SDN Intrusion Prevention via Shared-State Forwarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) face limitations such as slow detection and reaction times, resource intensity, noise generation, and the creation of a Single Point of Failure (SPOF) in networks, which complicates the detection and prevention of malicious data flows, especially in software-defined networks (SDN).
Innovation Solution
A system and method that utilizes a shared-state forwarding element to block, forward, or replicate data flows based on stored flow states and predetermined patterns, allowing for immediate threat response and reducing the load on intrusion detection by only processing suspect traffic, using Distributed Connection Tracking (DCT) to share flow states across the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If an Inline IPS is deployed to block malicious traffic immediately, then detection and reaction speed is improved, but the system creates a Single Point of Failure (SPOF) and requires expensive High Availability solutions
Solution Approach 1:
The system divides the IPS functionality into two separate components: an inspection element (IE) that performs malicious traffic detection, and a forwarding element (FE) that executes blocking actions. This segmentation eliminates the SPOF problem by allowing the IE to operate independently from the data path, while the FE can be replicated for high availability without compromising detection speed.
Solution Approach 2:
The patent introduces a shared state database as an intermediary between the IE and FE. The IE updates the shared state with classification results, and the FE queries this state to make blocking decisions. This intermediary mechanism enables the separation of detection and enforcement functions while maintaining coordinated operation, resolving the contradiction between speed and reliability.
2Measurement precision
If an IPS processes all network traffic to ensure comprehensive security, then detection accuracy is improved, but the system bandwidth is limited and causes performance degradation under traffic spikes
Solution Approach 1:
The system applies partial action by having the forwarding element make blocking decisions based on shared state information without requiring the inspection element to analyze every packet. The IE performs deep inspection only when necessary to update the shared state, while the FE handles the majority of traffic using the pre-computed classification data, thereby maintaining detection accuracy while preserving system bandwidth under traffic spikes.
3Reliability
If an Offline IPS is deployed to avoid creating a SPOF, then system reliability is improved, but detection and reaction times become much slower
Solution Approach 1:
The inspection element performs traffic classification and updates the shared state database in advance, before malicious traffic needs to be blocked. This preliminary action allows the forwarding element to immediately block suspicious traffic by querying the pre-updated shared state, achieving both the reliability of offline operation and the speed of inline response without requiring the IE to be in the critical data path.
Data Source
AI summary
The present disclosure provides a system for detecting and preventing the intrusion of malicious data flows in a software defined network (SDN). The system comprises at least one data storage or memory, configured to store flow states of data flows, and to share and update the flow states across the system, at least one shared-state forwarding element (FE) configured to block, forward, or replicate a received data flow based on a flow state of the data flow and/or a comparison of the data flow with predetermined patterns, and at least one inspection element (IE), configured to receive a replicated data flow, and to classify, whether the data flow is malicious or allowed. The IE is configured to alter the flow state of the data flow according to a classification result. The present disclosure provides a corresponding method for detecting and preventing intrusion of malicious data flows in a SDN.