Software defined network whitebox infection detection and isolation

Abstract

A method and system for white box infection detection and isolation. The methods and systems can monitor a plurality of white boxes deployed within a communications network; send a challenge to a first white box of the plurality of white boxes; determine a processing time to answer the challenge by the first white box; in response to receiving the answer to the challenge, determine whether the processing time exceeds an average processing time for the challenge by a predetermined percentage; and in response to the processing time exceeding the average processing time by the predetermined percentage, isolate the first white box from the communications network.

What is claimed: 
     
         1 . A method comprising:
 sending, by a processing system including a processor, a challenge to a first white box of a plurality of white boxes adapted to implement virtualized functions within a communications network;   
       determining, by the processing system, a processing time to answer the challenge by the first white box; and
 in response to the processing time exceeding, by a predetermined amount, an average observed challenge processing time of the plurality of white boxes, isolating, by the processing system, the first white box from the communications network. 
 
     
     
         2 . The method of  claim 1  further comprising:
 determining, by the processing system, whether the first white box is infected based on the processing time exceeding the average observed challenge processing time by the predetermined amount; 
 in response to the determination that the first white box is infected, taking, by the processing system, remedial measures to remove an infection from the first white box to obtain a non-infected white box; and 
 in response to taking remedial measures, restoring, by the processing system, communications with the non-infected white box by components of the communications network. 
 
     
     
         3 . The method of  claim 1 , wherein the challenge is included in a keep alive message of a plurality of keep alive messages periodically sent to the plurality of white boxes. 
     
     
         4 . The method of  claim 1 , wherein the challenge is sent by a white box integrity management systems. 
     
     
         5 . The method of  claim 1 , wherein the challenge is sent by a neighboring white box of the first white box. 
     
     
         6 . The method of  claim 1 , wherein the challenge is at least one of a random code and a random puzzle. 
     
     
         7 . The method of  claim 1 , wherein the average observed challenge processing time is based on a challenge processing time for each white box of the plurality of white boxes that are essentially identical. 
     
     
         8 . An apparatus comprising:
 a processing system including a processor; and   a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising:
 providing a challenge to a first white box of a plurality of white boxes adapted to implement virtualized functions within a network; and 
 in response to a processing time exceeding, by a predetermined amount, an average challenge processing time of the plurality of white boxes, isolating the first white box from the network. 
   
     
     
         9 . The apparatus of  claim 8 , wherein the operations further comprise:
 determining whether the first white box is infected based on the processing time exceeding the average challenge processing time by the predetermined amount;   in response to the determination that the first white box is infected, taking remedial measures to remove an infection from the first white box; and   in response to taking remedial measures, restoring communications with one or more white boxes by components of the network.   
     
     
         10 . The apparatus of  claim 8 , wherein the challenge is included in a keep alive message. 
     
     
         11 . The apparatus of  claim 8 , wherein the challenge is sent by a white box integrity management systems. 
     
     
         12 . The apparatus of  claim 8 , wherein the challenge is sent by a neighboring white box of the first white box. 
     
     
         13 . The apparatus of  claim 8 , wherein the challenge is at least one of a random code and a random puzzle. 
     
     
         14 . The apparatus of  claim 8 , wherein the average challenge processing time is based on a processing time for each white box of the plurality of white boxes that are essentially identical. 
     
     
         15 . A non-transitory, machine-readable storage medium comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
 initiating a challenge to a first white box of a plurality of white boxes adapted to implement virtualized functions within a system; and   in response to a processing time exceeding, by a threshold amount, a average challenge processing time, isolating the first white box from the system.   
     
     
         16 . The non-transitory, machine-readable storage medium of  claim 15  further comprising:
 determining whether the first white box is infected; 
 in response to the determination that the first white box is infected, taking remedial measures to remove an infection from the first white box; and 
 in response to taking remedial measures, restoring communications with one or more white boxes of the plurality of white boxes by components of the system. 
 
     
     
         17 . The non-transitory, machine-readable storage medium of  claim 15 , wherein the challenge is included in a keep alive message. 
     
     
         18 . The non-transitory, machine-readable storage medium of  claim 15 , wherein the challenge is sent by a white box integrity management systems. 
     
     
         19 . The non-transitory, machine-readable storage medium of  claim 15 , wherein the challenge is at least one of a random code and a random puzzle 
     
     
         20 . The non-transitory, machine-readable storage medium of  claim 15 , wherein the average challenge processing time is based on a processing time for each white box in a group of white boxes of the plurality of white boxes that are essentially identical.