Hybrid SDN/legacy policy enforcement

A method, system, and computer program product configure elements of a hybrid network. The method may include a processor obtaining at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network; the components include a first component type and a second component type. After obtaining the requirement, the processor generates a plan to configure a component of the first component type and a component of the second component type. The processor configures the component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection. The processor configures the component of the second component type according to a second portion of the plan by transmitting this portion to a controller of components of the second component type in the hybrid network. The controller configures the component upon receipt of the portion.

FIELD OF INVENTION

The Invention relates generally to systems and methods that increase network efficiency specifically related to ease, speed, and accuracy of configuration and reconfiguration of hybrid networks.

BACKGROUND OF INVENTION

Hybrid software-defined networking (SDN) and hybrid networks present a number of challenges. Challenges arise when planning hybrid SDN and legacy networks, including but not limited to, deploying new protocols, implementing rapid, error-free configuration, maintaining a highly skilled workforce, and managing merged control and data planes.

Although the implementation of a pure SDN network simplifies the network itself, this implementation is not only not always an option, it is also uniquely challenging. A pure SDN solution uses switches that are limited to simple tasks like forwarding. Additionally, SDN networks program all control functionality in a central controller and use an out-of-band network between the controller and switches. Because of these limitations, programming is difficult, it is unclear how to scale centralized control, there is no encryption (SDN has no encryption), and the necessity of an out-of-band network adds complexity to the data plane.

SUMMARY OF INVENTION

Shortcomings of the prior art are also overcome and additional advantages are provided through the provision of a method to 1) compute paths consisting of traditional routers and SDN switches; 2) verify security properties such as the containment of an adversary; 3) trace the intrusion and exfiltration vector of an adversary; and/or 4) find a path to a destination that avoids compromised nodes, is permitted by existing firewall policies and satisfies capacity and bandwidth constraints. A hybrid network into which aspects of embodiments of the present invention are implemented may include layer 3 (L3routing, L3 security, SDN routing, legacy systems, and distributed control.

Shortcomings of the prior art are also overcome and additional advantages are provided through the provision of a method to configure elements of a hybrid network to meet a requirement, the method including: obtaining, by the one or more processors, at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network, wherein the components of the hybrid network comprise a first component type and a second component type, wherein the first component type and the second component type are configured utilizing different protocols; responsive to obtaining the requirement, generating, by the one or more processors, based on the requirement, a plan to configure at least one component of the first component type and at least one component of the second component type; configuring, by the one or more processors, the at least one component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection; and configuring, by the one or more processors, the at least one component of the second component type according to the second portion of the plan, wherein the configuring comprises: transmitting, by the one or more processor, to a controller of components of the second component type in the hybrid network, a second portion of the plan, wherein the controller configures the at least one component of the second component type according to the second plan portion of the plan, upon receipt of the second portion of the plan.

Systems and methods relating to one or more aspects of the technique are also described and may be claimed herein. Further, services relating to one or more aspects of the technique are also described and may be claimed herein.

DETAILED DESCRIPTION OF THE INVENTION

Despite the great potential of software-defined networking, its assimilation into legacy networks is likely to be gradual as many entities utilize networks that include legacy systems and a wholesale swap of technology is expensive, inefficient, and potentially extremely problematic. Instead, network operators will likely replace parts of their networks with SDN to gain experience with it and understand how its strengths can be combined with those of legacy networks. Thus, tools are needed to conceptualize overall security and functionality requirements of a network and plan how these can be satisfied using an SDN part and a legacy part as appropriate. Embodiments of the present invention provide tools to manage hybrid network, which is a network that includes both SDN and legacy components.

Embodiments of the present invention find paths in networks satisfying access-control, capacity, bandwidth and routing policy constraints. Embodiments of the present invention identify and account for these constraints by utilizing simultaneous multi-threading (SMT) solver. Thus, embodiments of the present invention may be used to: 1) compute paths in a hybrid network consisting of traditional routers and Software-Defined Networking switches; 2) verify security properties such as the containment of an adversary (i.e., there is no path from a compromised node to a sensitive server); 3) trace the intrusion and exfiltration vector of an adversary; and/or 4) find a path to a destination that avoids compromised nodes, is permitted by existing firewall policies and satisfies capacity and bandwidth constraints.

