Network Forwarding Element with Variable Packet Delay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networks (SDNs) face security vulnerabilities due to delays in packet forwarding, which can be exploited by attackers to infer network configurations, as the interaction between the control and data planes introduces latency and resource-intensive flow rule installation, making it difficult to defend against observation-based attacks.
Innovation Solution
Implementing a method where data packets are forwarded with varying time delays, mimicking the controller-forwarding element interaction by using a delay entity to introduce time differences in packet forwarding, thereby obfuscating the controller-forwarding element interaction and reducing additional network resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If packets are forwarded by interacting with the controller (control plane), then forwarding decisions can be made dynamically, but forwarding delays increase and network security is compromised due to observable delay patterns
Solution Approach 1:
The patent creates a copy of the controller's forwarding behavior by implementing a local forwarding element that replicates the delay patterns. Instead of actual controller interaction causing delays, the system uses a local copy that mimics the same delay characteristics, thereby maintaining adaptability while reducing observable delays to attackers.
Solution Approach 2:
The patent introduces an intermediary forwarding element between the data plane and the controller. This intermediary component handles packets locally and introduces delays that mimic controller behavior, acting as a mediator that reduces the direct observable impact of controller interactions on network security while preserving dynamic forwarding capabilities.
2Reliability
If flow rules are installed in switches upon controller notification, then packets can be forwarded according to control decisions, but the installation process is costly and resource-intensive
Solution Approach 1:
The patent implements preliminary action by pre-installing flow rules in the local forwarding element before packets arrive. The forwarding element maintains a cache of flow rules that are installed in advance, eliminating the need for real-time flow rule installation during packet forwarding, thereby reducing the cost and complexity of the installation process while ensuring forwarding correctness.
3Reliability
If all packets are sent to the controller for forwarding decisions, then complete control over traffic is achieved, but network resources are consumed excessively and security is improved through loss of observability
Solution Approach 1:
The patent applies partial action by having the local forwarding element handle packets locally without always involving the controller. Instead of sending all packets to the controller, the system uses the local forwarding element to process packets that match cached flow rules, introducing delays only when necessary to mimic controller behavior. This reduces controller processing load while maintaining sufficient control completeness.
Data Source
AI summary
A method for forwarding data flows in a network, which has a forwarding element for forwarding the data flows, includes: receiving a data flow of the data flows, the data flow corresponding to a present forwarding rule of the forwarding element; forwarding the data flow with an added time delay. The added time delay includes a first forwarding time delay and second forwarding time delay. A first number of packets of the data flow, which are first packets, are forwarded by the first forwarding element with the first forwarding time delay. A second number of the packets of the data flow, which are second packets, are forwarded with the second forwarding time delay. The first forwarding time delay and the second forwarding time delay have a time difference from each other.