System and method for dataplane extensibility in a flow-based switching device

A network switching device includes a macroflow sub-plane that performs packet-based routing, a microflow routing module that performs flow-based routing, and a software defined network (SDN) agent. The microflow routing module includes a packet processing module and a virtual port, and is operable to determine that the packet processing module is to be utilized to process a flow, direct the flow to the packet processing module via the virtual port in response to determine that the packet processing module is to be utilized to process the flow, process the flow using the packet processing module, and direct the flow to a destination associated with the flow. The SDN agent sends a port status message to a SDN controller indicating that the microflow routing module includes the virtual port and that the virtual port is associated with the packet processing module.

FIELD OF THE DISCLOSURE

The present disclosure generally relates to information handling systems, and more particularly relates to dataplane extensibility in a flow-based switching device in a network.

BACKGROUND

DETAILED DESCRIPTION OF THE DRAWINGS

Network100includes networked systems110,120,130, and140, a flow-based switching device160, and an external network180. Systems110,120,130, and140represent a variety of computing resources of network100including client information handling systems, data processing servers, network storage devices, local and wide area networks, or other resources as needed or desired. System110includes a network interface card (NIC)112, system120includes a NIC122, system130includes a NIC132, and system140includes a NIC142. NICs112,122,132, and142represent network adapters that are operable to provide a data interface to transmit and receive data between the respective systems110,120,130, and140. As such, NICs112,122,132, and142can represent add-in cards, network interfaces that are integrated with a main board of respective systems110,120,130, and140, another network interface capability, or a combination thereof. Each of NICs112,122,132, and142are uniquely identified on network100via one or more unique identifiers. For example, NICs112,122,132, and142can each be identified by one or more of a media access control (MAC) address, an Internet protocol (IP) address, a world wide name (WWN), or another unique identifier, as needed or desired.

Systems110,120,130, and140are adapted to run one or more applications150,152,154, and156, or to run associated host applications151,153,155, and157. Thus, as illustrated, system110is running applications150,152,154, and156, system120is running host application151that is associated with application150, system130is running host application153that is associated with application152, and system140is running host application155that is associated with application154and host application157that is associated with application156. For example, application150can represent an electronic mail client application that is associated with host application151that represents an electronic mail server, application152can represent a data storage client application that is associated with host application153that represents a data storage server, application154can represent a web browser application that is requesting web data from host application155that represents a hosted website, and application156can represent streaming multimedia content that is associated with host application157that represents a streaming multimedia server.

Flow-based switching device160includes ports162,164,166, and168. Switching device160operates to route data packets between ports162,164,166, and168. As such, switching device160receives data packets from ports162,164,166, and168, determines the destination for the data packets, and sends the data packets to the port that is associated with the destination. Port162is connected to NIC112, port164is connected to NIC122, port166is connected to NIC132, and port168is connected via external network180to NIC142. As such, data packets received from system110on port162will be directed to port164,166, or168, based upon whether the data packets are destined for system120,130, or140. Data packets from systems120,130, and140will similarly be directed to appropriate port162,164,166, or168.

Switching device160includes a control plane170and a data plane175. Control plane170represents a central processing unit (CPU) complex and operates to provide network discovery, mapping, and management based upon various protocols, and provides for differentiated service within switching device160. For example, control plane170can perform network discovery and mapping based upon a shortest path first (SPF) or open shortest path first (OSPF) protocol, a peer-to-peer protocol (PPP), a neighbor discovery protocol (NDP), a border gateway protocol (BGP), or another network mapping and discovery protocol. Control plane110can also provide network management based upon a simple network management protocol (SNMP), a trivial file transfer protocol (TFTP), a Telnet session, or another network management protocol.