In accordance with an embodiment of the present invention, a Distributed Assured and Dynamic Configuration system (DADC) has been developed that assists in addressing the hybrid network challenges discussed. Among the advantages of utilizing this system is that it addresses the needs that motivated SDN, but works with full-featured devices. Thus, there is no need to reinvent the mature, scalable, distributed protocols, including those for encryption. Another advantage of utilizing this system in accordance with various aspects of the present invention is that it allows specification of network requirements. In embodiments of the present invention, DADC also synthesizes accurate configurations and improves efficiency of synthesis by several orders of magnitude over manual practice. In one example, configurations have achieved an accuracy of 100%. In accordance with certain aspects of an embodiment of the present invention, utilizing DADC can also automates central intellectual tasks of solving millions of dependencies between millions of configuration variables in seconds using SAT solvers. DADC can also be integrated with other systems (e.g., OpenFlow) to configure SDN switches. Unlike pure SDN, DADC also distributes control, ensuring scalability and control-plane fault-tolerance. In an embodiment of the present invention, consistency is ensured with group communication protocols. DADC may also provide in-band control channel without affecting the data plane.

By utilizing a DADC system (in an embodiment of the present invention), DADC assures SDN and hybrid networks (networks that include legacy systems) will be configured faster with fewer errors by less skilled staff, and DADC will preserve investment in legacy networks. This feature is an advantage over existing systems and as discussed herein, the present invention is routed in computer technology as aspects of embodiments of the present invention represent improvements to network configurations technology.

FIG. 1illustrates a hybrid network upon which program code executed by a processor, in accordance with an embodiment of the present invention, may: 1) compute paths consisting of traditional routers and SDN switches; 2) verify security properties such as the containment of an adversary; 3) trace the intrusion and exfiltration vector of an adversary; and/or 4) find a path to a destination that avoids compromised nodes, is permitted by existing firewall policies and satisfies capacity and bandwidth constraints. As seen inFIG. 1, the hybrid network includes layer 3 (L3) routing, L3 security, SDN routing, and distributed control.

Referring toFIG. 1, the hybrid network includes L3 routing. Specifically, in this non-limiting example of a hybrid network, there is a flow between Client1(C1) and Server with a certain bandwidth, there is a flow between Client2(C2) and Server with a certain bandwidth, routers R1and R3are reachable, and routers R2and R3are reachable.

Referring toFIG. 1, the hybrid network includes L3 security. There is a Generic Routing Encapsulation (GRE)/ Internet Protocol Security (IPSec) tunnel between R1and R3. There is a GRE/IPSec tunnel between R2and R3.

Referring theFIG. 1, the hybrid network includes SDN Routing. Specifically, R1and R2are reachable via SDN, R2and R3are reachable via SDN, and R1and R3are reachable only via S2. As depicted in the hybrid network inFIG. 1, the capacity of each link is greater than the sum of bandwidth of all flows passing through the link.

Referring theFIG. 1, the hybrid network includes distributed control. Specifically, each SDN switch is in a different administrative domain.

As aforementioned, hybrid networks, such as the example inFIG. 1, present challenges including deploying new protocols, implementing rapid, error-free configuration, maintaining a highly skilled workforce, and managing merged control and data planes. The different configurations within a given hybrid network may add to these challenges. Turning toFIG. 1, the hybrid network used as a non-limiting example includes many configuration variables, in this example, approximately two hundred and fifty (250). Configurations to the hybrid network ofFIG. 1include, but are not limited to L3 configurations and SDN configurations. L3 configurations may include, IP addresses, Masks, GRE source, destination, IPSec source, destination, encryption, hash, key, mode, Routing GRE into IPSec, Next hops, and Linux versions of these L3 configurations. SDN configurations include, but are not limited to, Mapping flows to SDN links, SDN routes, OpenFlow versions of configurations, and Controller to device mappings.

As seen inFIG. 1, in a hybrid network, there are multiple dependencies that can affect attempts at network configuration. For example, there is a large number of complex dependencies between various elements and configurations of those elements. Configuring and reconfiguring hybrid networks is an insurmountable challenge without the assistance of the present invention. An embodiment of the present invention, referred to as a DADC system, can generate these configurations and dependencies accurately, in seconds.

