Abstract:<p>Software-defined networking (SDN) has been increasingly utilized to enforce the security of complex networks. However SDN-based security enforcement mechanisms rely heavily on some specific security policies containing underlying network information. Facing the increasingly complex and huge SDN networks, we urgently need a novel security policy management mechanism which can be completely transparent to any underlying network information. That is it can permit network managers to define the high-level security policy model without containing any underlying information, and by means of model transformation, high-level security policy model can be automatically transformed into its corresponding lower-level security policy model containing underlying information. Moreover, we must ensure the system model of data plane updated by the low-level security policy model can hold all of security properties defined in high-level security policy model. Based on these insights, we propose a security policy model transformation and verification approach for SDN in this paper. We first specify the security policies used in SDN networks as a formal security policy model (SPM). Then we establish the system model of SDN's data plane and the mapping rules between the policy objects of SPM and the system objects of system model of data plane. Based on these mapping rules, we propose a security policy model transformation mechanism which transforms SPM into the low-level security policy model, RSPM. In order to verify the system model of data plane updated by RSPM can hold all of security properties defined in SPM, we propose a security policy verification mechanism based on model checking techniques and a group of validation conditions. Finally, we utilize a comprehensive case to illustrate the feasibility of this approach.</p>

A Network Security Policy Self-Adaptive Management And Distribution Model In Complex Network Environment

Evolving Defense Mechanism for Future Network Security

Proactive Security Defense of Dynamic Network

Research of United Platform of Network Security Management Model

Modeling and Defending Advanced Metering Infrastructure Subjected to Distributed Denial-of-Service Attacks

Research on Network Management Systems Via Multi-Agent Technology

A Model Transformation based Security Policy Automatic Management Framework for Software-defined Networking

A security policy model transformation and verification approach for software defined networking

New Study and Implementation of Policy Based Network Management System

Adaptive Control Strategy of Multiemergency Power Supply Network System Connected to New Energy

Dynamic intelligent resource allocation for emergency situations

Risk Assessment and Defense Resource Allocation of Cyber-Physical Distribution Systems under Denial-of-Service Attacks

Modeling on Policy Conflict for Managing Heterogeneous Security Systems in Distributed Network Environment

A Collaborative Network Security Management System in Metropolitan Area Network

Policy Based Network Security System

A Practical Runtime Security Policy Transformation Framework for Software Defined Networks

Self-organized Network Management and Computing of Intelligent Solutions to Information Security

Analyzing fault monitoring policy for wireless nwtwork

Security management for large computer networks

Design and Implementation of A Network Security Management System

A General Real-Time Cyberattack Risk Assessment Method for Distribution Network Involving the Influence of Feeder Automation System