IP Library › Granted Patent US 9,705,918
Granted Patent B2
US 9,705,918 · App. 13/801,871 · Granted Jul 11, 2017

Security mediation for dynamically programmable network

Inventors: Phillip A. Porras (Cupertino, CA); Martin W. Fong (Redwood City, CA); Vinod Yegneswaran (Foster City, CA)
Assignee: SRI International
H04L63/20H04L63/107H04L63/126
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,705,918
App. No.
13/801,871
Granted
Jul 11, 2017
Kind
B2
Abstract

A network security policy may be implemented at network switches as a set of active packet disposition directives. In a dynamically programmable network, the network switches can be dynamically reprogrammed with new packet disposition directives. A security mediation service permits such dynamic reprogramming as long as the new directives are consistent with the then-current network security policy. The security mediation service evaluates candidate packet disposition directives for conflicts with the currently active security policy, before instantiating the candidate packet disposition directives at the network switches.

Claims (77)

1. A method, comprising:

receiving, by a computing system on a network, a candidate flow rule, wherein the candidate flow rule is received during live operation of the network, wherein the network is dynamically programmable, wherein a flow rule is associated with an action, wherein an action determines a disposition of a communication corresponding to the flow rule, and wherein a flow rule can be implemented by a network switch on the network;

comparing the candidate flow rule against a set of currently active flow rules, wherein the set of currently active flow rules control a flow of communications across the network during live operation of the network;

determining that the candidate flow rule does not conflict with the set of currently active flow rules, wherein determining that the candidate flow rule does not conflict includes determining that a same action is associated with both the candidate flow rule and a rule from the set of currently active flow rules; and

transmitting a packet when the candidate flow rule does not conflict with the set of currently active flow rules, wherein the packet is configured to reprogram the network switch during live operation of the network, wherein reprogramming the network switch includes adding the candidate flow rule to the network switch.

2. The method of claim 1 , wherein comparing the candidate flow rule against the set of currently active flow rules includes determining whether an action of the candidate flow rule is also an action of a rule from the set of currently active flow rules.

3. The method of claim 1 , further comprising:

determining whether the candidate flow rule includes a particular set action, wherein a set action modifies a communication associated with the set action; and

expanding the candidate flow rule to include a modification associated with the particular set action.

4. The method of claim 3 , wherein the set of currently active flow rules are associated with priorities, and wherein the expanded candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

5. The method of claim 3 , wherein determining that the candidate flow rule does not conflict with the set of currently active flow rules includes determining that the expanded candidate flow rule does not conflict with the set of currently active flow rules.

6. The method of claim 1 , wherein a flow rule is associated with a match field, wherein a match field can be used to determine whether a communication corresponds to the flow rule, and wherein comparing the candidate flow rule against the set of currently active flow rules includes determining whether a value associated with a match field of the candidate flow rule is also a value associated with a match field of a rule from the set of currently active flow rules.

7. The method of claim 1 , further comprising:

determining that a match field of the candidate flow rule permits a new value to be substituted for a value in the match field; and

expanding the candidate flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the expanded candidate flow rule against the set of currently active flow rules.

8. The method of claim 1 , further comprising:

determining that a match field of a currently active flow rule permits a new value to be substituted for a value in the match field;

expanding the currently active flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the candidate flow rule against the expanded currently active flow rule.

9. The method of claim 8 , further comprising:

updating the set of currently active flow rules to include the expanded currently active flow rule.

10. The method of claim 1 , wherein the currently active flow rules are associated with priorities, and wherein the candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

11. The method of claim 1 , further comprising:

updating the set of currently active flow rules to include the candidate flow rule.

12. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:

receive, by a computing system on a network, a candidate flow rule, wherein the candidate flow rule is received during live operation of the network, wherein the network is dynamically programmable, wherein a flow rule is associated with an action, wherein an action determines a disposition of a communication corresponding to the flow rule, and wherein a flow rule can be implemented by a network switch on the network;

compare the candidate flow rule against a set of currently active flow rules, wherein the set of currently active flow rules control a flow of communications across the network during live operation of the network;

determine that the candidate flow rule does not conflict with the set of currently active flow rules, wherein determining that the candidate flow rule does not conflict includes determining that a same action is associated with both the candidate flow rule and a rule from the set of currently active flow rules; and

transmit a packet when the candidate flow rule does not conflict with the set of currently active flow rules, wherein the packet is configured to reprogram the network switch during live operation of the network, wherein reprogramming the network switch includes adding the candidate flow rule to the network switch.

13. The computer-program product of claim 12 , wherein the instructions for comparing the candidate flow rule against the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to:

determine whether an action of the candidate flow rule is also an action of a rule from the set of currently active flow rules.

14. The computer-program product of claim 12 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:

determine whether the candidate flow rule includes a particular set action, wherein a set action modifies a communication associated with the set action; and

expand the candidate flow rule to include a modification associated with the particular set action.

