# US 10,374,870 B2 · Efficient access control for trigger events in SDN > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,870 B2 - Document ID: US10374870B2 - Status: Granted - Kind: B2 - Application number: 15/109,646 - Filed: 2014-06-17 - Published: 2016-11-17 - Granted: 2019-08-06 - Earliest claimed: 2014-06-17 - Assignees: NEC Corporation - Applicants: NEC Europe Ltd. - Inventors: Felix Klaedtke; Ghassan Karame; Roberto Bifulco - Web page: https://patentgrep.com/patent/US10374870B2 ## CPC - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/342: between virtual entities, e.g. orchestrators, SDN or NFV entities - H04L 47/2483: involving identification of individual flows - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of providing access control for a software defined network (SDN) controller includes triggering, by the SDN controller upon receiving a trigger event from a data plane of the software defined network, one or more applications that are installed to run at a control plane of the software defined network atop the SDN controller to react to the trigger event, applying, by the SDN controller before triggering applications due to a trigger event, a conflict resolution scheme. The conflict resolution scheme includes determining all flow spaces that are affected by the trigger event and selecting from these flow spaces a single selected flow space that complies with a predetermined policy, determining, a single master application according to predefined criteria, and triggering, in addition to the master application, only those applications whose reactions to the trigger event do not conflict with the master application. ## Claims ### Claim 1 A method of providing access control for a software defined network (SDN) controller to control access to network resources, the method comprising: triggering, by the SDN controller upon receiving a trigger event from a data plane of the software defined network, one or more applications that are installed to run at a control plane of the software defined network atop the SDN controller to react to the trigger event, and applying, by the SDN controller before triggering applications due to a trigger event, a conflict resolution scheme configured to resolve conflicts among the applications, the conflict resolution scheme comprising: determining all flow spaces that are affected by the trigger event and selecting from these flow spaces a single selected flow space having assigned a priority that complies with a predetermined policy, determining, from the applications related to the selected flow space, a single master application according to predefined criteria, and triggering, in addition to the master application, only those applications whose reactions to the trigger event do not conflict with the master application, wherein the flow spaces are objects on the control plane. ### Claim 2 (depends on 1) The method according to claim 1, wherein the flow spaces are hierarchically organized in a tree-based data structure. ### Claim 3 (depends on 1) The method according to claim 1, wherein a flow space is defined as a tuple comprising a parameter that specifies a set of packet headers, a parameter that specifies a set of actions, and a parameter that specifies a set of attributes. ### Claim 4 (depends on 1) The method according to claim 1, wherein according to a predetermined policy, priority is given to flow spaces that are more local with respect to the flow space hierarchy. ### Claim 5 (depends on 1) The method according to claim 1, wherein according to a predetermined policy, priority is given to flow spaces that are more global with respect to the flow space hierarchy. ### Claim 6 (depends on 1) The method according to claim 1, wherein an application with the highest priority is determined, from the applications related to the selected flow space, as the master application. ### Claim 7 (depends on 1) The method according to claim 1, wherein, in addition to the master application, only those applications are triggered that are related to the selected flow space and whose reactions to the trigger event do not conflict with the master application. ### Claim 8 (depends on 1) The method according to claim 1, wherein users are empowered to install and run their own applications at the control plane atop the controller. ### Claim 9 (depends on 1) The method according to claim 1, wherein the installation of an application the specification of reactions of the application. ### Claim 10 (depends on 1) The method according to claim 1, wherein applications that are in conflict with each other in terms of their reaction are pre-computed. ### Claim 11 (depends on 1) The method according to claim 1, wherein the trigger event includes at least one packet-in event sent by a switch of the software defined network to the SDN controller when the switch receives a packet that does not match any of the entries in a flow table of the switch. ### Claim 12 (depends on 1) A software defined network (SDN) controller, the controller being configured to execute a method according to claim 1. ### Claim 13 A software defined network (SDN) with access control to control access to network resources, the SDN comprising: a network device comprising a controller that is configured, upon receiving a trigger event from a data plane of the software defined network, to trigger one or more applications that are installed to run at a control plane of the software defined network atop the controller to react to the trigger event, wherein the controller is further configured, before triggering applications due to the trigger event, to apply a conflict resolution scheme configured to resolve conflicts among the applications, the conflict resolution scheme comprising: determining all flow spaces that are affected by the trigger event and selecting from these flow spaces a single selected flow space having assigned a priority that complies with a predetermined policy, determining, from the applications related to the selected flow space, a single master application according to predefined criteria, and triggering, in addition to the master application, only those applications whose reactions to the trigger event do not conflict with the master application, and wherein the flow spaces are objects on the control plane. ### Claim 14 (depends on 13) The network according to claim 13, wherein the controller comprises a north-bound Advanced Programming Interface (API) that is configured to be employed by users for installing and running their own applications at the control plane atop said controller. ### Claim 15 (depends on 13) The network according to claim 13, wherein the controller comprises a reference monitor that is configured to execute the conflict resolution scheme. ### Claim 16 (depends on 15) The network according to claim 15, wherein the reference monitor is configured to pre-compute applications that are in conflict with each other in terms of their reaction. ### Claim 17 (depends on 16) The Network according to claim 16, wherein the reference monitor is configured to pre-compute the applications each time a new application is installed. ### Claim 18 (depends on 10) The method of claim 10, wherein applications that are in conflict with each other in terms of their reaction are pre-computed each time a new application is installed.