Methods and systems for establishment of VPN security policy by SDN application
View Patent ↗The present application is directed a computer-implemented methods and systems implementing Virtual Private Network (VPN) policies created or modified by Software Defined Network (SDN) applications. The VPN policies can be provided to SDN controllers for implementation. An SDN application can handle a request to establish a VPN by transmitting the request to a VPN provider, obtaining credentials for the VPN, and providing a security policy to an SDN controller.
1. A computer-implemented method for VPN policy implementation by a Software Defined Network (SDN) application, comprising:
transmitting, using an SDN application, a request to establish a virtual private network (VPN) to a VPN provider;
obtaining, at the SDN application and from the VPN provider, VPN server credentials for a VPN;
generating, using the SDN application, a security policy related to network traffic associated with the VPN;
converting, using the SDN application, the security policy to a table; and
transmitting, using the SDN application, the table to an SDN controller.
2. The computer-implemented method of claim 1 , further comprising:
receiving an alert, at the SDN application, from a network element that enforces a security rule based on the table, of a conflict with the security rule.
3. The computer-implemented method of claim 1 , wherein the VPN is a dynamic VPN.
4. The computer-implemented method of claim 3 , wherein the VPN server is dynamically updated based on a conflict with a security rule based on the table.
5. The computer-implemented method of claim 1 , further comprising:
monitoring, using the SDN application, network traffic information related to the VPN.
6. The computer-implemented method of claim 5 , further comprising:
analyzing, using the SDN application, the network traffic related to the VPN, wherein the security policy is based on analysis of the network traffic related to the VPN.
7. The computer-implemented method of claim 5 , further comprising:
analyzing, using the SDN application, the network traffic related to the VPN,
wherein a conflict with a security rule based on the table is identified based on matching, within the network traffic related to the VPN, a pattern defined in the table.
8. The computer-implemented method of claim 1 , wherein a network element that enforces a security rule based on the table includes a hybrid router, wherein the hybrid router is configured to communicate by conventional and OpenFlow protocols.
9. The computer-implemented method of claim 1 , wherein the table includes at least one OpenFlow Table Type Pattern (TTP).
10. The computer-implemented method of claim 1 , wherein the table includes at least one OpenFlow Multi-Flow Table (MFT).
11. A computer-implemented system for VPN policy implementation by a Software Defined Networking (SDN) application comprising:
a non-transitory memory having instructions stored thereon for implementing elements for network traffic control by the SDN application; and
a processor operatively coupled to the memory and configured to execute the instructions thereby effectuating:
one or more interfaces communicatively coupling the SDN application with user equipment and a virtual private network (VPN) provider, wherein the SDN application is configured to transmit a request to establish a VPN to a VPN provider, and wherein the SDN application is configured to obtain VPN server credentials for the VPN from the VPN provider;
a policy generation module of the SDN application configured to generate a security policy related to network traffic associated with the VPN;
a policy conversion module of the SDN application configured to convert the security policy to table configured for use by an SDN controller; and
a controller communication module of the SDN application configured to provide the table to the SDN controller.
12. The computer-implemented system of claim 11 , wherein the non-transitory memory stores instructions that when executed by the processor are configured to effectuate:
an authentication module of the SDN application configured to authenticate the SDN application to the SDN controller.
13. The computer-implemented system of claim 11 , wherein a network element that enforces a security rule based on the table includes a hybrid router, wherein the hybrid router is configured to communicate by conventional and OpenFlow protocols.
14. The computer-implemented system of claim 11 , wherein the table includes at least one OpenFlow Table Type Pattern (TTP).
15. The computer-implemented system of claim 11 , wherein the table includes at least one OpenFlow Multi-Flow Table (MFT).
16. The computer-implemented system of claim 11 , wherein the non-transitory memory stores instructions that when executed by the processor are configured to effectuate:
a monitor module of the SDN application configured to monitor network traffic associated with the VPN.
17. The computer-implemented system of claim 16 , wherein the non-transitory memory stores instructions that when executed by the processor are configured to effectuate:
an analysis module of the SDN application configured to identify anomalous traffic within the network traffic associated with the VPN, wherein the security policy is based on the anomalous traffic.
18. The computer-implemented system of claim 16 , wherein the non-transitory memory stores instructions that when executed by the processor are configured to effectuate:
an analysis module of the SDN application configured to analyze the network traffic associated with the VPN,
wherein a conflict with a security rule based on the table is identified based on matching, within the network traffic associated with the VPN, a pattern defined in the table.
19. A system, comprising:
a non-transitory memory having instructions stored thereon; and
a processor operatively coupled to the memory, wherein execution of the instructions by the processor causes:
transmitting, using a software defined networking (SDN) application, a request to establish a virtual private network (VPN) to a VPN provider;
obtaining, at the SDN application and from the VPN provider, VPN server credentials for a VPN;
generating, using the SDN application, a security policy related to network traffic associated with the VPN;
converting, using the SDN application, the security policy to a table; and
transmitting, using the SDN application, the table to an SDN controller.
20. The system of claim 19 , wherein execution of the instructions by the processor causes:
monitoring, using the SDN application, network traffic information related to the VPN.