Global Hash Table for Virtual Interface Address Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined data centers with virtualized networking, efficiently managing numerous firewall rules across a logical network is challenging due to the complexity of network traffic management and the need for optimized rule implementation.
Innovation Solution
A method is introduced that involves grouping network addresses into non-overlapping groups and generating global groups for service rules corresponding to virtual interfaces, allowing for efficient updates and management of firewall rules by using a global hash table and set intersections to reduce the number of flow entries and minimize priority re-assignment when rules change.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall rules are implemented in a distributed manner throughout the logical network, then network security coverage is improved, but the complexity of managing and updating service rules increases
Solution Approach 1:
The patent segments service rules into global groups and per-interface address groupings, allowing distributed firewall rules to be managed through hierarchical organization. Global groups contain service rules applicable across multiple interfaces, while per-interface groupings handle interface-specific rules, reducing overall management complexity.
Solution Approach 2:
The patent introduces global groups as an intermediary layer between the central controller and per-interface forwarding elements. This intermediary structure enables efficient propagation of service rule updates by allowing changes to be made at the global group level and automatically reflected across multiple interfaces without manual reconfiguration.
2Loss of energy
If the number of flow entries is reduced through address grouping, then network resource usage is improved, but the complexity of address grouping management increases
Solution Approach 1:
The patent merges multiple network addresses into non-overlapping address groups that can be represented by single flow entries. By combining addresses with identical service rule requirements into unified groups, the system reduces the total number of flow entries while maintaining security policy enforcement.
Solution Approach 2:
The patent transforms individual address matching into group-based matching by changing the parameter representation from specific IP addresses to abstract group identifiers. This parameter transformation enables more efficient flow table storage and processing while reducing memory and computational resources required for packet filtering.
3Adaptability or versatility
If service rules are updated frequently, then adaptability to changing network conditions is improved, but network churn and instability increase
Solution Approach 1:
The patent performs preliminary grouping of addresses into global groups before service rules are applied to interfaces. This preliminary organization creates a stable foundation that allows service rule updates to be propagated efficiently without requiring complete re-evaluation of address groupings, thereby reducing flow entry churn during updates.
Solution Approach 2:
The patent implements a nested structure where per-interface address groupings are contained within global groups. This nesting allows updates at the global group level to automatically propagate to child interfaces, enabling frequent service rule updates while maintaining stability through hierarchical inheritance rather than independent reconfiguration at each interface.
Data Source
AI summary
Certain embodiments described herein are generally directed to a hypervisor-wide data structure that holds service rule address information for multiple VIFs in a compact way, which can later be processed per-VIF, in order to perform VIF-specific address group updates. For example, certain embodiments described herein provide a network controller that maintains a global hash table for multiple VIFs that maps network addresses to groups of one or more service rules. In certain embodiments, a network address to service rules table for each VIF may be derived based on the global hash table by using set intersections.