SDN Controller Port Authorization via Identification Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software-defined network (SDN) controllers increase security risks by allowing unauthorized devices to access private data networks, as they rely on software configurations rather than manual device configurations, leading to potential malicious access.
Innovation Solution
A network device with a control unit that instructs connected switches to implement port limitations, broadcasts a controller address, receives identification information, establishes communication links, determines authorization based on a predetermined policy, and removes limitations on authorized devices, ensuring secure access to the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-defined network (SDN) controllers are used to enable easy addition of new devices based on software configurations, then device addition convenience is improved, but network security deteriorates due to increased risk of unauthorized access
Solution Approach 1:
The system performs preliminary identification and authorization checks before allowing a device to join the network. The controller receives identification information from the new device, verifies it against authorized device information stored in the system, and only then permits network access. This preliminary verification prevents unauthorized devices from joining while maintaining software-based configuration convenience.
Solution Approach 2:
The SDN controller acts as an intermediary between new devices and the network fabric. It receives connection requests, performs authorization verification by comparing device identification information against authorized lists, and controls whether the device is allowed to join. This intermediary role enables centralized security management while preserving the ease of software-based device addition.
2Object-affected harmful factors
If manual configuration of every device is required for network access, then network security is improved through centralized control, but device addition complexity increases
Solution Approach 1:
Authorized devices perform self-service by automatically providing their identification information to the SDN controller when attempting to join the network. The controller automatically verifies this information against the stored authorized device information and configures network access accordingly. This eliminates the need for manual configuration of each device while maintaining security through automated verification.
Solution Approach 2:
The system uses a universal identification mechanism that works for all devices joining the network. Instead of requiring device-specific manual configuration, the same automated process handles all authorized devices: they provide identification information, the controller verifies it against the authorized list, and network access is granted. This universal approach simplifies the process while maintaining centralized security control.
Data Source
AI summary
A control unit that is configured to instruct a device to implement a limitation on a port and broadcast a controller address. The control unit is further configured to receive first identification information associated with a second device connected to the port from the device, the first identification information being addressed to the controller address. Additionally, the control unit is configured to establish a communication link with the second device through the device and the port, receive second identification information associated with the second device over the communication link, determine whether the second device is authorized based on a policy, determine whether the first identification information and second identification information match, and instruct the first device to remove the limitation on the port in response to determining that the second device is authorized and that the first identification information matches the second identification information.