15. The computer-program product of claim 14 , wherein the set of currently active flow rules are associated with priorities, and wherein the expanded candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

16. The computer-program product of claim 14 , wherein the instructions for determining that the candidate flow rule does not conflict with the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to:

determine that the expanded candidate flow rule does not conflict with the set of currently active flow rules.

17. The computer-program product of claim 12 , wherein a flow rule is associated with a match field, wherein a match field can be used to determine whether a communication corresponds to the flow rule, and wherein the instructions for comparing the candidate flow rule against the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to:

determine whether a value associated with a match field of the candidate flow rule is also a value associated with a match field of a rule from the set of currently active flow rules.

18. The computer-program product of claim 12 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:

determine that a match field of the candidate flow rule permits a new value to be substituted for a value in the match field; and

expand the candidate flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the expanded candidate flow rule against the set of currently active flow rules.

19. The computer-program product of claim 12 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:

determine that a match field of a currently active flow rule permits a new value to be substituted for a value in the match field;

expand the currently active flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the candidate flow rule against the expanded currently active flow rule.

20. The computer-program product of claim 19 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:

update the set of currently active flow rules to include the expanded currently active flow rule.

21. The computer-program product of claim 12 , wherein the currently active flow rules are associated with priorities, and wherein the candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

22. The computer-program product of claim 12 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:

update the set of currently active flow rules to include the candidate flow rule.

23. A computing system on a network, comprising:

one or more processors; and

a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

receiving a candidate flow rule, wherein the candidate flow rule is received during live operation of the network, wherein the network is dynamically programmable, wherein a flow rule is associated with an action, wherein an action determines a disposition of a communication corresponding to the flow rule, and wherein a flow rule can be implemented by a network switch on the network;

comparing the candidate flow rule against a set of currently active flow rules, wherein the set of currently active flow rules control a flow of communications across the network during live operation of the network;

determining that the candidate flow rule does not conflict with the set of currently active flow rules, wherein determining that the candidate flow rule does not conflict includes determining that a same action is associated with both the candidate flow rule and a rule from the set of currently active flow rules; and

transmitting a packet when the candidate flow rule does not conflict with the set of currently active flow rules, wherein the packet is configured to reprogram the network switch during live operation of the network, wherein reprogramming the network switch includes adding the candidate flow rule to the network switch.

24. The computing system of claim 23 , wherein the instructions for comparing the candidate flow rule against the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

determining whether an action of the candidate flow rule is also an action of a rule from the set of currently active flow rules.

25. The computing system of claim 23 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

determining whether the candidate flow rule includes a particular set action, wherein a set action modifies a communication associated with the set action; and

expanding the candidate flow rule to include a modification associated with the particular set action.

26. The computing system of claim 25 , wherein the set of currently active flow rules are associated with priorities, and wherein the expanded candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

27. The computing system of claim 25 , wherein the instructions for determining that the candidate flow rule does not conflict with the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to:

determine that the expanded candidate flow rule does not conflict with the set of currently active flow rules.

28. The computing system of claim 23 , wherein a flow rule is associated with a match field, wherein a match field can be used to determine whether a communication corresponds to the flow rule, and wherein the instructions for comparing the candidate flow rule against the set of currently active flow rules include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

determining whether a value associated with a match field of the candidate flow rule is also a value associated with a match field of a rule from the set of currently active flow rules.

29. The computing system of claim 23 , wherein the non-transitory computer-readable medium further includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

determining that a match field of the candidate flow rule permits a new value to be substituted for a value in the match field; and

expanding the candidate flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the expanded candidate flow rule against the set of currently active flow rules.

30. The computing system of claim 23 , wherein the non-transitory computer-readable medium further includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

determining that a match field of a currently active flow rule permits a new value to be substituted for a value in the match field;

expanding the currently active flow rule to include the new value, wherein comparing the candidate flow rule against the set of currently active flow rules includes comparing the candidate flow rule against the expanded currently active flow rule.

31. The computing system of claim 30 , wherein the non-transitory computer-readable medium further includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

update the set of currently active flow rules to include the expanded currently active flow rule.

32. The computing system of claim 23 , wherein the currently active flow rules are associated with priorities, and wherein the candidate flow rule is compared against the set of currently active flow rules in a decreasing order of the priorities.

33. The computing system of claim 23 , wherein the non-transitory computer-readable medium further includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

updating the set of currently active flow rules to include the candidate flow rule.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 10, 2013
From: PORRAS, PHILLIP A.; FONG, MARTIN W.; YEGNESWARAN, VINOD
To: SRI INTERNATIONAL
Reel/Frame 030396/0106 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 22, 2013
From: PORRAS, PHILLIP A.; YEGNESWARAN, VINOD; WONG, MARTIN F.
To: SRI INTERNATIONAL
Reel/Frame 030387/0375 →
Continuity (2)
Provisional Application 61650287 · May 22, 2012
Related Publication 20140075498A1 · Mar 13, 2014