Controlled dispersed architecture for threat prevention in software defined networks
A method of life-cycle management for a threat-detection-agent at a network gateway node includes providing an SDN including a data plane, control plane, and an application layer including a threat-detection-agent life-cycle-management-block, deploying, by the threat-detection-agent life-cycle-management-block, a threat-detection-agent, receiving, by the threat-detection-agent life-cycle-management-block a health-statistics report from the threat-detection-agent, determining, by the threat-detection-agent life-cycle-management-block based on the health-statistics report, whether first threat-detection-agent has failed, and deploying, by the threat-detection-agent life-cycle-management-block, another threat-detection-agent, subsequent to determining that the threat-detection-agent has failed. The method may terminate the threat-detection-agent. Life-cycle management method may be applied to a threat-detection-agent deployed in the control plane.
1 . A method of life-cycle management for a threat-detection-agent at a network gateway node, comprising:
providing a software-defined network (SDN) comprising:
a data plane,
a control plane, and
an application layer, including a threat-detection-agent life-cycle-management-block;
deploying, by the threat-detection-agent life-cycle-management-block of the application layer, a first threat-detection-agent, wherein the first threat-detection-agent is associated with at least one network gateway of the data plane;
receiving, by the threat-detection-agent life-cycle-management-block of the application layer a health-statistics report from the first threat-detection-agent, wherein the health-statistics report indicates a health of the first threat-detection agent;
making a determination, by the threat-detection-agent life-cycle-management-block of the application layer, based at least in part on the health-statistics report, whether the first threat-detection-agent has experienced a failure; and
deploying, by the threat-detection-agent life-cycle-management-block of the application layer, a second threat-detection-agent, subsequent to the determination that the first threat-detection-agent has experienced a failure, wherein the second threat-detection-agent is associated with at least one network gateway of the data plane.
2 . The method of claim 1 , further comprising:
receiving, by the threat-detection-agent life-cycle-management-block of the application layer, a deployment status report from the first threat-detection-agent.
3 . The method of claim 1 , further comprising:
terminating, by the threat-detection-agent life-cycle-management-block, the first threat-detection-agent.
4 . The method of claim 1 , wherein the health-statistics report includes uptime of the first threat-detection-agent.
5 . A method of performing threat management for a network having a distributed threat-detection framework, comprising:
providing a software-defined network (SDN) comprising:
a data plane,
a control plane, and
an application layer;
detecting, by a threat-detection-agent, a threat in a local node, wherein the local node is associated with the threat-detection-agent;
transmitting, by the threat-detection-agent, a detected-threat-information-message;
receiving, by a threat-detection-manager, the detected-threat-information-message;
performing, by the threat-detection-manager, a threat analysis based at least in part on the detected-threat-information-message;
transmitting, by the threat-detection-manager, a threat analysis report;
receiving, by a network-management-block, the threat analysis report;
performing, by the network-management-block, a threat-resolving reconfiguration; and
transmitting, by the network-management-block, a threat-response-acknowledgement-message.
6 . The method of claim 5 , wherein the detected-threat-information-message is transmitted over a first control channel to an SDN controller, and the SDN controller transmits the detected-threat-information-message over a second control channel to the threat-detection-manager.
7 . The method of claim 5 , wherein the threat-detection-manager operates within the application layer of the SDN.
8 . The method of claim 7 , wherein an SDN controller operates within the control plane of the SDN, the threat-detection-manager operates within an application layer of the SDN, and the network-management-block operates within the application layer of the SDN.
9 . The method of claim 8 , further comprising:
receiving, by the threat-detection-agent, the threat-response-acknowledgement-message.
10 . A method of security enhancement for a network gateway in a network having a distributed threat-prevention framework, comprising:
providing a software-defined network (SDN) comprising:
a data plane, including a network-gateway-based threat-detection-agent,
a control plane, and
an application layer;
detecting, by the network-gateway-based threat-detection-agent, a threat at a first network gateway, the first network gateway having a first network infrastructure and a first set of properties;
making a determination, by the network-gateway-based threat-detection-agent, as to whether one or more other network gateways of a first portion of the network have network infrastructure and properties within a predetermined threshold of the first network infrastructure and first set of properties;
installing, by the network-gateway-based threat-detection-agent, additional security packages at the first network gateway subsequent to the determination that one or more other network gateways of the first portion of the network have network infrastructure and properties within the predetermined threshold of the first network infrastructure and first set of properties, wherein the additional security packages are obtained from the one or more other network gateways of the first portion of the network that have network infrastructure and properties within the predetermined threshold of the first network infrastructure and first set of properties; and
transmitting, by the network-gateway-based threat-detection-agent, a threat-report-message subsequent to the determination that no other network gateways of the first portion of the network have network infrastructure and properties within the predetermined threshold of the first network infrastructure and first set of properties.
