Securing of software defined network controllers

• US 9,497,207 B2
• Filed: 08/15/2014
• Issued: 11/15/2016
• Est. Priority Date: 08/15/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dhawan, Mohan, Mahajan, Kshiteej S., Mann, Vijay, Poddar, Rishabh
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): MURPHY, JOSEPH B
• Application Number:
  US14/460,976
• Publication Number:
  US 20160050223A1
• Time in Patent Office: 823 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods and arrangements for securing a software defined network. One or more control messages are intercepted. Information is extracted from the one or more control messages to create a global network state model, and there is determined, from the extracted information, presence of at least one prospective modification to the global network state model. Thereupon, a determination is made as to whether the at least one prospective modification presents a threat to security of the software defined network. Other variants and embodiments are broadly contemplated herein.

Claims

1. A method of detecting security attacks and securing a software defined network, said method comprising:

utilizing at least one processor to execute computer code configured to perform the steps of;

generating a representative global network state and a plurality of network constraints, wherein the representative global network state identifies representative traffic flow paths and traffic volume of the software defined network;

intercepting one or more control messages;

extracting information from the one or more control messages to create a current global network state, wherein the current global network state identifies current traffic flow paths and traffic volume of the software defined network;

determining, from the extracted information, presence of at least one modification to the software defined network, wherein the determining comprises validating the current global network state against the representative global network state and plurality of network constraints and identifying at least one change between the representative traffic flow paths and traffic volume of the software defined network and current traffic flow paths and traffic volume of the software defined network; and

thereupon determining whether the at least one modification presents a threat to security of the software defined network.

2. The method according to claim 1, comprising:

said determining whether the at least one modification presents a threat to security comprising recording a deviation from the representative global network state, and thereupon generating an alert.

3. The method according to claim 2, comprising:

obtaining administrator feedback with respect to the alert; and

augmenting the representative global network state based upon the administrator feedback.

4. The method according to claim 1, wherein said determining whether the at least one modification presents a threat to security comprises:

validating the at least one modification as being secure; and

thereupon permitting passage of the intercepted one or more control messages.

5. The method according to claim 4, wherein said validating comprises validating relative to a previously known representative global network state.

6. The method according to claim 1, wherein the one or more control messages comprise control messages flowing to one or more network controllers.

7. The method according to claim 6, wherein the one or more network controllers comprises a trusted network controller.

8. The method according to claim 6, wherein the one or more network controllers comprises an untrusted network controller.

9. The method according to claim 6, wherein the one or more control messages flow between at least one network element and the one or more network controllers.

10. The method according to claim 6, wherein the one or more control messages flow between at least one system administrator and the one or more network controllers.

11. The method according to claim 1, wherein said extracting comprises extracting header information.

12. The method according to claim 1, wherein the current global network state is created incrementally.

13. The method according to claim 1, wherein said intercepting comprises intercepting control message packets.

14. The method according to claim 1, wherein said intercepting comprises intercepting and replicating one or more control messages.

15. The method according to claim 1, wherein the one or more control messages comprise one or more control messages determined to be relevant to security of the software defined network.

16. An apparatus for detecting security attacks and securing a software defined network, said apparatus comprising:

at least one processor; and

a computer readable storage medium having computer readable program code embodied therewith and executable by the at least one processor, the computer readable program code comprising;

computer readable program code configured to generate a representative global network state and a plurality of network constraints, wherein the representative global network state identifies representative traffic flow paths and traffic volume of the software defined network;

computer readable program code configured to intercept one or more control messages;

computer readable program code configured to extract information from the one or more control messages to create a current global network state, wherein the current global network state identifies current traffic flow paths and traffic volume of the software defined network;

computer readable program code configured to determine, from the extracted information, presence of at least one modification to the software defined network, wherein the code configured to determine comprises code that validates the current global network state against the representative global network state and plurality of network constraints and code that identifies at least one change between the representative traffic flow paths and traffic volume of the software defined network and current traffic flow paths and traffic volume of the software defined network; and

computer readable program code configured to thereupon determine whether the at least one modification presents a threat to security of the software defined network.

17. A computer program product for detecting security attacks and securing a software defined network, said computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to generate a representative global network state and a plurality of network constraints, wherein the representative global network state identifies representative traffic flow paths and traffic volume of the software defined network;

computer readable program code configured to intercept one or more control messages;

computer readable program code configured to extract information from the one or more control messages to create a current global network state, wherein the current global network state identifies current traffic flow paths and traffic volume of the software defined network;

computer readable program code configured to determine, from the extracted information, presence of at least one modification to the software defined network, wherein the code configured to determine comprises code that validates the current global network state against the representative global network state and plurality of network constraints and code that identifies at least one change between the representative traffic flow paths and traffic volume of the software defined network and current traffic flow paths and traffic volume of the software defined network; and

computer readable program code configured to thereupon determine whether the at least one modification presents a threat to security of the software defined network.

18. The computer program product according to claim 17, wherein:

determining whether the at least one modification presents a threat to security comprises recording a deviation from the representative global network state, and thereupon generating an alert.

19. The computer program product according to claim 17, wherein determining whether the at least one modification presents a threat to security comprises:

validating the at least one modification as being secure; and

thereupon permitting passage of the intercepted one or more control messages.

20. A method comprising:

defining a representative global network state and a plurality of network constraints, wherein the representative global network state identifies representative traffic flow paths and traffic volume of a software defined network;

intercepting one or more control messages flowing to one or more network controllers, the one or more control messages comprising one or more control messages determined to be relevant to security of the software defined network;

extracting information from the one or more control messages to create a current global network state, wherein the current global network state identifies current traffic flow paths and traffic volume of the software defined network; and

determining whether at least one modification to the global network state model presents a threat to security of the software defined network, via;

recording a deviation from the representative global network state, wherein the recording comprises validating the current global network state against the representative global network state and plurality of network constraints and identifying at least one change between the representative traffic flow paths and traffic volume of the software defined network and current traffic flow paths and traffic volume of the software defined network; and

thereupon generating an alert.