SDN Path Switching with Preconfigured Security Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software-defined networks (SDNs) experience delays and disruptions due to the need to interrupt network traffic for security measure upgrades or path modifications, which is particularly pronounced in large and complex networks.
Innovation Solution
A method of pre-establishing multiple paths and security profiles in the data plane, allowing for seamless switching to a redundant path or security profile in response to trigger events such as security alerts or performance changes, minimizing traffic disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are upgraded or paths are modified in existing SDNs, then network security and performance are improved, but network traffic is interrupted causing delays and disruptions
Solution Approach 1:
The patent pre-establishes multiple paths and security profiles before they are needed. When a security upgrade or path modification is required, the system can immediately switch to a pre-configured alternative path or security profile without interrupting traffic flow. This preliminary preparation eliminates the need to terminate existing flows during security updates.
Solution Approach 2:
The system dynamically changes security parameters and path configurations by selecting from pre-defined security profiles associated with different paths. Each security profile contains specific security measures and parameters that can be activated by switching to the corresponding path, allowing rapid parameter changes without traffic interruption.
2Productivity
If multiple paths are pre-configured for rapid switching, then traffic disruption is minimized, but system complexity increases
Solution Approach 1:
The patent creates a universal framework where multiple paths and security profiles are managed through a common system architecture. The SDN controller handles path selection and security profile management centrally, allowing the system to manage complex multi-path configurations through a unified interface and control mechanism rather than requiring separate management for each path.
Solution Approach 2:
The SDN controller acts as an intermediary between the network applications and the underlying multi-path infrastructure. It abstracts the complexity of multiple paths and security profiles, presenting a simplified interface for path selection while managing the complex switching logic and security configuration in the background.
3Adaptability or versatility
If security profiles are dynamically switched in response to trigger events, then network adaptability is improved, but control plane processing load increases
Solution Approach 1:
Security profiles and their associated parameters are pre-configured and stored in the system before being needed. When a trigger event occurs, the SDN controller can immediately select and activate a pre-defined security profile without performing complex real-time security analysis or configuration, significantly reducing processing load during actual security events.
Solution Approach 2:
The system creates copies of security profiles that can be rapidly instantiated and activated. Instead of generating new security configurations from scratch in response to each trigger event, the system replicates and activates pre-validated security profile templates, reducing the computational burden on the control plane.
Data Source
AI summary
An aspect of the disclosure relates to a computer-implemented method of operating a software-defined network, the method comprising: initialising a plurality of paths through a data plane for traffic associated with a category of applications and/or services; selecting one of the plurality of paths to be an initial operational path; routing traffic associated with the category of applications and/or services via the initial operational path; subsequently obtaining data indicating that a trigger event has occurred; and responsive thereto: selecting a different one of the plurality of paths to be a replacement operational path; and routing traffic associated with the category of applications and/or services via the replacement operational path. Further aspects relate to a data processing system, a computer program, a computer-readable data carrier, and a data carrier signal.