# A Comprehensive Survey on Knowledge-Defined Networking
## 5 Control Plane
### Controller Functions
#### 5.4.3 Policy Enforcement  
Note that policy enforcement can occur on both the management and control planes. However, each of these planes will enforce different policies that are identical to each plane. As discussed in Section 4.5.2, the management plane is responsible for enforcing configuration and monitoring policies. As discussed in Section 5.4.1, the control plane is responsible for enforcing access control policies, QoS policies, routing policies, and security policies. The policy flow in a KDN environment [247,385] is graphically illustrated in Figure 8.  
Before policy enforcement by the control plane, first, policies must be defined by the network administrators, which specify how network devices must behave. These policies, which are applicable to the control plane, can cover a wide range of applications such as routing, security, access control, quality of service, etc. [386]. The control plane can enforce/translate policies by programming network devices to perform specific actions once certain conditions are met using a policy engine. A policy engine is used to translate the network policies into rules by considering other data, rules, and knowledge [385]. As evident from Figure 8, the controller policy enforcement and verification module generates flow rules by comparing the collected data with other data such as network topology and device capabilities, knowledge/rules from the knowledge plane, policy verification output from the policy verification module, and the requirements of the policy. As an example of policy enforcement, it can program switches to drop traffic that does not confirm to QoS policy, or it can program firewalls to block traffic that violates security policies [387]. The controller can use protocols such as OpenFlow to program policies (in the form of flow rules) into forwarding elements. From time to time, the control plane will verify that policies enforced are correctly functioning in the data plane. For achieving that purpose, the controller will collect policy data from the data plane and compare it with the existing policies, as shown in the policy verification module in Figure 8. The policy verification module will output the nodes' identifying information that does not adhere to the existing policies. If any policy violations are detected, the controller can take corrective action by sending the flow rules generated by the policy engine for such nodes [388]. A dynamic policy update in response to a change in a network condition, such as updating security policy upon detection of an intrusion in the network to block the threat, can be used to achieve the automation desired in the KDN paradigm, where network policies are dynamically updated to adapt to changing network environments with minimum human intervention. Policy updates can occur in the application plane based on knowledge/rules output from the knowledge plane in response to real-time network activity, as shown in Figure 8.  
Note that Figure 8 also shows the policy lifecycle for network monitoring and network configuration in the management plane. As evident from Figure 8, in the monitoring policy verification and enforcement module, configuration rules are generated from the policy engine based on network topology and configuration, monitoring policy verification output, data and knowledge, and network monitoring policy [247], as discussed in Section 4.2. The generated configuration rules from the monitoring policy enforcement and verification module will be compared with other data, knowledge, configuration policy verification output, and configuration policies to update the configuration rules and be provided to the data plane [389], as evident from the configuration policy enforcement and verification module in Figure 8.