Dynamic API Filtering for SDN Security Boundary Validation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Software-defined networking (SDN) exposes network elements to vulnerabilities through malicious API calls, which can exploit internal functions never designed to handle robust input, leading to potential crashes or privilege elevation, and existing security fixes take months to deploy.

Innovation Solution

Dynamic API call filtering and validation techniques are implemented, where filters are loaded into network elements without requiring a reboot, to validate parameters and authenticate API calls, preventing malicious executions by applying filters on a per-parameter basis and dynamically updating security measures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional firmware updates are used to fix security vulnerabilities, then security reliability is improved, but deployment time and system downtime increase significantly

Engineering Contradiction:
Improvesecurity reliabilityVSAvoiddeployment time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent implements dynamic filter loading that allows security filters to be loaded and activated without system reboot, making the security update process dynamic and flexible rather than static and disruptive. This enables continuous operation while applying security fixes.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The security update is segmented into filter modules that can be independently loaded and activated. Each filter addresses specific vulnerabilities and can be applied separately without requiring complete firmware replacement or system shutdown.

Inventive Principle:
Principle #1Segmentation

2Reliability

If comprehensive API validation is implemented, then security against malicious calls is improved, but processing overhead and system complexity increase

Engineering Contradiction:
Improvesecurity protectionVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces filter modules as intermediary components between API calls and internal functions. These filters act as mediators that validate and sanitize input parameters without requiring changes to the underlying internal functions, thus maintaining security while preserving system architecture simplicity.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

Validation and filtering operations are performed preliminarily before API calls reach internal functions. By pre-processing and validating inputs upfront, the system prevents malicious calls from reaching vulnerable internal functions, eliminating the need for complex post-processing or rollback mechanisms.

Inventive Principle:
Principle #10Preliminary action

3Productivity

If dynamic filter loading is implemented, then deployment speed is improved, but memory usage and resource consumption increase

Engineering Contradiction:
Improvedeployment speedVSAvoidmemory usage
Core Design Contradiction:
ProductivityVSQuantity of substance

Solution Approach 1:

The patent implements a mechanism where filters can be dynamically loaded, activated, and subsequently unloaded or deactivated. This allows the system to recover memory resources by discarding filters that are no longer needed, enabling rapid deployment while managing memory consumption through active filter sets rather than permanent residency.

Inventive Principle:
Principle #34Discarding and recovering

Data Source

PatentEP3095224B1Dynamic filtering for SDN API calls across a security boundary
Publication Date: 2020.03.11 CISCO TECHNOLOGY INC
  • EP3095224B1 patent drawingFigure 1
  • EP3095224B1 patent drawingFigure 2
  • EP3095224B1 patent drawingFigure 3

AI summary

Presented herein are techniques to reduce the vulnerabilities of network elements to malicious API calls. One or more filters that validate data across an API boundary at a network element are dynamically loaded into the network element such that a reboot of the network element is not required to use the one or more filters. An API call is received for an API function, wherein the API call contains one or more parameter values associated with the API function. The parameters may be validated using the one or more filters. If it is determined that the one or more filters validate the parameters for the API function, the API function may be executed using the parameter values. If it is determined that the one or more filters do not validate the parameters for the API function, the execution of the API function may be aborted.