## 2 Related Work  
We have drawn inspiration from the work by [PERSON] et al. [6], where a function Tag is defined that maps subjects or objects to the set of tags assigned to them, and where a security administrator can formulate logic-based authorization policies that define access rights in terms of these tags. This work extends work by [PERSON] et al. [7]. An important difference between our approach and the one of [6,7] is that our labels can be calculated automatically, while their tags are assigned by users. These authors also introduce expressive policy languages that are still under development for our approach. In [PERSON] et al. [3], entities and data are labeled with two labels, one for secrecy and another for integrity, and security policies are defined in such a way that data from entities can only flow into other entities labeled to receive them. In our approach, we generalize this idea by using labels that can be computed in any network, and we take advantage of the observation of [PERSON] [8], in which only one label is required to express both the secrecy and integrity of data. In a recent paper, [PERSON] et al. [9] propose MLS-Enforcer, a software-defined networking (SDN) controller that enforces multi-level policies while retaining the ability to securely relabel network nodes under changing configurations and network traffic demands; this is done by using a polynomial-time heuristic relabeling algorithm. From the security point of view, their method is much less general than our method, being restricted to a \"Relaxed Bell-La Padula\" model, and the labels used are heuristic and more complex than ours. However, they consider traffic demands that are outside of our scope. Future research can deal with combining the ideas of this paper with those of ours, possibly leading to more general results. Some papers propose the use of different types of access control and data flow control policy models in the IoT; for example, [PERSON] et al. [10] propose the use of provenance-based data flow control (PDFC), defined by complex authorization rules. Our policy model is simpler, covers both access and flow control, has well-defined concepts of secrecy and integrity, and can be directly applied to SDN. It also expresses provenance to the extent that our labels can express provenance. [PERSON] and [PERSON] [11] present a solution to enforce security policies to control the routing configuration in database-defined networks. To achieve this, the authors use row-level security checks and the lattice-based model [8, 12] alongside the RAVEL architecture ([PERSON] et al. [13]). Their solution consists of constructing routing tables by using the lattice model, encoding the tables in the database-defined network architecture of RAVEL, and enforcing multi-level security policies using row-level security as an enforcement mechanism. The authors deal separately with secrecy and integrity. To enforce the upward flow of data, the authors propose to define the flow path, in the _Can Flow_ table. This path consists of sequences of nodes that data can flow into. Once a path is defined, each node in this path starting from the first one, will be given a security label. Finally, a security policy is defined with respect to a multi-level model, which states that data can only flow upward from a security level into a higher one. The enforcement of downward data flow for integrity is dual. Our work generalizes the work done in this paper in at least two directions, namely that it can be applied to any network rather than lattice-based ones and that our labels encode simultaneously secrecy and integrity requirements. One idea we retain for further research is using a database approach to represent data flow policies. [PERSON] et al. [14] and [PERSON] et al. [15] use data flow tracking within the system to enforce fine-grained security policies using a combination of dynamic and static analysis. We take another approach, which is labeling data.