Preventing network tomography in software defined datacenter networks
AssigneeEmpire Techology Development LLC
InventorEzekiel Kruglick
Life of this patent
Estimating the term…
Abstract
Technologies are provided for preventing abuse of software-defined datacenter networks. In some examples, an SDN abuse prevention module within a control layer of an SDN may use graph analysis rules and monitor network paths over time to detect and prevent abusive network conformation change command series. Instance-generated network paths may be analyzed to determine if the paths attempt to repeatedly traverse one or more sensitive network paths. If so, the paths may be implemented or denied based on, among other things, the time scale within which they attempt to repeatedly traverse the sensitive network paths.
Claims28
A method to prevent network tomography in a software-defined datacenter network, the method comprising:
- detecting a first core network route generated by a first instance and traversing a sensitive path at a first time;
- detecting a second core network route generated by a second instance and traversing another path not including the sensitive path at a second time after the first time;
- detecting that a third core network route traverses the sensitive path at a third time after the second time;
- and
- determining whether to implement the third core network route based on at least one criterion.
-11. (canceled)
A software-defined network (SDN) module executed on one or more servers to prevent network tomography in a software-defined datacenter network, the SDN module comprising:
- a route analyzer module configured to:
- detect a first core network route generated by a first instance and traversing a sensitive path at a first time;
- detect a second core network route generated by a second instance and traversing another path not including the sensitive path at a second time after the first time;
- and
- detect that a third core network route traverses the sensitive path at a third time after the second time;
- and
- a processing module configured to:
- determine whether to implement the third core network route based on at least one criterion.
(canceled)
-18. (canceled)
A cloud-based datacenter configured to prevent network tomography in a software-defined datacenter network, the datacenter comprising:
- at least one virtual machine (VM) operable to be executed on one or more physical machines, and
- a datacenter controller configured to:
- detect a first core network route generated by a first instance executing on the at least one VM and traversing a sensitive path at a first time;
- detect a second core network route generated by a second instance executing on the at least one VM and traversing another path not including the sensitive path at a second time after the first time;
- detect that a third core network route traverses the sensitive path at a third time after the second time;
- and
- determine whether to implement the third core network route based on at least one criterion.
-27. (canceled)
(canceled)
Dependencies are inferred from the claim text.