Security actuator for a dynamically programmable computer network

A method for actuating flow policy directives in a dynamically programmable computer network, the method comprising, with at least one computing device:

• monitoring the dynamically programmable computer network for receipt of a flow policy directive from a flow policy directive source;
• in response to the monitoring, converting the flow policy directive to one or more packet disposition directives, the one or more packet disposition directives to implement the flow policy directive at one or more network switches of the dynamically programmable computer network;
• and
• transmitting the one or more packet disposition directives to a security mediator of the dynamically programmable computer network, the security mediator mediating conflicts between packet disposition directives and transmitting packet disposition directives to network switches of the dynamically programmable network,
• wherein receiving the flow policy directive comprises receiving a flow policy directive to quarantine communications associated with a network service identifier to a notifier internet address, the network service identifier comprising one or more of a network address or a network port, and
• wherein converting the flow policy directive comprises:
• creating a first quarantine flow policy trigger rule to cause the one or more network switches to forward to the computing device a first quarantine trigger packet addressed from the network service identifier;
• creating a second quarantine flow policy trigger rule to cause the one or more network switches to forward to the computing device a second quarantine trigger packet addressed to the network service identifier;
• creating, in response to receiving the first or second trigger packet associated with a predefined network service, a first flow modification rule to (i) forward to the notifier internet address data communications addressed from the network service identifier and (ii) modify the data communications to identify the notifier internet address;
• and
• creating, in response to receiving the first or second trigger packet a second flow modification rule to (i) forward to the network service identifier data communications addressed from the notifier internet address and (ii) modify the data communications to identify the second network service identifier;
• wherein the first flow modification rule and the second flow modification rule have a higher priority than the first quarantine trigger rule and the second quarantine trigger rule;
• wherein converting the flow policy directive comprises parsing the flow policy directive to identify at least one valid command.

A security actuator for actuating flow policy directives in a dynamically programmable computer network, the security actuator comprising a plurality of instructions embodied in one or more non-transitory machine accessible storage media of a computing device that, when executed, cause the computing device to:

• monitor the dynamically programmable network for receipt of a flow policy directive from a source of flow policy directives, and in response to the monitoring:
• initiate an automated mechanism to communicate with one or more network switches of the dynamically programmable computer network, the automated mechanism to:
• monitor for packets having one or more criteria matching a trigger rule;
• and
• in response to a packet having a criterion matching the trigger rule, cause the one or more network switches to implement the flow policy directive,
• receipt of the flow policy directive comprises to receive a flow policy directive to quarantine communications associated with a network service identifier to a notifier internet address, the network service identifier to include one or more of a network address or a network port;
• and
• to implement the flow policy directive comprises to:
• create a first quarantine trigger rule to cause the one or more network switches to forward to a computing device a first quarantine trigger packet addressed from the network service identifier;
• create a second quarantine trigger rule to cause the one or more network switches to forward to the computing device a second quarantine trigger packet addressed to the network service identifier;
• create, in response to receipt of the first or second quarantine trigger packet associated with a predefined network service, a first flow modification rule to (i) forward to the notifier internet address data communications addressed from the network service identifier and (ii) modify the data communications to identify the notifier internet address;
• and
• create, in response to the receipt of the first or second quarantine trigger packet a second flow modification rule to (i) forward to the network service identifier data communications addressed from the notifier internet address and (ii) modify the data communications to identify the second network service identifier,
• wherein the first flow modification rule and the second flow modification rule have a higher priority than the first quarantine trigger rule and the second quarantine trigger rule;
• wherein the security actuator, before actuating, parses the flow policy directives to identify at least one valid command.