Security Controller for SDN Packet Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
New network architectures, such as Software Defined Networking (SDN), decouple control and data planes, making it challenging to ensure that all network flows pass through security devices for compliance with security policies, particularly in dynamic and flexible network environments.
Innovation Solution
Implementing a security controller that classifies network flows and instructs network devices to perform actions such as dropping, shunting, or ignoring flows based on security policies, using mechanisms like APIs and tagging, to ensure secure routing and compliance in SDN networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network flows are routed dynamically in SDN architecture, then network flexibility and adaptability are improved, but security policy compliance becomes harder to ensure
Solution Approach 1:
The patent introduces a security controller as an intermediary component between the SDN controller and network devices. This security controller intercepts and inspects packet flows before they are routed, ensuring security policy compliance while allowing the SDN architecture to maintain its dynamic routing capabilities. The security controller acts as a mediator that validates flows without disrupting the flexible network architecture.
2Reliability
If all packet flows are inspected for security compliance, then security policy enforcement is improved, but network device performance deteriorates
Solution Approach 1:
The patent extracts the security inspection function from the network devices and places it in a dedicated security controller. This separation allows network devices to focus on high-speed packet forwarding while the security controller handles the computationally intensive flow inspection and classification tasks. The security controller receives packet copies for inspection without blocking the main data path, thus maintaining network device performance.
3Reliability
If security inspection is performed on all flows, then security coverage is improved, but processing time increases
Solution Approach 1:
The patent implements selective security inspection where not all packet flows are fully inspected. Instead, the security controller applies classification rules to identify flows that require security inspection and routes only those flows through the inspection path. Common or trusted flows can be allowed through with minimal or no inspection, reducing overall processing time while maintaining adequate security coverage for critical flows.
Data Source
AI summary
Techniques for packet classification for network routing are disclosed. In some embodiments, packet classification for network routing includes receiving packets associated with a new flow at a security controller from a network device, in which the network device performs packet forwarding; classifying the flow; and determining an action for the flow based on a policy (e.g., a security policy). In some embodiments, the network device is a Software Defined Network (SDN) network device (e.g., a packet forwarding device that supports the OpenFlow protocol or another protocol).