Flow-based isolation in a service network implemented over a software-defined network

A method for providing flow-based isolation in a service network that is implemented over a software-defined network, the method comprising:

• maintaining, on a first end user premises device of a plurality of end user premises devices that are connected to the service network, a first service network isolation flow that defines that any incoming communication having a source IP address within one or more subnets in the service network should be dropped;
• receiving, at the first end user premises device, a first communication from a service solution;
• evaluating, by the first end user premises device, the first communication against the first service network isolation flow to thereby determine that the first communication does not have a source IP address within the one or more subnets in the service network;
• in response to evaluating the first communication, allowing the first communication;
• receiving, at the first end user premises device, a second communication from a second end user premises device of the plurality of end user premises devices that are connected to the service network;
• evaluating, by the first end user premises device, the second communication against the first service network isolation flow to thereby determine that the second communication has a source IP address within the one or more subnets in the service network;
• and
• dropping the second communication.

One or more computer storage media storing computer executable instructions which, when executed in a software-defined networking architecture that includes a plurality of end user premises devices that are connected to a VLAN that forms a management network and a management solution, provide flow-based isolation by performing the following:

• maintaining, on each of the plurality of end user premises devices, a first service network isolation flow that defines that any incoming communication that originated within the management network should be dropped and a second service network isolation flow that defines that any outgoing communication that targets one of the end user premises devices should be dropped;
• receiving, at a first end user premises device of the plurality of end user premises devices, an incoming communication;
• evaluating, by the first end user premises device, the incoming communication against the first service network isolation flow to determine that the incoming communication originated within the management network;
• in response to evaluating the incoming communication, dropping the incoming communication;
• receiving, at the first end user premises device, an outgoing communication;
• evaluating, by the first end user premises device, the outgoing communication against the second service network isolation flow to determine that the outgoing communication targets one of the end user premises devices;
• and
• in response to evaluating the outgoing communication, dropping the outgoing communication.