SDN Firewall State Management via Control Plane Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewall systems in SDN networks, particularly those using the OpenFlow standard, face issues such as increased storage and calculation resources, data traffic, and vulnerability to denial-of-service attacks when managing stateful transport protocols, as they require additional tables and duplicate control functions in the data plane.
Innovation Solution
A method that involves the control equipment receiving connection identification and event information from the switching equipment, updating the connection state using a state machine, and sending new processing rules to the switching equipment while deleting obsolete rules, thereby offloading state management and reducing unnecessary traffic and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional tables and state management functions are added to switching equipment to manage stateful transport protocols, then connection state tracking capability is improved, but device complexity and storage requirements increase
Solution Approach 1:
The patent extracts state management functions from the switching equipment (data plane) and relocates them to the control equipment (control plane). The control equipment maintains connection state information and generates appropriate processing rules, while the switching equipment simply executes these rules without needing to track connection states itself. This separation resolves the contradiction by improving state tracking capability through centralized management while keeping switching equipment simple.
Solution Approach 2:
The control equipment acts as an intermediary between the network protocol state machine and the switching equipment. It receives connection information, processes it through the state machine, and translates it into processing rules that the switching equipment can execute. This intermediary approach allows sophisticated state management without increasing switching equipment complexity.
2Reliability
If control functions are duplicated in the data plane, then connection state management capability is improved, but resource usage and data traffic increase
Solution Approach 1:
The patent extracts control functions from the data plane and concentrates them in the control plane. The control equipment performs all state machine processing and rule generation, while the switching equipment only executes received rules. This eliminates duplication of control functions and reduces computational resource usage in the data plane while maintaining robust connection state management.
3Ease of operation
If processing rules are not deleted when connections terminate, then rule processing simplicity is maintained, but unnecessary data traffic and resource usage increase
Solution Approach 1:
The system implements feedback through the state machine that monitors connection states. When a connection terminates, the state machine detects this change and triggers the deletion of associated processing rules. This feedback mechanism maintains rule processing simplicity while automatically cleaning up obsolete rules to improve network resource efficiency.
Solution Approach 2:
The control equipment proactively deletes processing rules when connection termination is detected through the state machine, before these rules could process unnecessary traffic. This preliminary action prevents wasted resource usage while maintaining simple rule processing logic through automated management.
Data Source
Figure 1
Figure 2A~3
Figure 4~5
AI summary
The invention relates to a method of protecting a communication network, through which a client communication equipment is able to establish a stateful connection according to a transport protocol with a server communication equipment, and to transmit data packets to it, comprising the following steps: - Prior installation (E1) of at least one first rule, called initial (RIm), comprising the following sub-steps: ○ obtaining (E11) identification information of at least one connection (Cm) authorized by a network administrator;o transmission (E12) to the switching equipment of said at least one initial rule (RIm) for processing a data packet of said at least one connection (Cm), including at least some initial identification information of the authorized connection, information representative of a connection initiation event and an action of retransmitting the data packet to the control equipment; - Reception (E2) of a request message (RQ, RQ', RQ"), said message including at least some connection identification information (IC) and at least one information (IE) representative of a connection event, said message having been issued by a switching equipment (20) of the network, by application of an initial rule for processing a data packet issued by the client equipment (EC) to the server equipment (ES);- Obtaining (E3) a current state (Si) by searching in a connection table (TC) and updating (E4) the current state (Sj) of the connection from said at least one representative piece of information of a connection event and a state machine of the transport protocol; - Sending (E5) to said switching equipment a response message (RP, RP', RP") including;