Switch External Memory Access Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies, particularly in Software Defined Networks (SDNs), face challenges in efficiently accessing switch external memory from the control plane and data plane, neglecting efficient storage resource management.
Innovation Solution
A method is introduced where a control module issues authorized protocol and file I/O operation information to a switch, which determines the authority of the operating entity and executes authorized file operations, utilizing POSIX-defined or self-defined file operations to manage access to switch external memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the switch external memory is accessed without authorization control, then the access speed is fast, but the security and reliability of memory access is poor
Solution Approach 1:
The control module pre-configures authorization information including entity identifiers, operation types, and file paths before the data plane needs to access the external memory. This preliminary setup enables the switch to quickly verify access permissions without complex real-time authorization checks, thus improving reliability while maintaining access efficiency.
Solution Approach 2:
The patent introduces an intermediary authorization checking mechanism between the data plane and external memory. The switch acts as a mediator that receives access requests, verifies them against pre-configured authorization information, and either permits or blocks access. This intermediary layer ensures secure access without requiring complex real-time negotiation between control and data planes.
2Productivity
If the switch external memory is accessed without efficient management, then the system is simple, but the productivity and efficiency of memory access is poor
Solution Approach 1:
The patent segments the memory access management into distinct components: the control module handles authorization configuration, the switch handles access request processing and verification, and the external memory handles data storage. This segmentation allows each component to perform its function efficiently without creating bottlenecks, thereby improving productivity while maintaining manageable complexity.
Solution Approach 2:
The patent changes the parameter of access control from dynamic real-time verification to static pre-configured authorization. By transforming the authorization mechanism into a parameter-based system where access rights are defined in advance through configuration files or databases, the system achieves efficient memory access without complex runtime management overhead.
3Reliability
If authorization checking is performed for every file I/O operation, then the security is improved, but the processing time and operational overhead increases
Solution Approach 1:
Authorization information is configured in advance by the control module before any data plane operations occur. The switch loads and stores this authorization information locally, enabling rapid verification of access rights during file I/O operations without requiring time-consuming real-time authorization checks or communication with the control module.
Solution Approach 2:
The switch creates a local copy of the authorization information from the control module. This copy contains entity identifiers, permitted operation types, and file path permissions. By using this local copy for verification, the system achieves secure access control without the time overhead of querying the control module for each access request.
Data Source
Figure 1~3
Figure 4~5
Figure 6
AI summary
The present invention relates to a method for accessing a switch external memory from a control plane and a data plane, comprising: a control module issues information about an authorized entity and an authorized operation to a switch, and the switch receives and stores the authorized information; the switch receives a file I/O operation instruction and determines whether an operation entity has the authority of the file I/O operation instruction according to the instruction and the authorized information; and for the operation entity having the authority of the file I/O operation instruction, the switch extracts an instruction index and parameter from the file I/O operation instruction and executes a file I/O operation.