FIG. 2depicts an example technical architecture for a controller220(e.g., a DADC controller), in accordance with certain aspects of an embodiment of the present invention. As seen in this example, program code executed by a processor enables a controller to obtain security and functionality requirements210for a given network. The program code also enables the controller to receive current configurations and state information260from components of the hybrid network250, including, in the example ofFIG. 2, legacy (e.g., L3) components252aand SDN components252b. Responsive to receiving the security and functionality requirements and the current configurations, the program code generates new configurations for elements of the hybrid network. In an embodiment of the present invention, these configurations include configurations for L3 components and SDN components of the hybrid network. The program code communicates the new configurations to the components. In an embodiment of the present invention, the program code utilizes the controller230to send configurations information to L3 elements of the hybrid network. In an embodiment of the present invention, the controller230communicates new configurations to an SDN controller240and the SDN controller240sends the new configurations230(i.e., reconfigures) the SDN elements252bof the hybrid network.

Returning toFIG. 2, in an embodiment of the present invention, the program code executing at the DADC controller220may send new configurations230to legacy (e.g., L3) elements of a hybrid network252avia SNMP/SSH, both in-band and/or out-of-band. The SDN controller240, upon obtaining new configurations from the DADC controller,220may send new configurations to SDN elements of the hybrid network252busing SDNVia Pox/Openflow.

FIG. 3is a workflow that illustrates certain aspects of an embodiment of the present invention. In an embodiment of the present invention, one or more programs executing at a controller obtain a requirement for a hybrid network comprises of elements that include SDN components and legacy components (310). In an embodiment of the present invention, the requirement may include one or more of a security of a functionality requirement for the hybrid network. Responsive to obtaining the requirement, the one or more programs generate a plan for a new configuration for elements of the hybrid network, wherein the new configuration applies to at least one legacy component and at least one SDN component of the hybrid network to satisfy the requirement (320). In an embodiment of the present invention, the one or more programs generate sub-requirements based on the requirement. The sub-requirements may include specific functionality/connectivity changes to components in the network needed to meet the requirement. The plan may include the steps for implementing changes to components that would satisfy the requirement by satisfying the sub-requirements.

Returning toFIG. 3, the one or more programs configure the legacy component according to the plan utilizing a security protocol for use over an unsecured connection (330). The one or more programs communicate the plan to an SDN controller, which, upon receipt of the plan, configures the SDN component in accordance with the plan (340). The one or more programs receive updated configuration and state information from the components, based on new configurations in accordance with the plan (as necessitated by the requirement) (350). In an embodiment of the present invention, the legacy component and the SDN component may be configured concurrently. In an embodiment of the present invention, the security protocol utilized by the one or more programs is Simple Network Management Protocol (SNMP), an Internet-standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. In an embodiment of the present invention, the security protocol utilized by the one or more programs is Secure Shell (SSH), a cryptographic network protocol for operating network services securely over an unsecured network.

Embodiments of the present invention include tools that conceptualize overall security and functionality requirements of a network and plan how these can be satisfied using an SDN part and a legacy part as appropriate. Returning toFIG. 1, a requirement obtained by the one or more programs executing at a controller (310) may be a requirement to encrypt end-to-end flows between clients C1, C2and Server (FIG. 1), while also exercising tight control over the performance of these components. The one or more programs generate a plan to satisfy this requirement (320). For example, satisfying this requirement may include satisfying the subsidiary requirements of setting up a Layer-3 network consisting of C1, C2, C3and routers R1, R2, R3, setting up Generic Routing Encapsulation (GRE) tunnels between the routers and run Open Shortest Path First (OSPF) protocol over these so they can discover routes to all Layer-3 destinations, encrypt GRE tunnels with Internet Protocol Security (IPsec) tunnels, routing encrypted traffic into the SDN network, and/or ensuring that sum of the bandwidths of all flows mapped to an SDN link do not exceed that link's capacity. This one or more programs can satisfy the plan by correctly setting values of configuration variables such as IP addresses and masks of physical and logical interfaces, mapping of GRE interfaces to physical ones, IPSec local and remote endpoints, keys, encryption and hash algorithms, OSPF areas, the forwarding rules at routers injecting encrypted traffic into the SDN, and the forwarding rules at SDN switches.

Utilizing aspects of embodiments of the present invention, referred to as DADC, program code can specify constraints and automatically resolve them using SMT solvers. The program code leverages power and scalability of control plane protocols embedded in legacy devices. In the above example, i.e., generating a plan based on obtaining a requirement to encrypt end-to-end flows between clients C1, C2and Server, OSPF would compute Layer-3 routes without explicitly computing and installing those routes. Rather, to simplify the specification of dependencies, embodiments of the present invention utilize a specification language with a catalog of requirements that capture architecture patterns and logical structures and relationships for accomplishing common security and functionality tasks using different protocols. Examples of such requirements include, but are not limited to, IP subnets (for logical address grouping), OSPF domains (for fault-tolerant routing), Virtual Routing Redundancy Protocol (VRRP) clusters (for fault-tolerant routers), IPSec tunnels (for confidentiality), GRE tunnels (for virtual links) and access-control lists (for access-control). Requirements also include the following SDN-specific requirement: there exists a path supporting a flow, subject to routing policy and capacity constraints.

