Object Oriented Policy Conflict Checking Framework in Cloud Networks (OOPC)

doi:10.1109/TDSC.2021.3076424

2022-09-01

DOI：10.1109/TDSC.2021.3076424

原文链接

查看原文

摘要

En 中文

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37 percent lower latency in policy graph composition than previous work. The proposed solution performs 20 percent faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

Keyword:

Security

Electronics packaging

Cloud computing

Scalability

IP networks

Firewalls (computing)

Complexity theory

Software-defined networking (SDN)

OpenFlow

policy graph

policy composition

virtual network functions (VNFs)

object oriented paradigm (OOP)

service function chaining (SFC)

policy conflict detection

policy conflict resolution

AI总结

对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。

期刊

IEEE Transactions on Dependable and Secure Computing

IF:

7.5

论文数:

2.6K

被引数:

9.6K

机构

Arizona State University

学者数:

2.7W

论文数: 2.5W

被引数: 4.2W

taibah university

学者数:

3.1K

论文数: 3.4K

被引数: 1

引用论文

Reduction potentials of blue and purple copper proteins in their unfolded states: a closer look at rack-induced coordination

JBIC Journal of Biological Inorganic Chemistry

IF0

1998-08-01

PREAI

Pernilla Wittung-Stafshede; Michael G. Hill; Ester Gomez; A. J. Di Bilio; B. Göran Karlsson; Johan Leckner; J. R. Winkler; Harry B. Gray; B. G. Malmström

The melting of asteroidal-sized bodies by unipolar dynamo induction from a primordial T Tauri sun

Astrophysics and Space Science

IF0

1970-06-01

PREAI

C. P. Sonett; D. S. Colburn; K. Schwartz; K. Keil

Taxonomy of conflicts in network security policies

IEEE COMMUNICATIONS MAGAZINE

IF8.2

2006-03-01

PREAI

Hamed, H; Al-Shaer, E