Data model for software defined networks

• US 9,276,877 B1
• Filed: 03/15/2013
• Issued: 03/01/2016
• Est. Priority Date: 09/20/2012
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Wiretap Ventures, LLC
• Inventors: Chua, Roy Liang, Palmer, Matthew, Pearce, Andrew Keith, Hawley, David Warren
• Primary Examiner(s): Nguyen, Phuongchau Ba
• Application Number:
  US13/842,067
• Time in Patent Office: 1,082 Days
• Field of Search: 370/254, 709/223, 709/227, 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/036 Updating the topology between route computation elements, e.g. between OpenFlow controllers
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/42 Centralised routing
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

In one example, a controller device for a software defined network (SDN) includes one or more network interfaces configured to communicate with network devices of the SDN, and one or more processors configured to obtain data representative of the network devices in the SDN, instantiate software-based controller objects for controllers of the network devices, instantiate software-based switch description objects for switches of the network devices, wherein the software-based switch description objects each comprise data representative of a respective primary controller corresponding to a controller of the one or more controllers, a respective switch identifier, a respective switch media access control (MAC) address, a respective Internet protocol (IP) address, and a respective array of port description objects for each physical port on the respective switch, and managing, via the network interfaces, at least some of the switches using the switch description objects and the controller objects.

Claims

1. A method comprising:

obtaining, by a controller device of a software defined network (SDN), data representative of physical network devices in the SDN, wherein the physical network devices comprise one or more switches and one or more controllers including the controller device to build a network topology of the overall SDN network and connected physical devices;

instantiating, by the controller device, software-based controller objects for each of the one or more controllers, wherein the software-based controller objects each comprise data representative of a respective instance name, a respective server hostname, and a respective server host port to provide connectivity to each controlled object;

instantiating, by the controller device, software-based switch description objects for each of the one or more switches using a unique data model to effect port-based and header-based flow-controls for data packets traversing the one or more switches, wherein the software-based switch description objects each comprise data representative of a respective primary controller corresponding to a controller of the one or more controllers, a respective switch identifier, a respective switch media access control (MAC) address, a respective Internet protocol (IP) address, and a respective array of port description objects for each physical port on the respective switch; and

managing, by the controller device, at least some of the switches using the switch description objects and the controller objects to effect port-based and header-based control of flows for packets traversing the network topology.

2. The method of claim 1, wherein each of the port description objects comprises data representative of a respective port number, a respective port identifier, a MAC address, and a description of one or more capabilities for the respective port.

3. The method of claim 2, wherein the one or more capabilities comprise one or more of a media type for the respective port, a speed for the respective port, whether the respective port is half duplex or full duplex, and whether the port supports auto-negotiation.

4. The method of claim 1, further comprising:

determining changes to the SDN; and

logging the changes to the SDN in an event history.

5. The method of claim 4, wherein logging the changes comprises, for each change, logging data for an event record for an event causing the change, wherein the event record comprises a time of the event, a date of the event, a type for the event, a source for the event, a severity of the event, and a description of the event.

6. The method of claim 5, wherein logging data for the event record comprises logging a list of one or more values for arguments for the event.

7. The method of claim 1, wherein managing comprises defining a set of configuration data for managing a packet flow through the SDN that provides a data model supporting the instantiation of software FlowChain objects through the network topology.

8. The method of claim 7, wherein defining the set of configuration data comprises instantiating a software FlowChain object comprising data for an identifier, a source, one or more links between the switches for the packet flow, a flag indicating whether the FlowChain object is enabled, a flag indicating whether a path through the SDN corresponding to the FlowChain object is bi-directional, and a set of statistics.

9. The method of claim 8, wherein instantiating the software FlowChain object further comprises instantiating one or more software FlowLink objects that define respective software sub-device objects, wherein the software sub-device objects define a respective subset of network device functions for multi-function devices, and wherein the software sub-device objects comprise data representative of an identifier for a respective sub-device, an ingress switch identifier and port number, an egress switch identifier and port number, an ingress virtual local area network (VLAN) tag, an egress VLAN tag, a flag that indicates whether the sub-device is capable of performing network address translation (NAT), a flag that indicates whether the sub-device is capable of performing port address translation (PAT), and identifiers for physical ports of the sub-device.

10. The method of claim 1, further comprising instantiating a software service object that defines a class of traffic that flows through the SDN, wherein the service object comprises data representing an identifier for the service, a protocol type for the service, and one or more IP port-based service entries that define traffic controlled by the flow.

