Method and system for operating a software defined network

Abstract

A computer-implemented method for operating a software-defined network, the method comprising: obtaining a designation of multiple data plane components that together form a path through a data plane, the path being suitable for carrying traffic associated with a category of applications and / or services; based on the designation, determining which one or more of a plurality of security profiles the path can follow; selecting one of the one or more security profiles as an initial security profile; routing traffic associated with the category of applications and / or services via the path that executes the initial security profile; subsequently obtaining an alert that a network performance condition has deteriorated; and in response thereto: selecting a different security profile from the plurality of security profiles that is less resource intensive than the initial security profile as a replacement security profile; and routing traffic associated with the category of applications and / or services following the replacement security profile.

Description

Technical Field

[0001] The present disclosure relates to software defined network (SDN).

[0002] More specifically, aspects relate to a computer-implemented method of operating an SDN, a data processing system configured to perform such a method, a computer program containing instructions (when the program is executed by a computer, the instructions cause the computer to perform such a method), a computer-readable data carrier having such a computer program stored thereon, and a data carrier signal carrying such a computer program. Background Art

[0003] Figure 1 An example SDN environment 100 is shown. Software Defined Networking is a network management framework that enables dynamic management and control of modern computer networks. SDN aims to logically centralize network control by decoupling the forwarding process of network packets in the data plane 110 from the routing process in the control plane 120. The control plane 120 includes one or more SDN controllers (SCs) 130, which act as the centralized control component of the SDN network and make all routing decisions. The data plane 110 is composed of physical or virtual network devices called data plane elements (DPEs) 140, such as layer 2 and layer 3 switches, firewalls, load balancers, proxies, etc. The SC 130 typically uses an open flow protocol for communicating with the DPE 140 for the purpose of establishing data structures (e.g., switching tables) in order to configure the paths of network packets across the data plane 110. The SDN controller exposes its representative, state transfer (REST)-based application programming interface (API) to the upper layer (application plane 150), where network applications and services 160 can use these APIs (northbound interfaces) 170 to manage and monitor the underlying network infrastructure (data plane 110). (The term "application" generally refers to the foreground process that users interact with directly, while the term "service" generally refers to the background process that users interact with indirectly.) During normal operation, the SC 130 makes routing decisions based on information obtained from the application or service 160 and builds a path for its network traffic. This is usually done according to the default routing policy, usually using the shortest path algorithm, such as Open Shortest Path First (OSPF). The SC 130 also sets a static security profile for the network traffic, as specified in the security requirements of the service level agreement (SLA) 180 of the application / service. The SC 130 then pushes the corresponding forwarding and encryption rules to the DPE 140 using the OpenFlow protocol on the southbound interface 190.

[0004] In existing SDN environments, network security is not built into the SDN architecture. Therefore, any security measures required to protect the connected network resources must be defined and configured before traffic begins to flow. Sometimes, due to security events such as attacks on the SDN or a specific DPE 140, it is necessary to upgrade security measures, and / or isolate one or more DPEs 140. In contrast, in other cases, it may be desirable to reduce the level of security measures or modify the path through the data plane 110, for example to improve network performance measures such as latency and / or throughput. In order to make such changes, the existing network flow must be terminated and a new path established with any updated security measures applied. This interrupts network traffic, resulting in delays and interruptions to applications and services 160 using the SDN 100. The larger and more complex the network topology, the greater the delay. A method of reducing such delays and interruptions is needed. Summary of the invention

[0005] According to a first aspect, there is provided a computer-implemented method of operating a software defined network, the method comprising:

[0006] Initializing a plurality of paths through a data plane for traffic associated with a class of applications and / or services;

[0007] Selecting one of the multiple paths as an initial operation path;

[0008] routing traffic associated with the class of applications and / or services via the initial operational path;

[0009] subsequently obtaining data indicating that a triggering event has occurred; and

[0010] In response to this:

[0011] selecting a different path among the plurality of paths as a replacement operation path; and

[0012] Traffic associated with the class of applications and / or services is routed via an alternate operational path.

