WO2015027924A1

WO2015027924A1 - Method, apparatus, and controller for controlling flow table update

Info

Publication number: WO2015027924A1
Application number: PCT/CN2014/085324
Authority: WO
Inventors: 李勇; 牛小兵; 金德鹏; 柳嘉强; 刘彬
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-09-02
Filing date: 2014-08-27
Publication date: 2015-03-05
Also published as: CN104426813A

Abstract

A method, an apparatus, and a controller for controlling flow table update. The method comprises: when an old flow table needs to be updated with a new flow table, according to a filter switch mapping rule of the old flow table and a filter switch mapping rule of the new flow table, determining all first filter switches whose filter rule needs to be modified among multiple filter switches; and performing a control operation only on the all first filter switches, where the control operation on any first filter switch is performed in the following manner: a first control operation; a second control operation; and a third control operation. The foregoing technical solution provides a new manner that implements flow table update without violating a filter rule.

Description

Control method, device and controller for flow table update

Technical field

The present invention relates to the field of the Internet, and in particular, to a method, a device, and a controller for controlling flow table update.

Background technique

Software Defined Network (SDN) refers to separating the data plane from the control plane. The data plane consists of a packet forwarding device with a unified interface. The control plane consists of a centralized controller. The controller controls the packet forwarding function by configuring the forwarding rules of the data plane forwarding device. Due to the large scale of network nodes, strong dynamic traffic between nodes, and high requirements for continuous connectivity and reliability of the network, the data center needs flexible and fine control of packet forwarding. The software-defined network receives data because it meets this requirement. The focus of the central network designer.

The OpenFlow protocol is the most widely used protocol for control plane and data plane communication in SDN networks. An OpenFlow switch refers to a forwarding device that supports the OpenFlow protocol. It processes incoming packets through flow table rules configured by the controller. In particular, because the OpenFlow protocol supports packet loss operations, you can configure flow table rules on the OpenFlow switch to implement packet filtering. However, because the number of flow tables and the access bandwidth of the switch are limited, in order to cope with large-scale data traffic, multiple switches need to be used for filtering at the same time, and the load of each switch is the same as possible to improve resources. Utilization and filtering performance. After considering these factors, Figure 1 shows a typical two-layer structure for packet filtering based on OpenFlow switches. In this structure, the first layer switch S implements packet classification and equalization functions, and the second layer switch F implements filtering rules for each type of data packet. For example, for the file access service, the switch S divides the data packet into an authorized user data packet and an unauthorized user data packet according to the source IP address, and the second layer switch filters the access of the unauthorized user to the specific file server according to the destination IP address, and Ensure that authorized users can access normally. For convenience of description, S is called an ingress switch, and F is called a filtering switch. And use several data streams to abstract all packets entering S, the data stream can be defined by a typical 5-tuple, ie (source MAC address, destination MAC address, source IP address, destination IP address, protocol), each type of data A package consists of several data streams. According to security rules, packets corresponding to certain flows need to be filtered out, which we refer to as filtering rules for such packets. Different types of packets have different filtering rules.

In order to ensure security, the filtering rules implemented by the filtering switch should be consistent with the type of the data packet forwarded to it, that is, if S forwards the packet of the jth class, then the filtering of the jth class packet should be implemented in ^; rule. In addition, when different types of data traffic are transformed, the controller needs to modify the flow tables in S and F to achieve new equalization, so that the traffic forwarded to each filter switch is as equal as possible.

However, since the flow tables in the modified S and F cannot be guaranteed to take effect at the same time, the flow table update process may violate the filtering rules. The so-called violation filter rule refers to forwarding the k-th packet to F j≠k when the flow table in the middle implements the j-type packet filtering rule. Therefore, a flow table update scheme is required to ensure that the flow table update process does not violate the filter rules.

