SDN Communication Apparatus with Isolated Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security mechanisms in Software-Defined Networks (SDNs) fail to confine damage to a single network component, allowing compromised components to spread damage to the entire network, leading to deterioration in network security.
Innovation Solution
A communication apparatus and system with isolated environments for each communication process, utilizing a dispatcher to associate flows with specific processes based on dispatch rules, ensuring that each process operates within its own isolated environment, and employing a hypervisor for memory isolation and access control to prevent malicious activity from affecting other processes or the entire system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security mechanisms are implemented in SDNs to protect network components, then network security is improved, but the mechanisms fail to confine damage to single components, allowing compromised components to spread damage to the entire network
Solution Approach 1:
The network control functionality is segmented into multiple isolated virtual machines, each handling specific control tasks. This segmentation ensures that a compromise in one virtual machine cannot propagate to other virtual machines or the physical host, as each operates in an isolated environment with restricted access to shared resources.
Solution Approach 2:
A hypervisor acts as an intermediary layer between the virtual machines and the physical host system. This intermediary enforces strict access control policies, mediating all resource access requests and preventing unauthorized communication between virtual machines, thereby containing potential security breaches within individual virtual machine boundaries.
2Productivity
If multiple communication processes share the same network environment, then resource utilization is improved, but security is deteriorated as malicious activity can affect other processes
Solution Approach 1:
Multiple communication processes are segmented into separate virtual machines, allowing them to share physical hardware resources while maintaining strict logical isolation. Each virtual machine can utilize network resources independently without interfering with other virtual machines, achieving both high resource utilization and robust security isolation.
Solution Approach 2:
The hypervisor serves as an intermediary that manages resource sharing between virtual machines while enforcing isolation boundaries. It allows controlled access to shared resources such as network interfaces and processing power, while preventing malicious processes from affecting other virtual machines through enforced access control policies.
Data Source
AI summary
A communication apparatus comprising a plurality of communication processes, each of the communication processes configured to be executed in an environment allocated thereto and isolated from each of one or more environments arranged for remaining one or more processes, each of the communication processes performing communication processing on a flow associated thereto, a network interface connected to a network; a dispatcher that dispatches a packet to the communication process based on a dispatch rule that defines association of a flow with a communication process.