Security mediation for dynamically programmable network

Abstract

A network security policy may be implemented at network switches as a set of active packet disposition directives. In a dynamically programmable network, the network switches can be dynamically reprogrammed with new packet disposition directives. A security mediation service permits such dynamic reprogramming as long as the new directives are consistent with the then-current network security policy. The security mediation service evaluates candidate packet disposition directives for conflicts with the currently active security policy, before instantiating the candidate packet disposition directives at the network switches.

1 - 20 . (canceled) 
     
     
         21 . A method for synchronizing a plurality of programmable network devices with a dynamic set of flow rules, the method comprising:
 storing, in an aggregate state table, aggregate state data and local state data;   wherein the aggregate state data is representative of a current state of a network policy and the local state data is representative of a current state of a local policy;   wherein the network policy comprises at least one flow rule that controls sending and receiving of network traffic by a plurality of programmable network devices;   wherein the local policy comprises at least one flow rule that controls sending and receiving of network traffic by a local device of the plurality of programmable network devices;   in response to the aggregate state table indicating that a network policy change has occurred, causing the local device to add the network policy change to the local policy;   wherein the method is performed by one or more computing devices.   
     
     
         22 . The method of  claim 21 , comprising, in response to a conflict between the network policy change and the local policy, causing the local device to delete any portion of the local policy that conflicts with the network policy change. 
     
     
         23 . The method of  claim 21 , comprising, in response to a conflict between the network policy and a local policy change, updating the aggregate state table to indicate the local policy change. 
     
     
         24 . The method of  claim 21 , comprising, in response to a communication indicating that the local device has deleted a flow rule due to a timeout, updating the aggregate state table to indicate that the flow rule has been deleted by the local device. 
     
     
         25 . The method of  claim 21 , comprising coordinating the network policy with the local policy by registering a callback function to receive communications from the local device. 
     
     
         26 . The method of  claim 21 , comprising, in response to a communication indicating that the local device has rejected a flow rule due to exhaustion of a local flow table, updating the aggregate state table to indicate that the flow rule has been rejected by the local device. 
     
     
         27 . The method of  claim 21 , comprising, in response to determining that communication with the local device has been lost, simulating operation of the local device. 
     
     
         28 . The method of  claim 21 , comprising predicting an expiration of a flow rule at the local device. 
     
     
         29 . The method of  claim 21 , comprising, in response to an indication that a flow rule has been successfully added to the local device, adding the flow rule to the aggregate state data. 
     
     
         30 . One or more non-transitory computer readable storage media storing instructions executable to cause one or more processors to perform operations comprising:
 storing, in an aggregate state table, aggregate state data and local state data;   wherein the aggregate state data is representative of a current state of a network policy and the local state data is representative of a current state of a local policy;   wherein the network policy comprises at least one flow rule that controls sending and receiving of network traffic by a plurality of programmable network devices;   wherein the local policy comprises at least one flow rule that controls sending and receiving of network traffic by a local device of the plurality of programmable network devices;   in response to the aggregate state table indicating that a network policy change has occurred, causing the local device to add the network policy change to the local policy.   
     
     
         31 . The one or more non-transitory computer readable storage media of  claim 30 , wherein the instructions are executable to cause the one or more processors to perform operations comprising, in response to a conflict between the network policy change and the local policy, causing the local device to delete any portion of the local policy that conflicts with the network policy change; in response to a conflict between the network policy and a local policy change, updating the aggregate state table to indicate the local policy change. 
     
     
         32 . The one or more non-transitory computer readable storage media of  claim 30 , wherein the instructions are executable to cause the one or more processors to perform operations comprising, in response to a communication indicating that the local device has deleted a flow rule due to a timeout, updating the aggregate state table to indicate that the flow rule has been deleted by the local device; in response to a communication indicating that the local device has rejected a flow rule due to exhaustion of a local flow table, updating the aggregate state table to indicate that the flow rule has been rejected by the local device; in response to determining that communication with the local device has been lost, simulating the operation of the local device; in response to an indication that a flow rule has been successfully added to the local device, adding the flow rule to the aggregate state data. 
     
     
         33 . The one or more non-transitory computer readable storage media of  claim 30 , wherein the instructions are executable to cause the one or more processors to perform operations comprising coordinating the network policy with the local policy by registering a callback function to receive communications from the local device. 
     
     
         34 . The one or more non-transitory computer readable storage media of  claim 30 , wherein the instructions are executable to cause the one or more processors to perform operations comprising predicting an expiration of a flow rule at the local device. 
     
     
         35 . A system comprising:
 one or more processors; and   one or more non-transitory computer readable storage media storing instructions executable to cause the one or more processors to perform operations comprising:   storing, in an aggregate state table, aggregate state data and local state data;   wherein the aggregate state data is representative of a current state of a network policy and the local state data is representative of a current state of a local policy;   wherein the network policy comprises at least one flow rule that controls sending and receiving of network traffic by a plurality of programmable network devices;   wherein the local policy comprises at least one flow rule that controls sending and receiving of network traffic by a local device of the plurality of programmable network devices;   in response to the aggregate state table indicating that a network policy change has occurred, causing the local device to add the network policy change to the local policy;   in response to an indication that a flow rule has been successfully added to the local device, adding the flow rule to the aggregate state data.   
     
     
         36 . The system of  claim 35 , wherein the instructions are executable to cause the one or more processors to perform operations comprising, in response to a conflict between the network policy change and the local policy, causing the local device to delete any portion of the local policy that conflicts with the network policy change; in response to a conflict between the network policy and a local policy change, updating the aggregate state table to indicate the local policy change. 
     
     
         37 . The system of  claim 35 , wherein the instructions are executable to cause the one or more processors to perform operations comprising, in response to a communication indicating that the local device has deleted a flow rule due to a timeout, updating the aggregate state table to indicate that the flow rule has been deleted by the local device. 
     
     
         38 . The system of  claim 35 , wherein the instructions are executable to cause the one or more processors to perform operations comprising coordinating the network policy with the local policy by registering a callback function to receive communications from the local device. 
     
     
         39 . The system of  claim 35 , wherein the instructions are executable to cause the one or more processors to perform operations comprising, in response to a communication indicating that the local device has rejected a flow rule due to exhaustion of a local flow table, updating the aggregate state table to indicate that the flow rule has been rejected by the local device. 
     
     
         40 . The system of  claim 35 , wherein the instructions are executable to cause the one or more processors to perform operations comprising predicting an expiration of a flow rule at the local device.