In the current flow table update scheme, the flow table before and after the update is regarded as two sets of different flow tables, which are respectively referred to as the old flow table and the new flow table. First write the intermediate flow table at the ingress switch, so that the ingress switch uploads the data packet in the update process to the controller cache; then writes a new flow table in each filter switch, and then waits for the new flow table in all the filter switches to be valid. A new flow table is written at the ingress switch, and the cached packets are returned to the ingress switch for processing. Summary of the invention

In view of this, the embodiment of the present invention provides a method, a device, and a controller for controlling flow table update, to solve the technical problem of how to implement flow table update that does not violate the filtering rule.

To solve the above technical problem, the solution provided by the embodiment of the present invention is as follows:

The embodiment of the present invention provides a method for controlling flow table update, which is used for a controller in a data center network, where the data center network further includes an ingress switch and multiple filter switches, and the method includes:

When the old flow table needs to be updated to the new flow table, all the first filter switches that need to modify the filtering rule are determined according to the filter switch mapping rule of the old flow table and the filter switch mapping rule of the new flow table. ; Control operations are performed only on all the first filter switches, where the control operations for any of the first filter switches include:

a first control operation, the controlling the ingress switch to stop forwarding, to the any first filtering switch, a data packet of a corresponding data packet type, where the corresponding data packet type is in a filtering switch mapping rule of the old flow table The type of the packet corresponding to any of the first filter switches;

a second control operation, after the ingress switch stops forwarding the data packet of the corresponding data packet type to the any first filtering switch, modifying any one of the first filtering according to the filtering switch mapping rule of the new flow table Filtering rules in the switch;

a third control operation, after modifying the filtering rule in any one of the first filtering switches, modifying a forwarding rule for the any first filtering switch in the ingress switch according to a forwarding rule of the new flow table .

Preferably, the first control operation comprises:

Determining, by the plurality of filter switches, a second filter switch corresponding to the corresponding packet type in a filter switch mapping rule of the old flow table, and obtaining a determination result;

When the result of the determination is YES, the forwarding target device for the first data flow in the ingress switch is modified to the second filtering switch; wherein the first data flow is a forwarding rule of the old flow table. The data flow corresponding to any of the first filter switches.

Preferably, the first control operation comprises:

Modifying, in the ingress switch, a forwarding target device for the second data flow to the controller, so that the controller is capable of modifying the ingress switch for each of the first filtering switches, respectively, in the ingress switch After forwarding the rule, the data packet of the second data stream received from the ingress switch is returned to the ingress switch; wherein the second data stream is described in a forwarding rule of the old flow table. The data flow corresponding to any first filter switch.

Preferably, the controlling operations on all the first filter switches include: performing control operations on all the first filter switches in sequence.

Preferably, the step of performing control operations on all the first filter switches includes: a selecting step, selecting one of the to-be-processed filter switches from all the pending filter switches according to the preset first selection policy; The filter switch to be processed is a filter switch that has not modified the filtering rule in all the first filter switches; a controlling step of performing a control operation on the selected one of the to-be-processed filter switches; a returning step, after the selected control operation of the one to be processed filter switch is completed, being present in all the first filter switches When the filter switch is to be processed, the selection step is returned.

Preferably, the selecting step comprises:

Determining, in the filter switch mapping rule of the old flow table, the number of the filter switches corresponding to the same data packet type as each of the to-be-processed filter switches;

The reciprocal of the quantity is used as an update cost of each of the to-be-processed filter switches; according to a preset second selection policy, the one to be processed is selected from the to-be-processed filter switches whose calculated update cost is the smallest Process the filter switch.

Preferably, the second selection policy comprises a random selection policy.

The embodiment of the present invention further provides a flow table update control device, which is used for a controller in a data center network, where the data center network further includes an ingress switch and a plurality of filter switches, and the device includes:

The determining module is configured to: when the old flow table needs to be updated to the new flow table, determine, according to the filter switch mapping rule of the old flow table and the filter switch mapping rule of the new flow table, that the filtering rule needs to be modified in the plurality of filtering switches All first filter switches;

The control module is configured to perform control operations only on all the first filter switches, where the control operations for any of the first filter switches include:

Preferably, the first control operation comprises: Determining, by the plurality of filter switches, whether a second filter switch corresponding to the corresponding packet type in the filter switch mapping rule of the old flow table is obtained, and obtaining a determination result;

Preferably, the first control operation comprises:

Preferably, the control module is configured to sequentially perform control operations on all of the first filter switches.

