Secure network switching infrastructure

A packet switching network for connecting a plurality of hosts, the network comprising:

• a plurality of switches for connection to the plurality of hosts, said plurality of switches interconnected to allow packets received at a switch to be provided to each switch, said plurality of switches including a secure switch which includes a flow table with entries indicating allowable flows between hosts and directions for forwarding allowable flows;
• and
• a controller, said controller connected to said secure switch,
• wherein said secure switch and said controller interact to developing a secure connection between themselves,
• wherein said controller authenticates a host when connected to said secure switch,
• wherein said secure switch interrogates said flow table upon receiving a flow from a host, determines if said flow is contained in said flow table, forwards at least the first packet of said flow to said controller if said flow is not contained in said flow table and forwards the packets as directed by said flow table if said flow is contained in said flow table;
• and
• wherein said controller receives said at least first packet of said flow not contained in said flow table of said secure switch, determines that said flow is allowed, sets up a flow table entry in said secure switch upon determining that said flow is allowed and returns said at least first packet to said secure switch for further flow table interrogation after setting up said flow table entry in said secure switch.

A controller for use in a packet switching network connecting a plurality of hosts, the network including a plurality of switches for connection to the plurality of hosts, the plurality of switches interconnected to allow packets received at a switch to be provided to each switch, the plurality of switches including a secure switch which includes a flow table with entries indicating allowable flows between hosts and directions for forwarding allowable flows, the controller comprising:

• a network interface for interconnection to at least one of said plurality of switches;
• a CPU coupled to said network interface;
• and
• memory coupled to said CPU and storing data and software programs executed on said CPU, said software programs including:
• an operating system;
• a component to interact with the secure switch to develop a secure connection between said controller and the secure switch;
• a component to authenticate a host when connected to the secure switch;
• and
• a component to receive at least a first packet of a flow between two hosts not contained in the flow table of the secure switch, to determine that said flow is allowed, to set up a flow table entry in the flow table in the secure switch upon determining that said flow is allowed and to return said at least first packet to the secure switch after setting up said flow table entry in the secure switch.

A secure switch for use in a packet switching network for connecting a plurality of hosts, the network including a controller and a plurality of switches, the plurality of switches interconnected to allow packets received at a switch to be provided to each switch and to the controller, the secure switch comprising:

• a network interface for interconnection to at least one of said plurality of switches and to which a host may be connected;
• memory containing a flow table, said flow table including entries indicating allowable flows between hosts and directions for forwarding allowable flows;
• logic coupled to said network interface to interact with the controller to develop a secure connection between the controller and the secure switch;
• logic coupled to said network interface to receive a flow from a host and interrogate said flow table upon receiving said flow, determine if said flow is contained in said flow table, forward at least the first packet of said flow to the controller if said flow is not contained in said flow table and forward the packets as directed by said flow table if said flow is contained in said flow table;
• logic coupled to said network interface to receive flow table entries from the controller and place them in said flow table;
• and
• logic coupled to said network interface to receive a packet returned from the controller and provide it to the logic to interrogate said flow table.