OpenSec: Policy-Based Security Using Software-Defined Networking

IEEE Transactions on Network and Service Management

Volumn 13, Issue 1, 2016, Pages 30-42

  Lara, Adrian ^a   Ramamurthy, Byrav ^a  

^a UNIVERSITY OF NEBRASKA LINCOLN   (United States)

Author keywords

network security; OpenFlow; policy specification; policy based network management; Software defined networking

Indexed keywords

APPLICATION PROGRAMS; COMPUTATIONAL LINGUISTICS; INTELLIGENT AGENTS; INTRUSION DETECTION; NETWORK MANAGEMENT; SECURITY SYSTEMS; SOFTWARE DEFINED NETWORKING; SPECIFICATION LANGUAGES; SPECIFICATIONS; XML;

ADDITIONAL EXPERIMENTS; DEEP PACKET INSPECTION; OPENFLOW; POLICY BASED NETWORK MANAGEMENT; POLICY SPECIFICATION; POLICY SPECIFICATION LANGUAGES; SECURITY FRAMEWORKS; SOFTWARE APPLICATIONS;

NETWORK SECURITY;

EID: 84963935825     PISSN: 19324537     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNSM.2016.2517407     Document Type: Article

References (35)

1. A. Lara and B. Ramamurthy, "OpenSec: A framework for implementing security policies using OpenFlow," in Proc. IEEE Globecom Conf., Austin, TX, USA, Dec. 2014, pp. 781-786.
2. A. Lara, A. Kolasani, B. Ramamurthy, "Network innovation using OpenFlow: A survey," IEEE Commun. Surveys Tuts., vol. 16, no. 1, pp. 493-512, Feb. 2014.
3. A. Lara, A. Kolasani, B. Ramamurthy, "Simplifying network management using software defined networking and OpenFlow," in Proc. IEEE Int. Conf. Adv. Netw. Telecommun. Syst. (ANTS), Bangalore, India, Dec. 2012, pp. 24-29.
4. M. Casado, M. J. Freedman, J. Pettit, J. Luo, N. McKeown, S. Shenker, "Ethane: Taking control of the enterprise," SIGCOMM Comput. Commun. Rev., vol. 37, no. 4, pp. 1-12, Oct. 2007.
5. H. Kim and N. Feamster, "Improving network management with software defined networking," IEEE Commun. Mag., vol. 51, no. 2, pp. 114-119, Feb. 2013.
6. N. McKeown et al., "OpenFlow: Enabling innovation in campus networks," SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, pp. 69-74, Mar. 2008.
7. A. Voellmy, H. Kim, N. Feamster, "Procera: A language for highlevel reactive network control," in Proc. Workshop Hot Topics Softw. Defined Netw. (HotSDN), Helsinki, Finland, Aug. 2012, pp. 43-48.
8. S. Shin and G. Gu, "CloudWatcher: Network security monitoring using OpenFlow in dynamic cloud networks (or: How to provide security monitoring as a service in clouds?)," in Proc. 20th IEEE Int. Conf. Netw. Protocols (ICNP), Austin, TX, USA, Oct. 2012, pp. 1-6.
9. R. Hofstede, L. Hendriks, A. Sperotto, A. Pras, "SSH compromise detection using NetFlow/IPFIX," ACM SIGCOMM Comput. Commun. Rev., vol. 44, no. 5, pp. 20-26, 2014.
10. S. Shin, P. Porras, V. Yegneswaran, M. Fong, G. Gu, M. Tyson, "FRESCO: Modular composable security services for software defined networks," in Proc. Netw. Distrib. Syst. Sec. Symp. (NDSS), San Diego, CA, USA, Feb. 2013, pp. 1-16.
11. A. K. Bandara, E. C. Lupu, A. Russo, "Using event calculus to formalise policy specification and analysis," in Proc. IEEE Workshop Policies Distrib. Syst. Netw., Lake Como, Italy, Jun. 2003, pp. 26-39.
12. A. K. Bandara, E. C. Lupu, J. Moffett, A. Russo, "A goal-based approach to policy refinement," in Proc. IEEE Workshop Policies Distrib. Syst. Netw., Yorktown Heights, NY, USA, Jun. 2004, pp. 229-239.
13. A. K. Bandara, A. Kakas, E. C. Lupu, A. Russo, "Using argumentation logic for firewall policy specification and analysis," in Large Scale Management of Distributed Systems. New York, NY, USA: Springer, 2006, pp. 185-196.
14. J. Rubio-Loyola, J. Serrat, M. Charalambides, P. Flegkas, G. Pavlou, A. L. Lafuente, "Using linear temporal model checking for goal-oriented policy refinement frameworks," in Proc. IEEE Workshop Policies Distrib. Syst. Netw., Stockholm, Sweden, Jun. 2005, pp. 181-190.
