Security controller

1. A method, comprising:

receiving, by a security controller, a first security sequence generated by a network controller of a network and a second security sequence generated by a node of the network, wherein the second security sequence is a security configuration of the node when the second security sequence was generated;

generating, by the security controller, a third security sequence;

detecting, by the security controller, a discrepancy by comparing the first security sequence, the second security sequence, and the third security sequence; and

in response to detecting the discrepancy, determining, by the security controller, that the security configuration of the node has been modified.

2. The method of claim 1 , further comprising, in response to determining that the security configuration of the node has been modified:

generating, by the security controller, an alarm to an operator of the network;

isolating, by the security controller, the node from the network; and

instructing, by the security controller, the network controller to generate an additional node in the network.

3. The method of claim 1 , further comprising:

storing, by the security controller and prior to receiving the second security sequence from the node of the network, a second security configuration of the node, wherein the node is a virtual machine and the network is a software defined network (SDN); and

generating, by the security controller, the third security sequence based on the second security configuration, wherein the first security sequence, the second security sequence, and the third security sequence are each a checksum generated by a dynamic algorithm.

4. The method of claim 1 , wherein the second security sequence is generated in response to a creation of the node.

5. The method of claim 1 , further comprising:

tracking, by the security controller, a first host of the node; and

logging, by the security controller, an event, the event comprising the node being moved from the first host to a second host;

wherein:

the first host is a hardware platform on which the node resides; and

tracking the first host comprises capturing a fingerprint of the first host.

6. The method of claim 1 , further comprising receiving, by the security controller, a dynamic key, wherein generating the third security sequence requires the dynamic key.

7. The method of claim 1 , wherein the security configuration comprises one or more of the following:

a number of opened ports;

permitted traffic directions;

permitted protocols;

access privileges;

versions of security patches;

operating system specifics;

packet types and lengths; and

static routing tables.

8. A system comprising one or more processors and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, by a security controller, a first security sequence generated by a network controller of a network and a second security sequence generated by a node of the network, wherein the second security sequence is a security configuration of the node when the second security sequence was generated;

generating, by the security controller, a third security sequence;

detecting, by the security controller, a discrepancy by comparing the first security sequence, the second security sequence, and the third security sequence; and

in response to detecting the discrepancy, determining, by the security controller, that the security configuration of the node has been modified.

9. The system of claim 8 , wherein the operations further comprise, in response to determining that the security configuration of the node has been modified:

generating, by the security controller, an alarm to an operator of the network;

isolating, by the security controller, the node from the network; and

instructing, by the security controller, the network controller to generate an additional node in the network.

10. The system of claim 8 , wherein the operations further comprise:

storing, by the security controller and prior to receiving the second security sequence from the node of the network, a second security configuration of the node, wherein the node is a virtual machine and the network is a software defined network (SDN); and

generating, by the security controller, the third security sequence based on the second security configuration, wherein the first security sequence, the second security sequence, and the third security sequence are each a checksum generated by a dynamic algorithm.

11. The system of claim 8 , wherein the second security sequence is generated in response to a creation of the node.

12. The system of claim 8 , wherein the operations further comprise:

tracking, by the security controller, a first host of the node; and

logging, by the security controller, an event, the event comprising the node being moved from the first host to a second host;

wherein:

the first host is a hardware platform on which the node resides; and

tracking the first host comprises capturing a fingerprint of the first host.

13. The system of claim 8 , wherein the operations further comprise receiving, by the security controller, a dynamic key, wherein generating the third security sequence requires the dynamic key.

14. The system of claim 8 , wherein the security configuration comprises one or more of the following:

a number of opened ports;

permitted traffic directions;

permitted protocols;

access privileges;

versions of security patches;

operating system specifics;

packet types and lengths; and

static routing tables.

15. One or more non-transitory computer-readable storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, by a security controller, a first security sequence generated by a network controller of a network and a second security sequence generated by a node of the network, wherein the second security sequence is a security configuration of the node when the second security sequence was generated;

generating, by the security controller, a third security sequence;

detecting, by the security controller, a discrepancy by comparing the first security sequence, the second security sequence, and the third security sequence; and

in response to detecting the discrepancy, determining, by the security controller, that the security configuration of the node has been modified.

16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the operations further comprise, in response to determining that the security configuration of the node has been modified:

generating, by the security controller, an alarm to an operator of the network;

isolating, by the security controller, the node from the network; and

instructing, by the security controller, the network controller to generate an additional node in the network.

17. The one or more non-transitory computer-readable storage media of claim 15 , wherein the operations further comprise:

storing, by the security controller and prior to receiving the second security sequence from the node of the network, a second security configuration of the node, wherein the node is a virtual machine and the network is a software defined network (SDN); and

generating, by the security controller, the third security sequence based on the second security configuration, wherein the first security sequence, the second security sequence, and the third security sequence are each a checksum generated by a dynamic algorithm.

18. The one or more non-transitory computer-readable storage media of claim 15 , wherein the second security sequence is generated in response to a creation of the node.

19. The one or more non-transitory computer-readable storage media of claim 15 , wherein the operations further comprise:

tracking, by the security controller, a first host of the node; and

logging, by the security controller, an event, the event comprising the node being moved from the first host to a second host;

wherein:

the first host is a hardware platform on which the node resides; and

tracking the first host comprises capturing a fingerprint of the first host.

20. The one or more non-transitory computer-readable storage media of claim 15 , wherein the operations further comprise receiving, by the security controller, a dynamic key, wherein generating the third security sequence requires the dynamic key.