Abstract:As networks expand in size and complexity, they pose greater administrative and management challenges. Software Defined Networks (SDN) offer a promising approach to meeting some of these challenges. In this paper, we propose a policy driven security architecture for securing end to end services across multiple SDN domains. We develop a language based approach to design security policies that are relevant for securing SDN services and communications. We describe the policy language and its use in specifying security policies to control the flow of information in a multi-domain SDN. We demonstrate the specification of fine grained security policies based on a variety of attributes such as parameters associated with users and devices/switches, context information such as location and routing information, and services accessed in SDN as well as security attributes associated with the switches and Controllers in different domains. An important feature of our architecture is its ability to specify path and flow based security policies, which are significant for securing end to end services in SDNs. We describe the design and the implementation of our proposed policy based security architecture and demonstrate its use in scenarios involving both intra and inter-domain communications with multiple SDN Controllers. We analyse the performance characteristics of our architecture as well as discuss how our architecture is able to counteract various security attacks. The dynamic security policy based approach and the distribution of corresponding security capabilities intelligently as a service layer that enable flow based security enforcement and protection of multitude of network devices against attacks are important contributions of this paper.

Platform-Independent Firewall Policy Representation

A Reference Model And System Architecture For Database Firewall

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Applying static code analysis to firewall policies for the purpose of anomaly detection

Systematic review of automatic translation of high-level security policy into firewall rules

Boolean Expressions in Firewall Analysis

Toward Taming Policy Enforcement for Sdn in the Right Way: or Can We?

A Policy based Security Architecture for Software Defined Networks

Autonomous Attack Mitigation Through Firewall Reconfiguration

Research and Implementation of Platform-Independent and Flexible Access Control Framework

Enforcing Enterprise-wide Policies over Standard Client-Server Interactions.

Systematic Structural Testing of Firewall Policies

Distributing and Obfuscating Firewalls via Oblivious Bloom Filter Evaluation

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Implementation of Portion Approach in Distributed Firewall Application for Network Security Framework

PFirewall: Semantics-Aware Customizable Data Flow Control for Home Automation Systems

Directed Security Policies: A Stateful Network Implementation

Automated firewall configuration in virtual networks

A Formal Approach To Firewalls Testing Techniques

Architecture Of A Identity Based Firewall System