Software-defined network overlay

Patent metadata

Field	Value
Publication number	US-9258218-B2
Application number	US-201213691317-A
Country	US
Kind code	B2
Filing date	Nov 30, 2012
Priority date	Nov 30, 2012
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

A software-defined network overlay capability is configured to control one or more overlay networks using software-defined networking (SDN) in which control functions and forwarding functions are separated. The software-defined network overlay capability may be configured to vertically move packets across network layers, e.g., into an overlay network (e.g., into a tunnel via encapsulation), out of an overlay network (e.g., out of a tunnel via decapsulation), or the like. The software-defined network overlay capability may be configured to move packets from native forwarding infrastructure into an overlay network, between overlay networks (e.g., into a first overlay network from a second overlay network without leaving the second overlay network, out of a first overlay network and into a second overlay network, out of a first overlay network while remaining within a second overlay network, or the like), from an overlay network onto native forwarding infrastructure, or the like.

First claim

What is claimed is:

1. An apparatus, comprising:
a processor and a memory communicatively connected to the processor, the processor configured to:
determine a data flow definition for a data flow, wherein the data flow definition is based on one or more protocol header fields of one or more protocols, wherein the one or more protocols comprise one or more network layer protocols or one or more transport layer protocols;
determine a set of actions to be performed for the data flow at a forwarding element, wherein the set of actions comprises at least one tunneling action and at least one security action, wherein the at least one tunneling action comprises at least one of a set of multiple encapsulation actions or a set of multiple decapsulation actions, wherein the at least one security action is associated with a security protocol and comprises at least one of an encryption action or a decryption action;
wherein the set of multiple encapsulation actions comprises a tunneling encapsulation action, a transport layer encapsulation action, and a network layer encapsulation action;
wherein the set of multiple decapsulation actions comprises a network layer decapsulation action, a transport layer decapsulation action, and a tunneling decapsulation action; and

propagate, toward the forwarding element, control information indicative of the data flow definition and the set of actions.

2. The apparatus of claim 1 , wherein the processor is configured to:
receive information associated with the data flow; and
determine, based on the information associated with the data flow, at least one of the data flow definition or the set of actions.

3. The apparatus of claim 1 , wherein the processor is configured to:
identify the forwarding element toward which the control information is propagated.

4. The apparatus of claim 1 , wherein the at least one tunneling action is configured for at least one of moving packets of the data flow into a tunnel, moving packets of the data flow between tunnels, or moving packets of the data flow out of a tunnel.

5. The apparatus of claim 1 , wherein the at least one tunneling action is configured for at least one of moving packets of the data flow from native forwarding infrastructure into a tunnel or moving packets from a tunnel to native forwarding infrastructure.

6. The apparatus of claim 1 , wherein the at least one tunneling action comprises the set of encapsulation actions, wherein the control information comprises an indication of a protocol to be used to encapsulate packets of the data flow and an indication of at least one protocol header field to be used to encapsulate packets of the data flow.

7. The apparatus of claim 6 , wherein the control information further comprises at least one protocol header field value to be set for the at least one protocol header field.

8. The apparatus of claim 6 , wherein the control information further comprises at least one of an indication that computation of a packet checksum is to be performed or an indication that packet sequence numbers are to be added to packets of the data flow.

9. The apparatus of claim 1 , wherein the at least one tunneling action comprises the set of decapsulation actions, wherein the control information comprises an indication of a protocol from which packets of the data flow are to be decapsulated.

10. The apparatus of claim 9 , wherein the control information further comprises at least one of an indication that verification of a packet checksum is to be performed or an indication that packet sequence numbers are to be verified.

11. A method, comprising:
using a processor and a memory for:
determining a data flow definition for a data flow, wherein the data flow definition is based on one or more protocol header fields of one or more protocols, wherein the one or more protocols comprise one or more network layer protocols or one or more transport layer protocols;
determining a set of actions to be performed for the data flow at a forwarding element, wherein the set of actions comprises at least one tunneling action and at least one security action, wherein the at least one tunneling action comprises at least one of a set of multiple encapsulation actions or a set of multiple decapsulation actions, wherein the at least one security action is associated with a security protocol and comprises at least one of an encryption action or a decryption action;
wherein the set of multiple encapsulation actions comprises a tunneling encapsulation action, a transport layer encapsulation action, and a network layer encapsulation action;
wherein the set of multiple decapsulation actions comprises a network layer decapsulation action, a transport layer decapsulation action, and a tunneling decapsulation action; and

propagating, toward the forwarding element, control information indicative of the data flow definition and the set of actions.

12. An apparatus, comprising:
a processor and a memory communicatively connected to the processor, the processor configured to:
receive, at a forwarding element from a control element, control information comprising a data flow definition for a data flow and a set of actions to be performed for the data flow at the forwarding element, wherein the data flow definition is based on one or more protocol header fields of one or more protocols, wherein the one or more protocols comprise one or more network layer protocols or one or more transport layer protocols, wherein the set of actions comprises at least one tunneling action and at least one security action, wherein the at least one tunneling action comprises at least one of a set of multiple encapsulation actions or a set of multiple decapsulation actions, wherein the at least one security action is associated with a security protocol and comprises at least one of an encryption action or a decryption action;
wherein the set of multiple encapsulation actions comprises a tunneling encapsulation action, a transport layer encapsulation action, and a network layer encapsulation action;
wherein the set of multiple decapsulation actions comprises a network layer decapsulation action, a transport layer decapsulation action, and a tunneling decapsulation action; and

process a packet of the data flow based on the control information.

13. The apparatus of claim 12 , wherein the processor is configured to process the packet of the data flow based on the control information by:
identifying the data flow with which the packet is associated based on information included within the packet and the data flow definition of the data flow;
identifying the at least one tunneling action to be performed for the data flow based on a mapping of the data flow definition to the at least one tunneling action; and
performing the at least one tunneling action for the packet of the data flow.

14. The apparatus of claim 12 , wherein the at least one tunneling action is configured for at least one of moving packets of the data flow into a tunnel, moving packets of the data flow between tunnels, or moving packets of the data flow out of a tunnel.

15. The apparatus of claim 12 , wherein the at least one tunneling action is configured for at least one of moving packets of the data flow from native forwarding infrastructure into a tunnel or moving packets from a tunnel to native forwarding infrastructure.

16. The apparatus of claim 12 , wherein the at least one tunneling action comprises the set of encapsulation actions, wherein the control information comprises an indication of a protocol to be used to encapsulate packets of the data flow and an indica

Assignees

• Hampel Georg
• Steiner Moritz
• Bu Tian
• Alcatel Lucent

Inventors

• Hampel Georg
• Steiner Moritz
• Bu Tian

Classifications

• H04L45/38 Primary

  Flow based routing · CPC title

• H04L12/6418

  Hybrid transport · CPC title

• H04L45/64

  using an overlay routing layer · CPC title