SDN Flow Deflection for Resource Exhaustion Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software Defined Networks (SDNs) face vulnerabilities due to limited resources in network elements, particularly TCAM and CPU, which can be exploited in resource utilization attacks, leading to exhaustion and over-utilization, compromising network efficiency and security.
Innovation Solution
Implementing flow deflection capabilities within the SDN to redirect new flow requests from overloaded network elements to neighboring elements with available resources, managed by a controller that monitors and balances resource utilization across the network, generating flow forwarding rules to optimize resource allocation and mitigate attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flow requests are handled by a single network element, then processing is simple, but resource exhaustion occurs under attack conditions
Solution Approach 1:
The patent segments the flow handling responsibility across multiple network elements. When a resource utilization condition is detected at a first network element, flow forwarding rules are generated to redirect at least a portion of new flow requests to a second network element. This segmentation distributes the processing load and prevents resource exhaustion at any single element, thereby improving network resilience without requiring complete system-wide complexity.
2Reliability
If all new flow requests are processed by the same network element, then resource allocation is simple, but resource exhaustion leads to network failure
Solution Approach 1:
The patent implements dynamic resource allocation through flow forwarding rules that are generated and updated based on real-time resource utilization conditions. The system dynamically redirects flow requests between network elements depending on their current resource state, allowing the network to adapt to changing conditions and attacks. This dynamic approach ensures network availability by preventing resource exhaustion while maintaining flexible resource allocation.
3Reliability
If flow deflection is implemented to distribute load, then resource exhaustion is prevented, but network complexity increases
Solution Approach 1:
The patent introduces a controller as an intermediary that monitors resource utilization conditions across network elements and generates flow forwarding rules to redirect traffic. This intermediary approach prevents resource exhaustion attacks by intelligently distributing load while centralizing the complexity of monitoring and rule management. The controller acts as a mediator between network elements, coordinating their behavior to achieve collective resilience without requiring each element to become overly complex.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.