Preferably, the control module is configured to perform the following steps to control the sequence of all the first filter switches:

Selecting, according to the preset first selection policy, selecting one of the pending filtering switches from all the pending filtering switches; wherein the to-be-processed filtering switch is a filtering rule that has not been modified in all the first filtering switches. Filter switch;

a controlling step of performing a control operation on the selected one of the to-be-processed filter switches; a returning step, after the selected control operation of the one to be processed filter switch is completed, being present in all the first filter switches When the filter switch is to be processed, the selection step is returned.

Embodiments of the present invention also provide a controller of a control device including the flow table update described above.

Embodiments of the present invention also provide a computer program comprising program instructions that, when executed by a controller, cause the controller to perform the method as described above.

Embodiments of the present invention also provide a carrier carrying the computer program. As can be seen from the above, the embodiment of the present invention has at least the following beneficial effects: In the process of modifying the filtering rules of the filtering switch that needs to modify the filtering rule, the ingress switch does not forward the data packet to the filtering switch, so the process does not cause the problem of violating the filtering rule. On the other hand, since the above method is only The filtering switch that needs to modify the filtering rule performs the control operation. For other filtering switches that do not need to modify the filtering rules, the foregoing method does not need to stop the forwarding and filtering processing of the data packets corresponding to the other filtering switches, thereby avoiding such a Unnecessary latency of the packet. BRIEF abstract

Figure 1 shows a schematic diagram of a two-layer structure for implementing packet filtering based on an OpenFlow switch;

2 is a flow chart showing the steps of a flow table update control method according to an embodiment of the present invention; and FIG. 3 is a schematic structural diagram of a flow table update control device according to an embodiment of the present invention. Preferred embodiment of the invention

The embodiments of the present invention will be described in detail below with reference to the drawings and specific embodiments. The features of the embodiments of the present invention and the embodiments may be arbitrarily combined with each other without conflict.

The flow table update scheme indicated in the prior art needs to update the flow table in all the filter switches, and does not let the ingress switch forward the data packets to any one of the filter switches during the flow table update process. However, there may be a filtering switch whose filtering rules in the new and old flow tables are of the same type, and in the process of writing a new flow table to such a filtering switch, let the ingress switch forward the corresponding to it. Packets do not cause problems with violations of filtering rules. Therefore, in the background, stopping the ingress switch to forward the corresponding data packet to such a filter switch is unnecessary for avoiding the violation of the filtering rule, but the packet is caused by buffering the part of the data packet. Unnecessary waiting delay.

2 is a flow chart showing the steps of a flow table update control method according to an embodiment of the present invention. Referring to FIG. 2, an embodiment of the present invention provides a flow table update control method for a controller in a data center network. The data center network further includes an ingress switch and a plurality of filtering switches, and the method includes the following steps: Step 201: When the controller needs to update the old flow table to the new flow table, determine, according to the filter switch mapping rule of the old flow table and the filter switch mapping rule of the new flow table, that the filter rule needs to be modified in the plurality of filter switches. All first filter switches;

Step 202: The controller performs control operations on all the first filter switches, where the control operation for any first filter switch is performed as follows:

a first control operation, the controller controls the ingress switch to stop forwarding a data packet of a corresponding data packet type to the any first filtering switch, where the corresponding data packet type is a filtering switch mapping rule of the old flow table The data packet type corresponding to any one of the first filter switches; the second control operation, after the controller stops forwarding the data packet of the corresponding data packet type to the any first filter switch, according to the Filtering switch mapping rules of the new flow table, and modifying the filtering rules in any of the first filtering switches;

After the third control operation, the controller, after modifying the filtering rule in any one of the first filtering switches, modify the ingress switch for any one of the first filtering switches according to the forwarding rule of the new flow table. Forwarding rules.