[0013] The computer-implemented method may also include, after initializing the plurality of paths, periodically refreshing initialization parameters of corresponding one or more data plane components included in each of the plurality of paths so that traffic may be immediately routed via any one of the plurality of paths that is subsequently selected as a replacement operational path.

[0014] Initializing multiple paths can include:

[0015] defining each of the plurality of paths in a control plane;

[0016] configuring metadata associated with each of the plurality of paths; and

[0017] Each of the plurality of paths is activated in the data plane.

[0018] Metadata can include one or more of the following:

[0019] for configuration settings and / or parameters of one or more data plane components included in one or more of the plurality of paths,

[0020] one or more routing rules, and

[0021] Security profile.

[0022] The computer-implemented method may further include:

[0023] For each of the multiple paths:

[0024] obtaining a designation of a respective plurality of data plane components that together form the path; and

[0025] Based on the designation, determining which one or more of a plurality of security profiles the path can comply with;

[0026] wherein routing traffic via the initial operational path may be performed in accordance with an initial security profile selected from the plurality of security profiles; and

[0027] The computer-implemented method may also include: in response to obtaining data indicating that a triggering event has occurred, selecting a different security profile from the plurality of security profiles as a replacement security profile;

[0028] Wherein, routing traffic via the replacement operational path may be performed in accordance with the replacement security profile.

[0029] The selection of the initial security profile may precede the selection of the initial operation path, and the selection of the initial operation path may include selecting a path from among the plurality of paths that can comply with the initial security profile; and

[0030] The selection of the replacement security profile may precede the selection of the replacement operation path, and the selection of the replacement operation path may include selecting a path from among the plurality of paths that can comply with the replacement security profile.

[0031] Specify one or more of the following: security level; compliance with standard; key size; cipher; cipher mode; and performance indicator.

[0032] The data plane components may include one or more switches and / or firewalls and / or load balancers and / or proxies and / or gateways.

[0033] Each security profile may specify cryptographic primitives to be used for each of confidentiality, integrity, and authentication.

[0034] The computer-implemented method may further include:

[0035] ranking the plurality of cryptographic primitives according to one or more of security, throughput, and latency; and

[0036] The plurality of security profiles are generated by selecting from the ordered cryptographic primitives.

[0037] Generating an nth security profile of the plurality of security profiles may include:

[0038] Select the nth confidentiality cryptographic primitive in sort order;

[0039] Selecting the nth integrity cryptographic primitive in order; and

[0040] Select the nth-order authenticated cryptographic primitive.

[0041] A triggering event can be a security alert or an alert that network performance conditions have deteriorated.

[0042] The triggering event may be a security alert, and the replacement security profile may be selected to be more secure than the initial security profile; or

[0043] The triggering event may be an alert that network performance conditions have deteriorated, and the replacement security profile may be selected to be less resource intensive than the initial security profile.

[0044] The category of application and / or service may be one of the following: Smart Grid; Remote Surgery; Vehicle-to-Everything (V2X); and National Defense.

[0045] According to a second aspect, there is provided a computer-implemented method of operating a software defined network, the method comprising:

[0046] obtaining a designation of a plurality of data plane components that together form a path through a data plane, the path being suitable for carrying traffic associated with a class of applications and / or services;

[0047] Based on the designation, determining which one or more of a plurality of security profiles the path can comply with;

[0048] selecting a security profile among the one or more security profiles as an initial security profile;

[0049] routing traffic associated with the class of applications and / or services via a path consistent with the initial security profile;

[0050] subsequently obtaining data indicating that a triggering event has occurred; and

[0051] In response to this:

[0052] selecting a different security profile from the plurality of security profiles as a replacement security profile; and

[0053] Traffic associated with the class of applications and / or services is routed according to the replacement security profile.

[0054] The specification may specify one or more of the following: security level; compliance with a standard; key size; cipher; cipher mode; and performance metrics.

[0055] The data plane components may include one or more switches and / or firewalls and / or load balancers and / or proxies and / or gateways.

