Diffusive Flow Table for SDN Switch Load Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN), the limited capacity of hardware flow tables in switches leads to increased latency and reduced efficiency due to the replacement of normal data flow entries with attack data flows, causing switches to fill up and require deletion of existing entries to accommodate new ones.
Innovation Solution
A method and apparatus that determine a diffusive flow table based on the load of neighboring switches, allowing switches to forward unmatched data flows to neighboring switches, thereby reducing the load on overloaded switches and improving hit ratios and latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the switch stores flow entries for attack data flows to fill up the flow table, then the flow table capacity is utilized, but the latency for processing normal data flows is increased
Solution Approach 1:
The patent segments the flow table processing by introducing a diffusive flow table that separates normal data flow handling from attack data flow handling. The diffusive flow table stores flow entries specifically for normal data flows, while attack data flows are handled differently (dropped or sent to controller), preventing them from displacing normal flow entries in the main flow table.
Solution Approach 2:
The diffusive flow table acts as an intermediary structure between the main flow table and the incoming data flows. It intercepts and handles normal data flows before they reach the main flow table, preventing displacement issues and reducing latency by providing a dedicated storage area for normal flow entries.
2Quantity of substance
If the switch uses a limited capacity TCAM for flow table implementation, then hardware resources are conserved, but the switch cannot handle large quantities of flow entries without deletion
Solution Approach 1:
The patent segments the flow table functionality into two parts: the main flow table (TCAM-based) for general flow entries, and a diffusive flow table specifically for normal data flows. This segmentation allows the system to prioritize normal data flow entries and handle them more efficiently, reducing the frequency of flow entry deletions and replacements.
Solution Approach 2:
The patent changes the operational parameters of flow table management by introducing diffusion probability and load thresholds. When the flow table load exceeds a threshold, the system activates diffusive flow table operations, dynamically adjusting how flows are handled based on current load conditions rather than using a static approach.
3Reliability
If the switch sends packet_in packets to the controller for every unmatched attack data flow, then flow entries can be obtained, but the controller becomes overloaded and normal data flow processing is delayed
Solution Approach 1:
The diffusive flow table serves as an intermediary that handles normal data flows locally without requiring controller intervention. By pre-storing flow entries for normal data flows in the diffusive flow table, the system can process these flows autonomously, reducing the number of packet_in packets sent to the controller and improving overall processing throughput.
Solution Approach 2:
The switch enables self-service processing for normal data flows by maintaining a local diffusive flow table with relevant flow entries. This allows the switch to handle normal data flows independently without constantly querying the controller, improving both reliability and productivity simultaneously.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6a
AI summary
The present invention relates to the communications field, and specifically, to a flow table processing method and an apparatus. The method includes: monitoring, by a switch, a flow table load of the switch; when the flow table load of the switch exceeds a preset threshold, determining, by the switch, a diffusion target of a target data flow according to a matching rule of a diffusive flow table; and when the determined diffusion target is a neighboring switch of the switch, forwarding, by the switch, the target data flow to the neighboring switch. When the flow table load of the switch exceeds the preset threshold, the switch may have been attacked. A data flow that fails to be matched to a flow entry is forwarded to the neighboring switch according to a diffusion probability, for processing by the neighboring switch. This reduces a frequency at which the switch updates flow entries, improves a hit ratio of a normal data flow, and reduces a latency for forwarding a normal data flow.