Securing software defined networks via flow deflection

Abstract

A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.

What is claimed is: 
     
         1 . An apparatus, comprising:
 a processor and a memory communicatively connected to the processor, the processor configured to:
 receive, at a first network element of a software defined network from a second network element of the software defined network, a new flow request; and 
 propagate the new flow request from the first network element of toward a control element of the software defined network. 
   
     
     
         2 . The apparatus of  claim 1 , wherein the processor is configured to:
 receive, at the first network element from the control element, a flow forwarding rule for a data flow associated with the new flow request.   
     
     
         3 . The apparatus of  claim 2 , wherein the processor is configured to:
 receive, at the first network element from the control element, an indication that the flow forwarding rule for the data flow associated with the new flow request is to be removed from the first network element.   
     
     
         4 . The apparatus of  claim 1 , wherein the new flow request has a flow identifier associated therewith, wherein the processor is configured to:
 distinguish, based on the flow identifier, between a data flow associated with the new flow request and local data flows associated with data flow requests received at the second network element directly without use of flow deflection.   
     
     
         5 . The apparatus of  claim 4 , wherein the flow identifier is included within the new flow request. 
     
     
         6 . The apparatus of  claim 4 , wherein the flow identifier comprises a Multiprotocol Label Switching (MPLS) label or a Virtual Local Area Network (VLAN) identifier. 
     
     
         7 . The apparatus of  claim 1 , wherein the processor is configured to:
 based on detection of a resource utilization condition at the first network element, give higher priority to a local data flow of the first network element than to a data flow associated with the new flow request.   
     
     
         8 . The apparatus of  claim 7 , wherein the resource utilization condition comprises a Ternary Content-Addressable Memory (TCAM) utilization condition or a Central Processing Unit (CPU) utilization condition. 
     
     
         9 . A method, comprising:
 receiving, at a first network element of a software defined network from a second network element of the software defined network, a new flow request; and   propagating the new flow request from the first network element toward a control element of the software defined network.   
     
     
         10 . The method of  claim 9 , further comprising:
 receiving, at the first network element from the control element, a flow forwarding rule for a data flow associated with the new flow request.   
     
     
         11 . The method of  claim 10 , further comprising:
 receiving, at the first network element from the control element, an indication that the flow forwarding rule for the data flow associated with the new flow request is to be removed from the first network element.   
     
     
         12 . The method of  claim 9 , wherein the new flow request has a flow identifier associated therewith, the method further comprising:
 distinguishing, based on the flow identifier, between a data flow associated with the new flow request and local data flows associated with data flow requests received at the second network element directly without use of flow deflection.   
     
     
         13 . The method of  claim 12 , wherein the flow identifier is included within the new flow request. 
     
     
         14 . The method of  claim 12 , wherein the flow identifier comprises a Multiprotocol Label Switching (MPLS) label or a Virtual Local Area Network (VLAN) identifier. 
     
     
         15 . The method of  claim 9 , further comprising:
 based on detection of a resource utilization condition at the first network element, giving higher priority to a local data flow of the first network element than to a data flow associated with the new flow request.   
     
     
         16 . The method of  claim 15 , wherein the resource utilization condition comprises a Ternary Content-Addressable Memory (TCAM) utilization condition or a Central Processing Unit (CPU) utilization condition. 
     
     
         17 . An apparatus, comprising:
 a processor and a memory communicatively connected to the processor, the processor configured to:
 receive, at a control element of a software defined network from a first network element of the software defined network, a new flow request received by the first network element from a second network element of the software defined network; 
 propagate, from the control element toward the first network element, a flow forwarding rule for a data flow associated with the new flow request; and 
 initiate, by the control element based on a determination that a condition has been satisfied at the second network element, removal of flow deflection at the second network element. 
   
     
     
         18 . The apparatus of  claim 17 , wherein, to initiate removal of flow deflection at the second network element, the processor is configured to:
 initiate migration of the data flow from the first network element to the second network element.   
     
     
         19 . The apparatus of  claim 18 , wherein, to initiate migration of the data flow from the first network element to the second network element, the processor is configured to:
 propagate, from the control element toward the second network element, a flow forwarding rule indicative that packets of the data flow are to be forwarded from the second network element toward a destination node; and   propagate, from the control element toward the first network element, an indication that the flow forwarding rule for the data flow associated with the new flow request is to be removed from the first network element.   
     
     
         20 . The apparatus of  claim 17 , wherein, to initiate removal of flow deflection at the second network element, the processor is configured to:
 propagate, from the control element toward the second network element, a flow forwarding rule indicative that packets of the data flow are to be forwarded from the second network element to the first network element; and   propagate, from the control element toward the second network element, an indication that a flow deflection rule set on the second network element is to be removed.