[0056] Each security profile may specify cryptographic primitives to be used for each of confidentiality, integrity, and authentication.

[0057] The computer-implemented method may further include:

[0058] ranking the plurality of cryptographic primitives according to one or more of security, throughput, and latency; and

[0059] The plurality of security profiles are generated by selecting from the ordered cryptographic primitives.

[0060] Generating an nth security profile of the plurality of security profiles may include:

[0061] Select the nth confidentiality cryptographic primitive in sort order;

[0062] Selecting the nth integrity cryptographic primitive in order; and

[0063] Select the nth-order authenticated cryptographic primitive.

[0064] A triggering event can be a security alert or an alert that network performance conditions have deteriorated.

[0065] The triggering event may be a security alert, and the replacement security profile may be selected to be more secure than the initial security profile; or

[0066] The triggering event may be an alert that network performance conditions have deteriorated, and the replacement security profile may be selected to be less resource intensive than the initial security profile.

[0067] There may be one or more further paths through the data plane, the one or more further paths being suitable for carrying traffic associated with the class of applications and / or services, and the method may further comprise:

[0068] For each of the one or more additional paths:

[0069] obtaining a designation of a respective further plurality of data plane components that together form the further path; and

[0070] Based on the designations, determining which security profile of the plurality of security profiles the additional path can conform to;

[0071] Initializing the one or more further paths prior to obtaining data indicating that a triggering event has occurred; and

[0072] selecting one of the one or more additional paths as an alternative operating path in response to obtaining data indicating that the triggering event has occurred;

[0073] Wherein, routing traffic associated with a category of applications and / or services in accordance with the replacement security profile may be performed via the replacement operational path.

[0074] The computer-implemented method may also include, after initializing the one or more additional paths, periodically refreshing initialization parameters of corresponding one or more data plane components included in each of the one or more additional paths, so that traffic can be immediately routed via any one of the multiple paths that is subsequently selected as a replacement operational path.

[0075] Initializing one or more additional paths may include:

[0076] defining each of the one or more additional paths in a control plane;

[0077] configuring metadata associated with each of the one or more additional pathways; and

[0078] Each of the one or more additional paths is activated in the data plane.

[0079] Metadata can include one or more of the following:

[0080] configuration settings and / or parameters for one or more data plane components included in one or more of the one or more further paths,

[0081] one or more routing rules, and

[0082] Security profile.

[0083] The category of application and / or service may be one of: smart grid; remote surgery; connected vehicle 'V2X'; and national defense.

[0084] According to a third aspect, there is provided a data processing system configured to perform the method of any one of the first aspect or the second aspect.

[0085] According to a fourth aspect, there is provided a computer program comprising instructions, which, when executed by a computer, cause the computer to perform the method of any one of the first aspect or the second aspect.

[0086] According to a fifth aspect, there is provided a computer readable data carrier storing the computer program of the fourth aspect.

[0087] According to a sixth aspect, there is provided a data carrier signal carrying the computer program of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Various aspects of the present disclosure will now be described by way of example with reference to the accompanying drawings. In the drawings:

[0089] Figure 1 An example SDN environment is shown in FIG.

[0090] Figure 2 A computer-implemented method of operating an SDN according to the first aspect is shown;

[0091] Figure 3 A computer-implemented method of operating an SDN according to the second aspect is shown;

[0092] Figure 4 A computer-implemented method of operating an SDN according to an example combination of the first aspect and the second aspect is shown; and

[0093] Figure 5 Schematically shows the ability to perform Figure 2 , Figure 3 or Figure 4 An exemplary data processing system for any of the methods. DETAILED DESCRIPTION

[0094] The following description is presented to enable one skilled in the art to make and use the system of the invention and / or perform the method of the invention, and is provided in the context of a specific application. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art.

