SDN CONTROLLER

• US 20170331842A1
• Filed: 03/10/2017
• Published: 11/16/2017
• Est. Priority Date: 05/11/2016
• Status: Active Grant

• Current Assignee: Allied Telesis Holdings KK
• Original Assignee: Allied Telesis Holdings KK
• Inventors: Kikuchi, Yohei
• Granted Patent: US 10,616,246 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

An SDN controller used in a network constructed with an SDN, the SDN controller causes a computer to function as an address information specifying processing unit which specifies, based on a global address of an illegal attack server received from a threat detection system, communication with the received global address among communication in the network, and specifies a local address of a communication partner of the global address in the specified communication, a terminal identification information specifying processing unit which specifies terminal identification information on a client terminal to which the specified local address is assigned, and a security processing unit which passes to an edge network device, based on the specified terminal identification information, a control instruction to perform predetermined control processing to communication of the client terminal.

Claims

1. An SDN controller used in a network constructed with an SDN, the SDN controller causes a computer to function as:

an address information specifying processing unit configured to specify, based on a global address of an illegal attack server received from a threat detection system, communication with the received global address among communication in the network, and specify a local address of a communication partner of the global address in the specified communication;

a terminal identification information specifying processing unit configured to specify terminal identification information on a client terminal to which the specified local address is assigned; and

a security processing unit configured to pass to an edge network device, based on the specified terminal identification information, a control instruction to perform predetermined control processing to communication of the client terminal.

3. The SDN controller according to claim 1, wherein

the SDN controller notifies, as the control processing, other edge network devices in the network managed by the SDN controller of the specified terminal identification information.

4. The SDN controller according to claim 1, wherein

the SDN controller performs, as the control processing, any one or more of disconnection of communication or isolation of the client terminal, or detection, isolation, or restoration of a virus.

5. The SDN controller according to claim 1, wherein

the SDN controller writes, as the control processing, a rule to discard a packet from the client terminal having the terminal identification information in a rule table of the edge network device.

2. An SDN controller used in a network constructed with an SDN, the SDN controller causes a computer to function as:

a terminal identification information specifying processing unit configured to specify, based on a global address of an illegal attack server received from a threat detection system, communication with the received global address among communication in the network, and extract, from the specified communication, terminal identification information on a client terminal which is a transmission source; and

a security processing unit configured to pass to an edge network device, based on the extracted terminal identification information, a control instruction to perform predetermined control processing to communication of the client terminal.

6. The SDN controller according to claim 2, wherein

the SDN controller notifies, as the control processing, other edge network devices in the network managed by the SDN controller of the specified terminal identification information.

7. The SDN controller according to claim 2, wherein

the SDN controller performs, as the control processing, any one or more of disconnection of communication or isolation of the client terminal, or detection, isolation, or restoration of a virus.

8. The SDN controller according to claim 2, wherein

the SDN controller writes, as the control processing, a rule to discard a packet from the client terminal having the terminal identification information in a rule table of the edge network device.