SDN Intent-based conformance checking: application to security policies - Archive ouverte HAL Access content directly
Conference Papers Year : 2021

SDN Intent-based conformance checking: application to security policies

Abstract

With the popularity of software defined networking architectures, the growing complexity of its use cases dictates the need for better auditability especially for security. In this paper, we aim at facilitating high-level management-plane policy configuration conformance auditing and their reflection in the data plane, to detect missing or spurious flow rules with respect to security policies. To this end, we propose an efficient conformance checking approach based on an intentional northbound interface as well as traces of management, control and data plane. Leveraging a proof-of-concept implementation of our approach, we compare its conformance-checking runtime and precision against a direct method on virtual topologies and find that it significantly improves scalability. We conclude by proposing directions for further enhancements extending the techniques presented herein.
Fichier principal
Vignette du fichier
main.pdf (431.04 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03207525 , version 1 (25-04-2021)

Identifiers

  • HAL Id : hal-03207525 , version 1

Cite

Nicolas Herbaut, Camilo Correa, Jacques Robin, Raul Mazo. SDN Intent-based conformance checking: application to security policies. 7th IEEE International Conference on Network Softwarization (IEEE NetSoft 2021), Jun 2021, Tokyo (virtual), Japan. ⟨hal-03207525⟩
207 View
232 Download

Share

Gmail Mastodon Facebook X LinkedIn More