11 . The method of claim 10 , further comprising:
receiving, by a threat-detection-manager, the threat-report-message; and
making a determination, by the threat-detection-manager, as to whether one or more other network gateways of a second portion of the network have network infrastructure and properties within a predetermined threshold of the first network infrastructure and first set of properties.
12 . The method of claim 11 , further comprising:
installing, by the threat-detection-manager, one or more additional security packages at the first network gateway subsequent to the determination that one or more other network gateways of the second portion of the network have network infrastructure and properties within the predetermined threshold of the first network infrastructure and first set of properties, wherein the one or more additional security packages are obtained from the one or more other network gateways of the second portion of the network that have network infrastructure and properties within the predetermined threshold of the first network infrastructure and first set of properties.
13 . The method of claim 12 , wherein the first network gateway is a physical network gateway.
14 . The method of claim 13 , wherein the first network gateway is a virtual network gateway.
15 . A software-defined-network (SDN), comprising:
a data plane including one or more network gateways;
a control plane including one or more SDN controllers, wherein at least a first portion of the one or more network gateways are communicatively coupled to a first one of the one or more SDN controllers, and each SDN controller of the one or more SDN controllers is communicatively coupled to a controller-based threat-detection-agent; and
an application layer, including a threat-management-block, wherein the threat-management-block is communicatively coupled to at least one of the one or more SDN controllers,
wherein a network-gateway-based threat-detection-agent is communicatively coupled to the one or more network gateways, and the network-gateway-based threat-detection-agent is configured to provide a health-statistics report indicative of a health of the network-gateway-based threat-detection-agent itself.
16 . The SDN of claim 15 , wherein at least a portion of the one or more network gateways are physical network gateways.
17 . The SDN of claim 15 , wherein at least a portion of the one or more network gateways are virtual network gateways.
18 . The SDN of claim 15 , wherein the threat-management-block includes a threat-detection-manager.
19 . The SDN of claim 18 , wherein the threat-management-block further includes a threat-detection-agent-life-cycle-management-block,
wherein the threat-detection-agent-life-cycle-management-block is configured to receive the health-statistics report indicative of the health of the network-gateway-based threat-detection-agent itself.
20 . A non-transitory computer-readable medium comprising instructions to enable provision of a software-defined network (SDN) having a distributed threat-prevention framework, the instructions when executed by a processor cause the processor to:
configure a network having a plurality of network gateways in a data plane of the network, one or more SDN-controllers in a control plane of the network, and a threat-management-block in an application layer of the network;
instantiate, within the data plane of the network, at least one network-gateway-based threat-detection-agent that is associated with at least a first one of the plurality of network gateways; and
instantiate, within a control plane of the network, at least one SDN-controller-based threat-detection-agent that is associated with at least a first one of the one or more SDN-controllers,
wherein the at least one network-gateway-based threat-detection-agent is configured to detect threats and coordinate information within the data plane, and the at least one SDN-controller-based threat-detection-agent is configured to detect threats and coordinate information within the control plane,
wherein the at least one network-gateway-based threat-detection-agent is configured to provide a health-statistics report indicative of a health of the network-gateway-based threat-detection-agent itself.
21 . The non-transitory computer-readable medium of claim 20 , wherein at least a first one of the one or more SDN-controllers manages, controls, and provisions a data plane with a set of application-layer services.
22 . The non-transitory computer-readable medium of claim 20 , wherein the threat-management-block manages the at least one SDN-controller-based threat-detection-agent, and manages the at least one network-gateway-based threat-detection-agent.
23 . The non-transitory computer-readable medium of claim 22 , wherein the threat-management-block includes a threat-detection-agent-life-cycle-management-block, and further includes a threat-detection-manager.
24 . The non-transitory computer-readable medium of claim 23 , wherein the threat-detection-agent-life-cycle-management-block is configured to receive, from at least one control channel, a health-statistics report from the at least one network-gateway-based threat-detection-agent.