SDN Controller End-to-End Encryption Policy Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networks (SDNs) lack a standardized method for end-to-end encryption, leading to unsecured data exposure and vulnerability to snooping or tampering, especially in segments where data packets travel in plain text form across the network.
Innovation Solution
Implementing a method where an SDN controller manages and directs end-to-end encryption by sending policies and encryption algorithms to SDN components, enabling them to perform cryptographic operations and maintain data packet security throughout the network path, even as components become available or unavailable, while ensuring routability of secure data packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data packets are transmitted across SDN segments, then network communication is enabled, but data security is compromised due to exposure to snooping or tampering
Solution Approach 1:
The patent segments the SDN architecture into distinct functional components (SDN controller, networking gateways, hypervisors) and applies encryption at specific segments (end-to-end between source and destination gateways) rather than attempting to secure the entire network infrastructure uniformly. This allows security to be applied where most critical while maintaining network functionality.
Solution Approach 2:
The patent introduces encryption algorithms and security policies as intermediary layers between the data packets and the network transmission medium. These intermediaries (encryption mechanisms) transform the data into secured form before transmission and restore it at the destination, preventing direct exposure to potential attackers in the network segments.
2Reliability
If end-to-end encryption is implemented in SDN, then data security is improved, but device complexity increases due to managing encryption policies and algorithms across components
Solution Approach 1:
The patent extracts the complex task of encryption management from the individual network components (gateways, hypervisors) and centralizes it in the SDN controller. The controller receives security policies, selects appropriate encryption algorithms, and distributes them to components, thereby reducing the complexity burden on each individual device while maintaining overall security.
Solution Approach 2:
The SDN controller is designed to perform multiple functions: it manages network traffic routing, monitors network segments, and handles encryption policy distribution. This multi-functionality consolidates what would otherwise be separate security management systems into a single unified controller, reducing overall system complexity.
3Reliability
If encryption policies are distributed to SDN components, then cryptographic operations can be performed, but network adaptability decreases when components become available or unavailable
Solution Approach 1:
The patent implements dynamic policy distribution where the SDN controller continuously monitors the availability status of network components and adjusts encryption policy distribution accordingly. When components become available or unavailable, the controller dynamically updates which components receive and execute encryption policies, ensuring cryptographic operations can be performed by available components without rigid pre-configuration requirements.
Data Source
AI summary
A first information comprising an identification of an encryption algorithm supported by a first component from the first component of a software defined network (SDN) is received at a controller of the SDN. A set of policies and a set of encryption algorithms are sent to the first component. A policy determines a cryptographic operation applicable to a path in the SDN between the first component and a second component of the SDN. The first component comprises an originating point of the path and the second component comprises a destination point of the path.