11. A controller device for a software defined network (SDN), the controller device comprising:

one or more network interfaces configured to communicate with network devices of the SDN; and

one or more processors configured to obtain data representative of the network devices in the SDN, wherein the network devices comprise one or more switches and one or more controllers including the controller device to build a network topology of the overall SDN network and connected physical devices, instantiate software-based controller objects for each of the one or more controllers, wherein the software-based controller objects each comprise data representative of a respective instance name, a respective server hostname, and a respective server host port to provide connectivity to each controlled object, instantiate software-based switch description objects for each of the one or more switches using a unique data model to effect port-based and header-based flow-controls for data packets traversing the one or more switches, wherein the software-based switch description objects each comprise data representative of a respective primary controller corresponding to a controller of the one or more controllers, a respective switch identifier, a respective switch media access control (MAC) address, a respective Internet protocol (IP) address, and a respective array of port description objects for each physical port on the respective switch, and manage, via the network interfaces, at least some of the switches using the switch description objects and the controller objects to effect port-based and header-based control of flows for packets traversing the network topology.

12. The controller device of claim 11, wherein each of the port description objects comprises data representative of a respective port number, a respective port identifier, a MAC address, and a description of one or more capabilities for the respective port, and wherein the one or more capabilities comprise one or more of a media type for the respective port, a speed for the respective port, whether the respective port is half duplex or full duplex, and whether the port supports auto-negotiation.

13. The controller device of claim 11, wherein the one or more processors are further configured to determine changes to the SDN, and log the changes to the SDN in an event history, wherein for each change, the one or more processors are configured to log data for an event record for an event causing the change, wherein the event record comprises one or more of a time of the event, a date of the event, a type for the event, a source for the event, a severity of the event, and a description of the event.

14. The controller device of claim 11, wherein the one or more processors are configured to instantiate a software FlowChain object comprising data for an identifier, a source, one or more links between the switches for the packet flow, a flag indicating whether the FlowChain object is enabled, a flag indicating whether a path through the SDN corresponding to the FlowChain object is bi-directional, and a set of statistics.

15. The controller device of claim 11, wherein the one or more processors are configured to instantiate a software service object that defines a class of traffic that flows through the SDN, wherein the service object comprises data representing an identifier for the service, a protocol type for the service, and one or more IP port-based service entries that define traffic controlled by the flow.

16. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed, cause a processor of a controller device for a software defined network (SDN) to:

obtain data representative of physical network devices in the SDN, wherein the physical network devices comprise one or more switches and one or more controllers including the controller device to build a network topology of the overall SDN network and connected physical devices;

instantiate software-based controller objects for each of the one or more controllers, wherein the software-based controller objects each comprise data representative of a respective instance name, a respective server hostname, and a respective server host port to provide connectivity to each controlled object;

instantiate software-based switch description objects for each of the one or more switches using a unique data model to effect port-based and header-based flow-controls for data packets traversing the one or more switches, wherein the software-based switch description objects each comprise data representative of a respective primary controller corresponding to a controller of the one or more controllers, a respective switch identifier, a respective switch media access control (MAC) address, a respective Internet protocol (IP) address, and a respective array of port description objects for each physical port on the respective switch; and

manage at least some of the switches using the switch description objects and the controller objects via issuing instructions to the switches using an appropriate protocol to drive the data packets through the network topology.

17. The non-transitory computer-readable storage medium of claim 16, wherein each of the port description objects comprises data representative of a respective port number, a respective port identifier, a MAC address, and a description of one or more capabilities for the respective port, and wherein the one or more capabilities comprise one or more of a media type for the respective port, a speed for the respective port, whether the respective port is half duplex or full duplex, and whether the port supports auto-negotiation.

18. The non-transitory computer-readable storage medium of claim 16, further comprising instructions that cause the processor to:

determine changes to the SDN; and

log the changes to the SDN in an event history, wherein for each change, instructions cause the processor to log data for an event record for an event causing the change, wherein the event record comprises one or more of a time of the event, a date of the event, a type for the event, a source for the event, a severity of the event, and a description of the event.

19. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to define the set of configuration data comprise instructions that cause the processor to instantiate a software FlowChain object comprising data for an identifier, a source, one or more links between the switches for the packet flow, a flag indicating whether the FlowChain object is enabled, a flag indicating whether a path through the SDN corresponding to the FlowChain object is bi-directional, and a set of statistics.

20. The non-transitory computer-readable storage medium of claim 16, further comprising instructions that cause the processor to instantiate a software service object that defines a class of traffic that flows through the SDN, wherein the service object comprises data representing an identifier for the service, a protocol type for the service, and one or more IP port-based service entries that define traffic controlled by the flow.