15. J. Rubio-Loyola, J. Serrat, M. Charalambides, P. Flegkas, G. Pavlou, "A methodological approach toward the refinement problem in policybased management systems," IEEE Commun. Mag., vol. 44, no. 10, pp. 60-68, Oct. 2006.
16. M. Charalambides et al., "Policy conflict analysis for quality of service management," in Proc. IEEE Int. Workshop Policies Distrib. Syst. Netw., Stockholm, Sweden, Jun. 2005, pp. 99-108.
17. M. Charalambides et al., "Dynamic policy analysis and conflict resolution for DiffServ quality of service management," in Proc. IEEE/IFIP Netw. Oper. Manage. Symp. (NOMS), Vancouver, BC, Canada, Apr. 2006, pp. 294-304.
18. D. Agrawal, K.-W. Lee, J. Lobo, "Policy-based management of networked computing systems," IEEE Commun. Mag., vol. 43, no. 10, pp. 69-75, Oct. 2005.
19. R. Bhatia, J. Lobo, M. Kohli, "Policy evaluation for network management," in Proc. IEEE INFOCOM, Mar. 2000, vol. 3, pp. 1107-1116.
20. E. Bertino et al., "Analysis of privacy and security policies," IBM J. Res. Develop., vol. 53, no. 2, pp. 3:1-3:18, Mar. 2009.
21. S. Lange et al., "Heuristic approaches to the controller placement problem in large scale SDN networks," IEEE Trans. Netw. Serv. Manage., vol. 12, no. 1, pp. 4-17, Mar. 2015.
22. D. Tuncer, M. Charalambides, S. Clayman, G. Pavlou, "Adaptive resource management and control in software defined networks," IEEE Trans. Netw. Serv. Manage., vol. 12, no. 1, pp. 18-33, Mar. 2015.
23. M. Wichtlhuber, R. Reinecke, D. Hausheer, "An SDN-based CDN/ISP collaboration architecture for managing high-volume flows," IEEE Trans. Netw. Serv. Manage., vol. 12, no. 1, pp. 48-60, Mar. 2015.
24. N. Foster et al., "Frenetic: A network programming language," in Proc. ACM SIGPLAN Int. Conf. Funct. Program., Tokyo, Japan, Sep. 2011, pp. 279-291.
25. M. Bari, S. Chowdhury, R. Ahmed, R. Boutaba, "PolicyCop: An autonomic QoS policy enforcement framework for software defined networks," in Proc. IEEE SDN Future Netw. Serv. (SDN4FNS), Trento, Italy, Nov. 2013, pp. 1-7.
26. V. Sekar, S. Ratnasamy, M. K. Reiter, N. Egi, G. Shi, "The middlebox manifesto: Enabling innovation in middlebox deployment," in Proc. 10th ACM Workshop Hot Topics Netw., 2011, pp. 21:1-21:6.
27. Big Switch Networks. (2016). Floodlight [Online]. Available: www.projectfloodlight.org/floodlight/
28. A. Dixit, F. Hao, S. Mukherjee, T. V. Lakshman, R. Kompella, "Towards an elastic distributed SDN controller," SIGCOMM Comput. Commun. Rev., vol. 43, no. 4, pp. 7-12, Aug. 2013.
29. A. Tootoonchian and Y. Ganjali, "HyperFlow: A distributed control plane for OpenFlow," in Proc. Internet Netw. Manage. Conf. Res. Enterprise Netw., San Jose, CA, USA, Apr. 2010, p. 3.
30. N. Farrington et al., "Helios: A hybrid electrical/optical switch architecture for modular data centers," SIGCOMM Comput. Commun. Rev., vol. 41, no. 4, pp. 339-350, Aug. 2010.
31. F. Yonghong, B. Jun, W. Jianping, C. Ze, W. Ke, L. Min, "A dormant multi-controller model for software defined networking," Commun. China, vol. 11, no. 3, pp. 45-55, Mar. 2014.
32. R. Sherwood et al., "Carving research slices out of your production networks with OpenFlow," SIGCOMM Comput. Commun. Rev., vol. 40, no. 1, pp. 129-130, Jan. 2010.
33. V. Paxon et al. (2014). The Bro Network Security Monitor [Online]. Available: http://www.bro.org
34. ntop. (1998). nDPI: Open and Extensible LGPLv3 Deep Packet Inspection Library [Online]. Available: http://www.ntop.org/products/ndpi/
35. E. Dart, L. Rotman, B. Tierney, M. Hester, J. Zurawski, "The science DMZ: A network design pattern for data-intensive science," in Proc. Int. Conf. High Perform. Comput. Netw. Storage Anal. (SC), Denver, CO, USA, Nov. 2013, pp. 1-10.