SDN Flow Management via Domain-Based Rule Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional SDN networks face difficulties in accurately differentiating and managing traffic flows associated with primary and ancillary services, particularly in prioritizing business-critical services over employee leisure services, due to shared protocol information and the use of encrypted protocols, which limits the ability to apply specific forwarding rules.
Innovation Solution
An SDN application identifies traffic flows based on destination addresses and generates protocol field-based rules to differentiate and manage traffic flows, using a rule generation module that includes submodules for flow-to-domain, domain-to-service, service-to-rule, and Bag of Domains training, allowing for real-time, accurate association and management of support flows with primary services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional SDN networks use shared protocol information for flow management, then network simplicity is maintained, but the ability to accurately differentiate and prioritize traffic flows between primary and ancillary services deteriorates
Solution Approach 1:
The patent segments flow management into distinct categories by introducing domain-based classification. It divides traffic flows into primary service flows and ancillary service flows based on domain relationships, allowing differentiated handling. The system segments the flow identification process into extracting domain names from URLs, matching domains to services, and applying service-specific rules, thereby achieving accurate flow differentiation without overwhelming complexity.
Solution Approach 2:
The patent introduces an intermediary domain-name-to-service mapping mechanism that bridges the gap between protocol information and service identification. This mapping table acts as an intermediary layer that translates domain names into service identifiers, enabling the SDN controller to differentiate flows based on their associated services rather than relying solely on protocol fields. This intermediary structure resolves the contradiction by providing accurate service identification while maintaining manageable rule complexity.
2Reliability
If encrypted protocols are used for web services, then security is improved, but the ability to inspect and manage traffic flows deteriorates
Solution Approach 1:
The patent applies preliminary action by extracting and storing domain name information from URLs before the actual service interaction occurs. The system proactively parses URLs to extract domain names, pre-establishes domain-to-service mappings, and prepares service identification rules in advance. This preliminary extraction of identifying information allows reliable service identification without needing to decrypt the actual service traffic, thus maintaining both security and inspection capability.
Solution Approach 2:
The patent extracts the critical identifying element (domain name) from the URL structure and separates it from the encrypted service communication. By taking out the domain name information that appears in unencrypted URL fields, the system achieves reliable service identification without requiring access to or decryption of the encrypted service payload. This extraction approach resolves the contradiction by obtaining necessary identification information while preserving encryption for actual service data.
Data Source
AI summary
In an example embodiment, a Software Defined Networking (SDN) application identifies a domain based on a destination address of a packet that is associated with a primary service. The domain corresponds to the primary service, and the primary service is configured to trigger one or more support flows from one or more ancillary services. The SDN application identifies the one or more support flows based on the domain, and generates one or more rules for distribution to one or more network elements that handle packets of the one or more support flows from the one or more ancillary services.