Efficient conflict detection in flow-based virtualized networks

In the current Internet, traffic is routed at the level of destination prefixes. The next-generation Internet requires control of traffic at the level of flows or flow aggregates. To accommodate fine-grained control, modern switching substrates (e.g., OpenFlow) maintain forwarding information for each active flow in a flow table. A separate control plane manages flows within a subnetwork by updating this flow information within switches. When using network virtualization, a technique that allows sharing of networking resources among different logical networks, the physical switch and its flow table need to be shared. Current virtualization solutions in OpenFlow do not support hardware isolation in the flow table and thus lead to hidden conflicts and misconfiguration of flows. To maintain network-level flow integrity, we propose two new conflict detection techniques. The first algorithm uses an hybrid hash-trie structure to represent the flow table and determine the conflicting flows using a divide and conquer strategy. The second mechanism uses an ontology based logic inference system to represent and infer the conflicting flow entries. We performed extensive experimental evaluation of both the techniques. For flow table with thousands of flow entries, the proposed techniques effectively resolve the conflicts in approximately 100 milliseconds.