Dynamic API Filtering for SDN Security Boundary Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networking (SDN) exposes network elements to vulnerabilities through malicious API calls, which can exploit internal functions never designed to handle robust input, leading to potential crashes or privilege elevation, and existing security fixes take months to deploy.
Innovation Solution
Dynamic API call filtering and validation techniques are implemented, where filters are loaded into network elements without requiring a reboot, to validate parameters and authenticate API calls, preventing malicious executions by applying filters on a per-parameter basis and dynamically updating security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firmware updates are used to fix security vulnerabilities, then security reliability is improved, but deployment time and system downtime increase significantly
Solution Approach 1:
The patent implements dynamic filter loading that allows security filters to be loaded and activated without system reboot, making the security update process dynamic and flexible rather than static and disruptive. This enables continuous operation while applying security fixes.
Solution Approach 2:
The security update is segmented into filter modules that can be independently loaded and activated. Each filter addresses specific vulnerabilities and can be applied separately without requiring complete firmware replacement or system shutdown.
2Reliability
If comprehensive API validation is implemented, then security against malicious calls is improved, but processing overhead and system complexity increase
Solution Approach 1:
The patent introduces filter modules as intermediary components between API calls and internal functions. These filters act as mediators that validate and sanitize input parameters without requiring changes to the underlying internal functions, thus maintaining security while preserving system architecture simplicity.
Solution Approach 2:
Validation and filtering operations are performed preliminarily before API calls reach internal functions. By pre-processing and validating inputs upfront, the system prevents malicious calls from reaching vulnerable internal functions, eliminating the need for complex post-processing or rollback mechanisms.
3Productivity
If dynamic filter loading is implemented, then deployment speed is improved, but memory usage and resource consumption increase
Solution Approach 1:
The patent implements a mechanism where filters can be dynamically loaded, activated, and subsequently unloaded or deactivated. This allows the system to recover memory resources by discarding filters that are no longer needed, enabling rapid deployment while managing memory consumption through active filter sets rather than permanent residency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Presented herein are techniques to reduce the vulnerabilities of network elements to malicious API calls. One or more filters that validate data across an API boundary at a network element are dynamically loaded into the network element such that a reboot of the network element is not required to use the one or more filters. An API call is received for an API function, wherein the API call contains one or more parameter values associated with the API function. The parameters may be validated using the one or more filters. If it is determined that the one or more filters validate the parameters for the API function, the API function may be executed using the parameter values. If it is determined that the one or more filters do not validate the parameters for the API function, the execution of the API function may be aborted.