# A Comprehensive Survey on Knowledge-Defined Networking
## 7 Application Plane
### Application Scenarios
#### 7.3.3 Security  
Security policies for access control, encryption, firewalls, attack/anomaly/intrusion detection, etc. can be defined using security applications. Applications can enforce policies to detect and mitigate threats more quickly and effectively, helping to ensure the integrity, availability, and confidentiality of network resources. KDN provides a platform to check security policies to make sure that the network receives protection by preventing security breaches. Access Control (AC) mechanisms help ensure that only authorized users or devices can access network resources. Applications can define policies for access control, which will be integrated into flow rules by the controller and restrict traffic based on source and destination addresses and ports. Encryption, on the other hand, protects sensitive data from being disclosed to unauthorized parties. Some have proposed to implement access control considering network resources, security requirements, reconfiguration conflicts, etc., which implement both mandatory and discretionary AC [480]. As global-level network access control may not reflect fine-granular level access control, work in [481] suggests using user-level and flow-level access control, where access tables are initiated by network administrators and can be dynamically changed based on network activities. A controller-independent application-level dynamic access controller that mitigates application to controller threats by using 4 permission categories: read, add, update, and remove, has reduced application abuse compared to static permission control [482]. Considering the fact that malicious applications can launch hostile attacks using the northbound API, a secure application management framework to granularly manage application permissions by analyzing the legality of application permissions and using encrypted registration authorization has been studied in [483]. Mandatory access control, which employs an application policy to use extended attributes for access control based on security level, where the switch security level is regarded as the attribute of the access control environment, has been studied in [484]. This extended attributes-based AC method also has a secure path planning method based on particle swarm optimization for securing access data flow. A dynamic access control scheme to control network resources with an application policy to use broadcast encryption that deviates from updating permission lists to make sure that resources are available only to authorized users has been proposed in [485]. A decentralized access control mechanism called SILedger has been utilized based on blockchain and attribute-based encryption for effective token-based authorization of applications in heterogeneous IoT domains, where tokens are the currency of blockchain [486]. A framework known as P4-sKnock, which has an application policy aligned with a P4-based two-level host authentication and access control mechanism, where the first level introduces encrypted dynamic port knocking in order to secure the dynamic port knocking sequence by encryption, and the second level follows an authentication measure using a challenge-response host identity verification mechanism in order to authorize, quarantine, or block the host [487]. P4-sKnock prevents man-in-the middle attacks, IP spoofing attacks, replay attacks, and provides post-port knocking authentication. An administrative model to manage Role-Based Access Control (RBAC) actions using custom fine-grained permissions to extend the capabilities of services that define the authorization of network applications has been proposed in [488]. RBAC creates custom operations to extend the capabilities of services and provide permissions to administer AC. By using smart contracts for independent, immutable, verifiable policies in blockchain, work in [489] uses blockchain for creating access control policies for IoT devices, while providing a trackable policy management system to prevent forged policy dissemination.