[0095] According to one aspect of the present disclosure, it is proposed to switch traffic to redundant pre-established active paths in response to a triggering event. According to another aspect of the present disclosure, it is proposed to switch to different security profiles (on the same or different network paths) in response to a triggering event, wherein possible security profiles are pre-established based on the discovery of DPE capabilities (hardware and / or software). (Each security profile may, for example, specify a specific algorithm for each of confidentiality, integrity and authentication and set related parameters such as key size.) These two aspects may be combined to switch traffic to redundant pre-established active paths in response to a triggering event, the selection of a redundant path depending on the security level available on the path based on the capabilities of the DPE forming the path. In this way, two layers of security and / or efficiency are provided with minimal traffic disruption.

[0096] Figure 2 The operation of the SDN (eg Figure 1 The computer-implemented method 200 of the SDN 100 of the present invention may be performed by the SC 130, for example.

[0097] At step S240, multiple paths through the data plane 110 are initialized for traffic associated with a category of applications and / or services 160. The category of applications and / or services 160 may be, for example, one of the following: smart grid; remote surgery; vehicle-to-everything (V2X); and national defense. The category of applications and / or services 160 may include one or more applications and / or services 160.

[0098] Initializing the plurality of paths at step S240 may, for example, include: defining each of the plurality of paths in the control plane 120 at step S241; configuring metadata associated with each of the plurality of paths at step S242; and activating each of the plurality of paths in the data plane 110 at step S243. The metadata configured at step S242 may, for example, include one or more of the following: configuration settings and / or parameters for one or more DPEs 140 included in one or more of the plurality of paths; one or more routing rules; and a security profile. The DPE 140 may, for example, include one or more switches and / or firewalls and / or load balancers and / or proxies and / or gateways.

[0099] In step S245, one of the multiple paths is selected as the initial operation path. Step S245 may be performed before, after, or partially or entirely simultaneously with step S240.

[0100] Once steps S240 and S245 are completed, at step S250, traffic associated with a class of applications and / or services 160 is routed via the initial operational path.

[0101] At step S260, data indicating that a triggering event has occurred is obtained. The triggering event may be, for example, a security alert, such as one involving a port scan event, a firewall alert, a distributed denial of service (DDoS) attack, an invalid login attempt exceeding a predetermined number, an intrusion detection system (IDS) alert, malware detection, sensitive data exposure, a security misconfiguration alert, a hardware or software vulnerability alert, or a log inspection event. Alternatively, the triggering event may be, for example, an alert that a network performance condition has deteriorated, such as a decrease in packet throughput, an increase in round trip time, or an increase in packet jitter. The SC 130 may detect the triggering event through its own monitoring, or it may receive an alert from another entity, such as an entity included in the management plane 195.

[0102] In response to obtaining data indicating that a triggering event has occurred at step S260, a different path among the plurality of paths is selected as an alternative operational path at step S280. The alternative operational path may, for example, exclude one or more DPEs 140 of the initial operational path suspected of being compromised, and / or may include one or more DPEs 140 newly added to the SDN 100 since the initial operational path was selected.

[0103] Once an alternate operational path is selected at step S280, traffic associated with a class of applications and / or services 160 is routed via the alternate operational path at step S290.

[0104] After initializing the multiple paths in step S240, the initialization parameters of the corresponding one or more DPEs 140 included in each of the multiple paths can be refreshed in step S255, so that traffic can be immediately routed via any one of the multiple paths that is subsequently selected as a replacement operation path, that is, traffic can be routed without any further initialization, even if there is a long delay between initializing the multiple paths in step S240 and obtaining data indicating that the trigger event has occurred in step S260.

[0105] Figure 3 A computer-implemented method 300 of operating a software defined network according to the second aspect is shown, which method may be performed, for example, by the SC 130 .

[0106] At step S310, a designation of a plurality of DPEs 140 is obtained that together form a path through the data plane 110 that is suitable for carrying traffic associated with a class of applications and / or services 160. The DPEs 140 may, for example, include one or more switches and / or firewalls and / or load balancers and / or proxies and / or gateways. The designation may, for example, be discovered by the SC 130, for example by querying the DPEs 140 using the OpenFlow protocol, or provided to it by another entity. These designations may, for example, specify the hardware and / or software capabilities of the DPEs 140 in terms of one or more of the following: security level; compliance with standards; key size; cipher; cipher mode and performance indicators. The class of applications and / or services 160 may, for example, be one of the following: smart grid; remote surgery; vehicle-to-everything (V2X); and defense. The class of applications and / or services 160 may include one or more applications and / or services 160.

