Abstract:<p>Software-defined networking (SDN) has been increasingly utilized to enforce the security of complex networks. However SDN-based security enforcement mechanisms rely heavily on some specific security policies containing underlying network information. Facing the increasingly complex and huge SDN networks, we urgently need a novel security policy management mechanism which can be completely transparent to any underlying network information. That is it can permit network managers to define the high-level security policy model without containing any underlying information, and by means of model transformation, high-level security policy model can be automatically transformed into its corresponding lower-level security policy model containing underlying information. Moreover, we must ensure the system model of data plane updated by the low-level security policy model can hold all of security properties defined in high-level security policy model. Based on these insights, we propose a security policy model transformation and verification approach for SDN in this paper. We first specify the security policies used in SDN networks as a formal security policy model (SPM). Then we establish the system model of SDN's data plane and the mapping rules between the policy objects of SPM and the system objects of system model of data plane. Based on these mapping rules, we propose a security policy model transformation mechanism which transforms SPM into the low-level security policy model, RSPM. In order to verify the system model of data plane updated by RSPM can hold all of security properties defined in SPM, we propose a security policy verification mechanism based on model checking techniques and a group of validation conditions. Finally, we utilize a comprehensive case to illustrate the feasibility of this approach.</p>

A Computer Network Defense Policy Refinement Method

Research on Network Security Policy Refinement Consistency of Detection and Conflict Resolution Mechanisms

Proactive Security Defense of Dynamic Network

Research on Security Threat Monitoring and Testing Framework in Software - Defined Network Based on Depth Learning

A Model Based on Domain for Access Control Policy Refinement and Its Implementation

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Evolving Defense Mechanism for Future Network Security

Model for access control policy refinement based on domain and its implementation

Techniques of Distributed Application Access Control Policy Refinement and Policy Conflict Analysis

A computer network defense-oriented scheme description language

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

New Study and Implementation of Policy Based Network Management System

An automatic policy refinement mechanism for policy-driven grid service systems

Network defense decision-making based on deep reinforcement learning and dynamic game theory

Design for Dual Network Defense System

Simulation research on a new model of network defense situation

Design and implementation of computer network security detection and control system

Dual-structural network of active defense

A security policy model transformation and verification approach for software defined networking

A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management

A Two-Dimension Security Assessing Model for CMDs Combined with Generalized Stochastic Petri Net