916 results about "OpenFlow" patented technology

An OpenFlow switch controls transmission and reception of a packet according to a flow entry. Each of the flow entries contains a matching condition showing a communication flow of the packet and an action showing processing on the packet. An OpenFlow controller generates a registration flow entry which is stored in a flow table of a specific OpenFlow switch arranged on a route of the communication flow. An encapsulated packet is generated by relating the registration flow entry and an ordinary packet. The specific OpenFlow switch extracts the registration flow entry from the encapsulated packet in response to the reception of the encapsulated packet to produce a new flow entry and executes the action shown in the new flow entry.

A method of monitoring network traffic includes accessing a network that includes a controller and a switch device having a flow table, wherein the controller is communicatively coupled to the switch device, and is configured to program a behavior of the switch device through an openflow protocol, and obtaining information regarding the programmed behavior of the switch device, wherein the act of obtaining the information is performed by a network appliance that is communicatively coupled to the network. An apparatus communicatively coupled to a network, includes a processor configured for accessing the network that includes a controller and a switch device having a flow table, wherein the controller is communicatively coupled to the switch device, and is configured to program a behavior of the switch device through an openflow protocol, and obtaining information regarding the programmed behavior of the switch device.

The invention discloses a data center flow control method and a data center flow control system based on openflow. Openflow switchboards are controlled to operate a topology discovery protocol through a network controller, so tha information of all network nodes and links is collected and a network topology value is calculated; and the network controller periodically carries out end-to-end flow analysis on flows, calculates optimized paths of all the flows and transmits the optimized paths to each openflow switchboard, monitors the states of all the network links in real time, and maintains or downloads the optimized paths of the new flows to each openflow switchboard, so that the use rate of network bandwidth resources and the accuracy and the reliability of network concentrated management can be improved, the variation of the network flow can be fitted by sensitively regulating a flow load in a network, and the use rate and the reliability of the network can be effectively improved. The data center flow control method and the data center flow control system based on the openflow has a good application prospect.

A computer system according to the present invention includes a managing unit which outputs a plurality of virtual networks managed by a plurality of controllers in a visually perceivable form with the plurality of virtual networks combined, on the basis of topology data of the virtual networks, the topology data being generated based on communication routes. This enables centralized management of the whole of a virtual network controlled by a plurality of controllers which use an OpenFlow technology.

The invention discloses a network address translation (NAT) implementing system which comprises a controller and an openflow switch, wherein the controller issues a flow table and an improved group table, the openflow switch receives the flow table and the improved group table, a data package which needs to conduct address translation is matched according to a matching rule of the address translation recorded by the flow table, translation between a private address and a public internet protocol (IP) address is conducted according to a rule of address translation recorded by the improved group table, and the data package is transmitted out through an address which is translated. The invention further discloses an NAT implementing method and the openflow switch. According to the NAT implementing system, only the flow table and the improved group table are transmitted to the openflow switch once, frequent intersection between the openflow switch and the controller is not required, time delay of transmission of the data package is shortened, and transmission efficiency of a network is improved.

A logically centralized controller provides a stateful firewall service provider on a network. The logically centralized controller routes a plurality of packets associated with a traffic flow to a firewall, and blocks, allows, or further monitors the traffic flow based on the inspection of the plurality of packets by the firewall. The logically centralized controller thereby prevents unauthorized network activity while allowing network traffic to bypass the bottleneck created by the firewall.

The invention discloses a system and a method for interconnecting an openflow network and the conventional Internet protocol (IP) network. The method is characterized in that: the whole openflow network is abstracted into a router in the conventional IP network, under the control of a control subsystem, the whole openflow network acts as a standard router externally, and the control subsystem is mapped to a routing processing part of the standard router; a forwarding subsystem is mapped to be a data forwarding part of the standard router; and an edge interface of an edge exchange unit is mapped to be an interface of the standard router. According to the method, a system provided with the openflow network can be regarded as a router on the Internet, so the openflow network can be well integrated into the routing system of the whole Internet, and data packets pass through the openflow network just like passing through a hop standard router, so that interconnection between the openflow network and the conventional IP network is realized.