[0107] At step S320, based on the designation, it is determined which one or more of the plurality of security profiles the path can follow. Then, at step S330, one of the one or more security profiles is selected as an initial security profile. Then, at step S350, traffic associated with a class of applications and / or services 160 begins to be routed via the path following the initial security profile.

[0108] At step S360, data indicating that a triggering event has occurred is obtained. The triggering event may be, for example, a security alert, such as one involving a port scan event, a firewall alert, a distributed denial of service (DDoS) attack, invalid login attempts exceeding a predetermined number, an intrusion detection system (IDS) alert, malware detection, sensitive data exposure, a security misconfiguration alert, a hardware or software vulnerability alert, or a log inspection event. Alternatively, the triggering event may be, for example, an alert that a network performance condition has deteriorated, such as a decrease in packet throughput, an increase in round trip time, or an increase in packet jitter. The SC 130 may detect the triggering event through its own monitoring, or may receive an alert from another entity, such as an entity included in the management plane 195.

[0109] In response to obtaining data indicating that a triggering event has occurred at step S360, at step S390, before following the replacement security profile to route traffic associated with a category of applications and / or services 160, at step S370, a different one of the multiple security profiles is selected as a replacement security profile. If the triggering event is a security alert, a replacement security profile that is more secure than the initial security profile may be selected at step S370. Alternatively, if the triggering event is a warning that a network performance condition has deteriorated, then at step S370, the replacement security profile may be selected to be less resource intensive than the initial security profile. For example, the replacement security profile may be less computationally demanding (e.g., using cryptographic primitives with shorter key lengths) than the initial security profile. As another example, the replacement security profile may include cryptographic primitives of a type that results in a smoother (i.e., less bursty) traffic pattern, thereby reducing the maximum instantaneous resource demand on the network. (For example, a replacement security profile may include a stream cipher such as ChaCha or AES-CTR for confidentiality, replacing a block cipher such as 3DES or AES in the initial security profile.) In this way, an appropriate balance can be achieved between the level of security applied, network performance (in terms of latency, throughput, etc.), and resources consumed (power, bandwidth, memory, etc.).

[0110] A plurality of security profiles may optionally be generated at step S305 (or they may be obtained in some other manner, such as received from another entity). Generating the security profiles at step S305 may, for example, include sorting the plurality of cryptographic primitives at step S302, for example, according to one or more of security, latency, and throughput. (For example, 3DES uses 64-bit blocks, AES uses 128-bit blocks, and ChaCha uses 512-bit blocks. Larger blocks allow more data to be processed per unit time, increasing throughput.) The plurality of cryptographic primitives may, for example, be those cryptographic primitives that the DPE designation indicates that the DPE 140 is capable of supporting. Then, at step S303, the plurality of security profiles may be generated by selecting from the sorted cryptographic primitives.

[0111] Each security profile may specify, for example, cryptographic primitives to be used for each of confidentiality, integrity, and authentication.

[0112] • Confidentiality algorithms encrypt data (plaintext) making it unreadable or incomprehensible to anyone who does not possess the correct decryption key (ciphertext).

[0113] • Integrity algorithms ensure that any changes or modifications to the data (plaintext or ciphertext) protected by them are readily discernible in the case of intentional (malicious) changes or unintentional changes (caused by errors, for example due to noise on the communication channel).

[0114] Authentication algorithms verify the authenticity of data by assuring the receiver that the data was created by a known sender.

