SDN Security Architecture for Policy Translation and Conflict Resolution

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Software-defined networking (SDN) networks face challenging security issues, including secure policy transmission, accurate policy translation into flow rules, handling of conflicting flow rules, packet data scan detection, secure flow rule transportation, and prompt reaction to security attacks, which are not adequately addressed by existing security mechanisms.

Innovation Solution

The implementation of an SDN security architecture that includes attributes for flow rules such as policy characteristics, role of the policy creator, and security privilege level, enabling real-time or delayed policy synchronization, precise policy translation, conflict resolution, enhanced packet data scan detection, and automatic reaction to security threats through a secure SDN controller configuration with modules for authentication, policy translation, flow management, and security monitoring.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If security policies are translated into flow rules and synchronized in real-time, then security response speed is improved, but system complexity increases

Engineering Contradiction:
Improvesecurity response speedVSAvoidsystem complexity
Core Design Contradiction:
SpeedVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-translating security policies into flow rules and maintaining them in a local flow table at the gateway device. This allows the gateway to immediately enforce security policies without real-time communication with the SDN controller, achieving fast security response while simplifying the system architecture by caching rules locally rather than requiring complex real-time synchronization mechanisms.

Inventive Principle:
Principle #10Preliminary action

2Adaptability or versatility

If multiple security policies are enforced simultaneously, then security coverage is improved, but conflict management complexity increases

Engineering Contradiction:
Improvesecurity coverageVSAvoidconflict management complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by implementing role-based access control and policy priority attributes at the local gateway device. Each security policy is associated with a specific role and priority level, allowing the gateway to locally resolve conflicts between multiple security policies based on these attributes without requiring complex centralized conflict management. This enables comprehensive security coverage while keeping conflict management simple and distributed.

Inventive Principle:
Principle #3Local quality

3Loss of energy

If flow rules are synchronized periodically for non-real-time policies, then network bandwidth usage is reduced, but security policy freshness deteriorates

Engineering Contradiction:
Improvenetwork bandwidth usageVSAvoidsecurity policy freshness
Core Design Contradiction:
Loss of energyVSReliability

Solution Approach 1:

The patent applies dynamics by implementing dynamic synchronization intervals for flow rules based on their real-time requirements. Critical security policies with real-time requirements are synchronized immediately when updated, while non-critical policies use periodic synchronization. The system dynamically adjusts the synchronization behavior based on policy attributes and network conditions, optimizing the balance between bandwidth consumption and policy freshness rather than using a static approach.

Inventive Principle:
Principle #15Dynamics

4Measurement precision

If packet data scan detection is implemented, then security detection capability is improved, but processing overhead increases

Engineering Contradiction:
Improvesecurity detection capabilityVSAvoidprocessing overhead
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies partial action by implementing selective packet data scan detection only for packets that match specific security policies and require inspection. Rather than scanning all packets, the gateway device applies scan detection selectively to relevant traffic flows identified by flow rule matches. This provides sufficient security detection capability for targeted threats while minimizing processing overhead by avoiding unnecessary inspection of unrelated packets.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP3162017B1Security in software defined network
Publication Date: 2021.11.24 ALCATEL LUCENT SA
  • EP3162017B1 patent drawingFigure 1
  • EP3162017B1 patent drawingFigure 2
  • EP3162017B1 patent drawingFigure 3

AI summary

At least one security policy is obtained from a policy creator at a controller in an SDN network. The security policy is implemented in the SDN network, via the controller,based on one or more attributes specifying a characteristic of the security policy, a role of the creator of the security policy, and a security privilege level of the role of the creator of the security policy.