Data plane175performs the routing functions of switching device160by receiving data packets from ports162,164,166, and168, determining the destination for the data packets, and sending the data packets to the port that is associated with the destination. The routing functions can be packet-based or flow-based. As such, data plane175includes a packet-based routing engine177and a flow-based routing engine179. Packet-based routing engine177provides for routing behavior that is determined based upon the port that receives the data packets and a determination of the port to which the data packets are to be forwarded. For example, packet-based routing engine177can provide for routing based upon the Open Systems Interconnect (OSI) model for layer 2 and layer 3 data packet routing. Here, packet-based information is determined based upon header information of the data packets. For example, the header information can include a source MAC address, a source IP address, a destination MAC address, a destination IP address, another type of data packet header information, or a combination thereof. As such, packet-based routing engine177can include a routing table that associates certain destination addresses with the respective ports162,164,166, and168that are used to forward the data packets.

Table 1 illustrates an example of a packet-based routing table for network100. Here NIC112has a MAC address of 12:34:56:78:9a:bc, and an IP address of 000.111.001, NIC122has a MAC address of de:f0:12:34:56:78, and an IP address of 000.111.002, and NIC132has a MAC address of ab:12:cd:34:ef:56, and an IP address of 000.111.003. Data packets received by switching device160on ports164,166, or168, and that have header information that includes the MAC address or the IP address for NIC112, will be routed to port162. Similarly, data packets received that have header information that matches the MAC address or the IP address for NICs122and132will be routed to ports164and166, respectively. In a particular embodiment, packet-based routing engine177provides for routing behavior that is determined based upon other packet-based rules, such as those determined by an access control list (ACL), a firewall, a filter, another packet-based rule, or a combination thereof. In another embodiment, the packet-based routing table includes other fields for layer 2, layer 3, and ACL routing, as needed or desired.

Flow-based routing engine179provides for routing behavior that is determined based upon the particular flow of information with which the data packets are associated. A flow is a sequence of data packets sent from a particular source to a particular unicast, anycast, or multicast destination that the source desires to label as a flow, and can consist of all data packets in a specific transport connection or media stream. For example, a flow can be associated with a particular application, a user, a media stream, another flow identifier, or a combination thereof, as needed or desired. Flow-based routing engine179performs deep packet inspection to determine whether or not data packets received from servers110,120,130, or140are associated with a flow. As such, flow-based routing engine179can include flow routing rules, a flow routing table, other flow control mechanisms, or a combination thereof, in order to ascertain that a certain data packet is associated with a flow, and to thereby determine a port162,164,166, or168to which to forward the data packets.

Table 2 illustrates an example of a flow-based routing table for network100. Here in addition to the MAC address and IP address routing associations, the table includes each identified flow, and the associated egress port, application, and user. Here, when a deep packet inspection of the data packets indicates that the data packets are associated with one of the identified flows, the data packet is routed to the associated port162,164,166, or168. For example, if a data packet is identified as being a data packet associated with an e-mail from a first user that is being sent to an e-mail server, then the data packet will be routed to the host e-mail server151on system120. When host e-mail server151provides data packets back to the first user, the deep packet inspection of the data packet will reveal that the data packet is associated with flow—6, and the data packet will be routed via port162to e-mail application150on server110. In a particular embodiment, flow-based routing engine179provides for routing behavior that is determined based upon other data packet information, such as those determined by tuple inspection of the data packets, another flow-based rule, or a combination thereof. In another embodiment, the flow-based routing table includes other fields for flow-based routing, as needed or desired.

FIG. 2illustrates a network200similar to network100, including a flow-based switching device210and a software defined network (SDN) controller220. Switching device210is similar to switching device160, and has a split data plane including a macroflow sub-plane212and a microflow sub-plane214. Macroflow sub-plane212operates similarly to packet-based routing engine177, and microflow sub-plane214operates similarly to flow-based routing engine179. In a particular embodiment, macroflow sub-plane212represents an application specific integrated circuit (ASIC) that is suitable to receive data packets on a port of switching device210, and to quickly make routing decisions for the data packets using packet-based routing techniques as described above. For example, macroflow sub-plane212can be implemented via readily available, low cost, commercial ASIC product that is adapted to provide efficient packet-based routing.

