Access Control Apparatus for SDN Switch Load Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In centralized-control-type communication systems like OpenFlow, the increased load on control apparatuses and switches due to large packet communication and fine-grained access control can lead to performance issues, especially when using TLS/SSL for secure channels, resulting in packet delay and processing limitations.
Innovation Solution
Implementing a communication system with a control apparatus that sets control information in forwarding nodes, where packets not matching the first control information are forwarded using second control information, and an access control apparatus determines whether to generate control information for these packets, requesting it from the control apparatus only when necessary, thereby reducing the load on the control apparatus and switch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized control is used to manage security and service quality, then network management capability is improved, but control apparatus load increases
Solution Approach 1:
The patent segments the control function by introducing an access control apparatus that operates independently from the main control apparatus. The access control apparatus handles access control decisions locally, while the control apparatus focuses on flow entry management. This segmentation reduces the load on the control apparatus while maintaining centralized management capability.
Solution Approach 2:
The access control apparatus acts as an intermediary between switches and the control apparatus. It receives packets from switches, makes access control decisions, and only communicates with the control apparatus when flow entries need to be created or modified. This intermediary role reduces unnecessary communication overhead to the control apparatus.
2Reliability
If fine-grained access control is implemented, then security is improved, but the number of queries to control apparatus increases
Solution Approach 1:
The access control apparatus performs access control decisions in advance by maintaining local access control policies. When a packet arrives, it checks the policy locally and only queries the control apparatus if the packet requires flow entry creation or modification. This preliminary action eliminates the need for real-time queries for every access control decision.
Solution Approach 2:
The access control apparatus serves itself by maintaining local access control policies and making decisions independently. It only contacts the control apparatus when necessary for flow entry management, rather than requiring the control apparatus to handle every access control query. This self-service capability reduces query overhead.
3Reliability
If TLS/SSL is used for secure channels, then security is improved, but packet delay increases
Solution Approach 1:
The patent extracts the access control function from the main control apparatus and places it in the access control apparatus. This separation means that access control decisions no longer require TLS/SSL encrypted communication with the control apparatus, eliminating the security protocol overhead from the critical access control path and reducing packet delay.
4Productivity
If forwarding nodes store more flow entries, then processing capability is improved, but device limitations are exceeded
Solution Approach 1:
The patent segments the flow entry management responsibility between the access control apparatus and switches. The access control apparatus maintains access control policies and generates flow entries, while switches store and execute these flow entries. This segmentation allows the system to handle more traffic without exceeding switch flow entry storage limitations.
Solution Approach 2:
The system changes the parameter of flow entry management by introducing the access control apparatus that generates and manages flow entries externally. This allows flow entries to be created dynamically based on access control policies rather than being pre-configured in switches, effectively increasing processing capability without exceeding device storage limitations.
Data Source
AI summary
A communication system includes: a control apparatus setting control information in a forwarding node(s); a forwarding node(s); and an access control apparatus. The forwarding node(s) forwards packets by using first control information set by the control apparatus and second control information for forwarding packets that do not match a matching condition(s) in the first control information set by the control apparatus from a predetermined port of the forwarding node(s). The access control apparatus includes a determination unit determining whether to generate control information for the packets forwarded from the predetermined port of the forwarding node(s) and requesting the control apparatus to generate control information.