SDN Controller Message Attack Defense via Round-Robin Scheduling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software Defined Networking (SDN), controllers are vulnerable to packet_in message flooding attacks, which lead to resource occupation and prolonged processing times, affecting normal user service requests.
Innovation Solution
Implementing a message attack defense method where a controller receives and stores report messages in switch queues, performing round-robin scheduling to manage and prioritize messages, thereby isolating and efficiently processing packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the controller processes packet_in messages in the order they are received, then the processing order is simple and the device complexity is low, but during flooding attacks the processing time is prolonged and productivity decreases
Solution Approach 1:
The patent segments the message processing by dividing messages into different priority levels (normal priority and high priority). The controller processes high priority messages separately from normal priority messages, allowing urgent messages to be handled immediately while routine messages are processed in the queue. This segmentation resolves the contradiction by maintaining simple processing logic for normal messages while enabling fast response for urgent messages without increasing overall system complexity.
Solution Approach 2:
The patent changes the parameter of message processing by introducing a priority attribute that can take different values (normal or high). This parameter change allows the controller to adjust processing behavior dynamically based on message urgency. When a flooding attack is detected, the system can mark relevant messages as high priority, changing the processing parameter from simple FIFO to priority-based processing, thereby improving productivity without fundamentally changing the processing mechanism.
2Ease of operation
If the controller processes all packet_in messages sequentially, then the processing logic is simple and ease of operation is high, but the time to respond to service requests is prolonged
Solution Approach 1:
The patent segments the message queue into two distinct parts: a normal priority queue and a high priority queue. This segmentation allows the controller to maintain simple sequential processing for normal messages while providing a separate fast path for high priority messages. The ease of operation is preserved for the majority of messages, while response time for urgent messages is significantly reduced, resolving the contradiction between simple processing logic and fast response time.
Solution Approach 2:
The patent implements preliminary action by pre-establishing the dual-queue structure and priority classification mechanism before attacks occur. When messages arrive, the controller immediately classifies them into appropriate priority levels and queues, so that high priority messages are ready for immediate processing without requiring complex real-time decisions. This preliminary organization reduces response time while keeping the processing logic straightforward.
3Device complexity
If the controller handles all packet_in messages without prioritization, then the device complexity is low and ease of manufacture is high, but during attacks the controller burden increases and processing efficiency decreases
Solution Approach 1:
The patent segments message handling into priority-based streams, creating separate processing paths for normal and high priority messages. This segmentation protects the controller during attacks by ensuring that high priority messages (which may be attack-related or time-critical) are processed immediately, preventing the controller from being overwhelmed by a flood of normal priority messages. The complexity increase is minimal, involving only queue separation and priority marking, while reliability during attacks is significantly improved.
Solution Approach 2:
The patent introduces the priority queue system as an intermediary between message reception and processing. This intermediary mechanism buffers and prioritizes messages before they reach the main processing logic, protecting the controller from direct冲击 of flooding attacks. The intermediary layer filters and organizes incoming messages, allowing the core processing mechanism to remain simple while improving overall system reliability under attack conditions.
Data Source
AI summary
The present disclosure discloses a message attack defense method and apparatus. The method includes: receiving, by a controller, a report message sent by at least one switch; respectively storing, by the controller in a switch queue corresponding to each switch, the received report message that is sent by each switch; and performing, by the controller, round-robin scheduling on the switch queue corresponding to each switch.