It can be seen that, in the process of updating the flow table in the above manner, in the process of modifying the filtering rule of the filtering switch that needs to modify the filtering rule, the ingress switch does not forward the data packet to the filtering switch, so that the process does not cause violation of the filtering rule. On the other hand, since the foregoing method only controls the filtering switch that needs to modify the filtering rule, the foregoing method does not need to stop the data packet corresponding to the other filtering switch for other filtering switches that do not need to modify the filtering rule. Forwarding and filtering processing, thereby avoiding unnecessary waiting delays of such packets. In addition, the above method does not need to write a new flow table to the filter switch that does not need to modify the filtering rule, thereby reducing the number of flow table writes required for the update process. In addition, the above method can be realized by a set of flow meters.

Among them, the switch is for example: OpenFlow switch.

The old flow table includes an initial flow table, or a flow table after the flow table is updated according to the related art. The filter switch mapping rule of the old flow table may be parsed by the controller from the old flow table;

The filter switch mapping rule of the new flow table may be parsed by the controller from the new flow table; The forwarding rule of the new flow table may be parsed by the controller from the new flow table. A filter switch that needs to modify the filter rule is a filter switch that has a different packet type in the filter switch mapping rule of the old flow table and the filter switch mapping rule of the new flow table.

The modifying the filtering rule in any one of the first filtering switches according to the filtering switch mapping rule of the new flow table may include:

The filtering rule in any one of the first filtering switches is modified to the filtering rule corresponding to any one of the first filtering switches in the filtering switch mapping rule of the new flow table.

The modifying the forwarding rule for the any one of the first filtering switches in the ingress switch according to the forwarding rule of the new flow table may include:

The forwarding rule for the any one of the first filter switches in the ingress switch is modified to be a forwarding rule corresponding to any one of the first filter switches in the forwarding rule of the new flow table.

In the embodiment of the present invention, the first control operation may include:

The forwarding target device for the first data stream refers to that the ingress switch forwards the received data packet of the first data stream to the received data packet according to the self flow table after receiving the data packet of the first data stream to device of.

Alternatively, the first control operation may include:

The forwarding rule of the old flow table may be parsed by the controller from the old flow table. The forwarding target device for the first data stream refers to the device to which the ingress switch forwards the received data packet of the first data stream according to its own flow table after receiving the data packet of the first data stream. .

Certainly, the specific manner of the foregoing first control operation may also be combined. For example, the first control operation may include:

When the result of the determination is YES, the forwarding target device for the first data flow in the ingress switch is modified to the second filtering switch; wherein the first data flow is a forwarding rule of the old flow table. a data flow corresponding to any one of the first filter switches;

When the result of the determination is no, the forwarding target device for the second data flow in the ingress switch is modified to be the controller, so that the controller can modify the ingress switch in the ingress switch respectively. After the forwarding rule of all the first filtering switches, the data packet of the second data stream received from the ingress switch is returned to the ingress switch; wherein the second data stream is the The data flow corresponding to any of the first filter switches in the forwarding rule of the old flow table.

In the embodiment of the present invention, in the step of performing control operations on all the first filter switches, the control operations may be sequentially performed on all the first filter switches.

Optionally, in the step of performing control operations on all the first filter switches, the control operations may be performed on all the first filter switches in the following manner:

The selecting step may include:

Determining, in the filter switch mapping rule of the old flow table, each of the pending filtering The number of filter switches corresponding to the same packet type on the switch;

The second selection policy includes a random selection policy.

In order to make the embodiments of the present invention more clear, the preferred embodiments of the embodiments of the present invention are provided below.

The preferred embodiment provides a flow table update method for guaranteeing security rules in an SDN, wherein the old flow table is an initial flow table, and the flow table update method for ensuring security rules in the SDN includes the following steps:

Step A: The controller obtains initial data: includes an analysis flow table, and obtains initial and new forwarding rules and switch mapping rules, where the forwarding rules refer to a scheme for forwarding different data flows to different filtering switches; It refers to a scheme of assigning different filter switches to different types of data and executing corresponding filtering rules. Specifically, it includes analyzing the initial flow table, obtaining the initial forwarding rule = { ^ , l ≤ / ≤ J}, Ff = « indicates that the data stream is initially forwarded/forwarded to the nth filter switch, and the initial filter switch mapping rule is obtained M = 3⁄4" , 1 _≤ ⁿ ≤ N} , M _x ⁿ = m means that the nth filter switch implements the filtering rule of the mth type packet at the initial time; analyzes the new flow table, and obtains a new forwarding rule FW ₂ = {FW, 1 ≤ ! ≤ L ; and the new filter switch mapping rule M ₂ = {w ₂ ", l ≤ w ≤ N}.

