Abstract:Software-defined networking (SDN) has been utilized to enforce the security of traditional networks. However, the existing SDN-based security enforcement mechanisms rely heavily on the security policies containing the underlying information of data plane, such as MAC address, IP address or switch ports. These security policies need to be specifically developed by network operators and loaded into the control plane manually. With increasing the scale of underlying network, the existing security policy management mechanisms confront more and more challenges. The security policy transformation for SDN networks is to research how to transform the high-level security policy without containing the underlying information into the practical flow entries used by Openflow switches automatically, thereby implementing the automatic management of security policies. To achieve this objective, we propose a model transformation based security policy automatic management framework for software-defined networking in this paper. Leveraging its functional modules, the framework can solve the problems of how to find a connected path for each access control rule of security policy model (SPM) in data plane, how to transform the connected path into the system model of flow entries, as well as how to generate the practical flow entries according to the system model of flow entries. In order to validate the effectiveness and performance of framework, we implement the framework by leveraging POX controller and Mininet emulator. The experimental results illustrate the framework can transform SPM into practical flow entries, synchronously perceive the modifications caused by cutting down one connected path or changing SPM, and continuously keep the data plane holding the security properties defined by SPM at runtime.

New Study and Implementation of Policy Based Network Management System

The Management System Research Based on Information Technology

Research on Network Security Policy Refinement Consistency of Detection and Conflict Resolution Mechanisms

Design and Implement of Enhanced SNMP Access Control

Poster: Collaborative Policy Administration

Research on Network Management Systems Via Multi-Agent Technology

Hybrid network management paradigm

Operation-Oriented Network Management: a Policy-Based Approach

A Model Based on Domain for Access Control Policy Refinement and Its Implementation

Model for access control policy refinement based on domain and its implementation

Adaptive Measurement-Based Policy-Driven QoS Management with Fuzzy-Rule-based Resource Allocation

Intent Based Networking management with conflict detection and policy resolution in an enterprise network

A Novel Management Protocol for Hybrid Networks

Study and implementation on network management architecture under dis-crete services

Policy-driven network management architecture based on multi-agent

Implementation of a Novel Network Management System in WAN

Techniques of Distributed Application Access Control Policy Refinement and Policy Conflict Analysis

Survey Paper: A survey on policy languages in network and security management

An automatic policy refinement mechanism for policy-driven grid service systems

Modeling on Policy Conflict for Managing Heterogeneous Security Systems in Distributed Network Environment

A Model Transformation based Security Policy Automatic Management Framework for Software-defined Networking