Search

With the increase of network services, the scale of the flow table in the OpenFlow switch tends to increase rapidly, which makes it difficult to store flow tables in the limited memory of the switch, thus becoming a bottleneck of the SDN development. In order to reduce the storage space of internal flow tables in the SDN switch, this paper proposes two novel designs of multiple flow table based on the specific values in the matching field and logical relationship between matching fields.

With the rapid development of network technologies, many new technologies, such as Software Defined Network (SDN), are applied to firewalls to manage network security. However, current SDN firewalls cannot automatically change security policies according to dynamic network status or deploy personalized policy based on user identities. In this paper, we design a special SDN switch that incorporates a traffic acquisition module and a data analysis module. According to the traffic patterns caused by different user behaviors, the proposed switch could recognize the user identities by statistical analysis and clustering analysis, and automatically deploy corresponding network policies. Experiments conducted over an OpenvSwitch showed the proposed SDN switch could accurately identify three kinds of users and apply respective flow tables successfully.

Since the current SDN southbound interface level is low and programming situation is complex, it requires a high-level abstract programming language to simplify programming. First, this paper improves the NetCore programming language to generate NetCore-M language, so that it can support deployment of multi-policies combination including packet drop action. This paper describes in detail the syntax, semanteme, and implementation of NetCore-M language. Secondly, this paper describes the network policy conflict systematically and solves it. Finally, this paper shows that the modified multi-policies combination algorithm can effectively detect and prompt policies conflicts based on the implementation of the Pyretic project.