Location-Aware Relay Agent for SDN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security in software-defined networking (SDN) environments is compromised due to vulnerabilities in service nodes, such as DHCP servers, which are susceptible to malicious attacks like MAC address spoofing, affecting network performance and security.
Innovation Solution
Implementing a location-aware service request handling approach, where location information associated with virtual machines is used to modify service requests, enabling verification and authentication within the SDN environment, decoupling MAC addresses from IP address assignment and enhancing security by managing location information centrally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional service request handling is used in SDN environments, then network services can be provided, but network security is compromised due to vulnerabilities in service nodes
Solution Approach 1:
The patent introduces a location-aware relay agent as an intermediary between virtual machines and service nodes. This relay agent modifies service requests by adding location information (circuit ID and remote ID) before forwarding them to service nodes. The relay agent acts as a mediator that enhances security by verifying the location of clients before allowing service access, thereby preventing malicious attacks without compromising the functionality of network services.
2Reliability
If location information is added to service requests, then verification and authentication are enabled, but device complexity increases
Solution Approach 1:
The location-aware relay agent performs self-service by automatically modifying service requests with location information and handling authentication tasks autonomously. The relay agent inserts location-aware options (circuit ID and remote ID) into DHCP requests without requiring manual intervention or complex configuration. This self-service approach enables verification and authentication functionality while minimizing the increase in device complexity through automated processing.
3Ease of manufacture
If MAC addresses are coupled with IP address assignment, then network configuration is simplified, but security is reduced due to susceptibility to spoofing
Solution Approach 1:
The patent segments the authentication process into two independent components: location verification and IP address assignment. Instead of relying on MAC address binding, the system separates the identification of clients (through location information in relay agent options) from the allocation of IP addresses. This segmentation allows the relay agent to verify client locations and enforce policies independently from the DHCP server's IP assignment process, thereby enhancing security while maintaining configuration simplicity.
Data Source
AI summary
Example methods and systems are provided for location-aware service request handling. The method may comprise: generating and sending location information associated with virtualized computing instance to a service node or a management entity for transmission to the service node. The location information may identify logical element(s) to which the virtualized computing instance is connected. The method may further comprise: in response to detecting, from the virtualized computing instance, a service request for a service from the service node, generating a modified service request by modifying the service request to include the location information associated with the virtualized computing instance; and sending the modified service request towards the service node.