## 4 Policy/Intent-Based Security in SDN and NFV Networks
### Advancements in Policy Implementation Techniques  
It was mentioned how SDN has helped propel the use of policies to enforce security in modern networks [101]. Indeed, this has been advantageous for disseminating security policy enforcement in networks at large; however, the combination of SDNs with NFVs is when security policy enforcement is truly at its best in the current state of networking. This combination provides a flexible and dynamic environment for managing security policies efficiently, as is described in the work of [103], which, similarly to the work of [101], takes advantage of the centralised nature of SDN's control mechanisms to dynamically apply and modify security policies based on real-time network conditions and threats. The flexibility of this policy enforcement can be enhanced using NFVs as demonstrated in [104], whose work deals with embedding virtual networks that adhere to specific security policies across multiple domains, leveraging SDN and NFV technologies to emphasise inter-domain consistency. The study showcases how policy-based virtual network embedding can significantly enhance security in a multi-tenant environment, which is precisely  
Figure 2: FAIN architecture from [102]. what it is shifting towards, by maintaining strict adherence to security policies across the different network domains. Another way to approach security enforcement is by using the framework proposed in [105], which defines a policy scheme comprising four policy functions: separating, chaining, merging, and reordering. Even though the name of these functions is quite suggestive, a brief description will make it easier to understand how they benefit the network into which they are implemented. * **Separating:** this divides the virtual services and decreases the size of the attack flows using a load balancer. * **Chaining:** this links many VNFs to prevent various attack flows and constructs extensive security systems. * **Merging:** this combines unnecessary VNFs to optimise the security system and the system's resources. * **Reordering:** this reorders current VNFs depending on the type and strength of the current attack flows. With these four policy functions, not only were the system's resources applied more effectively, but the network was also designed more efficiently, and the system's security was enhanced due to these dynamic intra-domain configuration and reconfiguration capabilities. Besides this approach to policy-based networking, it is also possible to find in this work, as well as in the aforementioned work of [103], examples of how the policy-based network architecture has changed since its inception, as has been discussed previously in the FAIN architecture presented. In [103], it is found that policy-based networking is easily integrated into SDNs, which decouples the architecture into three different planes. The data plane is where the physical (or virtualized) infrastructure lies and connects to the control plane (via Southbound Interfaces), where network services are managed through the SDN Controller. This plane is connected to the application plane (via Southbound Interfaces) where the applications themselves are deployed as well as the Policy-based Security Architecture (PbSA) as described in the following depiction (Figure 3). Within the PbSA found two types of repositories: a Topology Repository, which contains information on the network's topology and is critical for routing and managing traffic, and a Policy Repository, which holds the policy expressions that define the security  
Figure 3: PbSA integrated into SDN architecture [103]. and operational guidelines for the network. Another crucial component in the PbSA is the Policy Manager, which manages all security operations within the network, ensuring policies are correctly implemented as well as updated.