SD-WAN Virtual Switch Packet Forwarding with Signature Inspection
Solution Overview
Problem
Conventional software-defined wide area networks (SD-WAN) lack robustness in securing traffic, particularly in detecting and controlling traffic leakage from insecure sources into secure connections, which can lead to security breaches and compromised data packet forwarding.
Innovation Solution
A method for a virtual switch in an SD-WAN environment that uses dedicated signature information to identify and control the forwarding of data packets, creating alarms and prioritizing secure traffic by determining unique signature information for each packet and storing it in a table, allowing secure packets to be forwarded to physical secured ports while suspicious packets trigger alarms or are diverted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a firewall is implemented as a VNF in an SD-WAN environment, then network security is provided through software, but the robustness of securing traffic against attacks is insufficient
Solution Approach 1:
The patent segments the firewall functionality into multiple virtual instances (VNFs) that can be deployed across different virtual switches and network paths. This segmentation allows traffic to be inspected by multiple security instances, enhancing robustness while maintaining software-based adaptability.
Solution Approach 2:
The patent introduces an intermediary mechanism that intercepts and inspects data packets between the virtual switch and the VNF firewall. This intermediary layer enables deep packet inspection and traffic analysis, strengthening security robustness without compromising the software-defined nature of the system.
2Reliability
If traffic leakage detection is implemented in SD-WAN, then security breaches can be detected, but the complexity of monitoring and controlling traffic increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing security policies and traffic baseline profiles before actual traffic monitoring begins. These pre-configured rules enable automated detection of anomalies without requiring complex real-time analysis, reducing operational complexity while maintaining high detection reliability.
Solution Approach 2:
The patent incorporates feedback mechanisms where detected traffic patterns and security events are continuously fed back to update detection algorithms and adjust security policies. This closed-loop system automates the monitoring process, reducing manual complexity while improving detection accuracy over time.
3Reliability
If signature-based packet inspection is implemented, then secure packets can be identified and prioritized, but the processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by implementing signature-based inspection only on packets that match specific criteria or exhibit suspicious characteristics, rather than inspecting every packet in depth. This selective approach maintains high identification accuracy for critical packets while reducing overall processing time and resource consumption.
Solution Approach 2:
The patent merges signature-based inspection with other packet classification methods (such as header analysis and flow-based routing) into a unified processing pipeline. This combination allows the system to quickly filter and prioritize packets using multiple criteria simultaneously, maintaining accuracy while reducing the time spent on any single inspection method.
Data Source
AI summary
A method, device, and computer-program product of forwarding data packets in a virtual switch is provided. The virtual switch comprises: first, second and third virtual ports for respectively receiving/transmitting: LAN traffic from/to a physical LAN port; secured traffic from/to a physical secured traffic port; and Internet traffic from/to a physical Internet port. The method comprises: determining, for selected data packets of the outbound traffic, signature information; storing the signature information and information identifying associated packets; outputting the outbound traffic for processing by a virtual machine; receiving at least a portion of the outbound traffic as outbound secured traffic for supply to the secured port; determining whether each data packet of the outbound secure traffic matches the dedicated signature information and responsively controlling the forwarding of the respective data packet as part of the outbound secured traffic to the secured port and/or creating a SUSPICIOUS SOURCE alarm.