The invention discloses a communication method, a software defined network SDN switch and a communication system, and relates to the field of communication. The control system deployment cost of SDN equipment based on OpenFlow in the wide area network environment deployment process can be lowered. The communication method is applied to an SDN based on the OpenFlow, an SDN control network comprises the SDN switch, an operator wireless exit gateway, a wireless convergence gateway and an SDN controller, the SDN switch is connected to an operator wireless network served by the operator wireless exit gateway through a wireless communication module, and the wireless convergence gateway is respectively connected to the wireless exit gateway of the operator wireless network and the SDN controller through a wired network. The communication method comprises the step that the SDN switch is in communication with the SDN controller through the operator wireless network and the operator wireless exit gateway. The communication method is mainly used for the achievement process of the SDN control network based on the OpenFlow.

The invention discloses a flow cleaning framework and device and a flow lead and reinjection method. The flow lead and reinjection method comprises the steps that a flow cleaning flow table and a flow reinjection flow table are generated by an OpenFlow controller and are issued to an OpenFlow cleaning switcher; a flow lead flow table is generated and is issued to an OpenFlow core router. When a server is attacked, flow of the attacked server led according to the flow lead flow table is matched by the OpenFlow cleaning switcher according to the flow cleaning flow table to carry out flow cleaning; the cleaned clean flow is forwarded according to the flow reinjection flow table to achieve flow reinjection. According to the flow cleaning framework based on OpenFlow, flow lead and flow reinjection are achieved uniformly; an abnormal flow cleaning component is composed of the OpenFlow controller and the OpenFlow cleaning switcher to achieve separation of control over a flow cleaning system and forwarding of the flow cleaning system; when service requirements are changed, all kinds of flow tables can be updated just through the OpenFlow controller, and accordingly reconfiguration and redeploy of a network are easily and flexibly achieved.

Fine traffic monitoring is achieved in a network in which sFlow and OpenFlow are combined. Specifically, flow identifiers (flow IDs) for identifying flows (or groups of packets) are prepared, and the flow identifiers are stored in entries of flow tables to allow sFlow agents to specify the flow identifiers as data sources. Specifically, the flow identifiers are stored in cookies of entries registered in flow tables of switches from a controller, and operations are performed for received packets matching the rules of the entries in accordance with the actions defined in the entries. In the switches, the flow identifiers specified as data sources in the MIBs used in sFlow are obtained and statistic information of packets matching the entries is obtained on the basis of the flow identifiers.

The invention provides an openflow network and IP (Internet Protocol) network interconnection communication method, which comprises the following steps that: on a switch which supports openflow, a routing process of an uplink port and an openflow protocol process of a downlink port are set; when a routing message enters the uplink port, the routing process acquires the routing information of the routing message, a controller is informed about the routing information by using the openflow protocol to convert the routing information into a flow table entry which is issued, and the routing information is issued to an openflow network in the form of the flow table entry according to a routing table entry; and when a flow table entry message enters the downlink port, the openflow protocol process acquires the flow table entry information of the flow table entry message, the flow table entry information is transmitted to the controller for resolution through the openflow protocol, the routing process is informed about a route by using the openflow protocol and the flow table entry information is issued to an IP network in a routing way according to forwarding rules. The invention additionally provides an openflow subnet edge switch for openflow network and IP network interconnection communication. The openflow network and IP network interconnection communication method and the openflow subnet edge switch provided by the invention have the advantages that the intercommunication between the openflow network and the IP network is realized and the respective operation of the openflow network and the IP network is not influenced.

The invention provides a multilevel flow table-based Openflow message forwarding method and a multilevel flow table-based Openflow message forwarding system. The method comprises the following steps of: at least constructing a primary flow table, a secondary flow table and a tertiary flow table sequentially in series, wherein the primary and secondary flow tables are constructed in a ternary content addressable memory (TCAM) form, the tertiary flow table is constructed in a Hash table form, and the primary, secondary and tertiary flow tables can be used independently or in a combined way; searching for forwarding operation over a message on the basis of the primary, secondary and tertiary flow tables; and forwarding the message according to the forwarding operation. Particle sizes of the primary, secondary and tertiary flow tables are decreased, and the tertiary flow table is constructed in the Hash table form, so that the tertiary flow table can acquire more flow items, and the system cost is controlled.

