End-to-end encryption in a software defined network

A method for end-to-end securing of data communications in a Software Defined Network (SDN), the method comprising:

• sending, from a first component of the SDN to a controller of the SDN, first information comprising an identification of an encryption algorithm from a set of encryption algorithms supported by the first component;
• preventing, using a set of policies received at the first component transmitted in encrypted form from the controller, the first component from using a first subset of the set of encryption algorithms on a path in the SDN between the first component and a second component of the SDN even though the first subset of encryption algorithms is supported at the first component and the second component, wherein the set of policies comprises the first subset of the set of encryption algorithms;
• selecting, responsive to receiving the transmission from the controller, a cryptographic operation from a second subset of the set of encryption algorithms, the cryptographic operation being applicable to the path, wherein the first component comprises an originating point of the path and the second component comprises a destination point of the path;
• saving the set of policies in a repository associated with the first component;
• and
• forming, responsive to a destination of a data packet being associated with the second component and reachable via the path in the SDN, a secure data packet by performing the cryptographic operation on the data packet.

A computer program product for end-to-end securing of data communications in a Software Defined Network (SDN), the computer program product comprising:

• one or more computer-readable storage mediums;
• program instructions, stored on at least one of the one or more storage mediums, to receive, at a controller of the SDN, first information from a first component of the SDN, the first information comprising an identification of an encryption algorithm from a set of encryption algorithms supported by the first component;
• program instructions, stored on at least one of the one or more storage mediums, to detect, at the controller, a second component becoming available in the SDN;
• program instructions, stored on at least one of the one or more storage mediums, to determine, at the controller, that a path is possible in the SDN between the first component and the second component where the first component comprises an originating point of the path and the second component comprises a destination point of the path;
• program instructions, stored on at least one of the one or more storage mediums, to prevent, using a set of policies transmitted in encrypted form from the controller to the first component, the first component from using a first subset of the set of encryption algorithms on the path even though the first subset of encryption algorithms is supported at the first component and the second component, wherein the set of policies comprises the first subset of the set of encryption algorithms;
• and
• program instructions, stored on at least one of the one or more storage mediums, to cause, using the set of policies transmitted in encrypted form from the controller to the first component, a selection at the first component of a cryptographic operation from a second subset of the set of encryption algorithms, the cryptographic operation being applicable to the path.

A computer program product for end-to-end securing of data communications in a Software Defined Network (SDN), the computer program product comprising:

• one or more computer-readable storage mediums;
• program instructions, stored on at least one of the one or more storage mediums, to send, from a first component of the SDN to a controller of the SDN, first information comprising an identification of an encryption algorithm from a set of encryption algorithms supported by the first component;
• program instructions, stored on at least one of the one or more storage mediums, to prevent, using a set of policies received at the first component a set of policies transmitted in encrypted form, the first component from using a first subset of the set of encryption algorithms on a path in the SDN between the first component and a second component of the SDN even though the first subset of encryption algorithms is supported at the first component and the second component, wherein the set of policies comprises the first subset of the set of encryption algorithms;
• program instructions, stored on at least one of the one or more storage mediums, to select, responsive to receiving the transmission from the controller, a cryptographic operation from a second subset of the set of encryption algorithms, the cryptographic operation being applicable to the path, wherein the first component comprises an originating point of the path and the second component comprises a destination point of the path;
• program instructions, stored on at least one of the one or more storage mediums, to save the set of policies in a repository associated with the first component;
• and
• program instructions, stored on at least one of the one or more storage mediums, to form, responsive to a destination of a data packet being associated with the second component and reachable via the path in the SDN, a secure data packet by performing the cryptographic operation on the data packet.

A computer system for end-to-end securing of data communications in a Software Defined Network (SDN), the computer system comprising:

• one or more processors, one or more computer-readable memories and one or more computer-readable storage mediums;
• program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to receive, at a controller of the SDN, first information from a first component of the SDN, the first information comprising an identification of an encryption algorithm from a set of encryption algorithms supported by the first component;
• program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to detect, at the controller, a second component becoming available in the SDN;
• program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to determine, at the controller, that a path is possible in the SDN between the first component and the second component where the first component comprises an originating point of the path and the second component comprises a destination point of the path;
• program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to prevent, using a set of policies transmitted in encrypted form from the controller to the first component, the first component from using a first subset of the set of encryption algorithms on the path even though the first subset of encryption algorithms is supported at the first component and the second component, wherein the set of policies comprises the first subset of the set of encryption algorithms;
• and
• program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to cause, using the set of policies transmitted in encrypted form from the controller to the first component, selection at the first component of a cryptographic operation from a second subset of the set of encryption algorithms, the cryptographic operation being applicable to the path.