Methods and systems for establishment of security policy between SDN application and SDN controller
View Patent ↗The present application is directed a computer-implemented methods and systems implementing control policies created or modified by Software Defined Network applications. The control policies can be provided to SDN controllers for implementation.
1. A computer-implemented method for network traffic control by a Software Defined Networking (SDN) application, comprising:
generating, using the SDN application, a control policy for a network traffic event, wherein the SDN application is a network element operable by way of a network application plane;
converting the control policy to a table configured for use by a SDN controller, wherein the SDN controller operable by way of a control plane; and
providing, from the SDN application, the table to the SDN controller,
authenticating the SDN application to the SDN controller, wherein authenticating the SDN application to the SDN controller provides the SDN application permissions to access network traffic information related to the SDN application and another node in communication with the SDN controller;
monitoring, using the SDN application, the network traffic information associated with network devices via a data plane; and
analyzing, using the SDN application, the network traffic information, wherein the control policy is based on analysis of the network traffic information,
wherein a control rule based on the table is enforced by a network element in communication with the SDN controller, wherein the network element is operable by way of the data plane.
2. The computer-implemented method of claim 1 , further comprising:
analyzing, using the SDN application, network traffic related to the SDN application, wherein the control policy is based on analysis of the network traffic, and
wherein the control policy is configured to identify anomalous traffic based on the analysis of the network traffic.
3. The computer-implemented method of claim 1 , wherein the control policy is configured to identify anomalous traffic based on the analysis of the network traffic information.
4. The computer-implemented method of claim 1 , wherein the control policy includes an action to be taken in response to current network traffic matching the table.
5. The computer-implemented method of claim 1 , wherein the network element includes a hybrid router, wherein the hybrid router is configured to communicate by conventional and OpenFlow protocols.
6. The computer-implemented method of claim 1 , wherein the network traffic event is a traffic signature over Stream Control Transmission Protocol (SCTP).
7. The computer-implemented method of claim 1 , wherein the table includes at least one OpenFlow Table Type Pattern (TTP).
8. The computer-implemented method of claim 1 , wherein the table includes at least one OpenFlow Multi-Flow Table (MFT).
9. The computer-implemented method of claim 4 , wherein the action includes one or more of providing an alarm, changing a path of the current network traffic, or changing resources associated with the current network traffic.
10. The computer-implemented method of claim 9 , wherein the action includes removing a VPN connection based on the matching of a pattern defined in the table, wherein the pattern is associated with unauthorized traffic.
11. A computer-implemented system for network traffic control by a Software Defined Networking (SDN) application comprising:
a non-transitory memory having instructions stored thereon for implementing elements for network traffic control by the SDN application, wherein the SDN application is a network element operable by way of a network application plane; and
a processor operatively coupled to the non-transitory memory and configured to execute the instructions thereby effectuating:
a policy generation module of the SDN application configured to generate a control policy for a network traffic event;
a policy conversion module of the SDN application configured to convert the control policy to table configured for use by a SDN controller, wherein the SDN controller operable by way of a control plane; and
a controller communication module of the SDN application configured to provide a table to the SDN controller,
authenticating the SDN application to the SDN controller, wherein authenticating the SDN application to the SDN controller provides the SDN application permissions to access network traffic information related to the SDN application and another node in communication with the SDN controller;
monitoring, using the SDN application, the network traffic information associated with network devices via a data plane; and
analyzing, using the SDN application, the network traffic information, wherein the control policy is based on analysis of the network traffic information,
wherein a control rule based on the table is enforced by a network element in communication with the SDN controller, wherein the network element is operable by way of the data plane.
12. The computer-implemented system of claim 11 , wherein the non-transitory memory stores instructions that when executed by the processor are configured to effectuate:
an analysis module of the SDN application configured to identify anomalous traffic within the network traffic, wherein the control policy is based on the anomalous traffic.
13. The computer-implemented system of claim 11 , wherein the control policy includes an action to be taken in response to current network traffic matching a pattern in the table.
14. The computer-implemented system of claim 11 , wherein the table includes at least one OpenFlow Table Type Pattern (TTP).
15. The computer-implemented system of claim 11 , wherein the network traffic event is a traffic signature over Stream Control Transmission Protocol (SCTP).
16. A system, comprising:
a non-transitory memory having instructions stored thereon; and
a processor operatively coupled to the non-transitory memory, wherein execution of the instructions by the processor causes:
generating, using a Software Defined Networking (SDN) application, a control policy for a network traffic event, wherein the SDN application is a network element operable by way of a network application plane;
converting the control policy to a table configured for use by a SDN controller, wherein the SDN controller operable by way of a control plane; and
providing, from the SDN application, the table to the SDN controller,
authenticating the SDN application to the SDN controller, wherein authenticating the SDN application to the SDN controller provides the SDN application permissions to access network traffic information related to the SDN application and another node in communication with the SDN controller;
monitoring, using the SDN application, the network traffic information associated with network devices via a data plane; and
analyzing, using the SDN application, the network traffic information, wherein the control policy is based on analysis of the network traffic information,
wherein a control rule based on a table is enforced by a network element in communication with the SDN controller, wherein the network element is operable by way of the data plane.