A dynamic IPS allocation scheme using openflow for economical secure networking

OpenFlow is attractive as a base of the data center network. IPS is also attractive as a security appliance. Then combining Openflow with IPS is an important issue. The simple solution is to screening all flow in an OpenFlow network using IPS. However, it may degrade throughput performance or increase equipment cost. In order to solve this problem, we propose a novel IPS allocation scheme. In this scheme, at first, security level is checked on each flow. Then a forwarding path is selected from IPS-involved path or cut-through path. From the result of the experiments, we can increase the number of cutthrough flows when the number of secure flows is large. Consequently, we can increase the whole network throughput without any additional equipment cost.