# Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN
## 2 Related Work
### ACL Implementation in Hybrid SDN  
[PERSON] et al. [12] discussed that network traffic is modified by the dynamic and opaque behavior of legacy switches that violates the two main promises of SDN. (i) ORIGIONBINDING strong binding between packet and its \"origin\" means packet generator (ii) PATHFOLLOWPOLICY Explicit policies should determine the paths that packets follow. Network Address Translation (NAT) and load balancing applications modify the packet headers that violate the ORIGIONBINDING. For example, the response served from a proxy's cache may violate PATHFOLLOWPOLICY. To cope with this limitation, the SDN paradigm is extended to adopt FlowTags architecture [38]. FlowTags envisages simple extensions to middleboxes to add tags that are carried in packet headers. SDN switches use these tags to modify the flow entries for packet forwarding. FlowTags implementation requires two prerequisites: (i) adequate header bits with SDN switch support to match on tags, and (ii) extensions to middlebox software. These Flowtags enable ACL policy implementation and verification for middleboxes as well as SDN switches. The limitation of this approach is that Flowtags need to add an additional component in the middleboxes which is tedious work for vendor-specific devices.  
[PERSON] et al. [6] investigated the problems and issues that occurred upon policy implementation due to a change in topology of the network. These issues may include unauthorized access to data, restricting access network resources, etc. To handle these problems, an automatic Policy Violation Detection for Topology Change (auto-PDTC) policy configuration technique is proposed. The network topology gets updated due to the addition or exclusion of network links or devices in an enterprise network. These changing topologies severely affect the configurations of network policies that are implemented on switches or router interfaces. When topology changes, it is time to verify the effectiveness of network policies to adhere to the organization objectives. Auto-PDTC offers an  
Figure 4: NetEgg Design layout using Generic SDN Controller.  
automatic mechanism that detects the topology change and validates the policies for the respective interfaces. The change in network topology is computed using the graph difference method. In the case of topology change, affected interfaces are indicated where policies need to be re-configured. The limitations of this study [6] are that only a single ACL policy is considered by using tree traversing. If we have multiple policies, then for each policy, multiple trees need to be traversed. There is a need to adopt some mechanism to reduce the overhead imposed by these separate tree-traversing method.  
It is clear from the above research that optimal policy implementation is not discussed properly in the literature. It is a big issue because the proper implementation of network policies requires much effort and determination. It affects the entire network performance as well as switches, routers and other networking devices efficiency [39]. The following are the research challenges that need to be addressed to implement policies optimally.  
* In case of hybrid SDN, legacy network devices need to be configured for ACL implementation. There is a need for a mechanism that can automatically enforce commands on legacy devices to configure policies.
* If there is a large number of nodes to implement policies, then what are the the optimum ways for policy implementation?
* If there are multiple policies, then these policies cannot be implemented in one go. It needs any mechanism to simplify these policies so that we can implement these in a single iteration.
* Network Loops may occur when policies are implemented; how to deal with these network loops.
* Due to complex policy implementation, some network nodes may not be reachable.
* During policy implementation, load balancing should be considered, so that no network devices are overwhelmed.