Step B: The controller compares the initial filter switch mapping rule M\ and the new filter switch mapping rule M ₂ to obtain a filter switch set F _c that needs to modify the filtering rule, that is, a switch set with different initial filtering rules and new filtering rules;

In step C, the controller selects the filter switch F with the lowest update cost from the set of filter switches F _c that need to be modified. The update cost may be defined according to different goals and needs; the update cost may be measured by different methods, for example, by the reciprocal of the number of switches implementing the same type of filtering rule, and the embodiment of the present invention is not limited to a specific update. Cost measurement method; When selecting the filter switch with the least cost, if the update cost of multiple filter switches is equal and at the same time, the filter switch F with the lowest cost as the final update is randomly selected. ;

In step D, the controller analyzes the current filter switch mapping rule to obtain and F. Have the same filtering a collection of other filter switches of the rule;

Step E: If not, the controller modifies the flow table of the ingress switch S according to the initial forwarding rule, and forwards it to F. The data stream is forwarded to the filter switch in ^; if ^ is empty, the controller modifies the flow table in the ingress switch and forwards it to F. The data stream is forwarded to the controller cache;

Step F, the controller is updated with F. Related flow tables, including first modifying F. Filtering rules to meet the new filter switch mapping rules; then, according to the new forwarding rules, modify the flow table in the ingress switch to forward the corresponding data stream to F. Finally, remove F from F _c . ;

Step G, if not empty, return to step C to execute; otherwise, perform step H;

In step H, the controller modifies the flow table in the ingress switch S to implement the forwarding rule FW _{2 of the} new flow table. In step I, the controller sends the data packet buffered by the controller to the ingress switch for processing.

In the following, from the perspective of logical reasoning, it is explained how the preferred embodiment ensures that the security rules are not corrupted during the update process. The security rule is not corrupted. The filtering rule implemented by the filtering switch in the flow table update process is consistent with the type of data packet forwarded to it.

Steps A, B, C, and D do not involve flow table updates, so they do not break the security rules;

Step E involves modifying the flow table in the ingress switch S. Since the filter switch in ^ has the same forwarding rules, the switch that forwards the data stream forwarded to it does not break the filter rule; when it is empty, it is forwarded to F. Forwarding the data stream to the controller cache does not break the security rules;

Step F involves modifying the flow table in the ingress switch S and the filter switch F. After the end of step E, no data stream has been forwarded to filter switch F. , so modify F. The filtering rules are safe; after modifying the filtering rules, F. The filtering rules satisfy the new switch mapping rules. Therefore, according to the new forwarding rules, the flow table in S is modified to forward the corresponding data stream to F. Is safe;

Step G does not involve flow table updates, so it does not break the security rules;

Before the step H is executed, the modification of the filtering rules of all the filtering switches is complete. That is, all the filtering switches meet the filtering rules of the filtering switch corresponding to the new flow table. Therefore, it is safe to modify the flow table in S according to the new forwarding rules.

Before the execution of step I, the flow table of all switches has been updated from the initial flow table to the new flow table. In this case, the flow entry of the switch is set to comply with the security rules, so the data packet buffered during the update process is sent to the ingress switch S for processing. It is safe. The preferred embodiment is directed to a flow table update in a packet filtering scenario based on an OpenFlow switch in a software-defined data center network, and a new flow table update scheme that does not destroy the filtering rule is provided, which is guaranteed in the flow table update process. The filtering rules deployed by the filtering switch are the same as the packet types forwarded to it.

