Abstract:Ensuring that information flowing through a network is secure from manipulation and eavesdropping by unauthorized parties is an important task for network administrators. Many cyber attacks rely on a lack of network-level information flow controls to successfully compromise a victim network. Once an adversary exploits an initial entry point, they can eavesdrop and move laterally within the network (e.g., scan and penetrate internal nodes) to further their malicious goals. In this paper, we propose a novel multilevel security (MLS) framework to enforce a secure inter-node information flow policy within the network and therein vastly reduce the attack surface available to an adversary who has penetrated it. In contrast to prior work on multilevel security in computer networks which relied on enforcing the policy at network endpoints, we leverage the centralization of software-defined networks (SDNs) by moving the task to the controller and providing this service transparently to all nodes in the network. Our framework, MLSNet, formalizes the generation of a policy compliant network configuration (i.e., set of flow rules on the SDN switches) as network optimization problems, with the objectives of (1) maximizing the number of flows satisfying all security constraints and (2) minimizing the security cost of routing any remaining flows to guarantee availability. We demonstrate that MLSNet can securely route flows that satisfy the security constraints (e.g., >80% of flows in a performed benchmark) and route the remaining flows with a minimal security cost.

Nsl - A Network Security Oriented Language

A Multi-level Security Local Area Network System based on BLP

From Model to Implementation: a Network Algorithm Programming Language

Study of Network Security Monitor System Based on Intelligent Agents

An Active Network Security Risk Management System

Network Simulation Using NS in LAN Environment

Study of Scalable Security for Active Network

A computer network defense-oriented scheme description language

MLSNet: A Policy Complying Multilevel Security Framework for Software Defined Networking

Design and Implementation of A Network Security Management System

Modeling of Network Situation Awareness

A Software Defined Networking-Oriented Security Scheme for Vehicle Networks

NetSecu: A Collaborative Network Security Platform for In-network Security

L-BLP Security Model in Local Area Network

A Language for Secure Requirement Description Based on Information Flow

A Collaborative Network Security Management System in Metropolitan Area Network

Design and analysis of a robust security layer for software defined network framework

Computer Network Security Technology Based on Java

SDL-based Network Performance Simulation

Research on Network Security of Information Systems Based on LAN

SLINCS: A Social Link Based Evaluation System for Network Coordinate Systems