Argela Yazilim Ve Bilisim Teknolojileri San Ve Tic A.s.

Netsia, Inc.

Sinan Tatlicioglu

Seyhan Civanlar

Erhan Lokman

Burak Gorkemli

Bulent Kaytaz

Metin Balci

Serkant Uluderya

Ali Volkan Atli

Onur Koyuncu

Aydin Ulas

A Metin Balci

Erol Ozcan

When network function virtualization (NFV) is overlaid on top of a SDN, a convergence gateway mediates between the orchestrator and the SDN controller. The convergence gateway collects from the orchestrator the information on the location, capacity, status, and usage information of all virtualized functions that run on SDN's physical platforms, and passes that information to the controller. The controller decides to optimally route a data flow for service chaining by obeying traffic engineering and quality of service policies of that data flow, choosing from available virtualized functions along that route. An information model based approach is also presented for information sharing across the orchestrator, convergence gateway and controller.

System and method for elastic scaling of virtualized network functions over a software defined network

A novel technique is shown for throttling control traffic in a Software Defined Network (SDN) between a controller and network switches when the controller and/or one or more control channels are congested. In this technique, the controller's processing power and the limited control channel bandwidth are more efficiently managed by drastically cutting down the control traffic during times of congestion.

System and method for control traffic reduction between SDN controller and switch

A novel system and a new data communication method are invented in a software-defined (SDN) network to provide delivery of certain types of critical data flows with certain QoS and/or extra security requirements in a congested network. The method of invention allows such critical data not to traverse the data plane, as it normally would, but instead to go from the ingress switch directly to the egress switch, thereby always in two hops using the control channels. By shortcutting all other switches along the traditional data path computed by normal routing, it potentially provides guaranteed throughput, lower latency/jitter or higher level of security.

System, method and article of manufacture for using control plane for critical data communications in software-defined networks

An ingress forwarder receives the IP packet and strips off the entire packet header and replaces it with the simple flow header assigned by the controller, and looks up its flow-table to determine from which port to forward the packet. All other forwarders along the path up to the egress forwarder perform the forwarding action simply by inspecting the flow header. The egress forwarder, before forwarding to the egress port, replaces the flow header with the original layer-2/3/4 header. Doing so, the host behavior remains unchanged while the routing/forwarding within the cloud of SDN is performed based on only the flow header.

System and method for routing in software defined networks using a flow header

The VNF hopping in a Software Defined Network (SDN) allows a traffic flow to change routes frequently amongst a chosen group of paths to obfuscate data paths or to meet specific performance requirements while satisfying the service chaining requirements by activating in real-time the same virtual functions on each chosen path. Using the VNF hopping method and additional capabilities built into an SDN controller and an orchestrator according to this invention, the controller determines multiple feasible routes for specific flows with desired service chaining functions and enables activation of those chained services, so that the active flow can randomly be assigned to different routes after a switch-over time period expires, or by a special randomization logic within the switch managed by the controller, or manually programmed by a system administrator.

Randomized VNF hopping in software defined networks

Sensitive data is sent through insecure network regions across different software defined networks (SDNs) over an encrypted path without requiring encryption applications at the source or destination hosts. One or more special-purpose encryptors are strategically placed within each SDN, which can act as an encryptor or decryptor, of both the data packet content and the header. Using the controller and a special encryption service application, the encrypted IP packets are forwarded from an encryptor, closest to the source, towards a decryptor, closest to the destination, utilizing a tagging method. Each encryptor has a static and globally unique tag. Each controller advertises to other controllers its encryptor information: IP of the encryptor, the IP block of the users the encryptor is responsible for and the unique encryptor tag(s). Each forwarder along the flow path is instructed by its respective controller how to forward packets towards the destination according to the tag.

System and method for programmable network based encryption in software defined networks

A system and method that rely on a centralized and trusted control mechanism for a software-defined network (SDN) to dynamically assign routes between two end points, and to simultaneously change their real IP addresses to fake IP addresses to establish short-lived obfuscated communications paths with a goal of preserving anonymity. The SDN controller determines the short-lived routes from a feasible route-set and new fake IP addresses from a reserved address pool for the source and destination hosts. It provisions only the switches along the route with rules so that a switch can forward packets of the data flow to another switch without needing to know the actual IP addresses of the communicating endpoints, and hence, providing strict anonymity even when the switches are compromised.

Growing community of inventors

Istanbul, Turkey

Sinan Tatlicioglu