  Software defined networking (SDN) has been adopted to enforce the security of
large-scale and complex networks because of its programmable, abstract,
centralized intelligent control and global and real-time traffic view. However,
the current SDN-based security enforcement mechanisms require network managers
to fully understand the underlying configurations of network. Facing the
increasingly complex and huge SDN networks, we urgently need a novel security
policy management mechanism which can be completely transparent to any
underlying information. That is it can permit network managers to define
upper-level security policies without containing any underlying information of
network, and by means of model transformation system, these upper-level
security policies can be transformed into their corresponding lower-level
policies containing underlying information automatically. Moreover, it should
ensure system model updated by the generated lower-level policies can hold all
of security properties defined in upper-level policies. Based on these
insights, we propose a security policy model transformation and verification
approach for SDN in this paper. We first present the formal definition of a
security policy model (SPM) which can be used to specify the security policies
used in SDN. Then, we propose a model transformation system based on SDN system
model and mapping rules, which can enable network managers to convert SPM model
into corresponding underlying network configuration policies automatically,
i.e., flow table model (FTM). In order to verify SDN system model updated by
the generated FTM models can hold the security properties defined in SPM
models, we design a security policy verification system based on model
checking. Finally, we utilize a comprehensive case to illustrate the
feasibility of the proposed approach.
