SDN Controller Conflict Detection for Flow Table Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OpenFlow standard lacks a comprehensive audit and tracking mechanism for flow tables, allowing address range conflicts in data flows to bypass SDN firewalls, and existing methods only address conflicts on individual switches rather than the entire network path.
Innovation Solution
A method and apparatus for conflict detection and resolution that involve a controller acquiring and analyzing the flow path of a data flow across multiple intermediate nodes, determining conflicts by comparing address ranges with security policies, and adjusting flow table entries or firewall rules to prevent conflicts across the entire network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If flow table entries are added or modified on individual switches to rewrite address ranges, then the ability to redirect data flows is improved, but the risk of address range conflicts bypassing firewall rules increases
Solution Approach 1:
The controller implements a feedback mechanism by continuously monitoring flow paths and detecting address range conflicts between flow table entries and firewall rules. When conflicts are detected, the controller automatically generates and sends resolution instructions to intermediate nodes, creating a closed-loop system that maintains firewall enforcement despite flow table modifications
Solution Approach 2:
The controller acts as an intermediary between flow table management and firewall rule enforcement. It receives flow path information from intermediate nodes, detects conflicts with firewall rules, and coordinates resolution by sending updated flow table entries to the appropriate nodes, thereby mediating between the need for flow redirection and firewall security
2Device complexity
If conflict detection is performed only on individual switches, then the detection process is simple, but conflicts on the entire network path cannot be detected
Solution Approach 1:
The controller performs multiple functions: it collects flow path information from all intermediate nodes, detects address range conflicts between flow table entries and firewall rules, and coordinates resolution across the entire network path. This multi-functional approach enables comprehensive conflict detection without requiring complex detection mechanisms at each individual node
3Measurement precision
If the controller monitors the entire network path for conflicts, then conflict detection accuracy is improved, but the system complexity and processing overhead increase
Solution Approach 1:
The conflict detection process is segmented into distinct phases: first, the controller collects flow path information from intermediate nodes; second, it detects conflicts between flow table entries and firewall rules; third, it generates resolution instructions. This segmentation allows the controller to handle complex monitoring tasks in manageable steps, reducing processing overhead while maintaining high detection accuracy
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Conflict detection and resolution methods and apparatuses relate to the field of communications technologies, and are applicable to a scenario in which a data flow is transmitted on a network, and are used to block a data flow from an overall perspective of a path of a data flow on an entire network. The conflict detection method includes: acquiring, by a controller, a flow path of a data flow on a network, where the flow path is used to indicate a path along which the data flow reaches a destination address range from a source address range through at least two intermediate nodes on the network, a first flow table rule is added to or deleted from flow tables of the at least two intermediate nodes, and the first flow table rule is any flow table rule; and determining, by the controller, whether a conflict exists according to an address range of the flow path and an address range of a security policy.