# A Review of Industry 4.0 Manufacturing Process Security Risks
## 4 Solutions
### Efficient and Secure Scaling of Information Networks
#### 4.2.2 Software-Defined Networks and Network Function Virtualization  
Section 3.4.2 briefly focused on the complex problem of information network scaling. The concept of a software-defined network (SDN) presents a unique and very promising solution to this complex networking problem. Where network control and data-forwarding functionalities are typically embedded within the same device for a conventional network, the concept of an SDN enables the possibility of decoupling network functionality from actual network infrastructure [6; 48; 49]. The main aspect of this network decoupling process is the abstraction of the underlying network infrastructure that interconnects network devices. This allows the entire network to be treated as a logical entity. The network intelligence and network control logic are contained in a central, software-defined network controller that forms the heart of the SDN. From within this software-based network controller, a global view of the interconnection of devices on the network is kept and maintained. An SDN network can be divided into three main entities, namely the management plane, control plane and data plane [49]. This also introduces the concept of network function virtualization (NFV), where networking functions such as firewalls, switching and routing are separated from the rest of the network infrastructure [6; 49]. The separation of a network into these three entities makes it possible to optimize the underlying functionalities of each of these entities. The entities make use of dedicated interfaces called the northbound, southbound, eastbound and westbound interfaces [49]. Figure 8 illustrates this network separation into the three main entities, and summarizes the architectural layout of an SDN:  
The management plane contains all the functionalities that manage the network. These management functionalities include tasks such as routing, firewalls and policy enforcement. Another important aspect that falls under the management plane is network load balancing. Since the network functionalities can be controlled in software, it is possible to balance the load on a network evenly within the available network infrastructure, which optimizes the efficiency of the network. The data plane, also called the forwarding plane, mainly involves the forwarding of packets by interfacing with network switches (either hardware- or software-based) and other physical devices. Within the data plane, tasks such as packet header inspection and packet forwarding to controllers and network ports ensure that data will flow from the relevant data sources to the intended destinations. By matching packet headers to the installed flow tables, packets can be forwarded to the corresponding network devices present in the network. In the case of packets addressed to devices not contained in the flow tables, these packets can either be dropped or forwarded to a separate external network entity. The control plane maintains a global view of the entire network, while acting as the main decoupling entity between the management and data planes. In the control plane, the data flow between the management and data planes is managed by means of software-controlled flow entries, while providing real-time statistics to the management plane to optimize the load on the network. Auditing and inventory tasks are also performed by the control plane to ensure optimal use of the available network resources. Interfacing with legacy networks is also managed from the control plane. With network functionality no longer solely dependent on the layout of dedicated network equipment, IT personnel can dynamically (essentially in real-time) alter the network behavior and even add new network services and devices in a much shorter time than would be required on a conventional network. Figure 8: Network entity separation and software-defined network (SDN) architectural layout.