###### Abstract  
Data security on the Internet of Things (IoT) is usually implemented through encryption. This paper presents a solution based on routing, in which data are forwarded only to entities that are intended to receive them according to security requirements of secrecy (also called confidentiality), integrity, and conflicts. Our solution is generic in the sense that it can be used in any network, together with encryption as appropriate. We use the fact that, in any network, security requirements generate a partial order of equivalence classes of entities, and each entity can be labeled according to the position of its equivalence class in the partial order. Routing tables among entities can be compiled using the labels. The method is demonstrated in this paper for software-defined networking (SDN) routers and controllers. We propose a centralized IoT architecture with a cloud structure using SDN as networking infrastructure, where storage entities (i.e., cloud servers) are associated with application entities. A small 'hospital' example is shown for illustration. Procedures for network reconfigurations are presented. We also demonstrate the method for the normal case where different partial orders, representing distinct but concurrent security requirements, coexist among a set of entities. The method proposed does not impose an overhead on the normal functioning of SDN networks since it requires calculations only when the network must be reconfigured because of administrative intervention or policies. These occasional updates can be done efficiently and offline.  
Internet of Things (IoT); software-defined networking (SDN); data and information security; data flow control; access control; secrecy-confidentiality-integrity +
Footnote †: journal: Cybersecurity and Privacy  
0000-0002-0001-5000]A. [PERSON]  
0000-0002-0002-0000][PERSON]  
0000-0002-0002-0002-0000]A. [PERSON]  
0000-0002-0002-0002-0002-0002-0000  
Encryption is the established method to protect data in the IoT, and it can be expected to remain so. However, routing, with its ability to prevent data from reaching certain entities or to direct data towards certain entities, has received much less attention. This paper focuses on routing and proposes a method for using it, possibly as a complement to encryption, especially in cases where encryption is unfeasible or impractical (e.g., if the network's entities have very limited computing capabilities), in order to further strengthen data security.  
Software-defined networking (SDN) is a networking architecture that facilitates the establishment of global routing strategies. In SDN, packets can be forwarded or dropped. However, no research exists on the use of SDN for the satisfaction of the security requirements mentioned above. Most security research related to SDN is concerned with infrastructure vulnerabilities.  
Our approach to using SDN for data security is based on data labeling, combined with policies stating that only entities labeled in certain ways can receive data from entities labeled in certain other ways. Data labeling can be used to specify constraints on passing data among entities as a general-purpose data flow control method. Research towards the use of labeling in security exists (see Section 2), but not in connection with the global routing capabilities of SDN. We show that SDN routing tables can be compiled for arbitrary networks by using labels constructed according to an efficient method.  
In Section 2, we provide a literature review. In Section 3, we give a short account of previous research on data flow control for security and an introduction to software-defined networking. Section 4 describes our method in principle. Section 5 presents a concrete 'hospital' example. Section 6 discusses the topic of network reconfigurations. Section 7 shows how networks with multiple flows can be implemented in our method. Section 8 presents how our method was simulated and tested. Section 9 deals with efficiency and scalability. Section 10 concludes the paper.