SDN Packet Tag Verification for Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networks (SDNs), packets can be susceptible to corruption due to unintended or malicious routing through unauthorized network elements, and existing systems lack effective verification mechanisms to ensure packet integrity and adherence to defined forwarding rules.
Innovation Solution
Implementing a verification system where SDN switches mark packets with tags containing their identifiers and digests of network forwarding rules, and a verifier checks these tags against a cumulative verifier tag to ensure correct routing and rule adherence, using a network rules table and topology table to validate packet paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packets are routed through SDN elements without verification, then network throughput and processing speed are maintained, but packet integrity and security deteriorate due to potential corruption and unauthorized routing
Solution Approach 1:
The system applies preliminary action by marking packets with verification tags before they traverse the SDN network. These tags contain cryptographic digests of the forwarding rules that will be applied, allowing verification to occur efficiently at the endpoint without requiring complex intermediate checking mechanisms at each SDN switch.
Solution Approach 2:
The verification tag acts as an intermediary that carries verification information through the network. Instead of requiring direct communication between verification mechanisms and each SDN element, the tag serves as a self-contained mediator that encapsulates the necessary verification data (packet identifier, ingress port, and digest of applied rules) for later validation.
2Reliability
If verification mechanisms are implemented at each SDN switch, then packet integrity is improved, but processing overhead and network latency increase
Solution Approach 1:
The verification information is prepared in advance when the packet is marked at the ingress SDN switch. The digest of the forwarding rules is calculated and embedded in the verification tag before the packet traverses the network, eliminating the need for time-consuming verification calculations at intermediate switches or the egress point.
Solution Approach 2:
The verification function is extracted from the data plane forwarding operations at each SDN switch. Instead of requiring each switch to participate in verification processing, the verification tag is attached once at the ingress and validated at the egress, separating the verification concern from the high-speed forwarding path.
3Object-affected harmful factors
If comprehensive packet verification is performed, then security against malicious routing is improved, but system complexity and computational overhead worsen
Solution Approach 1:
The system changes the parameter of verification from checking actual packet paths through multiple switches to verifying cryptographic digests in tags. This parameter change transforms a complex path-tracing problem into a simple digest comparison operation, significantly reducing verification complexity while maintaining security.
Solution Approach 2:
Instead of verifying the actual complex routing path, the system uses a cryptographic copy (digest) of the forwarding rules that were applied. This digest serves as a compact representation that can be verified without reconstructing or analyzing the actual packet traversal path, simplifying the verification mechanism.
4Measurement precision
If SDN switches mark packets with detailed verification information, then verification accuracy is improved, but packet overhead and processing load increase
Solution Approach 1:
The verification information is transformed from detailed path descriptions into compact cryptographic digests. This parameter change reduces the verification data from potentially large path-route descriptions to fixed-size hash values, minimizing packet overhead while maintaining verification precision.
Solution Approach 2:
The verification tag combines multiple pieces of information (packet identifier, ingress port, and digest of forwarding rules) into a single composite structure. This composite approach allows comprehensive verification information to be carried in a unified, efficient format that minimizes overhead while providing precise verification capability.
Data Source
AI summary
Examples relate to packet tagging in Software Defined Networks (SDN). In an example, at least one SDN switch of an SDN marks a packet passing through the SDN switch with a packet tag, wherein the packet tag comprises an identifier of the SDN switch and a digest of a set of network forwarding rules of the SDN switch. Some examples generate, by a verifier, a verifier tag comprising the identifier of the at least one SDN switch and the digest of the set of network forwarding rules of the at least one SDN switch obtained from a network rules table and a network topology table stored in the verifier. Some examples receive, at a particular network element and from a verifier of the SDN, a request for attestation of the packet. Some examples check, by a verification engine, the packet tag against the verifier tag.