SDN Security Architecture for Policy Translation and Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined networking (SDN) networks face challenging security issues, including secure policy transmission, accurate policy translation into flow rules, handling of conflicting flow rules, packet data scan detection, secure flow rule transportation, and prompt reaction to security attacks, which are not adequately addressed by existing security mechanisms.
Innovation Solution
The implementation of an SDN security architecture that includes attributes for flow rules such as policy characteristics, role of the policy creator, and security privilege level, enabling real-time or delayed policy synchronization, precise policy translation, conflict resolution, enhanced packet data scan detection, and automatic reaction to security threats through a secure SDN controller configuration with modules for authentication, policy translation, flow management, and security monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If security policies are translated into flow rules and synchronized in real-time, then security response speed is improved, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-translating security policies into flow rules and maintaining them in a local flow table at the gateway device. This allows the gateway to immediately enforce security policies without real-time communication with the SDN controller, achieving fast security response while simplifying the system architecture by caching rules locally rather than requiring complex real-time synchronization mechanisms.
2Adaptability or versatility
If multiple security policies are enforced simultaneously, then security coverage is improved, but conflict management complexity increases
Solution Approach 1:
The patent applies local quality by implementing role-based access control and policy priority attributes at the local gateway device. Each security policy is associated with a specific role and priority level, allowing the gateway to locally resolve conflicts between multiple security policies based on these attributes without requiring complex centralized conflict management. This enables comprehensive security coverage while keeping conflict management simple and distributed.
3Loss of energy
If flow rules are synchronized periodically for non-real-time policies, then network bandwidth usage is reduced, but security policy freshness deteriorates
Solution Approach 1:
The patent applies dynamics by implementing dynamic synchronization intervals for flow rules based on their real-time requirements. Critical security policies with real-time requirements are synchronized immediately when updated, while non-critical policies use periodic synchronization. The system dynamically adjusts the synchronization behavior based on policy attributes and network conditions, optimizing the balance between bandwidth consumption and policy freshness rather than using a static approach.
4Measurement precision
If packet data scan detection is implemented, then security detection capability is improved, but processing overhead increases
Solution Approach 1:
The patent applies partial action by implementing selective packet data scan detection only for packets that match specific security policies and require inspection. Rather than scanning all packets, the gateway device applies scan detection selectively to relevant traffic flows identified by flow rule matches. This provides sufficient security detection capability for targeted threats while minimizing processing overhead by avoiding unnecessary inspection of unrelated packets.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
At least one security policy is obtained from a policy creator at a controller in an SDN network. The security policy is implemented in the SDN network, via the controller,based on one or more attributes specifying a characteristic of the security policy, a role of the creator of the security policy, and a security privilege level of the role of the creator of the security policy.