The scheme based on the intermediate flow table pointed out in the background is a flow table update scheme in a general scenario, mainly focusing on the consistency of the flow table update process, and also considering the flow table before and after the update as two sets of different flow tables, respectively For the old flow table and the new flow table, in the update process, for each data packet, or according to the old flow table, or according to the new flow table, it cannot be processed according to the old flow table in some network devices. In other network devices, it is processed according to the new flow table. For consistency purposes, there is another option: Use the Virtual Local Area Network (VLAN) tag to distinguish between the old and new sets of flow tables. At the same time, set the VLAN tag for each packet entering the network at the ingress switch. The network device processes incoming packets with flow table rules having the same VLAN tag.

Although the above two schemes can be used for the flow table update in the scenario shown in Figure 1, there are several main problems. First, the VLAN tag-based scheme includes both old and new flow tables in the update process, and needs to occupy more flow table resources. In addition, since VLANs are used as labels, global VLAN allocation and management are required. Second, the middle is used. The scheme of the flow table uploads the data packet to the controller during the update process, so the controller interface bandwidth and processing capability will become the bottleneck affecting the network performance. Finally, the above two schemes update the flow table in all the switches in parallel, although The time required for the flow table update is reduced, but it will cause a sudden increase in control network traffic and affect network performance.

Compared with the VLAN tag-based update method, the preferred embodiment uses only one set of flow table resources in the update process, which reduces the requirement of the flow table resource in the update process, and since the VLAN tag is not used, the preferred embodiment is The scenario shown in Figure 1 is more versatile; compared to the intermediate flow table based update method, the preferred embodiment avoids uploading all data packets involved in the update process to the controller for processing, reducing the load on the controller. In addition to the above advantages, the preferred embodiment uses a sequential update scheme, in which the controller updates only one or a few switch flow tables at each time, compared to the parallel scheme, the flow control information caused by the flow table update task The increase is less, so that the preferred embodiment effectively reduces the control traffic jitter while ensuring that the flow table update process does not violate the security rules.

The preferred embodiment ensures that the flow table update process does not compromise the security defined by the data center network. Filter rules, and reduce the number of flow tables required during the update process, reducing the jitter of network traffic during the update process.

In the preferred embodiment, the update cost is measured according to the reciprocal of the number of switches that can be used to implement the same filtering rule, and the related flow is preferentially performed on the filter switch with the smallest number of switches currently available to implement the same filtering rule. The table update helps to reduce the packet traffic that needs to be uploaded to the controller during the update process.

Preferred embodiments of the preferred embodiment are set forth below, and how the preferred embodiment is applied to the flow table update process is illustrated.

The preferred embodiment assumes two types of data packets; three filter switches, ^ and four data streams, and wherein data streams 1-2 form a first type of data packet, and data stream 3-4 constitutes a second type of data packet. . And assume that the initial forwarding rule is FW _{1 =} {FWI = FW^ = 2, FW, ³ = 3, FW, ⁴ = 3}, that is, data stream 1 is forwarded to ^, data stream 2 is forwarded to F ₂ , and the data stream is forwarded. 3 and data stream 4 is forwarded to F ₃ ; the mapping rule of the initial filter switch is ^^^^, ^ ² ^, ^?), that is, F ₂ implements the filtering rule of the first type of data packet, and F ₃ implements the second type. The filtering rules for the packet. The new forwarding rule is FW ₂ = {FW = 1, FW ₂ ² = 1, FW = 2, FW ₂ ⁴ = 3}, ie, data stream 1 and stream 2 are forwarded to the new stream table, stream 3 Forward to F ₂ , data stream 4 is forwarded to F ₃ ; new filter switch mapping rule is M ₂ = =

= 2, ₂ ³ = 2}, that is, the new flow table ^; the filtering rules for the first type of data packets, and the filtering rules for the second type of data packets.