The invention provides a method and system for designing a distributed virtual network in a cloud calculating data center. The method and system are applied to the technical field of cloud calculation. The method includes the following steps: creating a distributed virtual switch, wherein the distributed virtual switch is composed of a plurality of OpenFlow virtual switch bodies, an OpenFlow controller and a physical switch port; enabling the OpenFlow virtual switch bodies to be in communication with the OpenFlow controller according to preset strategies. According to the method, the distributed virtual switch is created based on the SDN thought and particularly achieved through the OpenFlow protocol. The whole data center is configured by the distributed virtual switch in a concentrated mode through the OpenFlow controller, virtual switch networking is accordingly simplified, and centralized management and intelligent monitoring on the virtual network environment in the cloud calculating data center are achieved.

The invention provides a method for achieving dynamic multicast spanning tree path adjustment based on OpenFlow. An OpenFlow technology is utilized to solve the problems in a multicast service of a host entering or leaving a multicast set, multicast spanning tree path dynamic adjustment and distributed multicast spanning tree strategies. According to the OpenFlow technology, a traditional packet forwarding process completely controlled by a router or a switch is converted into the process together completely by the OpenFlow switch and the controller, and therefore separation of forwarding logics and specific forwarding operation is achieved.

The invention relates to an OpenFlow control method and a corresponding insert, a platform and a network thereof. The method comprises the steps that mapping relationships between a user network and virtual local area networks as well as switch ports are built and stored according to the needs of building a network when OpenStack network nodes create the user network, in the mapping relationships, the user network corresponds to one or a plurality of virtual local area networks, and one virtual local area network corresponds to a plurality of switch ports; OpenStack calculation nodes synchronously store the mapping relationships in the OpenStack network nodes in an OpenFlow controller; the OpenFlow controller stores the synchronous mapping relationships of the OpenStack calculation nodes to generate a flow table and send the flow table to OpenFlow switches, and each virtual local area network in the mapping relationships is associated with one flow table item in the flow table. The invention further provides an OpenFlow controller insert, an OpenStack cloud management platform and a software defined network, and the quantity of flow table items is greatly reduced to be beneficial for system expansion through the binding of the virtual local area network and the flow table items.

The invention provides an OpenFlow network flow control method for the QoS assurance of an application. The OpenFlow network flow control method comprises the following steps that: a user requests a service from a server; the server sends a QoS request message to an SDN controller; after receiving the message, the controller calculates an optimal transmission path for the server according to a network resource use condition and reserves a resource; and simultaneously, the transmission state and the network link condition of the server are monitored when the server transmits a QoS data flow, such that a QoS flow is transmitted reliably and stably. A required network resource is provided for an application service by strictly assuring the QoS transmission of the application service and utilizing the service difference to network resource requirements; therefore, the QoS of the application is effectively ensured; and simultaneously, the network resource is utilized effectively.

A method for guaranteeing control traffic throughput in an in-band network configured for delivering control and data traffic, and considering both local and global views of the communication network. The method includes determining an initial configuration for forwarding first control traffic from the packet forwarding device, wherein the initial configuration comprises a first in-band queue for receiving the first control traffic that is delivered over the control path to the controller via a port in the packet forwarding device, and a first bandwidth reserved for the first queue. The method includes performing handshaking with the controller by sending a request to the controller confirming the initial configuration using a network control protocol, and receiving a response from the controller in association with the request. The method includes confirming or modifying the initial configuration based on the response.

The invention relates to a SDN network DDoS attack detecting method based on network layer flow abnormity in order to detect and process a DDoS attack in a SDN network according to the network layer flow abnormity. The method comprises steps of: getting access to an OpenFlow switch flow table information items by using a SDN network controller in order to acquire a communication flow characteristic reaching the OpenFlow switch; and analyzing and processing the acquired detection characteristic by using introduced information entropy and single-side connection density in order to obtain a training and detection characteristic element group. It is found that in a implementing process, the SDN network DDoS attack detecting and processing method based on network layer flow abnormity may effectively improve detection accuracy of the DDoS attack generated in the SDN network, makes corresponding treatment on a communication flow according to a detected result, may well deal with the DDoS attack, from which a network may possibly suffer, in the form of saturated flow, and has very obvious beneficial effects.

