In-band Switch Routing for Secure Controller Connection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In TCP networks, a target switch may not know how to respond to a controller after receiving a packet for establishing a connection since it has not been programmed, leading to uncertainty in the network path to use for response.
Innovation Solution
A system and method where a switch identifies routing data from a request packet, populates a table with this data, sends a response packet to the controller, and establishes a connection based on the request and response packets, including verifying the digital signature and updating the table for changes in transmitting devices or interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TCP connection establishment protocol is used, then secure communication is achieved, but the target switch cannot respond because it lacks programming before connection establishment
Solution Approach 1:
The system performs preliminary routing configuration by injecting host routes for controller IP addresses into the target switch before TCP connection establishment. This preliminary action enables the switch to have the necessary routing information in advance to respond to connection requests, resolving the contradiction between requiring security (TCP) and needing responsiveness (routing capability).
Solution Approach 2:
The patent introduces an intermediary mechanism where a source switch or controller injects host routes into the target switch's routing table. This intermediary action provides the target switch with the necessary routing information without requiring full programming, enabling it to respond to TCP connection establishment requests while maintaining security protocols.
2Ease of operation
If host routes are injected into target switch, then response path is determined, but routing table size increases and memory is consumed
Solution Approach 1:
The system applies local quality by injecting only specific host routes for controller IP addresses into the target switch's routing table, rather than populating the entire routing table. This localized approach provides the necessary response path determination capability while minimizing the increase in routing table size and memory consumption, addressing the contradiction between ease of operation and quantity of routing data.
3Adaptability or versatility
If indirect connection through intermediary switch is used, then connection can be established, but target switch does not know how to respond
Solution Approach 1:
The system performs preliminary injection of host routes for the controller's IP address into the target switch's routing table before the indirect connection is established. This preliminary action ensures that the target switch has the necessary routing information to respond to the controller even when connections are established indirectly through intermediary switches, preventing loss of routing information while maintaining connection flexibility.
Data Source
AI summary
Aspects of the disclosure relate generally to switches responding to master controllers before establishing a secure connection in an in-band controlled network. In order to do so, a computing device may receive a request packet from a transmitting device, the request packet originating from a controller computer. When the request packet enters a designated port on the computing device, the computing device may identify routing data from the received request packet, the routing data indicating a path to respond to the controller computer. The computing device may next populate a table using the identified routing data of the request packet. The computing device may send a response packet to the controller computer using the identified routing data in the populated table. From here, a connection may be established between the computing device and controller computer.