915 results about "OpenFlow" patented technology

An OpenFlow switch controls transmission and reception of a packet according to a flow entry. Each of the flow entries contains a matching condition showing a communication flow of the packet and an action showing processing on the packet. An OpenFlow controller generates a registration flow entry which is stored in a flow table of a specific OpenFlow switch arranged on a route of the communication flow. An encapsulated packet is generated by relating the registration flow entry and an ordinary packet. The specific OpenFlow switch extracts the registration flow entry from the encapsulated packet in response to the reception of the encapsulated packet to produce a new flow entry and executes the action shown in the new flow entry.

A method of monitoring network traffic includes accessing a network that includes a controller and a switch device having a flow table, wherein the controller is communicatively coupled to the switch device, and is configured to program a behavior of the switch device through an openflow protocol, and obtaining information regarding the programmed behavior of the switch device, wherein the act of obtaining the information is performed by a network appliance that is communicatively coupled to the network. An apparatus communicatively coupled to a network, includes a processor configured for accessing the network that includes a controller and a switch device having a flow table, wherein the controller is communicatively coupled to the switch device, and is configured to program a behavior of the switch device through an openflow protocol, and obtaining information regarding the programmed behavior of the switch device.

The invention discloses a data center flow control method and a data center flow control system based on openflow. Openflow switchboards are controlled to operate a topology discovery protocol through a network controller, so tha information of all network nodes and links is collected and a network topology value is calculated; and the network controller periodically carries out end-to-end flow analysis on flows, calculates optimized paths of all the flows and transmits the optimized paths to each openflow switchboard, monitors the states of all the network links in real time, and maintains or downloads the optimized paths of the new flows to each openflow switchboard, so that the use rate of network bandwidth resources and the accuracy and the reliability of network concentrated management can be improved, the variation of the network flow can be fitted by sensitively regulating a flow load in a network, and the use rate and the reliability of the network can be effectively improved. The data center flow control method and the data center flow control system based on the openflow has a good application prospect.

A computer system according to the present invention includes a managing unit which outputs a plurality of virtual networks managed by a plurality of controllers in a visually perceivable form with the plurality of virtual networks combined, on the basis of topology data of the virtual networks, the topology data being generated based on communication routes. This enables centralized management of the whole of a virtual network controlled by a plurality of controllers which use an OpenFlow technology.

The invention discloses a system and a method for interconnecting an openflow network and the conventional Internet protocol (IP) network. The method is characterized in that: the whole openflow network is abstracted into a router in the conventional IP network, under the control of a control subsystem, the whole openflow network acts as a standard router externally, and the control subsystem is mapped to a routing processing part of the standard router; a forwarding subsystem is mapped to be a data forwarding part of the standard router; and an edge interface of an edge exchange unit is mapped to be an interface of the standard router. According to the method, a system provided with the openflow network can be regarded as a router on the Internet, so the openflow network can be well integrated into the routing system of the whole Internet, and data packets pass through the openflow network just like passing through a hop standard router, so that interconnection between the openflow network and the conventional IP network is realized.

The invention discloses a flow cleaning framework and device and a flow lead and reinjection method. The flow lead and reinjection method comprises the steps that a flow cleaning flow table and a flow reinjection flow table are generated by an OpenFlow controller and are issued to an OpenFlow cleaning switcher; a flow lead flow table is generated and is issued to an OpenFlow core router. When a server is attacked, flow of the attacked server led according to the flow lead flow table is matched by the OpenFlow cleaning switcher according to the flow cleaning flow table to carry out flow cleaning; the cleaned clean flow is forwarded according to the flow reinjection flow table to achieve flow reinjection. According to the flow cleaning framework based on OpenFlow, flow lead and flow reinjection are achieved uniformly; an abnormal flow cleaning component is composed of the OpenFlow controller and the OpenFlow cleaning switcher to achieve separation of control over a flow cleaning system and forwarding of the flow cleaning system; when service requirements are changed, all kinds of flow tables can be updated just through the OpenFlow controller, and accordingly reconfiguration and redeploy of a network are easily and flexibly achieved.

