Dynamic Security Provisioning for Cloud-Native Networks: An Intent-Based Approach

This paper presents a methodology for automating network management and security enforcement in cloud-native environments through an intent-based approach. Intents allow for the specification of security requirements and precise enforcement details, such as security controls. Moreover, they enable defining changes to the networking environment and additional requirements to react to security-relevant events. A refinement process completes enforcement decisions when details are left unspecified, including the security controls to use and the network layout, and then generates the security controls' configurations. An automated framework deploys the desired chains in software networks orchestrated with Kubernetes and configures the involved security controls thanks to an Network Service Mesh-based operator. The approach has been validated in realistic use cases and proved scalable and helpful in simplifying administrator tasks and reducing errors.