OpenFlow SDN Switch Mirroring Packets to Firewall
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software Defined Networking (SDN) environments face increased security risks due to the replacement of smart network switches with inexpensive commodity switches, which lack deep packet inspection capabilities, necessitating a low-cost method for performing deep packet inspection without compromising network performance.
Innovation Solution
Implementing a system that uses Open Flow protocol for communication between a network switch, controller, and firewall, enabling deep packet inspection through 'observe' and 'enforce' modes, where the network switch mirrors packets to the firewall for analysis, allowing or denying them based on threat detection, and controlling the depth of inspection to balance security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If smart network switches with deep packet inspection functionality are used, then network security is improved, but device cost increases significantly
Solution Approach 1:
The patent introduces a separate deep packet inspection device that acts as an intermediary between the network switch and the network. This inspection device performs security checks on packets while the network switch maintains its simple, low-cost commodity design. The switch forwards packets to the inspection device, which then determines whether to allow or block traffic, thus separating the security function from the switching function and enabling cost-effective implementation.
2Reliability
If deep packet inspection is performed on all packets, then network security is improved, but network performance deteriorates due to processing delays
Solution Approach 1:
The patent implements selective deep packet inspection where not all packets are inspected with the same depth. The system can adjust the inspection level based on packet characteristics, flow types, and security policies. For example, established connections may receive lighter inspection while new or suspicious connections receive more thorough analysis. This localized quality approach maintains security while reducing overall processing overhead and improving network performance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a method and system for performing deep packet inspection of messages transmitted through a network switch in a Software Defined Network (SDN). Embodiments of the invention include a network switch, a controller, and a firewall in a software defined networking environment. In the present invention, the network switch is a simple network switch that is physically separate from the controller and the firewall. The invention may include a plurality of physically distinct network switches communicating with one or more controllers and firewalls. In certain instances, communications between the network switch, the controller, and the firewall are performed using the Open Flow standard communication protocol.