Fine traffic monitoring is achieved in a network in which sFlow and OpenFlow are combined. Specifically, flow identifiers (flow IDs) for identifying flows (or groups of packets) are prepared, and the flow identifiers are stored in entries of flow tables to allow sFlow agents to specify the flow identifiers as data sources. Specifically, the flow identifiers are stored in cookies of entries registered in flow tables of switches from a controller, and operations are performed for received packets matching the rules of the entries in accordance with the actions defined in the entries. In the switches, the flow identifiers specified as data sources in the MIBs used in sFlow are obtained and statistic information of packets matching the entries is obtained on the basis of the flow identifiers.

The invention provides an openflow network and IP (Internet Protocol) network interconnection communication method, which comprises the following steps that: on a switch which supports openflow, a routing process of an uplink port and an openflow protocol process of a downlink port are set; when a routing message enters the uplink port, the routing process acquires the routing information of the routing message, a controller is informed about the routing information by using the openflow protocol to convert the routing information into a flow table entry which is issued, and the routing information is issued to an openflow network in the form of the flow table entry according to a routing table entry; and when a flow table entry message enters the downlink port, the openflow protocol process acquires the flow table entry information of the flow table entry message, the flow table entry information is transmitted to the controller for resolution through the openflow protocol, the routing process is informed about a route by using the openflow protocol and the flow table entry information is issued to an IP network in a routing way according to forwarding rules. The invention additionally provides an openflow subnet edge switch for openflow network and IP network interconnection communication. The openflow network and IP network interconnection communication method and the openflow subnet edge switch provided by the invention have the advantages that the intercommunication between the openflow network and the IP network is realized and the respective operation of the openflow network and the IP network is not influenced.

The invention provides a method and system for designing a distributed virtual network in a cloud calculating data center. The method and system are applied to the technical field of cloud calculation. The method includes the following steps: creating a distributed virtual switch, wherein the distributed virtual switch is composed of a plurality of OpenFlow virtual switch bodies, an OpenFlow controller and a physical switch port; enabling the OpenFlow virtual switch bodies to be in communication with the OpenFlow controller according to preset strategies. According to the method, the distributed virtual switch is created based on the SDN thought and particularly achieved through the OpenFlow protocol. The whole data center is configured by the distributed virtual switch in a concentrated mode through the OpenFlow controller, virtual switch networking is accordingly simplified, and centralized management and intelligent monitoring on the virtual network environment in the cloud calculating data center are achieved.

The invention provides a method for achieving dynamic multicast spanning tree path adjustment based on OpenFlow. An OpenFlow technology is utilized to solve the problems in a multicast service of a host entering or leaving a multicast set, multicast spanning tree path dynamic adjustment and distributed multicast spanning tree strategies. According to the OpenFlow technology, a traditional packet forwarding process completely controlled by a router or a switch is converted into the process together completely by the OpenFlow switch and the controller, and therefore separation of forwarding logics and specific forwarding operation is achieved.

The invention provides an OpenFlow network flow control method for the QoS assurance of an application. The OpenFlow network flow control method comprises the following steps that: a user requests a service from a server; the server sends a QoS request message to an SDN controller; after receiving the message, the controller calculates an optimal transmission path for the server according to a network resource use condition and reserves a resource; and simultaneously, the transmission state and the network link condition of the server are monitored when the server transmits a QoS data flow, such that a QoS flow is transmitted reliably and stably. A required network resource is provided for an application service by strictly assuring the QoS transmission of the application service and utilizing the service difference to network resource requirements; therefore, the QoS of the application is effectively ensured; and simultaneously, the network resource is utilized effectively.

A method for guaranteeing control traffic throughput in an in-band network configured for delivering control and data traffic, and considering both local and global views of the communication network. The method includes determining an initial configuration for forwarding first control traffic from the packet forwarding device, wherein the initial configuration comprises a first in-band queue for receiving the first control traffic that is delivered over the control path to the controller via a port in the packet forwarding device, and a first bandwidth reserved for the first queue. The method includes performing handshaking with the controller by sending a request to the controller confirming the initial configuration using a network control protocol, and receiving a response from the controller in association with the request. The method includes confirming or modifying the initial configuration based on the response.

