Method to enable deep packet inspection (DPI) in openflow-based software defined network (SDN)
View Patent ↗The present invention relates to a method and system for performing deep packet inspection of messages transmitted through a network switch in a Software Defined Network (SDN). Embodiments of the invention include a network switch, a controller, and a firewall in a software defined networking environment. In the present invention, the network switch is a simple network switch that is physically separate from the controller and the firewall. The invention may include a plurality of physically distinct network switches communicating with one or more controllers and firewalls. In certain instances, communications between the network switch, the controller, and the firewall are performed using the Open Flow standard communication protocol.
1. A method of deep packet inspection in a Software Defined Networking environment, the method comprising:
receiving a set configuration command from a controller by a network switch, wherein the set configuration command sets an operational mode for deep packet inspection;
receiving an address of a firewall; establishing communications with the firewall;
receiving a get configuration request from the firewall;
sending a configuration reply to the firewall, wherein the configuration reply includes the operational mode for deep packet inspection; receiving a first packet;
determining, by hardware processor, whether information contained in the first packet does not match any entry in a flow table; and
forwarding at least a portion of the first packet to the controller, and then forwarding at least a portion of the first packet to the firewall if the controller determines to DPI scan this flow, wherein the firewall performs deep packet inspection on the portion of the first packet;
sending the first packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is an observation mode; receiving a second packet;
determining that information contained in the second packet matches an entry in the flow table and DPI scan is configured on this flow;
forwarding at least a portion of the second packet to the firewall when it is determined that the information contained in the second packet matches an entry in the flow table when a number of bytes forwarded from the first packet is less than a pre-determined number of bytes, wherein the firewall performs deep packet inspection on the portion of the second packet forwarded to the firewall; and
sending the second packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is in the observation mode.
2. The method of claim 1 , further comprising:
sending a copy of at least some bytes from the first packet to the controller before forwarding the portion of the first packet to the firewall; and
receiving an instruction from the controller to forward the portion of the first packet to the firewall before forwarding the portion of the first packet to the firewall.
3. The method of claim 1 , further comprising:
receiving an allow message from the firewall when the operational mode of the network switch is an enforce mode, wherein the allow message indicates that the first packet has passed a deep packet inspection.
4. The method of claim 3 , further comprising:
receiving a deny message from the firewall when the operational mode of the network switch is the enforce mode, wherein the deny message indicates that the second packet failed a deep packet inspection; and
dropping the second packet.
5. The method of claim 3 , further comprising
receiving an allow message from the firewall when the operational mode of the network switch is the enforce mode, wherein the allow message indicates that the second packet passed a deep packet inspection.
6. The method of claim 5 , wherein the address of the firewall received is an IP address of the firewall, wherein the first packet is sent through a port to an address identified in the flow table after the first packet has passed deep packet inspection, and wherein the second packet is sent through the port to the address identified in the flow table after the second packet has passed deep packet inspection.
7. The method of claim 1 , wherein the at least portion of the first packet corresponds to a pre-determined number of bytes for performing deep packet inspection on a flow of packets.
8. The method of claim 1 , wherein:
the communications established with the firewall are established by the controller communicating with the firewall and with the network switch,
the configuration request received from the firewall is passed through the controller, and
the configuration reply is sent by the network switch to the firewall through the controller.
9. A system for deep packet inspection in a Software Defined Networking environment, the system comprising:
a network switch including a memory; a controller; and a firewall, wherein the network switch:
receives a set configuration command from the controller by the network switch, wherein the set configuration command sets an operation mode for deep packet inspection;
receives an address of a firewall; establishes communications with the firewall; sends a configuration reply to the firewall, wherein the configuration
reply includes the operational mode for deep packet inspection; receives a first packet;
determines whether information contained in the first packet does not match any entry in a flow table; and
forwards at least a portion of the first packet to the controller, and then forwarding at least a portion of the first packet to the firewall if the controller determines to DPI scan this flow, wherein the firewall performs deep packet inspection of the portion of the first packet;
wherein the network switch:
sends the first packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is an observation mode; receives a second packet;
determines that information contained in the second packet matches an entry in the flow table and DPI scan is configured on this flow;
forwards at least a portion of the second packet to the firewall when it is determined that the information contained in the second packet matches an entry in the flow table when a number of bytes forwarded from the first packet is less than a pre-determined number of bytes, wherein the firewall performs deep packet inspection on the portion of the second packet forwarded to the firewall; and
sends the second packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is the observation mode.
10. The system of claim 9 , wherein the network switch:
sends a copy of at least some bytes from the first packet to the controller before forwarding the portion of the first packet to the firewall; and
receives an instruction from the controller to forward the portion of the first packet to the firewall before forwarding the portion of the first packet to the firewall.
11. The system of claim 9 , wherein the network switch:
receives an allow message from the firewall when the operational mode of the network switch is an enforce mode, wherein the allow message indicates that the first packet has passed a deep packet inspection.
12. The system of claim 11 , wherein the network switch:
receives a deny message from the firewall when the operational mode of the network switch is the enforce mode, wherein the deny message indicates that the second packet failed a deep packet inspection; and
drops the second packet.
13. The system of claim 12 , wherein the network switch
receives an allow message from the firewall when the operational mode of the network switch is the enforce mode, wherein the allow message indicates that the second packet passed a deep packet inspection.
14. The system of claim 9 , wherein the address of the firewall received is an IP address of the firewall, wherein the first packet is sent through a port to an address identified in the flow table after the first packet has passed deep packet inspection, and wherein the second packet is sent through the port to the address identified in the flow table after the second packet has passed deep packet inspection.
15. The system of claim 9 , wherein the at least portion of the first packet correspond to a pre-determined number of bytes for performing deep packet inspection on a flow of packets.
16. The system of claim 9 , wherein:
the communications established with the firewall are established by the controller communicating with the firewall and with the network switch,
the configuration request received from the firewall is passed through the controller, and
the configuration reply is sent by the network switch to the firewall through the controller.
17. A non-transitory computer readable storage medium having embodied thereon program executable by a processor performing a method of deep packet inspection in a Software Defined Networking environment, the method comprising:
receiving a set configuration command from a controller by a network switch, wherein the set configuration command sets an operational mode for deep packet inspection;
receiving an address of a firewall; establishing communications with the firewall;
receiving a get configuration request from the firewall;
sending a configuration reply to the firewall, wherein the configuration reply includes the operational mode for deep packet inspection; receiving a first packet;
determining whether information contained in the first packet does not match any entry in a flow table; and
forwarding at least a portion of the first packet to the controller, and then forwarding at least a portion of the first packet to the firewall if the controller determines to DPI scan this flow, wherein the firewall performs deep packet inspection on the portion of the first packet;
sending the first packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is an observation mode; receiving a second packet;
determining that information contained in the second packet matches an entry in the flow table and DPI scan is configured on this flow;
forwarding at least a portion of the second packet to the firewall when it is determined that the information contained in the second packet matches an entry in the flow table when a number of bytes forwarded from the first packet is less than a pre-determined number of bytes, wherein the firewall performs deep packet inspection on the portion of the second packet forwarded to the firewall; and
sending the second packet through a port to an address identified in the flow table without looking for a message from the firewall when the operational mode of the network switch is in the observation mode.
18. The non-transitory computer readable storage medium of claim 17 , the program being further executable to:
send a copy of at least some bytes from the first packet to the controller before forwarding the portion of the first packet to the firewall; and
receive an instruction from the controller to forward the portion of the first packet to the firewall before forwarding the portion of the first packet to the firewall.