[0115] In this case, in step S301, a plurality of cryptographic primitives may be grouped into the three categories. Then, in step S302, sorting the plurality of cryptographic primitives may include sorting the cryptographic primitives of each category, respectively, to generate a sorted list of confidentiality primitives, a sorted list of integrity primitives, and a sorted list of authentication primitives. Then, in step S303, selecting the cryptographic primitives may include selecting a list from each of the three sorted lists. For example, generating a security profile that is sorted nth in a plurality of security profiles may include: selecting a confidentiality cryptographic primitive that is sorted nth in step S303a, selecting an integrity cryptographic primitive that is sorted nth in step S303b, and selecting an authentication cryptographic primitive that is sorted nth in step S303c. For example, the generated plurality of security profiles may be as shown in Table 1, wherein the cryptographic primitives have been sorted according to security strength, so that profile n+1 is more secure than profile n.

[0116]

[0117] Table 1

[0118] The selection of the initial security profile at step S330 may depend on the categories of applications and / or services as shown in Table 2, for example.

[0119] Application / Service Category Initial Security Configuration File Smart Grid Profile 2 Remote surgery Profile 4 V2X Profile 1 national defense Profile 3

[0120] Table 2

[0121] The selection of the replacement security profile at step S370 may be based on, for example, a predetermined rule, such as “security level increased by 1.” Starting from the initial security profile assignment shown in Table 2, this results in the replacement security profile assignment shown in Table 3.

[0122] Application / Service Category Replace the security configuration file Smart Grid Profile 3 Remote surgery Profile 5 V2X Profile 2 national defense Profile 4

[0123] Table 3

[0124] Such rules may, for example, depend on the detected triggering event. For example, detection of a security event classified as a low threat level may result in the assignment of the security profile of Table 3, while detection of a security event classified as a high threat level may trigger the "security level increase 2" rule, and detection of a security event classified as a high threat level may result in all application / service categories being assigned the highest security level profile (profile 6 in the scheme of Table 1).

[0125] As opposed to being based on predetermined rules, selecting a replacement security profile may alternatively be tailored to a particular application / service category. For example, the initial security profile and the replacement security profile may be specified in an application / service SLA.

[0126] Figure 4 A computer-implemented method 400 of operating an SDN according to an exemplary combination of the first aspect and the second aspect is shown, which method may be performed, for example, by the SC 130 .

[0127] In step S410, similar to Figure 3 Then, in step S420, the DPE 140 is assigned by Figure 3 In a manner similar to step S320, the security profile capabilities of each of the plurality of paths through the data plane 110 suitable for carrying traffic associated with a class of applications and / or services 160 are determined. Then, in step S430, the security profile capabilities of each of the plurality of paths through the data plane 110 are determined in a manner similar to step S320. Figure 3 The initial security configuration file is selected in step S330.

[0128] In step S440, similar to Figure 2 The multiple paths are initialized in the manner of step S240.

[0129] In step S445, similar to Figure 2 The initial operation path is selected in the manner of step S245. The initial operation path is selected from the plurality of paths that can follow the initial security profile selected in step S430. (Alternatively, the initial operation path may be selected first, and then the initial security profile may be selected from the security profiles that the initial operation path can follow.)

[0130] Once all of steps S410, S420, S430, S440 and S445 are completed, traffic is routed via an initial operational path following the initial security profile at step S450.

[0131] In step S460, Figure 2 Step S260 and Figure 3 In a similar manner to step S360, data indicating that a triggering event has occurred is obtained.

[0132] In response to obtaining data indicating that a trigger event has occurred at step S460, at step S470 a trigger event is generated similar to Figure 3 In step S370, the security configuration file is selected to be replaced.

[0133] Similarly, in response to obtaining data indicating that a trigger event has occurred at step S460, at step S480, a trigger event is generated in a manner similar to Figure 2The replacement operation path is selected in the manner of step S280. The replacement operation path is selected from those paths that can follow the replacement security profile among the multiple paths. (Alternatively, the replacement operation path can be selected first, and then the replacement security profile is selected from those security profiles that the replacement operation path can follow.)

[0134] Finally, in step S490, traffic is routed via the replacement operational path in accordance with the replacement security profile.

[0135] Figure 5 An exemplary data processing system (DPS) 500 capable of performing any of the methods 200, 300, 400 is schematically shown. It comprises a processor 510 operatively coupled to a memory 520 and an interface (I / O) 530.

