Network Controller Automatic Whitelisting via Timer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control methods in Software Defined Networks (SDNs) are cumbersome and prone to unauthorized access due to manual IP address management and lack of automatic whitelisting, especially for legacy services without updated security patches.
Innovation Solution
A method and system where a network controller initiates a timer upon service accessibility, records client identity information in an access control list only if the timer has not expired, and provides the list to network switches upon expiration, enabling automatic whitelisting and reducing manual configuration needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual IP address collection is used for access control lists, then access control can be implemented, but the process becomes cumbersome and incomplete over time
Solution Approach 1:
The system automatically collects IP addresses of clients accessing the service and generates access control lists without manual intervention. The network controller autonomously monitors service accessibility, tracks client connections, and maintains the access control list, eliminating the need for manual IP address collection while ensuring complete and up-to-date information.
Solution Approach 2:
The system continuously monitors network traffic and service accessibility, using this feedback to dynamically update the access control list. The network controller receives information about client access attempts and service status, adjusts the access control list accordingly, and ensures the list remains accurate over time without manual reconfiguration.
2Reliability
If access control is implemented later in service lifetime, then security can be added, but complete IP address information may not be available
Solution Approach 1:
The system proactively collects IP address information from the beginning by monitoring all client access attempts to the service. By continuously tracking which IPs access the service and maintaining this information in the access control list, the system ensures complete IP data is available even if access control is implemented later, preventing information loss.
3Reliability
If traditional firewalls with manual access control lists are used, then access control is achieved, but unauthorized access can still occur through vulnerabilities
Solution Approach 1:
The system automatically and dynamically updates the access control list based on real-time monitoring of service accessibility and client connections. This continuous self-updating ensures the list reflects current legitimate users, reducing the window of opportunity for unauthorized access through vulnerabilities while maintaining strict access control enforcement.
Data Source
AI summary
There is provided mechanisms for handling access to a service in a network. A method is performed by a network controller. The method comprises obtaining an indication of the service is accessible in the network. The indication is received from a network switch operatively connecting a server of the service to the network. The indication causes a timer to start. The method comprises obtaining an indication of a client requesting to access the service. The indication is received from the network switch. The method comprises recording, only when the timer has not yet expired, identity information of the client in an access control list. The method comprises providing the access control list at least to the network switch upon expiration of the timer.