SDN Data Stream Security Routing via Dynamic Path Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data stream security processing methods in software-defined networks (SDNs) suffer from low security performance and high load on controllers due to the lack of effective security detection and routing through middleboxes.
Innovation Solution
A data stream security processing method that determines security levels based on feature information and selects forwarding paths that may include security devices, such as firewalls or intrusion prevention systems, to enhance security and alleviate controller load, using mechanisms like shortest security path finding and fastest detection path finding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a data stream passes through a software module inside the controller for security detection, then security detection is performed, but security performance is not high and load of the controller is heavy
Solution Approach 1:
The patent extracts the security detection function from the software module inside the controller and implements it as a separate security detection module deployed on network devices. This extraction reduces the controller's processing load while maintaining security detection capabilities, directly resolving the contradiction between security performance and controller load.
Solution Approach 2:
The patent introduces a security detection module as an intermediary component that handles security detection tasks. This module can be deployed on network devices and communicates with the controller through a standardized interface, allowing security detection to be performed outside the controller's software module and thereby reducing controller load.
2Reliability
If the controller determines transmission path and performs security detection, then complete security processing is achieved, but load of the controller is heavy
Solution Approach 1:
The patent segments the controller's functions by separating security detection from path determination. The controller focuses on determining transmission paths and managing security policies, while the security detection module handles actual security detection. This segmentation reduces the controller's functional complexity while maintaining complete security processing.
Solution Approach 2:
The security detection module is designed as a universal component that can be deployed on different network devices and handles multiple security detection tasks. It provides multi-functional security processing capabilities including detection, classification, and forwarding decisions, reducing the need for the controller to handle all security functions directly.
3Productivity
If a forwarding path goes through only a forwarding device, then forwarding efficiency is high, but security detection capability is insufficient
Solution Approach 1:
The patent implements dynamic path selection where forwarding paths can adaptively include security devices based on real-time security requirements. The system dynamically determines whether to route traffic through security devices or direct forwarding paths, allowing forwarding efficiency to be maintained when security risks are low while enabling security detection when needed.
Solution Approach 2:
The patent changes the parameter of forwarding path composition by introducing security devices as optional intermediate nodes. The forwarding path is no longer fixed to only forwarding devices but can include security devices based on security level requirements, traffic characteristics, and policy configurations, thereby balancing forwarding efficiency and security detection capability.
Data Source
AI summary
A data stream security processing method and apparatus are disclosed. The data stream security processing method of the present invention includes: acquiring feature information of a data stream (101), where the feature information includes source information and destination information of the data stream; determining a security level of the data stream (102) according to the feature information; determining (103), according to the security level, a forwarding path for transmitting the data stream; and delivering (104) information used for indicating the forwarding path to devices in the forwarding path. A forwarding path is determined according to the security level, where a forwarding path may go through a security device to implement a corresponding security function of the forwarding path, thereby improving data stream forwarding security. The method and apparatus may be used in a software defined network, SDN, for example using OpenFlow.