Attribute-Based Access Control (ABAC) has been chosen to replace the traditional access control model due to its dynamics, flexibility and scalability recently. However, during the migration and deployment process of ABAC policies, the key issue is how to mine accurate access control policies and quickly evaluate the policies when an access request arrives. Previous approaches typically addressed these two aspects separately, and the emergence of integrated solutions has provided new insights for addressing this issue. However, despite the high accuracy of the integrated solution in policy evaluation, it still falls short in terms of interpretability and performance. Therefore, this paper proposes a decision tree based ABAC policy mining and policy evaluation (DTAME) scheme, which employs different policy mining and evaluation algorithms based on various datasets. For access control lists, we utilize decision tree algorithms to mine ABAC policies and conduct policy evaluations based on policy trees. For access control logs, we adopt a decision tree to achieve performance approximating that of XGBoost. Experimental results show that the scheme offers superior interpretability and policy evaluation performance at the expense of a certain degree of accuracy.

With the extensive development of SDN technology, the scalability and reliability of SDN multi-control have gradually attracted people's attention. This paper designs the two-layer trusted multi-controller architecture based on multi-chain, and relies on the decentralization, decision-making credibility, and high-performance guarantee provided by the architecture as the core foundation to design the multi-controller scalability mechanism and reliability mechanism. As the core component of the distributed system, multi-chain provides the basic control layer with the CFT blockchain as a trusted distributed coordination component, and provides the dynamic decision layer with the BFT blockchain to ensure the multi-party participation and availability of decision-making processes such as abnormal detection and recovery. It ensures the decentralization and high performance of the cluster by dynamically adjusting the members of the decision-making layer. The scalability mechanism includes the initial load balancing mechanism(ILBM) and fine-grained dynamic load balancing mechanism, the former is responsible for the prevention of uneven load, and the latter is responsible for the detection and recovery of partial overload and global overload. The reliability solution is responsible for the detection and recovery of controller crush and link failure exceptions. Both types of mechanisms rely on the exception detection mechanism based on switch reporting(EDSR) to achieve efficient and reliable multitype exception detection. Finally, the simulation results show that the ILBM can prevent the overload of the controller, and the two-layer trusted multi-controller architecture can ensure high performance while providing credibility and decentralization for decision-making.

Network attacks are becoming more intense and characterized by complexity and persistence. Mechanisms that ensure network resilience to faults and threats should be well provided. Different approaches have been proposed to network resilience; however, most of them rely on static policies, which is unsuitable for current complex network environments and real-time requirements. To address these issues, we present a Belief-Desire-Intention (BDI) based multi-agent resilience network controller coupled with blockchain. We first clarify the theory and platform of the BDI, then discuss how the BDI evaluates the network resilience. In addition, we present the architecture, workflow, and applications of the resilience network controller. Simulation results show that the resilience network controller can effectively detect and mitigate distributed denial of service attacks.

As a newly proposed secure transport protocol, QUIC aims to improve the transport performance of HTTPS traffic and enable rapid deployment and evolution of transport mechanisms. QUIC is currently in the IETF standardization process and will potentially carry a significant portion of Internet traffic in the emerging future. An important safety goal of QUIC protocol is to provide effective data service for users. To aim this safety requirement, we propose a formal analysis method to analyze the safety of QUIC handshake protocol by using model checker SPIN and cryptographic protocol verifier ProVerif. Our analysis shows the counterexamples to safety properties, which reveal a design flaw in the current protocol specification. To this end, we also propose and verify a possible fix that is able to mitigate these flaws.