The invention discloses an SDN firewall state detecting method and system based on the OpenFlow protocol. The method comprises adding a state table and a state transition table inside an OpenFlow switch to recording the state and the change information of data flows; meanwhile, also establishing and maintaining a state transition table in an SDN controller to achieve synchronization of data flow states of the controller and the switch. Besides, the invention also discloses modification of the format of an original OpenFlow table. The modification comprises adding associated state fields into the original OpenFlow table, modifying the OpenFlow protocol and adding new message State_in to facilitate treatment of previous state operation information of the controller and the switch and to maintain uniformity of the connecting state tables in the controller and the switch. The SDN firewall state detecting method and system based on the OpenFlow protocol can effectively achieve access control with finer granularity, and meanwhile, by means of cooperative operation of the OpenFlow switch and the SDN controller, can complete deployment of a state detecting firewall and provide safe and efficient services for an SDN network.

The invention provides a method and a system for realizing Openflow multi-stage flow tables on the basis of a ternary content addressable memory (TCAM). The method comprises the following steps of: S1, dividing a TCAM table maintained on an Openflow switch into multiple logical flow tables; and S2, setting the matched domain type for each logical flow table. The TCAM table is divided into multiple logical flow tables and the matched field length of each flow table comprises multiple forms, so that storage items of the TCAM table are effectively increased, different application requirements are met and the manufacturing cost of the Openflow switch is effectively reduced.

The invention provides a transmission method for data among OpenFlow network domains and a device. The method comprises the steps: obtaining global network information by a controller of a local network domain, wherein the global network information is information which is needed when data exchange is conducted between the local network domain and an adjacent network domain; and for a data message of which a destination address is not located in the local network domain, controlling an exchanger of the local network domain through the controller of the local network domain to transmit the data message to the adjacent network domain according to the global network information. Through the technical scheme, an effect of the data exchange among the different OpenFlow network domains can be achieved.

The invention discloses an extensible virtual local area network message transmission method, a device and a system, which can be applied to an open flow network. When an open flow switch receives a first message sent by a first virtual machine in the open flow network, a match of the first message is built according to the information of the first message; according to the match of the first message, a first flow table entry corresponding to the match of the first message is acquired; according to the first flow table entry, package of the extensible virtual local area network VXLAN is ensealed by the first message, and the packaged first message is sent to a second virtual machine; and the first virtual machine and the second virtual machine are located in different open flow switches or different physical machines. The problem that the existing OpenFlow network protocol does not fully support the VXLAN can be solved.

The invention discloses an open storage managing and scheduling method and system based on a software-defined network. The system comprises an Openflow interchanger, an SDN network controller, an extra-domain origin server and one or more users. The open storage managing and scheduling system is characterized further comprising one or more intra-domain caching servers which serve as intra-domain origin servers used for storing resources for the users to request in a network, one or more users request the resources through the Openflow interchanger, requests of one or more users are forwarded to the SDN network controller through the Openflow interchanger, the resources requested by the users are cached to the intra-domain caching servers closest to the users, the SDN network controller guides the requests of the users again to the closest intra-domain caching servers which the resources requested by the users are cached in, and the requested resources are acquired from the caching servers according to the requests which are guided again.

The invention provides a streaming media distribution system and method based on a software defined network. The method includes the steps that a first application server of an access network extracts request parameters from a received request for streaming media data and sends the extracted request parameters to a first network controller; the first network controller retransmits the request parameters to a first service dispatching engine and instructs the access network and relevant network elements to reserve links and bandwidth resources for the request, wherein the first service dispatching engine is connected with the first network controller through the Openflow protocol; the first service dispatching engine inquires whether the requested streaming media are local; when the requested streaming media are local, the first service dispatching engine selects a streaming media server locally; the selected streaming media server provides the requested streaming media through the reserved links and the reserved bandwidth sources.

The invention relates to a parallel search method and system of Openflow. According to the method and system, a compression storage mode through longitudinal segmentation of a rule table is proposed for multi-component and multi-list data search of the Openflow, so as to meet the requirement for storage space. A fast search and forwarding function is realized through parallel search of engines; a flow table in the Openflow is longitudinally segmented, compressed and stored, and the engines process respective header field parts, so that fast massage sorting and forwarding are achieved; and the problems of low table look-up efficiency due to complicated Openflow rules and large power consumption are solved.

