SDNS Architecture: Self-Sovereign Infrastructure

The Problem: Fragmented Authority

Modern IT infrastructure is managed by dozens of independent systems. DNS is controlled by one provider. DHCP by another. Firewall rules live in one console. VPN configuration in another. Backup policies in a third. Monitoring in a fourth. Each system is its own authority, with its own credentials, its own audit trail, and its own failure modes.

When something goes wrong, the first question is always: who changed what, when, and where? In a fragmented environment, the answer requires checking five different dashboards, three different log formats, and two different vendors' support portals. By the time you've assembled the picture, the incident has escalated.

Cloud computing made this worse, not better. Now the same questions span on-premises infrastructure and one or more cloud providers, each with their own networking model, their own security primitives, and their own way of doing things.

The fundamental problem is not complexity. It is fragmented authority. No single system knows the complete truth about your infrastructure.

The SDNS Solution: One Cohesive Authority

SDNS — Software Defined Systems Networking and Storage — is the integrated behavior that emerges when multiple specialized DEC-LLC products share data, events, and AI-driven reasoning through a common databus. Each product is independently useful. Together, they create a coordinated view of infrastructure where networking, compute, security, and storage decisions are informed by the full picture — not fragments of it.

The Products

Each product can be deployed standalone and delivers immediate value. A customer can buy OpenUTM as a firewall and use nothing else. But when two or more products are deployed together, they share state, correlate events, and act as a unified authority.

Core Principle: External Provisioners Are Input Adapters

The SDNS platform accepts configuration input from many sources: cloud-init in a cloud environment, PXE for bare-metal provisioning, USB drives for air-gapped sites, a web-based setup wizard for interactive deployment, or an API for automation. These are all input adapters — mechanisms for delivering configuration data to the platform.

They are not the authority. The platform is the authority.

This distinction matters because it means the platform can operate, converge, and recover regardless of which input adapter was used to provision it. A firewall deployed via cloud-init on AWS and a firewall deployed via USB on a rack-mount appliance run the same software, enforce the same policies, and report to the same management plane.

The Closed Loop

When all four products are deployed, they form a closed loop:

1. OpenUTM controls what traffic enters and leaves the network. It enforces security policy at every boundary — on-premises, in the cloud, and across hybrid connections.
2. NIVMIA sees and controls everything on the network. It discovers devices, monitors health, collects flow data, standardizes configurations, corrects errors (VLAN mismatches, BGP peering issues, OSPF table inconsistencies, broadcast storms), plans bandwidth and QoS capacity, and implements changes across the entire fleet — including third-party vendor equipment the customer depends on but doesn't own.
3. IVMIA manages the entire compute estate. VMs across every hypervisor and cloud, physical workstations and laptops, POS terminals, field devices — with resource allocation, redistribution across hosts, hardware compatibility verification, and capacity planning.
4. VaultSync protects everything. VMs, physical servers, network configs, company phones, and the business data embedded in all of them. Backup is not just recovery — it's a data source.

Together, they answer every question about infrastructure state: What is connected? What is allowed? What is running? Is it backed up? No external service is needed to answer these questions. The platform knows.

Cloud and On-Premises Are Implementation Details

The SDNS platform treats deployment location as an implementation detail, not an architectural decision. The same product image runs on bare metal, in a virtual machine, in a cloud instance, or in a container. The same policies apply. The same UI manages it. The same audit trail records changes.

This design eliminates the "cloud migration" problem. There is no migration. The products move with the workload. The authority stays the same.

Security Model: Nothing Gets Past

The closed-loop architecture has a direct security benefit: there are no gaps between products. In a traditional environment, the firewall doesn't know what the monitoring system sees, the backup system doesn't know what the firewall blocked, and the hypervisor manager doesn't know what any of them are doing.

In the SDNS model:

• OpenUTM blocks a threat and notifies NIVMIA
• NIVMIA correlates the alert with traffic patterns and notifies the operator
• VaultSync has already backed up the pre-incident state
• IVMIA can isolate the affected VM if needed

The entire response happens within the platform. No SIEM integration required. No webhook chains to configure. No "check the other dashboard." One authority, one audit trail, one response.

Regulated Industry Fit

Organizations in healthcare, finance, government, and critical infrastructure must demonstrate who controls their systems, how changes are authorized, and where the audit trail lives. The SDNS platform provides a clear answer: we are the single authority for all network, security, compute, and data protection state.

Every change flows through the platform's provisioning engine. Every change is logged. Every log is backed up. The complete chain of custody — from policy definition to enforcement to verification — exists within a system the customer controls.

No third-party cloud service can modify the state without the platform's knowledge. No external DNS provider can silently change a record. No managed firewall service can update a rule. If it's not in the platform's log, it didn't happen.

Architecture Summary

© 2026 Diwan Enterprise Consulting LLC (DEC-LLC). All rights reserved.
For more information, contact info@decllc.biz or visit dec-llc.biz.