The invention relates to a SDN network DDoS attack detecting method based on network layer flow abnormity in order to detect and process a DDoS attack in a SDN network according to the network layer flow abnormity. The method comprises steps of: getting access to an OpenFlow switch flow table information items by using a SDN network controller in order to acquire a communication flow characteristic reaching the OpenFlow switch; and analyzing and processing the acquired detection characteristic by using introduced information entropy and single-side connection density in order to obtain a training and detection characteristic element group. It is found that in a implementing process, the SDN network DDoS attack detecting and processing method based on network layer flow abnormity may effectively improve detection accuracy of the DDoS attack generated in the SDN network, makes corresponding treatment on a communication flow according to a detected result, may well deal with the DDoS attack, from which a network may possibly suffer, in the form of saturated flow, and has very obvious beneficial effects.

The invention discloses an SDN firewall state detecting method and system based on the OpenFlow protocol. The method comprises adding a state table and a state transition table inside an OpenFlow switch to recording the state and the change information of data flows; meanwhile, also establishing and maintaining a state transition table in an SDN controller to achieve synchronization of data flow states of the controller and the switch. Besides, the invention also discloses modification of the format of an original OpenFlow table. The modification comprises adding associated state fields into the original OpenFlow table, modifying the OpenFlow protocol and adding new message State_in to facilitate treatment of previous state operation information of the controller and the switch and to maintain uniformity of the connecting state tables in the controller and the switch. The SDN firewall state detecting method and system based on the OpenFlow protocol can effectively achieve access control with finer granularity, and meanwhile, by means of cooperative operation of the OpenFlow switch and the SDN controller, can complete deployment of a state detecting firewall and provide safe and efficient services for an SDN network.

The invention provides a transmission method for data among OpenFlow network domains and a device. The method comprises the steps: obtaining global network information by a controller of a local network domain, wherein the global network information is information which is needed when data exchange is conducted between the local network domain and an adjacent network domain; and for a data message of which a destination address is not located in the local network domain, controlling an exchanger of the local network domain through the controller of the local network domain to transmit the data message to the adjacent network domain according to the global network information. Through the technical scheme, an effect of the data exchange among the different OpenFlow network domains can be achieved.

The invention discloses an open storage managing and scheduling method and system based on a software-defined network. The system comprises an Openflow interchanger, an SDN network controller, an extra-domain origin server and one or more users. The open storage managing and scheduling system is characterized further comprising one or more intra-domain caching servers which serve as intra-domain origin servers used for storing resources for the users to request in a network, one or more users request the resources through the Openflow interchanger, requests of one or more users are forwarded to the SDN network controller through the Openflow interchanger, the resources requested by the users are cached to the intra-domain caching servers closest to the users, the SDN network controller guides the requests of the users again to the closest intra-domain caching servers which the resources requested by the users are cached in, and the requested resources are acquired from the caching servers according to the requests which are guided again.

The invention provides a streaming media distribution system and method based on a software defined network. The method includes the steps that a first application server of an access network extracts request parameters from a received request for streaming media data and sends the extracted request parameters to a first network controller; the first network controller retransmits the request parameters to a first service dispatching engine and instructs the access network and relevant network elements to reserve links and bandwidth resources for the request, wherein the first service dispatching engine is connected with the first network controller through the Openflow protocol; the first service dispatching engine inquires whether the requested streaming media are local; when the requested streaming media are local, the first service dispatching engine selects a streaming media server locally; the selected streaming media server provides the requested streaming media through the reserved links and the reserved bandwidth sources.

The invention relates to a parallel search method and system of Openflow. According to the method and system, a compression storage mode through longitudinal segmentation of a rule table is proposed for multi-component and multi-list data search of the Openflow, so as to meet the requirement for storage space. A fast search and forwarding function is realized through parallel search of engines; a flow table in the Openflow is longitudinally segmented, compressed and stored, and the engines process respective header field parts, so that fast massage sorting and forwarding are achieved; and the problems of low table look-up efficiency due to complicated Openflow rules and large power consumption are solved.

