SDN Packet Forwarding Unit Access Control Entity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software defined networks face challenges in ensuring access control among different network slices and within the same slice, leading to potential interference and resource sharing issues, with existing solutions like FlowVisor adding latency and complexity.

Innovation Solution

A data packet forwarding unit with an access control entity that manages access to forwarding rules based on stored access rules, using identifiers to control access and prevent interference between slices, eliminating the need for hypervisor-based virtualization.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If FlowVisor hypervisor-based virtualization is used to ensure access control among network slices, then isolation and access control are improved, but control plane latency increases and system complexity increases

Engineering Contradiction:

Improveaccess control isolationVSAvoidcontrol plane latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the access control functionality from the external FlowVisor hypervisor layer and embeds it directly within the data packet forwarding unit (switch). This removes the intermediate virtualization layer that caused latency, allowing the switch to enforce access control rules natively without external mediation, thus reducing control plane latency while maintaining isolation guarantees

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent merges the access control entity with the data packet forwarding unit, combining previously separate functions (forwarding and access control) into a single integrated component. This consolidation eliminates the need for separate hypervisor-based virtualization, reducing system complexity and control plane latency while maintaining reliable access control among network slices

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If FlowVisor hypervisor-based virtualization is used to ensure access control among network slices, then isolation and access control are improved, but device complexity increases

Engineering Contradiction:

Improveaccess control isolationVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent removes the FlowVisor hypervisor layer from the system architecture, extracting access control functionality and embedding it directly in the switch. This elimination of the intermediate virtualization layer reduces system complexity while maintaining access control isolation

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent combines the access control entity with the data packet forwarding unit, merging previously separate components into one integrated device. This consolidation simplifies the overall system architecture by eliminating the need for separate hypervisor infrastructure while preserving isolation guarantees

Inventive Principle:

Principle #5Merging (Combining)

3Ease of operation

If centralized control plane is used in SDN to simplify control plane protocol development, then ease of operation is improved, but control plane latency increases

Engineering Contradiction:

Improvecontrol plane protocol developmentVSAvoidcontrol plane latency

Core Design Contradiction:

Ease of operationVSLoss of time

Solution Approach 1:

The patent segments the control plane functionality by distributing access control enforcement to individual switches through embedded access control entities. This allows switches to autonomously enforce access control rules locally without requiring centralized control plane intervention for every access decision, reducing control plane latency while maintaining simplified protocol development through SDN

Inventive Principle:

Principle #1Segmentation

4Productivity

If network slices share the same SDN infrastructure, then resource utilization is improved, but access control and isolation become more difficult

Engineering Contradiction:

Improveresource utilizationVSAvoidaccess control isolation

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements local quality by embedding access control entities within individual switches that enforce slice-specific access control rules locally. Each switch can independently manage access control for different network slices sharing the same infrastructure, ensuring isolation while enabling efficient resource utilization through shared underlying hardware

Inventive Principle:

Principle #3Local quality

Data Source

PatentEP3479532B1A data packet forwarding unit in software defined networks

Publication Date: 2020.07.15 HUAWEI TECH CO LTD

Figure 1
Figure 2
Figure 3

AI summary

This invention relates to a data packet forwarding unit (202) configured to forward data packets within a software defined network on the basis of a set of data packet forwarding rules, the data packet forwarding unit (202) comprises a memory (202b) configured to store the set of data packet forwarding rules and a set of access rules and an access control entity (202a) configured to control the access to the set of data packet forwarding rules on the basis of the set of access rules.