SDN Application Integrity via Authorization Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Software-Defined Networks (SDNs) lack efficient and effective configuration to process API calls from SDN applications, leading to insecure interactions between SDN applications and controllers, compromising integrity in Network Function Virtualization (NFV) environments.
Innovation Solution
An authorization SDN controller translates embedded codes from user SDN applications into network addresses and privilege data sets, enabling authorized API calls and isolating applications from unauthorized access, ensuring secure interaction and integrity through SDN application privilege data sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SDN controllers process API calls from SDN applications without authorization mechanisms, then the system operates with simple configuration and fast processing, but security and integrity are compromised
Solution Approach 1:
The authorization SDN controller performs preliminary actions by translating embedded codes into network addresses and privilege data sets before the actual API calls are made. This advance preparation of authorization data enables subsequent security verification without adding complexity to the main control flow.
Solution Approach 2:
An authorization SDN controller is introduced as an intermediary component between SDN applications and user SDN controllers. This mediator translates embedded codes and manages privilege data sets, enabling security verification without requiring complex configuration changes in the existing SDN controllers.
2Reliability
If authorization mechanisms are implemented to verify API calls, then security and integrity are improved, but processing time and computational overhead increase
Solution Approach 1:
Privilege data sets are generated and stored in advance by the authorization SDN controller before API calls are executed. This preliminary preparation eliminates the need for complex real-time verification during API call processing, thereby reducing processing time while maintaining security.
Solution Approach 2:
The system uses embedded codes that are translated into privilege data sets, which serve as simplified copies or representations of the original authorization credentials. These privilege data sets enable fast verification without requiring complex real-time analysis of the original embedded codes.
3Ease of operation
If SDN applications can access any SDN controller, then system versatility and ease of operation are improved, but unauthorized access and security risks increase
Solution Approach 1:
The system implements location-specific authorization by translating embedded codes into controller-specific network addresses and privilege data sets. Each SDN application is authorized to access specific controllers based on its identity, enabling versatile access while preventing unauthorized cross-controller access.
Solution Approach 2:
The authorization SDN controller acts as an intermediary that manages access permissions between SDN applications and multiple user SDN controllers. It translates embedded codes into appropriate privilege data sets for each target controller, enabling secure and versatile access without requiring applications to know or manage permissions manually.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A Software-Defined Network (SDN) authorizes Application Programming Interface (API) calls from user SDN applications (111-113) to user SDN controllers (121-123). A user SDN application (111-113) transfers an embedded code to an authorization SDN controller (124). The authorization SDN controller (124) translates the embedded code into an SDN controller network address and an SDN application privilege data set. The authorization SDN controller (124) transfers the SDN controller network address to the user SDN application (111-113). The authorization SDN controller (124) transfers the SDN application privilege data set to the user SDN controller (121-123). The user SDN application (111-113) transfers an SDN API call to the user SDN controller (121-123) using the SDN controller network address. The user SDN controller (121-123) determines if the SDN API call is authorized by the SDN application privilege data set. The user SDN controller (121-123) services the API call if the SDN API call is authorized and inhibits an unauthorized API call.