Methods to add an “
Admission Control /
Access Control”
system to control access to a “
Software-Defined-Deterministic
Industrial Internet of Things” (SDD-IIoT) network are described. The SDD-IIoT comprises a “
Software Defined Networking” (SDN) control-plane, and many “
Software-Defined-Deterministic
Wide Area Networks” (SDD-WANs). The SDN control-plane comprises 3
layers of “Zero Trust Architectures”, i.e., rule-based “Attribute-Based
Access Control” (ABAC) systems, where subjects can request access to resources. A controller's “Knowledge-Base” consists of a set of facts and rules, which an
inference-engine processes to make access decisions. Each SDD-WAN comprises a low-complexity deterministic forwarding-plane, with many simple deterministic packet switches (D-switches), realized with “Field Programmable Gate Arrays” (FPGAs). The forwarding-plane implements “Authenticated Encrypted Deterministic Channels” (AEDCs or D-flows) directly in hardware in layer-3, using
Quantum Safe ciphers. Each D-flow has a deterministic data-rate requirement, with
delay and
jitter requirements. The D-switches can forward encrypted data, according to pre-defined periodic (repeating) deterministic schedules. For a packet to be accepted at the destination, it must be successfully decrypted at the destination in layer-3, using a
Quantum Safe
cipher. Malicious packets from cyber-attackers will fail the decryption process in layer-3, and thus be detected and removed. Each enterprise has an “Enterprise-Controller”, to control access to its private resources (i.e., computers, data-bases, etc), with an extensive
knowledge base of rules. Each SDD-WAN has a “WAN-Controller”, to control the communications between enterprises over the SDD-WAN. If an Enterprise-Controller or WAN-Controller approves a request to establish a new D-flow, the SDN control-plane will download deterministic schedules and secret keys to the D-switches in the forwarding-plane. An IIoT-Controller will control the communications between different SDD-WANs. In an IIoT deployment, there may be 10s of WAN-Controllers, each with 100s of Enterprise-Controllers. These collaborative controllers work together, to control access to the bandwidth of the SDD-IIoT. They can achieve exceptionally-strong cyber-security, where the expected number of successful cyber-attacks per year from external cyber-attackers with
Quantum Computers, can be reduced to zero. The SDD-IIoT can achieve security comparable to that offered by “
Quantum Key Distribution” (QKD) networks in practice, determined by the computational
hardness of
cracking Quantum Safe ciphers. The SDD-IIoT can save the industry 10s . . . $100s of billions (US dollars) per year, by exploiting low-cost FPGAs, providing a powerful incentive to innovate layer-3 of
the Internet.