SDN Pipe for Network Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security methods in software-defined networking (SDN) face challenges in efficiently intercepting and inspecting network traffic for compliance with security policies, particularly in virtualized environments, as they often require complex configurations and may not effectively bypass unnecessary packet inspections.
Innovation Solution
The implementation of an SDN computer network with an SDN controller and switch that creates an SDN pipe between a sender component and a security component, using OpenFlow protocol to insert flow rules that redirect specific packets for inspection while disabling broadcast functions to optimize packet flow and bypass unnecessary inspections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flow rules are inserted to redirect packets for inspection, then packet inspection capability is improved, but network traffic complexity increases
Solution Approach 1:
The network pipe is segmented into distinct segments: an ingress pipe segment for incoming traffic, an egress pipe segment for outgoing traffic, and a bypass pipe segment for traffic that should not be inspected. Flow rules are inserted to redirect packets to appropriate segments based on their destination, enabling selective inspection while maintaining network functionality.
Solution Approach 2:
The SDN switch acts as an intermediary between the sender component and the security component. Flow rules in the switch's flow table mediate packet redirection to the security component for inspection, then forward inspected packets to their final destination, simplifying the overall architecture while maintaining inspection capability.
2Productivity
If broadcast function is disabled for pipe ports, then packet flow efficiency is improved, but network connectivity requirements increase
Solution Approach 1:
The broadcast function is selectively disabled only for ports that are part of the SDN pipe (ingress and egress pipe ports), while remaining enabled for other ports. This local quality change prevents broadcast packets from being sent down the pipe, improving efficiency for inspected traffic while maintaining broadcast functionality where needed.
3Speed
If flow rules are inserted to bypass inspection for specified packets, then inspection speed is improved, but security coverage may be reduced
Solution Approach 1:
Flow rules are inserted to bypass inspection for specific packet types (such as established connections or trusted traffic) while maintaining inspection for other packets. This partial action approach optimizes inspection speed for critical traffic while preserving security coverage for potentially malicious traffic.
Data Source
AI summary
A software defined networking (SDN) computer network includes an SDN controller and an SDN switch. The SDN controller inserts flow rules in a flow table of the SDN switch to create an SDN pipe between a sender component and a security component. A broadcast function of the SDN switch to the ports that form the SDN pipe may be disabled. The SDN pipe allows outgoing packets sent by the sender component to be received by the security component. The security component inspects the outgoing packets for compliance with security policies and allows the outgoing packets to be forwarded to their destination when the outgoing packets pass inspection. The SDN controller may also insert a flow rule in the flow table of the SDN switch to bypass inspection of specified packets.