SDN数据平面中大规模流表的高性能查找方法研究

Software defined networking (SDN) has significantly improved network flexibility, manageability and controllability by decoupling data forwarding and logic control, and opening network programmability. Thus, it has become a hot topic in the field of future network. But when it comes to actual deployment, SDN data plane will face the performance bottleneck of data forwarding caused by large-scale OpenFlow flow tables. The existing flow table lookup methods are hard to satisfy practical requirements due to the lack of consideration on traffic pattern especially under malicious attacks in real networks. This project is therefore motivated to investigate the lookup performance of large-scale flow tables based on network traffic distribution characteristics. First, we will investigate the varying pattern of the uniformity of flow table fields at the time of their operations by introducing the concept of deviation index, which will provide the theoretical guidance for designing highly uniform hash functions of the flow tables. Second, we will build a classification scheme of large-scale flow tables and apply heuristic policies to optimize the organization pattern of flow table entries based on network traffic locality to dramatically improve flow table lookup performance. Finally, we will build a malicious flow separation mechanism and employ approximate membership queries to rapidly determine the search results of network attack packets in virtue of their properties, which will effectively stand against network malicious behaviors. Therefore, this project will resolve the performance bottleneck of data forwarding in OpenFlow switches to some extent, and contribute to promote the evolution and development of SDN.

软件定义网络SDN将数据转发和逻辑控制解耦，并开放网络可编程能力，极大提高了网络的灵活性和可管控性，成为近年来未来网络领域的研究热点。SDN在实际部署时，数据平面将面临OpenFlow流表规模庞大导致的数据转发性能瓶颈。现有的流表查找方法因缺乏考虑实际网络中特别是恶意攻击发生时的流量模式而难以满足实用要求。因此，本课题将从网络流量分布特性入手，围绕大规模流表查找性能展开深入研究。引入离散度概念，探究流表字段运算时的均匀性变化规律，为设计均匀性高的流表哈希函数提供理论指导；基于网络流量局部性，构建大规模流表分类管理方案，应用启发式策略优化流表项组织管理方式，显著提升流表查找性能；利用网络攻击包流特性，建立恶意流隔离缓存机制，应用近似从属查询理论快速判定流表查找结果，有效抵御网络恶意攻击。本课题的研究将在一定程度上解决OpenFlow交换机的数据转发性能瓶颈，为推进SDN的演进和发展做出贡献。

软件定义网络SDN作为一种数据转发和逻辑控制分离的创新网络架构，提高了网络的灵活性、可管控性和可编程性。当SDN进入大规模部署时，逻辑上集中的控制平面将出现严重的性能瓶颈，同时也面临OpenFlow大规模流表的存储查找性能问题。为此，本课题针对SDN大规模部署场景，测量包到达过程和流到达过程，建立OpenFlow分组转发排队模型，设计控制器集群优化部署方法，为SDN大规模部署提供参考依据。对于OpenFlow硬件交换机，基于流表字段特性和存储介质特性，构建OpenFlow大规模流表分级存储体系，利用流分布特性设计高效的流表查找方法，有效解决了大规模流表的存储空间问题。对于OpenFlow软件交换机，基于网络包流局部性设计缓存预测机制和掩码启发策略，应用近似从属查询方法快速判定流表查找失败结果，显著提升了OpenFlow包分类的流表查找性能。本课题的研究有效缓解了SDN控制平面和流表存储查找的性能瓶颈，为推进SDN大规模部署做出一定的理论和方法贡献。