TECHNICAL FIELD

The technical field generally relates to software defined networks (SDNs) and, more specifically, to systems and methods for white box infection detection and isolation within an SDN.

BACKGROUND

Communication networks have migrated from using specialized networking equipment executing on dedicated hardware, like routers, firewalls, and gateways, to SDNs executing as virtualized network functions (VNF) in a cloud infrastructure. To provide a service, a set of VNFs may be instantiated on the general purpose hardware. Each VNF may require one or more virtual machines (VMs) to be instantiated. In turn, VMs may require various resources, such as memory, virtual central processing units (vCPUs), and virtual network interfaces or virtual network interface cards (vNICs). Cloud systems are complex multi-layer hardware and software systems that consist of multiple services and components, interacting with each other through complicated mechanisms.

To reduce costs and provide flexibility in communication network design, SDNs can utilize commodity equipment, e.g., white box hardware. However, using commodity equipment throughout a communications network can be exploited by hackers that are able to use similar techniques on each piece of commodity equipment due to each piece of commodity equipment being identical or very similar in design and operation with one another. Infiltrating multiple pieces of commodity equipment in the communications network can lead to widespread network outages, as well as data theft and further illicit activity. This disclosure is directed to addressing issues in the existing technology.

SUMMARY

Determining that a hacker has compromised a white box used within a communications network is crucial in order to prevent a wide-scale interruption or data theft. Disclosed herein is a framework for white box infection detection and isolation that efficiently mitigates damage to a communications using identical or similar equipment (white boxes) by challenging each white box to determine if the white box has been compromised and isolating the white box from the communications network if the white box is determined to be compromised.

In an example, there may be a computer-implemented method for white box infection detection and isolation. The computer-implemented method includes monitoring a plurality of white boxes deployed within a communications network; sending a challenge to a first white box of the plurality of white boxes; determining a processing time to answer the challenge by the first white box; in response to receiving the answer to the challenge, determining whether the processing time exceeds an average processing time for the challenge by a predetermined percentage; and in response to the processing time exceeding the average processing time by the predetermined percentage, isolating the first white box from the communications network.

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to limitations that solve any or all disadvantages noted in any part of this disclosure.

