Patent ID: 9654513
Date: 2017-05-16
CPC Classifications: H04L

Claim:
1. A computer-implemented method for automatically deploying a network security policy based on virtual network topology in a dynamic software defined network (SDN) comprising: providing a flow control interface in the dynamic SDN, the dynamic SDN separating a network topology from a physical network infrastructure, the flow control interface having knowledge of networks associated with the controller endpoints coupled to the networks and a policy appropriate for each endpoint, the flow control interface receiving a virtual network topology, operational endpoints, and a policy to apply to the operational endpoints; responsive to receiving an SDN change indication, identifying changes to enforcement points for an SDN change corresponding to the SDN change indication, each enforcement point having an associated network node, each enforcement point having knowledge regarding an optimal set of policies to load, the flow control interface deterministically knowing upcoming traffic that will flow to each enforcement point by being notified of new network flows; providing enforcement points affected by the SDN change with a policy reflecting the SDN change; downloading dynamically policy changes to enforcement points; monitoring for at least one of an acknowledgement and a time out of the policy changes; and performing an action based on the monitoring.