Two formal design solutions for the generalization of network segmentation

Abstract

Computer networks are getting more and more complex with enormous number of resources, diverse access control policies, and spanning over different platforms and geographical regions. Clearly, these networks have multiple points of entry – as we see in the sliced 5G networks. In networks with multiple entry points shared resources are accessed via several paths through several subnetworks – thus increasing their attack surface and opening it to several vulnerabilities. Hence, a secure design of these networks poses a much greater challenge than the traditional networks with only a single entry point.In this paper, we propose two secure design solutions for the segmentation of networks with multiple entry points. These solutions are based on mathematical formalisms for network segmentation — thus enabling automation and dynamic segmentation of these networks. Finally, we use mininet, a Software Defined Network (SDN) emulator tool, to illustrate the usage of the proposed algorithms to configure and govern networks within three typical SDN architectures.