}\);
4. SFF4 flow entry to remove the top label (\(l_{12}^{\prime}\)) in the stack of the packet that is received from \(f_{2}^{\prime}\);
5.