Network operating system for managing and securing networks

• US 20090138577A1
• Filed: 09/26/2008
• Published: 05/28/2009
• Est. Priority Date: 09/26/2007
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Balland, Peter J. III, Shenker, Scott J., Gude, Natasha, Amidon, Keith Eric, Pfaff, Benjamin Levy, Wendlandt, Daniel J., Casado, Martin, Pettit, Justin
• Granted Patent: US 9,083,609 B2
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0809 Plug-and-play configuration
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0859 by keeping history of different configuration generations or by rolling back to previous configuration versions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Claims

1. A method for managing a network, comprising:

maintaining a view of current state of the network, the current state of the network characterizing the network topology and network constituents, the network constituents including network entities and network elements residing in or on the network;

characterizing the location and identity of network entities;

announcing events corresponding to changes in the state of the network; and

configuring one or more of the network elements based on the network view and/or one or more of the events.

2. The method of claim 1, further comprising accessing configuration state on network elements without using SNMP.

3. The method of claim 1 and further comprising maintaining a history of prior network views.

4. The method of claim 1 and further comprising maintaining a history of prior network flows and events.

5. The method of claim 1, further comprising providing a programmatic interface, the programmatic interface permitting management applications to access the network view, communicate network events, and configure network elements.

6. The method of claim 1, further comprising hosting virtual machines on a plurality of servers, wherein the virtual machines implement a controllable switch abstraction having a plurality of virtual switches, thereby creating a virtual environment.

7. The method of claim 3, further comprising maintaining a history of prior network flows and events.

8. The method of claim 7, further comprising performing a forensic analysis of the history of prior network views and the history of prior network flows and events.

9. The method of claim 1, further comprising selectively intercepting traffic destined for certain hosts, the certain hosts operating in a reduced power mode, wherein the hosts remain in reduced power mode until critical traffic is intercepted.

10. A method for managing network traffic, comprising enforcing a globally declared network policy, wherein enforcing the globally declared network policy includes ensuring that actions taken by network elements implement the globally declared network policy, wherein the actions including forwarding, and wherein the globally declared network policy refers to high-level names, is independent of network topology and is independent of the location of network constituents.

11. The method of claim 10, further comprising controlling network traffic wherein the control of traffic is performed on a real-time, per-flow basis.

12. The method of claim 10, wherein the globally declared network policy is enforced by commercial network switches and wherein the policy is implemented using ACL capabilities of the commercial network switches.

13. The method of claim 10, wherein the step of enforcing is performed without out-of-band communication and wherein all system traffic travels over network data paths used for communication between hosts and servers.

14. The method of claim 10, further comprising selectively intercepting traffic destined for certain hosts, the certain hosts operating in a reduced power mode, wherein the hosts remain in reduced power mode until critical traffic is intercepted.

15. The method of claim 10, further comprising hosting virtual machines on a plurality of servers, wherein the virtual machines implement a controllable switch abstraction having a plurality of virtual switches, thereby creating a virtual environment.

16. The method of claim 10, further comprising configuring network elements responsive to one or more network events.

17. A method for managing a network, in which new network constituents are discovered automatically, comprising automatically configuring one or more elements to adapt to the presence of the new network constituents.

18. The method of claim 17, wherein the attributes of the new network constituents are entered manually upon discovery and wherein the configuring step is performed consistent with these attributes.

19. The method of claim 17 wherein the configuring step includes enforcing a globally declared policy.

20. The method of claim 17 wherein network constituents includes at least one of a VM and a constituent hosted by a VM, and wherein servers and other network devices support virtual switches controllable and configurable in the same manner as physical network elements.

21. A method comprising routing a majority of traffic using ACL capabilities of commercial switches.

22. A method for intelligently intercepting packets destined for hosts, thereby enabling hosts to remain in reduced power modes until critical traffic is sent to them.

23. A method for selectively intercepting traffic destined for certain hosts, the certain hosts operating in a reduced power mode, wherein the hosts remain in reduced power mode until critical traffic is intercepted.

24. The method of claim 23, further comprising determining whether to forward a packet to a host, wherein the determining is performed by a controller that is not on a regular datapath.