On SDPN: Integrating the Software-Defined Perimeter (SDP) and the Software-Defined Network (SDN) Paradigms

Abstract

In this paper, we introduce the Software-defined Perimeter Network (SDPN) that is a single virtual Zero Trust overlay network that can provide perimeter-like functionality across the Internet. Modern networks increasingly need to integrate virtual network components that exist outside of the organization and often exist within multiple different cloud-based systems. These virtual network components are operated most efficiently when they operate within a single network management domain, traditionally achieved via castle-and-moat network perimeter. SDPN integrates the multi-plane management model (data, control, and application planes) and core functionality of the Software-defined Perimeter (SDP) and the Software-defined Network (SDN) paradigms with Zero Trust security principles to create a single virtual network perimeter. In the control plane, the SDPN controller combines SDP controller and SDN controller functionality into one logical controller. The SDPN controller also introduces trust as the trust anchor via a root certificate issued by a trusted third-party. At the data layer, servers, devices, and network functions are simplified into nodes. The SDPN controller manages every node in the perimeter via a control channel. The SDPN framework provides for Zero Trust security both within and beyond a managed network domain while reducing the attack surface, securing network flows, and enabling simple network management.