Network control security

Patent metadata

Field	Value
Publication number	US-9432380-B2
Application number	US-201414492938-A
Country	US
Kind code	B2
Filing date	Sep 22, 2014
Priority date	Sep 22, 2014
Publication date	Aug 30, 2016
Grant date	Aug 30, 2016

Abstract

Technologies are generally described for systems, devices and methods effective to allow a network element to retrieve a control command. In some examples, a network controller device may associate an identifier with the control command. The network controller device may send the identifier and the associated control command over a first network with a first level of security to a computing device. The network controller device may send an activation signal to the network element over a second network with a second level of security different from the first level of security. The network controller device may send the identifier to the network element over the second network. The identifier may be effective to allow the network element to retrieve the control command.

First claim

What is claimed is:

1. A method to allow a network element to retrieve a control command, the method comprising:
associating, by a network controller device, an identifier with the control command;
sending, by the network controller device, the identifier and the associated control command over a first network with a first level of security to a computing device;
sending, by the network controller device, an activation signal to the network element over a second network with a second level of security different from the first level of security; and
sending, by the network controller device, the identifier to the network element over the second network, wherein the identifier is effective to allow the network element to retrieve the control command.

2. The method of claim 1 , wherein:
first devices that are part of the first network are privileged to write to a memory of the computing device; and
second devices that are part of the second network are not privileged to write to the memory of the computing device.

3. The method of claim 1 , further comprising:
sending, by the network element, the identifier to the computing device, in response to receipt of the activation signal.

4. The method of claim 1 , wherein the control command is generated based on one or more programming instructions.

5. The method of claim 1 , further comprising:
identifying, by the computing device, the control command associated with the identifier, in response to receipt of the identifier from the network element; and
sending the control command from the computing device to the network element.

6. The method of claim 1 , wherein the control command is effective to configure the network element to take an action related to a software defined network.

7. The method of claim 6 , wherein the action includes changing from a first routing algorithm to a second routing algorithm.

8. The method of claim 1 , wherein:
the control command is a first control command, the computing device is a first computing device, and the method further comprises:
receiving, by the network element, a second control command from a second computing device over the second network, wherein the second control command does not include the identifier.

9. The method of claim 1 , wherein the network controller device, the computing device, and the network element are arranged in a software defined network.

10. A network communication system comprising:
a network controller device;
a computing device configured to be in communication with the network controller device over a first network with a first level of security; and
a network element configured to be in communication with the network controller device and the computing device, wherein
the network controller device is effective to:
send an identifier and associated control command over the first network to the computing device;

the computing device effective to store the identifier and the associated control command in a memory of the computing device;
the network controller device further effective to:
send an activation signal to the network element over a second network with a second level of security different from the first level of security; and
send a copy of the identifier to the network element over the second network;

the network element effective to, in response to receipt of the activation signal, send the copy of the identifier to the computing device; and
the computing device further effective to, in response to receipt of the copy of the identifier, send the control command associated with the identifier to the network element.

11. The network communication system of claim 10 , wherein the network controller device, the computing device, and the network element are arranged in a software defined network.

12. The network communication system of claim 11 , wherein the control command is effective to configure the network element to take an action related to the software defined network.

13. The network communication system of claim 10 , wherein to send the control command associated with the identifier to the network element, the computing device is further effective to perform a lookup with the copy of the identifier to identify the control command associated with the identifier.

14. The network communication system of claim 10 , wherein:
first devices that are part of the first network are privileged to write to a memory of the computing device; and
second devices that are part of the second network are not privileged to write to the memory of the computing device.

15. The network communication system of claim 10 , wherein:
the control command is a first control command, the computing device is a first computing device, and the network element is further effective to:
receive a second control command from a second computing device over the second network, wherein the second control command does not include the identifier.

16. A network controller device, comprising:
a processor; and
a memory configured to be in communication with the processor and effective to store one or more instructions, wherein
the processor effective to, in accordance with the one or more instructions:
send an identifier and control command over a first network with a first level of security to a computing device;
send an activation signal to a network element over a second network with a second level of security different from the first level of security; and
send a copy of the identifier to the network element over the second network, wherein the network element is effective to receive the control command from the computing device.

17. The network controller device of claim 16 , wherein the network controller device is further effective to write the control command to a memory of the computing device over the first network.

18. The network controller device of claim 16 , wherein:
first devices that are part of the first network are privileged to write to a memory of the computing device; and
second devices that are part of the second network are not privileged to write to the memory of the computing device.

19. The network controller device of claim 16 , wherein the activation signal is a ping effective to determine whether the network element is available to receive the copy of the identifier.

20. The network controller device of claim 16 , wherein the control command is generated based on one or more programming instructions configured to alter a characteristic of a software defined network.

Assignees

• Empire Technology Dev Llc

Inventors

• Margalit Mordehai
• Wechsler Yoav
• Dabija Vlad Grigore

Classifications

• H04L45/308 Primary

  Route determination based on user's profile, e.g. premium users · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title