In an embodiment of the present invention, a flow is defined by a five tuple consisting of source and destination addresses and ports and a protocol. Routing policy constraints specify what devices can and cannot be on the path. Capacity constraints specify that the sum of the bandwidth of all flows mapped to a link is not greater than that link's capacity. In an embodiment of the present invention, the program code can generate requirements composed with Boolean operators (e.g., typically “AND”) to form a very large class of requirements. Composition may be analogous to superposition of logical structures in network architecture planning diagrams.

Returning toFIG. 1, controller220compiles requirements into primitive constraints, for example, in the language of an SMT solver. These constraints may be on all the configuration variables in the network. For example, the program code compiles a requirement for SDN path finding into a constraint by generalizing an algorithm to compute shortest paths with SAT2. The program code executing at controller220(e.g., a DADC controller) uses the SMT solver to find a solution in abstract form and transforms it into the vendor-specific configuration scripts (e.g., Configuration Implementing Requirements230,FIG. 2) for each device in the network. In an embodiment of the present convention, program code of the controller220then applies these scripts to the devices over a control network that can either be out-of-band or in-band. For legacy devices, DADC uses SNMP or SSH depending on vendor support. In an embodiment of the present invention, for SDN devices, DADC generates a Python script that is executed by the Pox controller. For example, the controller220may read the solution file and apply the forwarding rules to the switches using Openflow.

In an embodiment of the present convention, the program code may also solve other configuration-related problems, including but not limited to: diagnosis, repair, verification and moving-target defense by formulating them as constraint-satisfaction problems. In an embodiment of the present invention, the program code also performs distributed configuration by building on the total-ordering guarantees of group communication protocols. Embodiments of the present invention provide a compositional framework for specifying and synthesizing a wide range of hybrid networks. Algorithms for synthesizing networks satisfying new requirements can be included in the DADC requirement catalog provided they can be encoded as a constraint satisfaction problem, for example, by encoding constraints into an SMT language and applying them in response to requirements obtained by the program code at a controller.

FIG. 4is an example of a distributed architecture utilized by some embodiments of the present invention. In an embodiment of the present invention, as seen inFIG. 4, components or a hybrid network are partitioned into enclaves, each with a separate controller. The network inFIG. 4is just one example of a network partitioned into enclaves and the advantages of these network configuration are explained further in the discussion ofFIG. 5.

FIG. 5is an example of a distributed architecture utilized by some embodiments of the present invention. In an embodiment of the present invention, as seen inFIG. 5, components of a hybrid network530are partitioned into enclaves540a-540d, each with a separate controller510a-510d. Each controller510a-510d, which may be a DADC controller, obtains security and functionality requirements from a logical bus512.

Returning toFIG. 5, in an embodiment of the present invention, message types conveying these requirements from the logical bus512include, but are not limited to: new requirement, component status, and/or moving-target defense. Each individual controller510a-510dmay utilize an in-band control channel to convey configuration information to elements in its respective enclave540a-540d. In an embodiment of the present invention, the controllers solve dependencies between dynamic state and configurations, generate new configurations, and apply to components in their enclaves. In an embodiment of the present invention, controller action consistency is ensured by total-ordering of group communication protocols, and determinism of SAT/SMT (Boolean Satisfiability Problem/Satisfiability Modulo Theories) solvers. Consistency is maintained between the controllers as, in an embodiment of the present invention, they execute the configurations in the same order such to keep the components in all enclaves in sync and accessible to each other.

Advantages provided by an embodiment of the present invention include, but are not limited to, specification of hybrid network requirements, automated configuration generation for Linux, SDN, CORE and Mininet, hybrid network set up in minutes (rather than days), encrypted reachability between Clients and Servers, visualization of logical structures, visualization of existing configurations.

