## 4 Policy/Intent-Based Security in SDN and NFV Networks
### Enhancing Security in SDNs and NFVs through PBN  
While researching how policy-based networking can be applied to network security, quite a few examples of proposed systems for automating policy enforcement in SDNs and NFVs came across. One is the work proposed, implemented, and validated in the thesis of [61] that revolves around using the VEREFOO (Verified Refinement and Optimised Orchestration) framework, designed to automate security policies in an NFV environment. This framework enhances security automation by providing tools for refining policies from high-level language to medium-level and eventually into network configurations like IP quintuples. The framework is leveraged to develop a module that allows for consistent multi-language translation among several packet filters in the market and focuses on the security within NFV by analysing packet filter behaviour and facilitating the translation process by considering the different firewall languages used in various scenarios. The implementation described in this extensive work is tailored to multiple firewall platforms, including Iptables, IpFirewall, BPF-iptables (developed by the University of Torino), Open vSwitch, and Fortinet. The network is configured in a way that is enforced across all these platforms, ensuring that the translated security policies adhere to the defined medium-level abstraction model. In terms of testing and validation, the implemented models were tested in various network scenarios, confirming that the policy translations act as intended  
Figure 5: IBN model for intent translation [106]. by the medium-level abstraction model. Another instance of security enhancement via security policies in this type of network is explored in [109], which also uses a refinement model that transforms high-level security requirements into specific configurations for network security functions (NSFs). This work required two models: a capability model that defines the NSFs and ensures they meet the specific security policy requirements and optimization models used to select the optimal NSFs to implement the required security measures based on performance and security criteria. In its implementation, the proposed system extends the OpenMANO framework, incorporating a Security Awareness Manager (SAM) to execute policy refinements. This addition allowed for real-time adaptations to the network or policy changes, mitigating one of the usual limitations in policy-based networking, and since it extends upon an already existing framework, implementing it becomes easier than developing a standalone system. After implementation, the system was validated using different network scenarios to ensure its practicality and efficiency in real-world applications, which entailed performance testing to confirm that policy refinement scales appropriately for current networks and for what is expected in larger-scale virtualized networks. For IoT systems that utilise SDN and NFV technologies, an innovative approach to enhance the flexibility of these systems via a semantic-aware, zero-touch, policy-driven security orchestration framework that facilitates dynamic and conflict-free security policy enforcement and VNF, or in this case Virtual Network Security Function (VSF) orchestration, was also found in [110]. Beyond the use of semantic-aware orchestration that can handle high-level security requirements, this approach incorporates an optimised algorithm for Service Function Chaining (SFC) that maximises QoS, security aspects, and resource usage during the deployment and lifecycle management of VSFs. Still, in the context of IoT networks which possess an inherent heterogeneity and constrained nature of devices, the work of [111] proposes a methodology that utilises optimization theory, in this case, the Maximum Satisfiability Modulo Theories (MaxSMT), to automatically compute and enforce security configurations in SDN-based IoT networks.