The invention provides a flow forwarding method and a flow forwarding device. The method is applied to an Openflow Controller in an OpenFlow network and comprises the following steps: A, determining exchange equipment for simultaneously bearing N equivalent paths in the OpenFlow network; B, notifying the exchange equipment of creating a flow distribution group, adding an output port corresponding to each path in the N equivalent paths on the exchange equipment into the flow distribution group; and C, distributing a first OpenFlow meter corresponding to the flow distribution group to the exchange equipment, wherein the first OpenFlow meter contains destinations of the N equivalent paths and is used for the flow distribution group as the output port, so that when the exchange equipment forwards the flow to the destinations, the flow distribution group in the first OpenFlow meter is used as the output port to forward the flow.

The invention discloses a multi-path load balancing method based on the price mechanism for an industrial real-time network. The method specifically comprises the following steps: an RYU control sendsa data packet to sense an overall network topology; real-time bandwidth and delay monitoring is carried out through the OpenFlow protocol; k shortest paths from feasible paths are calculated throughthe KSP algorithm and used as candidate path; link evaluation is carried out on the k candidate paths, the candidate path with the optimum current link status serves as a forwarding path, and the candidate path with the second optimum current link status serves as a reserved path; the RYU controller sends a forwarding strategy for a current network flow to flow tables of corresponding switches; and the RYU controller carries out real-time link status monitoring, and when a link utilization rate is larger than a threshold, reselects the optimum path other than the current path for rerouting andsends the flow tables to the switches. The method provided by the invention has the advantages that the network resource utilization rate can be improved, and network congestion can be reduced; and an SDN controller is used for whole network monitoring on a data center, and the forwarding path is selected according to current real-time network conditions, so that dynamic multi-path load balancingcan be achieved.

The invention discloses a system and a method for realizing cross-interchanger link aggregation on an OpenFlow interchanger. Through building an MLAG (multi-chassis link aggregation) application on an OpenFlow controller, the MLAG application triggers the OpenFlow controller to send an LACP (link aggregation control protocol) message to non-OpenFlow equipment through the OpenFlow interchanger, and in addition, the OpenFlow interchanger sends the LACP message received from the non-OpenFlow equipment to the MLAG application to be processed through the OpenFlow controller. The system and the method have the advantages that through a standardized OpenFlow protocol, an MLAG technology is realized, so that the OpenFlow interchanger can provide the load sharing and fault protection functions for the accessed non-OpenFlow equipment when the non-OpenFlow equipment is accessed, and the problem that the traditional Ethernet interchanger cannot realize the intercommunication of MLAG synchronous protocols among different manufacturers is solved.

The invention provides an SDN controller-oriented real-time DDoS attack detection system and method, and the method comprises the steps: analyzing a data packet collected by an SDN controller, judgingwhether a detection flow is abnormal or not through an entropy value, and carrying out the abnormal warning if the detection flow is abnormal; collecting flow table information through an OpenFlow protocol; allowing a controller to send a corresponding message to an OpenFlow switch to collect a flow table, wherein each flow table is composed of a plurality of flow table entries; analyzing changesof network flow distribution characteristics in unit time through the flow table entry information so as to detect attacks, extracting flow table entry related information and converting the flow table entry related information into one-dimensional characteristic information related to DDoS attacks; adopting a neural network algorithm to train datasets to generate a CNN-BiLSTM model, classifyingthe real-time traffic to realize the detection of the real-time DDoS attack. The DDoS attack flow detection in the SDN environment can be efficiently realized, and the false alarm rate of the system can be reduced.

The invention discloses a message processing method. The method comprises the following steps of creating a second OF (OpenFlow) port and a link aggregation port connected with the second OF port in a data forwarding module, and creating a corresponding uplink port for the link aggregation port to form an aggregation channel, wherein the uplink port includes more than one selected physical network card ports of a server; when a data message coming from a virtual machine network card enters a data forwarding module through a first OF port, forwarding the message to a second OF port by matching an uplink flow table, wherein the inlet port of the uplink flow table is taken as the first OF port into which the data message enters, and the outlet port is taken as the second OF port; and when a data message coming from the second OF port is received on the link aggregation port, selecting one selected physical network card port in an uplink port group for serving as the outlet port through a Hash algorithm, and forwarding the message. According to the method and the equipment, the load sharing of the host physical port of the server can be realized.