Signature-Based Packet Isolation in SDN Virtual Forwarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software defined networking (SDN) techniques are inadequate in isolating undesired packet flows, such as denial-of-service attacks, as they often disrupt all operations of a virtual computing instance, affecting both desired and undesired packets, leading to suboptimal network performance.
Innovation Solution
Configuring a hypervisor to monitor packets for specific signatures and selectively block or drop undesired packets while allowing desired packets to be forwarded, using a management plane to manage virtual forwarding elements and implement blacklisting or whitelisting based on administrator input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If existing techniques quarantine the virtual computing instance by powering off or decoupling the virtual port, then undesired packet flows are blocked, but all operations of the virtual computing instance are disrupted including desired packet flows
Solution Approach 1:
The patent segments the packet handling process by implementing signature-based classification at the virtual forwarding element level. Instead of treating all packets from a virtual computing instance uniformly, the system divides packet processing into desired and undesired categories based on signature matching, allowing selective blocking of only malicious packets while permitting legitimate traffic to continue flowing.
Solution Approach 2:
The patent applies local quality by implementing granular control at the packet level rather than instance level. The virtual forwarding element is configured with specific signatures that identify undesired packet flows, enabling the system to apply different handling qualities (block vs. forward) to different packets based on their characteristics, thus protecting against harmful factors without affecting overall productivity.
2Object-affected harmful factors
If the virtual port is decoupled from the virtual computing instance, then undesired traffic is blocked, but network configuration management becomes complex and time-consuming
Solution Approach 1:
The patent implements self-service by enabling the virtual forwarding element to automatically detect, classify, and block undesired packet flows based on pre-configured signatures. The system autonomously monitors packet flows, performs signature matching, and applies blocking rules without requiring administrator intervention for each security incident, thereby reducing operational complexity while maintaining effective protection.
Solution Approach 2:
The patent applies preliminary action by pre-configuring signatures that define characteristics of undesired packet flows before security incidents occur. These signatures serve as pre-established rules that automatically trigger blocking actions when matched, eliminating the need for complex real-time configuration decisions and reducing the complexity of network management.
3Object-affected harmful factors
If signature-based packet monitoring is implemented at the virtual forwarding element, then targeted blocking of undesired packets is achieved, but the hypervisor and virtual forwarding element complexity increases
Solution Approach 1:
The patent introduces an intermediary layer in the form of signature-based classification rules that mediate between packet inspection and blocking decisions. The virtual forwarding element uses these signatures as intermediary criteria to automatically determine whether to block or forward packets, reducing the need for complex hypervisor-level configuration while achieving targeted security control.
Data Source
AI summary
Certain embodiments described herein are generally directed to a method for managing packets at a virtual forwarding element of a hypervisor. In one example, the method includes receiving a first plurality of packets at a virtual port of the virtual forwarding element. The method further includes detecting the first plurality of packets correspond to a signature configured at the virtual port. The method also includes dropping at least one packet of the first plurality of packets at the virtual port based on detecting the first plurality corresponds to the signature. The method further includes receiving a second plurality of packets at the virtual port of the virtual forwarding element, wherein the second plurality of packets do not correspond to the signature. The method also includes forwarding the second plurality of packets to one or more destinations by the virtual forwarding element.