Sharded SDN Control Plane for Scalable Cross-Network Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As software defined networks (SDNs) scale, management by a single controller becomes burdensome and slow, necessitating a more efficient method to handle increased network complexity and facilitate seamless communication across virtual networks.
Innovation Solution
Implementing a sharded control plane architecture where controllers are divided by dimensions such as function or virtual network, enabling each controller to manage partial network information and authenticate access, allowing for easier scaling and updates without disrupting other functionalities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single controller manages the entire SDN, then centralized control is maintained, but management becomes slow and burdensome as network size increases
Solution Approach 1:
The control plane is segmented into multiple independent controller instances, each responsible for a specific shard of the network (e.g., specific virtual networks, functions, or network segments). This segmentation distributes the management burden, improving scalability and performance while reducing the complexity of any single controller instance.
2Adaptability or versatility
If controllers are sharded by dimensions such as function or virtual network, then scalability and flexibility improve, but coordination and authorization between controllers become more complex
Solution Approach 1:
Each controller instance is designed with universal capabilities to handle multiple types of requests and operations across different shards. Controllers can authenticate and authorize requests from other controllers, program host devices, and manage various virtual networks, reducing the need for specialized coordination protocols and simplifying inter-controller communication.
3Adaptability or versatility
If cross-network communication is enabled through sharded controllers, then network flexibility increases, but security verification becomes more challenging
Solution Approach 1:
The system implements a feedback-based authorization mechanism where controllers verify requests from other controllers by checking authentication tokens and maintaining authorization states. The verifying controller receives feedback from the source controller about the requesting device's credentials and makes authorization decisions based on this feedback, ensuring secure cross-network communication while maintaining flexibility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the disclosure are directed to a software defined network (SDN) having a sharded control plane. The SDN may include a host device and a sharded control plane. The sharded control plane may include a first controller and a second controller sharded by one or more dimensions. The first controller and the second controller may be configured to process requests received from the first host device based on their respective sharded one or more dimensions. The one or more dimensions may be networks or functions.