[0136] The memory 520 may optionally include computer program instructions that, when executed by the processor 510, cause the data processing system 500 to perform any of the methods 200, 300, 400. Alternatively or additionally, the interface 530 may optionally include one or both of a physical interface 531 configured to receive a data carrier having such instructions stored thereon and a receiver 532 configured to receive a data carrier signal carrying such instructions.

[0137] The interface 530 includes a receiver 532 configured to receive a message. The receiver 532 may include one or more wireless receiver modules and / or one or more wired receiver modules. The interface 530 also includes a transmitter 533 configured to send a message. The transmitter 533 may include one or more wireless transmitter modules and / or one or more wired transmitter modules.

[0138] Embodiments of the present invention will become apparent to those skilled in the art in view of this description.This description is to be regarded as exemplary only.

[0139] Where one or more method steps are listed in the present application, the presence of precursors, subsequent and intermediate method steps is not excluded unless such exclusion is explicitly stated. Similarly, where one or more components of a device or system are listed in the present application, the presence of separate or inserted additional components is not excluded unless such exclusion is explicitly stated.

[0140] Furthermore, where the application has listed the steps of a method or process in a particular order, it is possible or even advantageous in some cases to change the order in which some steps are performed, and the specific steps of the method or process claims set forth herein are not to be interpreted as being sequence-specific unless such sequence specificity is explicitly stated in the claims. That is, unless otherwise specified, the operations / steps may be performed in any order, and embodiments may include more or fewer operations / steps than those disclosed herein. It is also contemplated that a particular operation / step may be performed or performed before, simultaneously with, or after another operation according to the described embodiments.

[0141] The scope of the present invention includes any novel feature or combination of features disclosed herein. Applicants therefore note that new claims may be formulated to these features or combinations of features during the prosecution of the present application or any other application derived therefrom. In particular, with reference to the appended claims, features of dependent claims may be combined with features of the independent claims, and features of individual independent claims may be combined in any appropriate manner and not merely in the specific combinations recited in the claims.

[0142] Where the embodiments of the invention described may be implemented at least in part using a software-controlled programmable processing device (e.g., a microprocessor, a digital signal processor or other processing device, a data processing apparatus or system), it should be understood that a computer program for configuring a programmable device, apparatus or system to implement the aforementioned method is contemplated as an aspect of the invention. For example, such a computer program may be implemented as source code or compiled for implementation on a processing device, apparatus or system, or may be implemented as object code.

[0143] Such a computer program may be encoded as executable instructions contained in a carrier medium, a non-transitory computer-readable storage device, and / or a storage device in a machine or device readable form, such as in a volatile memory, a non-volatile memory, a solid-state memory, a magnetic storage such as a disk or tape, an optical or magneto-optical readable storage such as a tape, a compact disk (CD), a digital versatile disk (DVD), or other medium capable of storing code and / or data. Such a computer program may alternatively or additionally be provided from a remote source contained in a communication medium, such as an electrical signal, a radio frequency carrier wave, or an optical carrier wave. Such a carrier medium is also contemplated as an aspect of the present invention.

[0144] Such instructions, when executed by a processor (or one or more computers, processors and / or other devices), may cause the processor (or one or more computers, processors and / or other devices) to perform at least a portion of the methods described herein.

[0145] When a processor is mentioned in this document, it should be understood to refer to a single processor or multiple processors that are operably connected to each other. Similarly, when a memory is mentioned in this document, it should be understood to refer to a single memory or multiple memories that are operably connected to each other.

[0146] The methods and processes may also be partially or completely embodied in hardware modules or devices or firmware, so that when the hardware modules or devices are activated, they perform the associated methods and processes. The methods and processes may be implemented using a combination of code, data and hardware modules or devices.

