  Aiming at the privacy preservation of dynamic Web service composition, this
paper proposes a SDN-based runtime security enforcement approach for privacy
preservation of dynamic Web service composition. The main idea of this approach
is that the owner of service composition leverages the security policy model
(SPM) to define the access control relationships that service composition must
comply with in the application plane, then SPM model is transformed into the
low-level security policy model (RSPM) containing the information of SDN data
plane, and RSPM model is uploaded into the SDN controller. After uploading, the
virtual machine access control algorithm integrated in the SDN controller
monitors all of access requests towards service composition at runtime. Only
the access requests that meet the definition of RSPM model can be forwarded to
the target terminal. Any access requests that do not meet the definition of
RSPM model will be automatically blocked by Openflow switches or deleted by SDN
controller, Thus, this approach can effectively solve the problems of
network-layer illegal accesses, identity theft attacks and service leakages
when Web service composition is running. In order to verify the feasibility of
this approach, this paper implements an experimental system by using POX
controller and Mininet virtual network simulator, and evaluates the
effectiveness and performance of this approach by using this system. The final
experimental results show that the method is completely effective, and the
method can always get the correct calculation results in an acceptable time
when the scale of RSPM model is gradually increasing.
