SDN Controller Bypassing Firewalls for Authorized Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networking (SDN) controllers face complexity and inefficiency in managing authorized data flows due to the need for extensive customization and high computational resources, especially with the rise of large data flows known as 'elephant flows' which overwhelm networks, leading to increased costs and latency.
Innovation Solution
Implementing a method where an SDN controller bypasses the firewall for authorized flows by inserting flow criteria into a master data flow list, reducing the need for physical network ports and compute power, and using a policy engine to manage and validate data packets, thereby optimizing network bandwidth and reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software-defined networking controllers implement extensive customization for each software controller, then network service functionality is improved, but device complexity and cost increase
Solution Approach 1:
The patent implements a universal SDN controller architecture that can handle multiple network service types through a single standardized platform. The controller uses a unified data flow list structure that accommodates various network services without requiring separate customized controllers for each service type, thereby reducing overall system complexity while maintaining versatility.
Solution Approach 2:
The system manages network service functionality by dynamically changing parameters in the data flow list rather than requiring structural customization of the controller itself. Flow criteria such as source IP, destination IP, ports, and protocols are modified through parameter updates, allowing the same controller to adapt to different network services without increasing device complexity.
2Reliability
If traditional firewalls validate all data packets, then network security is improved, but bandwidth consumption and processing time increase
Solution Approach 1:
The SDN controller performs preliminary validation of data flows by checking flow criteria against the master data flow list before packets reach the firewall. This preliminary action identifies authorized flows in advance, allowing the firewall to bypass validation for known authorized traffic while maintaining security for unknown flows, thereby improving bandwidth efficiency without compromising security.
Solution Approach 2:
The patent introduces an intermediary mechanism where the SDN controller acts as a mediator between the firewall and the network. The controller maintains a master data flow list that serves as an intermediary reference, allowing the firewall to quickly determine whether packets need full validation or can be bypassed, reducing processing time while maintaining security.
3Productivity
If physical network ports and compute power are increased to handle large data flows, then network capacity is improved, but cost increases
Solution Approach 1:
The patent uses software-based virtualization to create virtual network ports and compute resources that replicate physical functionality without requiring actual physical hardware. The SDN controller manages virtual data flow lists that can handle large amounts of traffic through software processing, eliminating the need to proportionally increase physical network ports and compute resources to handle large data flows.
Solution Approach 2:
The system implements a universal software-defined networking platform that can handle multiple data flow types and volumes through a single virtualized infrastructure. This multi-functional approach allows one set of physical resources to serve multiple purposes, reducing the total quantity of physical network ports and compute power needed while maintaining high network capacity.
Data Source
AI summary
Methods and systems for managing authorized data flows using software defined networking include receiving flow criteria sent from a firewall and extracted from a first data packet, determining whether flow criteria of the first data packet matches an entry in a master data flow list, inserting the flow criteria from the first data packet into the master data flow list on a software defined networking controller, and sending the flow criteria of the first data packet to the router. The router may forward a second data packet associated with the data flow toward a destination based on the validation of the first data packet by the firewall. The flow criteria may not match an entry in a router data flow list on the router and may include at least two of: a source IP address, a destination IP address, a destination port, and a protocol of transmission.