Apparatus and method for deploying firewall on SDN and network using the same

1. An apparatus for deploying a firewall on a software-defined network (SDN), the apparatus comprising:

a public key distributor configured to transmit a public key;

a resource monitor configured to monitor resources of a network;

a host monitor configured to receive a firewall rule of at least one host, which is encrypted by the public key;

a decryption unit configured to decrypt information received from the host monitor by using a secret key;

a merge unit configured to merge the decrypted information to provide a merged firewall rule; and

a firewall deployment unit configured to deploy the merged firewall rule to a switch;

wherein the public key is transmitted to the switch through a control plane, and the switch is directly connected to the host, and

the host, to which the public key is transmitted, is configured to transmit a firewall rule of the host to the host monitor through a data plane.

2. The apparatus according to claim 1 , wherein the switch, to which the public key is transmitted, is configured to transmit the public key to the host through the data plane, and

the host, to which the public key is transmitted, is configured to encrypt the firewall rule of the host by using the public key and transmit the encrypted firewall rule to the host monitor.

3. The apparatus according to claim 1 , wherein the host monitor is configured to periodically receive the firewall rule of the host.

4. The apparatus according to claim 1 , wherein the merged firewall rule is integrated with a flow rule of the switch, or is the same as the flow rule of the switch.

5. An apparatus for deploying a firewall on a software-defined network (SDN), the apparatus comprising:

a public key distributor configured to transmit a public key;

a resource monitor configured to monitor resources of a network;

a host monitor configured to receive a firewall rule of at least one host, which is encrypted by the public key;

a decryption unit configured to decrypt information received from the host monitor by using a secret key;

a merge unit configured to merge the decrypted information to provide a merged firewall rule; and

a firewall deployment unit configured to deploy the merged firewall rule to a switch,

wherein the firewall deployment unit is configured to select the switch to which the merged firewall rule is transmitted, and

the switch, to which the merged firewall rule is transmitted, is selected as the switches that maximize a total data traffic reduced in the network.

6. The apparatus according to claim 5 , wherein a total number of the merged firewall rule does not exceed the capacity of the switch.

7. The apparatus according to claim 5 , wherein the merged firewall rule for any one host is placed on only one switch.

8. A method for deploying a firewall on a software-defined network (SDN), the method comprising:

gathering firewall rules of at least two hosts;

merging the firewall rules to provide a merged firewall rule; and

transmitting the merged firewall rule to only a selected switch,

wherein the switch, to which the merged firewall rule is transmitted, is selected as switches that maximize a total data traffic reduced in the network,

wherein the gathering of the firewall rules of the at least two hosts is performed by an encryption process, the encryption process comprising:

distributing a public key by using a control plane of a network;

assigning, by the switch receiving the public key, the public key to a host directly connected to the switch; and

encrypting the firewall rule of the host by using the public key and transmitting the encrypted firewall rule to a data plane.

9. The method according to claim 8 , wherein a total number of the merged firewall rules does not exceed the capacity of the switch.

10. The method according to claim 8 , wherein the merged firewall rule for any one host is placed on only one switch.