SDN Source Identification via Security Function Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networks (SDNs), identifying the source switch for malicious flows is challenging, especially when source addresses are spoofed and flow rules refer to individual flows ambiguously, making it difficult for SDN controllers to pinpoint the source in overlay networks.
Innovation Solution
The implementation of security function containers (SFCs) that act as endpoints for virtual tunnels, track each flow, and notify the SDN controller when a flow is flagged as malicious, allowing the controller to perform a backtracking traceroute operation to determine the true source switch, even in cases where flow rules are wild-carded and do not explicitly refer to individual flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If flow rules are wild-carded to refer to multiple flows ambiguously, then device complexity is reduced, but source identification precision deteriorates
Solution Approach 1:
The patent introduces Security Function Containers (SFCs) as intermediary entities that sit between the wild-carded flow rules and the source identification process. SFCs act as mediators that receive ambiguous wild-carded flow rules, perform deterministic source identification through backtracking traceroute operations, and return precise source information to the SDN controller. This intermediary layer resolves the contradiction by maintaining simple wild-carded flow rules while achieving precise source identification through the SFC mediation mechanism.
2Measurement precision
If backtracking traceroute operation is performed to identify source device, then source identification precision is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by having Security Function Containers pre-establish and maintain mapping information between wild-carded flow rules and specific network flows before source identification is needed. When an SDN controller requests source identification, the SFC can perform backtracking traceroute operations using pre-prepared flow rule mappings, significantly reducing the time required compared to starting from scratch. This preliminary preparation of flow rule associations accelerates the source identification process while maintaining precision.
3Device complexity
If SDN controller directly identifies source without SFC, then device complexity is reduced, but reliability of source identification deteriorates
Solution Approach 1:
The patent introduces Security Function Containers as specialized intermediary components that enhance the reliability of source identification without significantly increasing overall system complexity. The SFC acts as a dedicated mediator with specialized algorithms for deterministic source identification through backtracking traceroute operations. This specialized intermediary provides reliable source identification while keeping the SDN controller's complexity manageable through clear interface definitions and standardized communication protocols.
Solution Approach 2:
The Security Function Container performs self-service by autonomously executing backtracking traceroute operations and determining source devices without requiring complex controller intervention. The SFC independently manages the source identification process, maintaining reliability through self-contained algorithms and data structures. This self-service capability enhances reliability while preventing the SDN controller from becoming overly complex with source identification logic.
Data Source
AI summary
In an example, there is disclosed a computing apparatus, having: a network interface to communicatively couple to a software-defined network (SDN); first one or more logic elements providing an SDN controller engine to provide a control function for the SDN; and second one or more logic elements providing a route tracing engine to: receive a tunneling notification from a network device agent, the tunneling notification associated with a network flow; and perform a backtracking traceroute operation to deterministically identify a source device for the flow. There is also disclosed a method of providing the foregoing, and one or more tangible, non-transitory computer-readable storage mediums for providing the foregoing.