Virtual Router Access Control for Minimal SDN Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software defined networks (SDNs), data flow-based network control is impossible when minimal implementation is done using an SDN controller and switch, leading to issues like network segmentation and unauthorized access, especially due to limitations in IP identification information.
Innovation Solution
A system and method for network access control using an access control application and a virtual router within an SDN switch, which performs data flow-based access control, blocking unauthorized applications and managing network segments through identification information like MAC and IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If minimal SDN implementation is used with only SDN controller and switch, then device complexity is reduced, but network access control capability deteriorates
Solution Approach 1:
The patent embeds a virtual router function within the SDN switch, creating a nested structure where the virtual router is contained inside the switch. This allows the SDN switch to perform both switching and routing functions, enabling data flow-based network access control without adding separate routing devices. The virtual router uses flow tables to identify applications and control their network access, resolving the contradiction by nesting control functionality within the existing minimal SDN infrastructure.
2Measurement precision
If traditional IP-based network control is used, then network segmentation is possible, but measurement precision of application identification deteriorates
Solution Approach 1:
The patent changes the identification parameters from traditional IP addresses to application-level identification using deep packet inspection. The virtual router examines packet payloads, protocols, and communication patterns to identify specific applications (e.g., P2P, web browsing, streaming). This parameter change enables precise application-level network access control, allowing the system to distinguish between different applications using the same IP address and apply granular policies based on application type rather than just network layer addressing.
3Measurement precision
If data flow-based network control is implemented, then network access control precision is improved, but device complexity increases
Solution Approach 1:
The patent merges the virtual router function with the SDN switch into a single integrated device. The virtual router's flow table is stored within the SDN switch, and the switch uses its existing flow table processing capabilities to implement data flow-based control. This merging eliminates the need for separate routing hardware and complex inter-device communication, achieving precise application-level network access control while keeping the system architecture simple and unified.
Data Source
AI summary
A node according to an embodiment disclosed in the present document may store instructions for: performing a network access request to an external server through an access control application, the network access request including identification information of a target application and identification information of a destination network; receiving a data flow from the external server through the access control application, the data flow corresponding to identification information of the node and the identification information of the destination network and including information about whether a data packet can be transmitted through a virtual router; and transmitting a data packet of the target application on the basis of the received data flow, through the access control application. The virtual router may be included in a switch to which the node transmits the data packet.