In a particular embodiment, microflow sub-plane214represents a processing capability of switching device210that is suitable to receive data packets on a port of switching device210, and to quickly make routing decisions for the data packets using flow-based routing techniques as described above. For example, microflow sub-plane214can be implemented as a multi-core processing complex that is able to rapidly make multiple processor-intensive flow-based routing decisions, such as a network processing unit (NPU). The split data plane thus provides an adaptable, scalable solution to increased flow-based traffic on network200.

SDN controller220provides visibility into the switching paths of the network traffic through macroflow sub-plane212and microflow sub-plane214, and permits the switching paths to be modified and controlled remotely. SDN controller220establishes a link with macroflow sub-plane212via an SDN agent222that operates on switching device210, and establishes a link with microflow sub-plane214via an SDN agent224that operates on the switching device. SDN agents222and224permit secure communications between the SDN controller210and sub-planes212and214. An example of an SDN includes a network that is controlled by an OpenFlow protocol, or another flow-based switching network instantiated in software. In a particular embodiment, switching device210operates to support virtual port addressing on macroflow sub-plane212, on microflow sub-plane214, or on both, as needed or desired.

Macroflow sub-plane212receives and routes data packets230and232. As illustrated, macroflow sub-plane212receives both data packets230and232. Macroflow sub-plane212determines if the data packets are able to be routed based upon the packet-based rules implemented by the macroflow sub-plane. If so, microflow sub-plane212routes the data packets. For example, data packets230represent a group of data packets that can be routed based upon the packet-based rules, and data packets230are shown as transiting switching device210through only macroflow sub-plane212. However, if the data packets are not able to be routed based upon the packet-based rules implemented by macroflow sub-plane212, or if the data packets otherwise require further classification based upon a deep packet inspection, the data packets are sent to microflow sub-plane214, and the microflow sub-plane routes the data packets. For example, data packets232represent a group of data packets that cannot be routed based upon the packet-based rules, and data packets232are shown as transiting switching device210through both macroflow sub-plane212and microflow sub-plane214.

FIG. 3illustrates a network300similar to network200, including a flow-based switching device310, a SDN controller340, and a packet processing module store350. Switching device310is similar to switching device210, and has a split data plane including a macroflow sub-plane320and a microflow sub-plane330. Switch310includes a hardware accelerator312. Microflow sub-plane330includes a packet processing module332, a flow table334, and virtual ports336and338. Macroflow sub-plane320operates similarly to Macroflow sub-plane320, and microflow sub-plane330operates similarly to microflow sub-plane214. In a particular embodiment, macroflow sub-plane320represents an application specific integrated circuit (ASIC) that is suitable to receive data packets on a port of switching device310, and to quickly make routing decisions for the data packets using packet-based routing techniques as described above, and microflow sub-plane330represents a processing capability of switching device310that is suitable to receive data packets on a port of switching device310, and to quickly make routing decisions for the data packets using flow-based routing techniques as described above. SDN controller340provides visibility into the switching paths of the network traffic through macroflow sub-plane320and microflow sub-plane330, and establishes links with the macroflow sub-plane via an SDN agent342, similar to SDN agent222, and with the microflow sub-plane via an SDN agent344, similar to SDN agent224. The routing of data packets through macroflow sub-plane320is similar to the routing of data packets through macroflow sub-plane212and the routing of data packets from the macroflow sub-plane to microflow sub-plane330is similar to the routing of data packets to microflow sub-plane214, as described above.