[0147] Examples of processing systems, environments and / or configurations suitable for the embodiments described herein include, but are not limited to, embedded computer devices, personal computers, server computers (dedicated or cloud (virtual) servers), handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, mobile phones, smart phones, tablet computers, network personal computers (PCs), minicomputers, mainframes, distributed computing environments including any of the above systems or devices, etc. Hardware modules or devices described in the present disclosure include, but are not limited to, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), dedicated or shared processors, and / or other hardware modules or devices.

[0148] The receivers and transmitters described herein may be independent or may be included in a transceiver. The communication link described herein includes at least one transmitter that can send data to at least one receiver via one or more wired or wireless communication channels. The wired communication channel may be arranged for electrical or optical transmission. Such a communication link may optionally also include one or more relay transceivers.

Claims

1. A computer-implemented method of operating a software-defined network, the computer-implemented method comprising: obtaining a designation of a plurality of data plane components that together form a path through a data plane, the path being suitable for carrying traffic associated with a class of applications and / or services; Based on the designation, determining one or more security profiles among a plurality of security profiles that the path can follow; selecting a security profile among the one or more security profiles as an initial security profile; routing traffic associated with said category of applications and / or services via said path following said initial security profile; Then get an alert that network performance has deteriorated; as well as In response to this: selecting a different security profile from the multiple security profiles with a computing resource requirement smaller than that of the initial security profile as a replacement security profile; as well as Traffic associated with the class of applications and / or services is routed in accordance with the replacement security profile.

2. The computer-implemented method of claim 1 , wherein: The designation specifies one or more of: a security level; a compliance standard; a key size; a cipher; a cipher mode; and a performance indicator.

3. The computer-implemented method of claim 1 or 2, wherein: The data plane components include one or more switches and / or firewalls and / or load balancers and / or proxies and / or gateways.

4. The computer-implemented method of claim 1 , wherein: Each security profile specifies the cryptographic primitives to be used for each of confidentiality, integrity, and authentication.

5. The computer-implemented method of claim 4, further comprising: ranking a plurality of cryptographic primitives according to one or more of security, throughput, and latency; as well as The plurality of security profiles are generated by selecting from ordered cryptographic primitives.

6. The computer-implemented method of claim 5, wherein: Generating an nth security profile among the multiple security profiles includes: Select the nth confidentiality cryptographic primitive in sort order; Selecting the nth integrity cryptographic primitive in order; and Select the nth-order authenticated cryptographic primitive.

7. The computer-implemented method of claim 1 , wherein: There are one or more additional paths through the data plane, the one or more additional paths being suitable for carrying traffic associated with the class of applications and / or services, the method further comprising: For each additional path of the one or more additional paths: obtaining a designation of a respective further plurality of data plane components that together form the further path; and Based on the designations, determining a security profile among the plurality of security profiles that the additional path can follow; prior to obtaining the alert, initializing the one or more additional pathways; and In response to obtaining the alert, selecting one of the one or more additional paths as an alternate operating path; Wherein routing traffic associated with the category of applications and / or services in accordance with the replacement security profile is performed via the replacement operational path.

8. The computer-implemented method of claim 7, further comprising: After initializing the one or more additional paths, periodically refreshing initialization parameters of corresponding one or more data plane components included in each of the one or more additional paths enables immediate routing of traffic via any one of the multiple paths that is subsequently selected as the replacement operation path.

9. The computer-implemented method of claim 7 or 8, wherein: Initializing the one or more additional paths comprises: defining, in a control plane, respective ones of the one or more further paths; configuring metadata associated with respective ones of the one or more further pathways; and Respective additional paths of the one or more additional paths are activated in the data plane.

10. The computer-implemented method of claim 9, wherein: The metadata includes one or more of the following: configuration settings and / or parameters for one or more data plane components included in one or more of the one or more further paths; one or more routing rules; and Security profile.

11. The computer-implemented method of claim 1 , wherein: The category of applications and / or services is one of the following: smart grid; remote surgery; connected vehicles (V2X); and national defense.

12. A data processing system configured to execute the method according to any one of claims 1 to 11.

13. A computer program comprising instructions which, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 11.

14. A computer-readable data carrier having stored thereon a computer program according to claim 13.

Images