A technique for full flow virtualization of multi-tenant OpenFlow networks

OpenFlow provides new capabilities for wide-area network applications such as traffic engineering and security applications with many implementations having been proposed. OpenFlow allows flows to be described using arbitrary values or wildcards in the header fields. This functionality enables a controller to manage flow entries using only a limited number of the entries. In particular, in the case of wide-area networks, the sharing of the infrastructure among tenants (e.g., application service providers and their customers) is necessary, owing to the high capital outlay and operational costs. A technique for multi-tenancy creates logically isolated virtual OpenFlow networks so that multiple tenants can handle flows independently on a single physical OpenFlow network. Of the proposed techniques, OpenVirteX virtualizes the header address space (called the flow space) for tenants. This encourages tenants to participate because, differing from some other implementations, negotiations by tenants to divide the flow space are not required. However, OpenVirteX forces tenant controllers to set either exact Media Access Control (MAC) or Internet Protocol (IP) address in the matching fields because matching fields in the physical OpenFlow switches must have either exact MAC or IP addresses to isolate flows of the different tenants. Although prefix or wildcard matching is widely used to handle a large number of flows with a small number of flow setting by an OpenFlow controller, there is no available virtualization technique that enables prefix or wildcard matching with flow space virtualization. In this paper, we propose an OpenFlow network virtualization technique that allows prefix or wildcard matching with flow space virtualization. The proposed technique translates flow entries set by tenant controllers using prefix or wildcard matching to exact-match flow entries through lazy evaluation of the actual data packets. Evaluation results obtained using a prototype of the proposed technique show that the overhead of virtualization has an acceptable impact.