Switching device310provides for in-flow data packet processing extensions. Here, in addition to the flow routing rules, flow routing table, other flow control mechanisms for the routing of data packets within microflow sub-plane330, further processing on the data packets is performed by hardware accelerator312included in switch310, and by packet processing module338in the microflow sub-plane. Hardware accelerator312represents a processing capability that is included with switch310, and can be implemented on the switch as dedicated hardware circuitry, firmware operating on the switch to provide the acceleration functionality, or a combination thereof. As such, hardware accelerator312can be provided by the manufacturer of switch310at the time of manufacture, or can be an updated functionality through firmware updates or the like. An example of the functionality provided by hardware accelerator312includes a virtual private network (VPN), a packet encryption engine, a packet compression engine, a firewall, an intrusion prevention and detection system (IPDS) functionality, payload pattern matching, key lookup, bit field manipulation, another functionality provided with switch310, or a combination thereof. Packet processing module332represents similar functionality as can be provided by hardware accelerator312, but where the functionality is added to microflow sub-plane330. For example, packet processing module332can be loaded into a memory of an NPU on microflow sub-plane330. In a particular embodiment, the functions of hardware accelerator312and of packet processing module332are activated based upon data packet processing extensions that are defined by a particular specification, such as the OpenFlow Switch Specification, or another open network specification. In this embodiment, particular tags or markers in the data packets can be identified which initiate the processing of the data packets of a particular flow by hardware accelerator312and by packet processing module332. Note that in a particular embodiment, packet processing module332can include some or all of the functions of hardware accelerator312, as needed or desired.

In another embodiment, the functions of hardware accelerator312and of packet processing module332are activated based upon flow routing. A method of activating hardware accelerator312and packet processing module332based upon flow routing is shown here, when a flow360is identified that is to utilize the functionality of packet processing module332, a flow entry is created in flow table334that associates the flow with virtual port336, and that associates the virtual port with a continuation of the routing of the flow to the desired destination for the flow. Here, when data packets are received at switch310that are associated with flow360, the data packets are directed to microflow sub-plane330, and flow table334directs that the data packets be routed in microflow sub-plane330to virtual port336, and the data packets are processed by packet processing module332. The processed data packets of flow360are routed back through virtual port336and the processed data packets are directed to the destination address associated with the flow. Similarly, when a flow362is identified that is to utilize the functionality of hardware accelerator312, a flow entry is created in flow table334that associates the flow with virtual port338, and that associates the virtual port with a continuation of the routing of the flow to the desired destination for the flow. Here, when data packets are received at switch310that are associated with flow362, the data packets are directed to microflow sub-plane330, and flow table334directs that the data packets be routed in microflow sub-plane330to virtual port338, and the data packets are processed by hardware accelerator312. The processed data packets of flow362are routed back through virtual port338and the processed data packets are directed to the destination address associated with the flow.

Note that as illustrated, a single virtual port336is associated with packet processing module332, and a single virtual port338is associated with hardware accelerator312, that the virtual ports are bi-directional, and that when processed data packets are returned from the packet processing module or the hardware accelerator, the processed data packets are processed as flow entries in flow table334that are associated with the virtual ports. In another embodiment, packet processing module332and hardware accelerator312are each associated with a pair of virtual ports, one for ingress into the functional space of the respective elements, and one for egress from the functional space. Here, a flow table similar to flow table334would include flow entries associated with the egress ports for further routing of the respective flows. In another embodiment, packet processing module332and hardware accelerator312are each associated with multiple virtual ports, each of which is accessed as a destination associated with a different flow. In this way, the functions of packet processing module332and of hardware accelerator312can be sequentially accessed by a particular flow. For example, a flow entry can direct data packets to a third virtual port associated with packet processing module332, a flow entry in flow table334that is associated with the third virtual port can direct data packets to a fourth virtual port associated with hardware accelerator312, and a flow entry in the flow table that is associated with the fourth virtual port can direct the data packets to the destination address associated with the flow.

When virtual ports336and338are instantiated on microflow sub-plane330, SDN agent344sends a port status message to SDN controller340, informing the SDN controller of the presence of the virtual ports on the microflow sub-plane. In addition to indicating the presence of virtual ports336and338, the port status message includes meta-data informing the SDN controller of the functionality associated with packet processing module332and with hardware accelerator312. In a particular embodiment, SDN controller340is connected to SDN agents in one or more additional switches similar to switch310. Here, each switch can advertise the virtual ports created thereon, and the added processing functionality that is associated with each virtual port. Moreover, SDN controller340can manage routing through the network of switches that includes switch310and the one or more additional switches, such that, when a flow is detected that needs to utilize the functionality of one or more of packet processing module332and hardware accelerator312, the flow can be routed to switch310for processing by the packet processing module or the hardware accelerator, as needed. In addition, SDN controller340can operate to perform load balancing between the switches of the network. For example, if the number of flows in the network that need to utilize the functionality of packet processing module332or hardware accelerator312is high, SDN controller340can operate to load balance the flows such that any one switch is not over-utilizing its associated packet processing module or hardware accelerator.