FIGS. 6-11illustrate certain functionalities of various embodiments of the present invention.FIG. 6depicts-specifying a hybrid network in DADC. Note that the example network utilized is the hybrid network inFIG. 1. FIG,7depicts that the program code comprising a constraint solver, in an embodiment of the present invention, automatically generates configuration variables.FIG. 8depicts the visualization of a configuration solution (with SDN links labeled with flow endpoints) generated by the program code.FIG. 9depicts a GRE/IPSec visualization of a given hybrid network in accordance with an embodiment of the present invention.FIG. 10depicts platform-specific configurations for Linux and CORE automatically generated by the program code (e.g., executed at a controller) in an embodiment of the present invention.FIG. 11depicts SDN and Mininet configurations that were automatically generated by program code in an embodiment of the present invention.

As explained herein, embodiments of the present invention (sometimes referred to as DADC) can take a plan and synthesize values of (both legacy and SDN) configuration variables to implement the plan. Embodiments of the present invention represent an advantage over present methods of configuration because this synthesis is inherently hard. Requirements induce a very large number of complex constraints between configuration variables within and across multiple components and protocol layers. For example, IPSec tunnel set up requires that the key and encryption and hash algorithms at both endpoints be identical, and that the peer values be symmetric. GRE packets must be routed into the IPSec tunnel for encryption. SDN forwarding rules must ensure reachability between routers, and be consistent with bandwidth and capacity constraints. Thus, constraints cannot be resolved independently of each other because of shared variables. Arguably, search spaces are astronomical. Thus, manual resolution of these constraints is infeasible. Attempts to do so, as with current practice, cause large numbers of configuration errors. Thus, embodiments of the present invention provide automatic constraint solving and configuration plan generation without this overhead.

FIG. 12andFIG. 13are relevant to the nodes executing program code discussed in this disclosure, including the controller220(FIG. 2).FIG. 12illustrates a block diagram of a resource1200in computer system, such as a controller. Returning toFIG. 12, the resource1200may include a circuitry502that may in certain embodiments include a microprocessor504. The computer system1200may also include a memory506(e.g., a volatile memory device), and storage508. The storage508may include a non-volatile memory device (e.g., EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, firmware, programmable logic, etc.), magnetic disk drive, optical disk drive, tape drive, etc. The storage508may comprise an internal storage device, an attached storage device and/or a network accessible storage device. The system1200may include a program logic510including code512that may be loaded into the memory506and executed by the microprocessor504or circuitry502.

In certain embodiments, the program logic510including code512may be stored in the storage508, or memory506. In certain other embodiments, the program logic510may be implemented in the circuitry502. Therefore, whileFIG. 13shows the program logic510separately from the other elements, the program logic510may be implemented in the memory506and/or the circuitry502. The program logic510may include the program code discussed in this disclosure that facilitates the reconfiguration of elements of various computer networks, including those in various figures.

Using the processing resources of a resource1200to execute software, computer-readable code or instructions, does not limit where this code can be stored. Referring toFIG. 13, in one example, a computer program product1300includes, for instance, one or more non-transitory computer readable storage media602to store computer readable program code means or logic604thereon to provide and facilitate one or more aspects of the technique.

As will be appreciated by one skilled in the art, aspects of the technique may be embodied as a system, method or computer program product. Accordingly, aspects of the technique may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system”. Furthermore, aspects of the technique may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus or device.

Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus or device.

In one aspect of the technique, an application may be deployed for performing one or more aspects of the technique. As one example, the deploying of an application comprises providing computer infrastructure operable to perform one or more aspects of the technique.

As a further aspect of the technique, a computing infrastructure may be deployed comprising integrating computer readable code into a computing system, in which the code in combination with the computing system is capable of performing one or more aspects of the technique.

As yet a further aspect of the technique, a process for integrating computing infrastructure comprising integrating computer readable code into a computer system may be provided. The computer system comprises a computer readable medium, in which the computer medium comprises one or more aspects of the technique. The code in combination with the computer system is capable of performing one or more aspects of the technique.

Further, other types of computing environments can benefit from one or more aspects of the technique. As an example, an environment may include an emulator (e.g., software or other emulation mechanisms), in which a particular architecture (including, for instance, instruction execution, architected functions, such as address translation, and architected registers) or a subset thereof is emulated (e.g., on a native computer system having a processor and memory). In such an environment, one or more emulation functions of the emulator can implement one or more aspects of the technique, even though a computer executing the emulator may have a different architecture than the capabilities being emulated. As one example, in emulation mode, the specific instruction or operation being emulated is decoded, and an appropriate emulation function is built to implement the individual instruction or operation.