In step B, by comparing and ₂ , the filter switch set F _c ={Fj needs to be modified; in step C, the switch with the lowest update cost is selected = F ₂ ;

Since the filtering rules of the first type of data packets are implemented, the F is obtained in step D. Switch set with the same filtering rules = };

Since it is not empty, in step E, the flow table in S is modified, and the data stream 2 forwarded to =^ ₂ is changed to the filter switch forwarded to;

Since M ₂ ² = 2, in step F, the filter switch F is first modified. The flow table in =F ₂ is used to implement the filtering rule of the second type of data packet; then, according to the forwarding rule Ff ₂ , the flow table in S is modified, and the data stream 3 is forwarded to the filter switch F ₂ ; finally ^=^ Remove from it;

After the step F is executed, the F _{c is} already an empty set, so the step H is directly executed, and the current forwarding rule has been corresponding to the forwarding rule FW ₂ corresponding to the new flow table, the current filter switch mapping rule, and the new flow table. The filter switch mapping rule M ₂ is completely the same, so the flow table does not need to be modified in step H; and the data packet is not uploaded to the controller during the update process, so step 1 is not required, so in the preferred embodiment The flow table update process ends here.

As shown in FIG. 3, an embodiment of the present invention further provides a flow table update control device, which is used for a controller in a data center network, where the data center network further includes an ingress switch and a plurality of filter switches, where the device includes :

The control module is configured to perform control operations only on all the first filter switches, where the control operations for any of the first filter switches are performed as follows:

It can be seen that, in the process of modifying the filtering rule by the filtering switch that needs to modify the filtering rule, the ingress switch does not forward the data packet to the filtering switch, so that the process does not cause a violation of the filtering rule; Because the foregoing method only controls the filtering switch that needs to modify the filtering rule, the foregoing method does not need to stop the forwarding and filtering processing of the data packet corresponding to the other filtering switch for other filtering switches that do not need to modify the filtering rule. , thus avoiding unnecessary waiting delays of such packets.

The first control operation may include:

Determining, by the plurality of filter switches, whether a second filter switch corresponding to the corresponding packet type in the filter switch mapping rule of the old flow table is obtained, and obtaining a determination result; When the result of the determination is YES, the forwarding target device for the first data flow in the ingress switch is modified to the second filtering switch; wherein the first data flow is a forwarding rule of the old flow table. The data flow corresponding to any of the first filter switches.

Alternatively, the first control operation may include:

In the embodiment of the present invention, in the control module, the control operations may be sequentially performed on all the first filter switches.

Optionally, in the control module, all the first filter switches may be sequentially controlled in the following manner:

The embodiment of the invention further provides a controller, which includes the control device for updating the flow table described above.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct the associated hardware, such as a read only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software. The above is only an embodiment of the present invention. It should be noted that those skilled in the art can make some improvements and refinements without departing from the principles of the embodiments of the present invention. Retouching should also be considered as the scope of protection of the embodiments of the present invention.

Industrial applicability

In the above technical solution, in the process of modifying the filtering rule of the filtering switch that needs to modify the filtering rule, the ingress switch does not forward the data packet to the filtering switch, so that the process does not cause a violation of the filtering rule; The technical solution only controls the filtering switch that needs to modify the filtering rule. For other filtering switches that do not need to modify the filtering rule, the foregoing method does not need to stop the forwarding and filtering processing of the data packet corresponding to the other filtering switch. Unnecessary waiting delays for such packets are avoided.

Claims

claims

1. A flow table update control method for a controller in a data center network. The data center network also includes an ingress switch and multiple filter switches. The method includes:

When the old flow table needs to be updated to a new flow table, all first filtering switches among the plurality of filtering switches that need to modify the filtering rules are determined based on the filtering switch mapping rules of the old flow table and the filtering switch mapping rules of the new flow table. ;

Only control operations are performed on all the first filtering switches, where the control operations on any first filtering switch include:

The first control operation is to control the ingress switch to stop forwarding data packets of a corresponding data packet type to any first filtering switch; wherein the corresponding data packet type is the filtering switch mapping rule of the old flow table. Describe the data packet type corresponding to any first filtering switch;

The second control operation is to modify the any first filtering according to the filtering switch mapping rules of the new flow table after the ingress switch stops forwarding data packets of the corresponding data packet type to the any first filtering switch. Filtering rules in the switch;

The third control operation is to modify the forwarding rules of the ingress switch for any first filtering switch according to the forwarding rules of the new flow table after modifying the filtering rules in any first filtering switch. .

