SDN Controller Access Control Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control mechanisms for software defined networks (SDN) are limited in scope and do not scale with the number of applications, leading to unclear and ineffective access control policies, particularly in multi-tenant environments where resource sharing and competition occur.
Innovation Solution
A conflict resolution scheme is applied by the SDN controller, which defines flow spaces based on packet headers, assigns priorities, selects a master application, and triggers only applications whose reactions do not conflict with the master application, ensuring efficient and flexible access control by utilizing a tree-based data structure and reference monitor to enforce policies close to the data plane.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple applications are triggered to react to trigger events in SDN controller, then network management flexibility and functionality are improved, but access control conflicts and system complexity increase
Solution Approach 1:
The patent segments the network space into multiple flow spaces based on packet headers, where each flow space is independently managed with its own access control policies. This segmentation allows different applications to operate in different flow spaces without conflicts, enabling network management flexibility while controlling system complexity through structured division of the control plane.
Solution Approach 2:
The patent introduces a reference monitor as an intermediary component that mediates between multiple applications and the SDN controller. The reference monitor enforces access control policies by determining which applications can access which flow spaces, thereby managing conflicts between multiple triggered applications while maintaining system functionality and flexibility.
2Reliability
If access control policies are enforced in multi-tenant SDN environments, then network security and resource protection are improved, but scalability and performance degradation occur
Solution Approach 1:
The patent implements preliminary action by pre-defining flow spaces and assigning access control policies to them before actual network operations begin. The reference monitor is pre-configured with policies that determine application access rights to different flow spaces. This preliminary setup enables fast, policy-based access control decisions during runtime without requiring complex real-time analysis, thus maintaining security while ensuring scalability.
3Ease of manufacture
If existing best-effort access control mechanisms are used, then implementation simplicity is maintained, but access control effectiveness and policy enforcement clarity deteriorate
Solution Approach 1:
The patent applies local quality by associating specific access control policies with individual flow spaces rather than applying uniform access control across the entire network. Each flow space can have customized access control rules tailored to its specific requirements, enabling precise policy enforcement for different network segments while maintaining overall system simplicity through the modular flow space structure.
Data Source
AI summary
A method of providing access control for a software defined network (SDN) controller includes triggering, by the SDN controller upon receiving a trigger event from a data plane of the software defined network, one or more applications that are installed to run at a control plane of the software defined network atop the SDN controller to react to the trigger event, applying, by the SDN controller before triggering applications due to a trigger event, a conflict resolution scheme. The conflict resolution scheme includes determining all flow spaces that are affected by the trigger event and selecting from these flow spaces a single selected flow space that complies with a predetermined policy, determining, a single master application according to predefined criteria, and triggering, in addition to the master application, only those applications whose reactions to the trigger event do not conflict with the master application.