SDN Security Group Flow Table Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN), the complexity of matching security group flow tables increases with the number of virtual machine ports and rules, leading to inefficient packet processing due to the need for multiple combined flow tables, which complicates the matching process and increases the number of flow tables required.
Innovation Solution
The method splits the security group matching flow table into two parts: port matching flow tables and rule matching flow tables, each with a connection identifier, allowing the SDN controller to generate and match these tables separately, reducing the total number of flow tables needed and simplifying the matching process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single security group matching flow table is used to match packets against M virtual machine ports and N rules, then packet matching can be performed in one table, but the complexity of the flow table increases and the number of matching operations increases
Solution Approach 1:
The patent divides the security group matching flow table into two separate flow tables: a first flow table for matching virtual machine port information and a second flow table for matching security group rule information. This segmentation reduces the complexity of each individual flow table while maintaining the ability to match packets against M virtual machine ports and N rules. The SDN controller generates these separate flow tables and delivers them to the switching device, which processes packets through both tables to complete the matching operation.
2Adaptability or versatility
If multiple virtual machines are added to a security group with N rules, then the security group can serve more virtual machines, but the number of flow tables required increases to M*N
Solution Approach 1:
The patent segments the flow table generation process into two independent parts: one handling virtual machine port matching and another handling security group rule matching. This allows the system to support M virtual machines with N rules using only two flow tables instead of M*N flow tables. The first flow table handles port matching for all M virtual machines, and the second flow table handles rule matching for all N rules, eliminating the need for a Cartesian product of flow tables.
Solution Approach 2:
Each flow table is designed to be universal in its function: the first flow table universally matches all virtual machine port information regardless of which specific virtual machine, and the second flow table universally matches all security group rule information. This multi-functionality allows a single flow table to handle multiple virtual machines and rules without requiring separate flow tables for each combination.
3Ease of operation
If the SDN controller delivers a comprehensive security group matching flow table with all virtual machine and rule information, then all packet matching can be done in one place, but the matching process becomes complex and computationally intensive
Solution Approach 1:
The patent segments the matching process into two distinct stages corresponding to two separate flow tables. The first flow table performs port information matching and the second flow table performs rule information matching. This segmentation simplifies the matching process by breaking down the complex task of matching packets against M virtual machines and N rules into two simpler, more manageable matching operations, reducing the computational complexity at each stage.
Data Source
Figure 1a
Figure 1b
Figure 1c~2
AI summary
This application discloses a flow table processing method and the method is applicable to a software-defined networking SDN. After determining that M virtual machine ports are added to a security group, an SDN controller generates a first matching flow table set, a second matching flow table set, and an action flow table of the security group. The first matching flow table set and the second matching flow table set together implement matching of the security group. The action flow table of the security group includes a packet action for a packet that successfully matches the security group. The method provided in this application lowers complexity of a flow table used to implement security group matching, and improves security group matching efficiency.