Publications

FlowVirt: Flow Rule Virtualization for Dynamic Scalability of Programmable Network Virtualization

2018 IEEE 11th International Conference on Cloud Computing (CLOUD), Acceptance rate 18.97% (48/253), San Francisco, CA, USA, 2018, pp. 350-358, doi: 10.1109/CLOUD.2018.00051.

Gyeongsik Yang, Bong-yeol Yu, Wontae Jeong, Chuck Yoo

Download PDF

Abstract

We propose a new concept called "flow rule virtualization" (FlowVirt) for programmable network virtualization (P-NV). In P-NV, network hypervisor is a key component in that it plays a role in creating and managing virtual networks. This paper first reports a critical limitation of network hypervisor - scalability problem, which results in the high consumption of the switch memory, control channel, and CPU cycles: 3.9, 4.7, and 1.7 times higher than host-based network virtualization, respectively. This scalability problem arises because all the flow rules from the virtual network controllers are directly installed into switches. To resolve the scalability problem, FlowVirt introduces a flow rule abstraction: virtual and physical flow rules. By separating virtual and physical flow rules, the abstraction virtualizes flow rules so that FlowVirt can merge virtual flow rules to a smaller number of physical flow rules to be installed in switches. The evaluation results show the enhanced scalability of FlowVirt. The number of flow rules to be installed in switches decreases by up to 10 times compared to the previous P-NV. The control channel bandwidth and CPU cycles are also reduced by up to 14 and 3 times, respectively.

Paper summary

Virtualize forwarding rules as well as addresses

Several compatible virtual rules can share a physical rule without giving up tenant control.

Programmable network virtualization can fill switch tables with separate rules for similar traffic. FlowVirt separates virtual flow rules from physical flow rules and controls how they are merged.

Merge compatible rules under tenant policy

FlowVirt keeps virtual rules distinct from the physical rules installed on switches. It selects a virtualization type, changes the physical match fields accordingly and records the mapping. Before merging rules, it checks action conflicts and the tenant’s isolation requirements. The permitted granularity matters: traffic that can share a next hop need not always remain separate by endpoint or application, but a tenant policy can require those distinctions.

FlowVirt maps virtual rules into physical entries after checking the selected virtualization granularity and rule compatibility.View full-size figure
FlowVirt maps virtual rules into physical entries after checking the selected virtualization granularity and rule compatibility.

Reduce switch state and control traffic together

The OpenVirteX-based prototype is tested with Mininet in linear, Internet2 and fat-tree topologies. The paper reports reductions of up to tenfold in flow-rule count and control-channel bandwidth relative to OpenVirteX. Although virtualization adds computation, fewer rules and messages reduce overall CPU use by up to 32% in the reported tests. The amount of merging depends on traffic paths and tenant policy.

Largest reported FlowVirt reductions relative to OpenVirteX in the emulated networks.
MetricReduction
Flow-rule countUp to 10×
Control-channel bandwidthUp to 10×
CPU useUp to 32%

Key takeaways

  1. Multiple virtual rules can share a physical forwarding entry. FlowVirt treats that mapping as a scalability mechanism.
  2. Aggregation must preserve policy meaning. Compatibility and action-conflict checks determine which tenant rules can safely share an installed entry.