SDN controller340also operates to provide packet processing module332to switch310from packet processing module store350. Here, packet processing module store350operates to retain one or more packet processing modules similar to packet processing module332. Here, packet processing module store350can include a packet processing module development system where new functions and features are developed for the packet processing modules prior to being loaded to switch310. Moreover, in a particular embodiment SDN controller340retrieves one or more packet processing module from packet processing module store350and loads the modules onto switch310and the one or more additional switches in the network.

FIG. 4is a block diagram illustrating an embodiment of an information handling system400, including a processor410, a chipset420, a memory430, a graphics interface440, an input/output (I/O) interface450, a disk controller460, a network interface470, and a disk emulator480. In a particular embodiment, information handling system400is used to carry out one or more of the methods described herein. In another embodiment, one or more of the systems described herein are implemented in the form of information handling system400.

Chipset420is connected to and supports processor410, allowing the processor to execute machine-executable code. In a particular embodiment, information handling system400includes one or more additional processors, and chipset420supports the multiple processors, allowing for simultaneous processing by each of the processors and permitting the exchange of information among the processors and the other elements of the information handling system. Chipset420can be connected to processor410via a unique channel, or via a bus that shares information among the processor, the chipset, and other elements of information handling system400.

Memory430is connected to chipset420. Memory430and chipset420can be connected via a unique channel, or via a bus that shares information among the chipset, the memory, and other elements of information handling system400. In another embodiment (not illustrated), processor410is connected to memory430via a unique channel. In another embodiment (not illustrated), information handling system400includes separate memory dedicated to each of the one or more additional processors. A non-limiting example of memory430includes static random access memory (SRAM), dynamic random access memory (DRAM), non-volatile random access memory (NVRAM), read only memory (ROM), flash memory, another type of memory, or any combination thereof.

Graphics interface440is connected to chipset420. Graphics interface440and chipset420can be connected via a unique channel, or via a bus that shares information among the chipset, the graphics interface, and other elements of information handling system400. Graphics interface440is connected to a video display442. Other graphics interfaces (not illustrated) can also be used in addition to graphics interface440as needed or desired. Video display442includes one or more types of video displays, such as a flat panel display, another type of display device, or any combination thereof.

I/O interface450is connected to chipset420. I/O interface450and chipset420can be connected via a unique channel, or via a bus that shares information among the chipset, the I/O interface, and other elements of information handling system400. Other I/O interfaces (not illustrated) can also be used in addition to I/O interface450as needed or desired. I/O interface450is connected via an I/O interface452to one or more add-on resources454. Add-on resource454is connected to a storage system490, and can also include another data storage system, a graphics interface, a network interface card (NIC), a sound/video processing card, another suitable add-on resource or any combination thereof. I/O interface450is also connected via I/O interface452to one or more platform fuses456and to a security resource458. Platform fuses456function to set or modify the functionality of information handling system400in hardware. Security resource458provides a secure cryptographic functionality and includes secure storage of cryptographic keys. A non-limiting example of security resource458includes a Unified Security Hub (USH), a Trusted Platform Module (TPM), a General Purpose Encryption (GPE) engine, another security resource, or a combination thereof.