The invention provides a flow forwarding method and a flow forwarding device. The method is applied to an Openflow Controller in an OpenFlow network and comprises the following steps: A, determining exchange equipment for simultaneously bearing N equivalent paths in the OpenFlow network; B, notifying the exchange equipment of creating a flow distribution group, adding an output port corresponding to each path in the N equivalent paths on the exchange equipment into the flow distribution group; and C, distributing a first OpenFlow meter corresponding to the flow distribution group to the exchange equipment, wherein the first OpenFlow meter contains destinations of the N equivalent paths and is used for the flow distribution group as the output port, so that when the exchange equipment forwards the flow to the destinations, the flow distribution group in the first OpenFlow meter is used as the output port to forward the flow.

The invention discloses a multi-path load balancing method based on the price mechanism for an industrial real-time network. The method specifically comprises the following steps: an RYU control sendsa data packet to sense an overall network topology; real-time bandwidth and delay monitoring is carried out through the OpenFlow protocol; k shortest paths from feasible paths are calculated throughthe KSP algorithm and used as candidate path; link evaluation is carried out on the k candidate paths, the candidate path with the optimum current link status serves as a forwarding path, and the candidate path with the second optimum current link status serves as a reserved path; the RYU controller sends a forwarding strategy for a current network flow to flow tables of corresponding switches; and the RYU controller carries out real-time link status monitoring, and when a link utilization rate is larger than a threshold, reselects the optimum path other than the current path for rerouting andsends the flow tables to the switches. The method provided by the invention has the advantages that the network resource utilization rate can be improved, and network congestion can be reduced; and an SDN controller is used for whole network monitoring on a data center, and the forwarding path is selected according to current real-time network conditions, so that dynamic multi-path load balancingcan be achieved.

The invention discloses a system and a method for realizing cross-interchanger link aggregation on an OpenFlow interchanger. Through building an MLAG (multi-chassis link aggregation) application on an OpenFlow controller, the MLAG application triggers the OpenFlow controller to send an LACP (link aggregation control protocol) message to non-OpenFlow equipment through the OpenFlow interchanger, and in addition, the OpenFlow interchanger sends the LACP message received from the non-OpenFlow equipment to the MLAG application to be processed through the OpenFlow controller. The system and the method have the advantages that through a standardized OpenFlow protocol, an MLAG technology is realized, so that the OpenFlow interchanger can provide the load sharing and fault protection functions for the accessed non-OpenFlow equipment when the non-OpenFlow equipment is accessed, and the problem that the traditional Ethernet interchanger cannot realize the intercommunication of MLAG synchronous protocols among different manufacturers is solved.

The invention provides an SDN controller-oriented real-time DDoS attack detection system and method, and the method comprises the steps: analyzing a data packet collected by an SDN controller, judgingwhether a detection flow is abnormal or not through an entropy value, and carrying out the abnormal warning if the detection flow is abnormal; collecting flow table information through an OpenFlow protocol; allowing a controller to send a corresponding message to an OpenFlow switch to collect a flow table, wherein each flow table is composed of a plurality of flow table entries; analyzing changesof network flow distribution characteristics in unit time through the flow table entry information so as to detect attacks, extracting flow table entry related information and converting the flow table entry related information into one-dimensional characteristic information related to DDoS attacks; adopting a neural network algorithm to train datasets to generate a CNN-BiLSTM model, classifyingthe real-time traffic to realize the detection of the real-time DDoS attack. The DDoS attack flow detection in the SDN environment can be efficiently realized, and the false alarm rate of the system can be reduced.

The invention discloses a message processing method. The method comprises the following steps of creating a second OF (OpenFlow) port and a link aggregation port connected with the second OF port in a data forwarding module, and creating a corresponding uplink port for the link aggregation port to form an aggregation channel, wherein the uplink port includes more than one selected physical network card ports of a server; when a data message coming from a virtual machine network card enters a data forwarding module through a first OF port, forwarding the message to a second OF port by matching an uplink flow table, wherein the inlet port of the uplink flow table is taken as the first OF port into which the data message enters, and the outlet port is taken as the second OF port; and when a data message coming from the second OF port is received on the link aggregation port, selecting one selected physical network card port in an uplink port group for serving as the outlet port through a Hash algorithm, and forwarding the message. According to the method and the equipment, the load sharing of the host physical port of the server can be realized.