Architecture

High-Level

Figure 1. High-level CoVisor architecture.

Figure 1 illustrates the high-level CoVisor architecture. CoVisor serves as a transparent layer between controllers and the physical network. Each of the five applications shown at the top of Figure 1 is an unmodified SDN program running on its own controller; each controller outputs OpenFlow rules for the virtual topology shown below it, without any knowledge that this virtual topology does not physically exist. CoVisor intercepts the OpenFlow rules output by all five controllers and compiles them into a single policy for the physical network.

At the far left of Figure 1, we see that CoVisor takes configuration input from the administrator. These configuration responsibilities are threefold:

  1. define how the policies of the controllers should be assembled;
  2. create each controller’s virtual network by specifying the components to be included and the physical-virtual mapping; and
  3. state access control limitations for each controller.

Implementation

CoVisor is built on top of OpenVirteX (OVX). In OVX, one or more PhysicalSwitches map to a single OVXSwitch. A controller's view of the network comprises the network of OVXSwitches (OVXNetwork). To support one-physical-to-many-virtual topology abstraction, we add the PlumbingGraph layer between the PhysicalSwitch and the OVXNetwork. In CoVisor, each PhysicalSwitch maps to a single PlumbingGraph. Then, each PlumbingSwitch in the PlumbingGraph maps to one or more OVXSwitches. If a single PlumbingSwitch maps to multiple OVXSwitches, the administrator must specify how the individual OVXSwitches' flowtables are composed to create a single PlumbingSwitch flowtable. Finally, each controller sees the network as comprising whichever OVXSwitches it is connected to, though in reality every controller is connected to CoVisor.

Figure 2 shows the relationships. In the figure, all black lines and shapes are physical network components. Blue represents the PlumbingGraph, and red indicates the controller's view. Solid lines are network connections, and dashed lines indicate abstract mappings.
Figure 2. CoVisor implementation.