2. The method of claim 1, wherein the first control operation includes: determining whether any of the plurality of filter switches corresponds to the corresponding data packet type in the filter switch mapping rule of the old flow table. The second filtering switch obtains the judgment result;

When the judgment result is yes, modify the forwarding target device for the first data flow in the ingress switch to the second filtering switch; wherein, the first data flow is the forwarding rule of the old flow table The data flow corresponding to any first filtering switch described in .

3. The method of claim 1, wherein the first control operation includes: modifying the forwarding target device for the second data flow in the ingress switch to the controller, so that the controller can After the ingress switch modifies the forwarding rules in the ingress switch for all the first filtering switches, the data packet of the second data flow received from the ingress switch is returned to the ingress switch. ; Wherein, the second data stream is the data flow corresponding to any first filtering switch in the forwarding rule of the old flow table.

4. The method according to claim 1, wherein the controlling operation only on all the first filtering switches includes:

Control operations are sequentially performed on all first filter switches.

5. The method of claim 4, wherein the step of sequentially controlling only all first filter switches includes:

The selection step is to select one of the filtering switches to be processed from all the filtering switches to be processed according to the preset first selection strategy; wherein the filtering switch to be processed is one of all the first filtering switches that has not yet modified the filtering rules. filter switch;

Control step: perform a control operation on the selected filter switch to be processed; return step: after the control operation of the selected filter switch to be processed is completed, there are When a filter switch is pending, return to the selection steps described.

6. The method of claim 5, wherein the selecting step includes:

Determine the number of filter switches currently corresponding to the same data packet type as each of the pending filter switches in the filter switch mapping rules of the old flow table;

The reciprocal of the number is used as the update cost of each filter switch to be processed; according to the preset second selection strategy, select the filter switch to be processed from the filter switches to be processed with the smallest calculated update cost. Handle filter switches.

7. The method of claim 6, wherein the second selection strategy includes a random selection strategy.

8. A flow table update control device, used for a controller in a data center network. The data center network also includes an ingress switch and a plurality of filter switches. The device includes:

The determination module is configured to determine, according to the filtering switch mapping rules of the old flow table and the filtering switch mapping rules of the new flow table, which of the plurality of filtering switches need to modify the filtering rules when the old flow table needs to be updated to the new flow table. All first filter switches;

The control module is configured to only perform control operations on all first filter switches, where the control operations for any first filter switch include: The first control operation is to control the ingress switch to stop forwarding data packets of a corresponding data packet type to any first filtering switch; wherein the corresponding data packet type is the filtering switch mapping rule of the old flow table. Describe the data packet type corresponding to any first filtering switch;

9. The device of claim 8, wherein the first control operation includes: determining whether any of the plurality of filter switches corresponds to the corresponding data packet type in the filter switch mapping rule of the old flow table The second filtering switch obtains the judgment result;

10. The apparatus of claim 8, wherein the first control operation includes: modifying the forwarding target device for the second data flow in the ingress switch to the controller, so that the controller can After the ingress switch modifies the forwarding rules of the ingress switch for all the first filtering switches, the data packet of the second data flow received from the ingress switch is returned to the ingress switch. ; Wherein, the second data flow is a data flow corresponding to any first filtering switch in the forwarding rules of the old flow table.

11. The device according to claim 8, wherein the control module is configured to sequentially control all the first filter switches.

12. The device according to claim 11, wherein the control module is configured to perform the following steps to sequentially control all the first filter switches:

The selection step is to select one of the filtering switches to be processed from all the filtering switches to be processed according to the preset first selection strategy; wherein the filtering switch to be processed is one of all the first filtering switches that has not yet modified the filtering rules. filter switch; Control step: perform a control operation on the selected filter switch to be processed; return step: after the control operation of the selected filter switch to be processed is completed, there are When a filter switch is pending, return to the selection steps described.

13. A controller, which includes the flow table updating control device according to any one of claims 8 to 12.

14. A computer program, including program instructions. When the program instructions are executed by a controller, the controller can execute the method described in any one of claims 1 to 1.

15. A carrier carrying the computer program of claim 14.