Flow Entry Management via Controller Authority Levels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OpenFlow protocol lacks authority control over flow entries in the flow table, leading to potential arbitrary modifications and reduced system security, particularly in scenarios like plug-and-play ad hoc networks and multi-controller operations.
Innovation Solution
A method and device for flow entry management that sets and enforces management authority levels for controllers connected to switches, ensuring that only authorized controllers can perform management operations on flow entries based on predefined security levels, preventing unauthorized modifications or deletions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the OpenFlow protocol allows controllers to manage flow entries without authority control, then the ease of operation is improved, but the system security deteriorates
Solution Approach 1:
The patent introduces authority level parameters for both controllers and flow entries. Controllers are assigned authority levels, and flow entries are assigned security levels. The switch compares these parameters to determine whether a controller can manage a specific flow entry, thereby implementing security control through parameter matching.
2Adaptability or versatility
If the OpenFlow protocol allows any controller to modify any flow entry, then the adaptability is improved, but the loss of information increases due to arbitrary modifications
Solution Approach 1:
The patent implements differentiated authority control where different flow entries have different security levels and different controllers have different authority levels. This allows the system to grant appropriate access rights to different controllers for different flow entries, protecting critical flow entries while allowing flexible management of non-critical ones.
Data Source
Figure 1
Figure 2~3
AI summary
A flow entry management method and device are disclosed. After receiving a management instruction for any flow entry, where the management instruction is initiated by any controller connected to any switch, the any switch may first determine, according to an obtained management authority level of the any controller relative to the any switch and a security level of the any flow entry, whether the management authority level of the any controller relative to the any switch is not lower than the security level of the any flow entry corresponding to the management instruction initiated by the any controller, and when a determining result is yes, determine that the any controller has an authority to perform corresponding management on the any flow entry, and perform corresponding management on the any flow entry according to the management instruction initiated by the any controller, thereby achieving an objective of effectively protecting the flow entry and further improving system security on a basis of avoiding an operation phenomenon of arbitrarily deleting or modifying the flow entry and the like.