Disk controller460is connected to chipset420. Disk controller460and chipset420can be connected via a unique channel, or via a bus that shares information among the chipset, the disk controller, and other elements of information handling system400. Other disk controllers (not illustrated) can also be used in addition to disk controller460as needed or desired. Disk controller460includes a disk interface462. Disk controller460is connected to one or more disk drives via disk interface462. Such disk drives include a hard disk drive (HDD)464, and an optical disk drive (ODD)466, and can include one or more disk drive as needed or desired. ODD466can include a Read/Write Compact Disk (R/W-CD), a Read/Write Digital Video Disk (R/W-DVD), a Read/Write mini Digital Video Disk (R/W mini-DVD, another type of optical disk drive, or any combination thereof. Additionally, disk controller460is connected to disk emulator480. Disk emulator480permits a solid-state drive484to be coupled to information handling system400via an external interface482. External interface482can include industry standard busses such as USB or IEEE 1394 (Firewire) or proprietary busses, or any combination thereof. Alternatively, solid-state drive484can be disposed within information handling system400.

Network interface device470is connected to I/O interface450. Network interface470and I/O interface450can be coupled via a unique channel, or via a bus that shares information among the I/O interface, the network interface, and other elements of information handling system400. Other network interfaces (not illustrated) can also be used in addition to network interface470as needed or desired. Network interface470can be a network interface card (NIC) disposed within information handling system400, on a main circuit board such as a baseboard, a motherboard, or any combination thereof, integrated onto another component such as chipset420, in another suitable location, or any combination thereof. Network interface470includes a network channel472that provide interfaces between information handling system400and other devices (not illustrated) that are external to information handling system400. Network interface470can also include additional network channels (not illustrated).

Information handling system400includes one or more application programs432, and Basic Input/Output System and Firmware (BIOS/FW) code434. BIOS/FW code434functions to initialize information handling system400on power up, to launch an operating system, and to manage input and output interactions between the operating system and the other elements of information handling system400. In a particular embodiment, application programs432and BIOS/FW code434reside in memory430, and include machine-executable code that is executed by processor410to perform various functions of information handling system400. In another embodiment (not illustrated), application programs and BIOS/FW code reside in another storage medium of information handling system400. For example, application programs and BIOS/FW code can reside in HDD464, in a ROM (not illustrated) associated with information handling system400, in an option-ROM (not illustrated) associated with various devices of information handling system400, in storage system490, in a storage system (not illustrated) associated with network channel472, in another storage medium of information handling system400, or a combination thereof. Application programs432and BIOS/FW code434can each be implemented as single programs, or as separate programs carrying out the various features as described herein.

In the embodiments described herein, an information handling system includes any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or use any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system can be a personal computer, a consumer electronic device, a network server or storage device, a switch router, wireless router, or other network communication device, a network connected device (cellular telephone, tablet device, etc.), or any other suitable device, and can vary in size, shape, performance, price, and functionality. The information handling system can include memory (volatile (e.g. random-access memory, etc.), nonvolatile (read-only memory, flash memory etc.) or any combination thereof), one or more processing resources, such as a central processing unit (CPU), a graphics processing unit (GPU), hardware or software control logic, or any combination thereof. Additional components of the information handling system can include one or more storage devices, one or more communications ports for communicating with external devices, as well as, various input and output (I/O) devices, such as a keyboard, a mouse, a video/graphic display, or any combination thereof. The information handling system can also include one or more buses operable to transmit communications between the various hardware components. Portions of an information handling system may themselves be considered information handling systems.

When referred to as a “device,” a “module,” or the like, the embodiments described herein can be configured as hardware. For example, a portion of an information handling system device may be hardware such as, for example, an integrated circuit (such as an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a structured ASIC, or a device embedded on a larger chip), a card (such as a Peripheral Component Interface (PCI) card, a PCI-express card, a Personal Computer Memory Card International Association (PCMCIA) card, or other such expansion card), or a system (such as a motherboard, a system-on-a-chip (SoC), or a stand-alone device). The device or module can include software, including firmware embedded at a device, such as a Pentium class or PowerPC™ brand processor, or other such device, or software capable of operating a relevant environment of the information handling system. The device or module can also include a combination of the foregoing examples of hardware or software. Note that an information handling system can include an integrated circuit or a board-level product having portions thereof that can also be any combination of hardware and software.