OpenFlow Proxy for SR-IOV NIC Traffic Segregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, controlling access to Single Root Input/Output Virtualization (SR-IOV) enabled network interface cards (NICs) is challenging, as current methods either rely on hardware-level control or lack efficient management of network traffic, leading to performance issues and difficulties in segregating network traffic.
Innovation Solution
Implementing an OpenFlow proxy that communicates with OpenFlow controllers and SR-IOV enabled NICs, using OpenFlow protocol rules to manage network traffic, allowing the proxy to query controllers for matching rules and update virtual switches, enabling centralized control and management of network access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If hardware-level control is used for SR-IOV NICs, then access speed and network performance are improved, but centralized control capability and network traffic segmentation are lost
Solution Approach 1:
The patent introduces an intermediary component (the proxy or controller) that mediates between the SR-IOV NIC and the virtual machine. This intermediary maintains direct hardware access for high performance while providing centralized control capabilities through software-based rule management and traffic segmentation.
2Productivity
If hardware-level control is used for SR-IOV NICs, then network access performance is improved, but network traffic segmentation and virtualization control are reduced
Solution Approach 1:
The patent applies segmentation by dividing network control into multiple components: a centralized controller for policy management, a proxy for rule translation, and virtual switches for traffic segmentation. This allows high-performance direct NIC access while maintaining sophisticated traffic segmentation through software-defined rules.
Solution Approach 2:
The proxy acts as an intermediary that translates centralized control rules into hardware-specific actions, enabling both high performance and flexible traffic segmentation simultaneously.
3Ease of operation
If centralized control is implemented through software, then network traffic management flexibility is improved, but processing overhead and performance latency increase
Solution Approach 1:
The system performs preliminary action by pre-compiling and caching network control rules in the proxy and virtual switches. This allows rapid rule application without real-time software processing overhead, reducing latency while maintaining flexibility.
Solution Approach 2:
The proxy intermediary pre-processes and optimizes control rules before they reach the hardware, reducing the processing burden on the main system and minimizing latency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for permitting a controller within a virtualization environment to control access to devices virtualized within hardware are described herein. For example, a NIC may be able to request rules that define how network traffic is managed at the NIC's virtual switch. In some arrangements, the NIC may transmit a query for the matching rule to a proxy, which may determine whether it has a rule matching the request. If the proxy does not have a matching rule, the proxy may query a controller for the matching rule, which may transmit the rule to the proxy. The proxy may update its store of rules and transmit the matching rule to the NIC. Upon receipt of the matching rule, the NIC may update the rules stored in its virtual switch and may process the packet in accordance with the matching rule.