# Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN
## 1 Introduction  
In a traditional computer network, both control and data planes are vertically implemented at each forwarding device, thus, a traditional computer network is distributed in nature. To control atraditional computer network, the operators usually implement fine-grained network policies known as Access Control Lists (ACL) at the network interfaces of switches/routers [1; 2] by using low-level commands. The operators manually plane, design, and then implement these ACL policies according to network requirements. The present approach for implementing ACL is very complicated and error-prone [3; 4; 5]. A misconfiguration can drastically degrade the network performance by enabling unauthorized users to access confidential resources [6]. Moreover, it is also a costly process requiring a team of 10-30 members to handle a network of a hundred switches [7]. More recently, Software Defined Networking (SDN) has emerged as a new network architecture which decouples control plane from data plane by implementing a control plane at a logically centralized controller [8]. This induces that SDN has a centralized architecture. In SDN, the network operator can easily control packet forwarding by implementing ACL policies at the controller [9; 10; 11]. In this way, specific applications can be used to configure switches automatically for packet forwarding and policy implementation that eliminates the path misconfigurations [12] and other security attacks [13]. By using an OpenFlow protocol, network operators can implement action like forward, drop and modification of packet header [14], etc., as well as flow entries on the switches to drop the malicious packets based upon the network policy. Nowadays, SDN is not widely adopted by organizations in practice except for some big companies like Google [15; 16], Microsoft [17], VMware [18]. The main reason is the large budget that is required to establish a new network infrastructure from scratch [19], and another reason is fear of downtime when new infrastructure is being installed [20]. To accommodate these problems, an alternate solution is to deploy a limited number of OpenFlow switches alongside the legacy switches [21]. The remaining legacy switches can gradually be replaced with OpenFlow switches and finally realizing entire SDN deployment. A network having both types of network devices (i.e., OpenFlow switches and legacy switches) is known as a hybrid SDN [19; 22]. In addition to the above, the following advantages can be achieved by using hybrid SDN:  
1. As already discussed, the SDN establishment is costly. A large amount is needed to buy new SDN devices. Even after the establishment of pure SDN, network operators, administrators, and staff need the training to develop, configure and operate the SDN which also requires a large budget [23]. Hybrid SDN can easily relax these budgets. 2. By using Hybrid SDN, some benefits of the SDN model can adhere to [24]. For example, in an Internet Service Provider (ISP), there are millions of forwarding entries while OpenFlow network switches can support tens of thousands of forwarding entries [24]. In an ISP distribution network, OpenFlow devices can be used while the ISP access network can use legacy network devices as shown in Figure 1. In this way, ISP can observe a hybrid SDN in which OpenFlow switches are deployed in the distributed network to obtain the benefits of pure SDN while millions of forwarding entries are handled in the access network by using the legacy devices. 3. SDN provides fine-grained control for data traffic flows. If we require fine-grained control for a small portion of the network, then hybrid SDN can be deployed by using SDN devices in a small portion of the network [24]. For example, if a company, having network infrastructure shown in Figure 2, needs fine-grained control for the small part of the network in as indicated using the blue box, then only that portion will be upgraded to an SDN. 4.