Nicholas Gray M. Sc.

2019

1.
Gray, N., Grigorjew, A., Hoßfeld, T., Shukla, A., Zinner, T.: Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks. IFIP/IEEE Symposium on Integrated Network and Service Management (IM) (2019).
[ Abstract ] [ BibTeX ] [ EndNote ]
 
Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.
@inproceedings{info3-demo-2019-1, abstract = {Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.}, author = {Gray, Nicholas and Grigorjew, Alexej and Hoßfeld, Tobias and Shukla, Apoorv and Zinner, Thomas}, booktitle = {IFIP/IEEE Symposium on Integrated Network and Service Management (IM)}, keywords = {myown sys:hidden:inproceedings ngn sardine}, month = 3, title = {Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks}, year = 2019 }
%0 Conference Paper %1 info3-demo-2019-1 %A Gray, Nicholas %A Grigorjew, Alexej %A Hoßfeld, Tobias %A Shukla, Apoorv %A Zinner, Thomas %B IFIP/IEEE Symposium on Integrated Network and Service Management (IM) %D 2019 %T Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks %X Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.

2018

1.
Grigorjew, A., Gray, N., Hoßfeld, T., Shukla, A., Zinner, T.: Bridging the Gap Between Programming and Implementation of Networking Devices. Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies (2018).
[ BibTeX ] [ EndNote ]
 
@inproceedings{info3-inproceedings-2018-49, author = {Grigorjew, Alexej and Gray, Nicholas and Hoßfeld, Tobias and Shukla, Apoorv and Zinner, Thomas}, booktitle = {Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies}, keywords = {myown 5g-net sys:hidden:inproceedings ngn}, month = 12, title = {Bridging the Gap Between Programming and Implementation of Networking Devices}, year = 2018 }
%0 Conference Paper %1 info3-inproceedings-2018-49 %A Grigorjew, Alexej %A Gray, Nicholas %A Hoßfeld, Tobias %A Shukla, Apoorv %A Zinner, Thomas %B Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies %D 2018 %T Bridging the Gap Between Programming and Implementation of Networking Devices
2.
Gray, N., Lange, S., Zinner, T., Pfaff, B., Hock, D.: Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks. 7th International Conference on Communications and Electronics (ICCE). , Hue, Vietnam (2018).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.
@inproceedings{info3-inproceedings-2018-33, abstract = {With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.}, address = {Hue, Vietnam}, author = {Gray, Nicholas and Lange, Stanislav and Zinner, Thomas and Pfaff, Benedikt and Hock, David}, booktitle = {7th International Conference on Communications and Electronics (ICCE)}, keywords = {myown 5g-net sys:hidden:inproceedings ngn sardine}, month = 7, title = {Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks}, year = 2018 }
%0 Conference Paper %1 info3-inproceedings-2018-33 %A Gray, Nicholas %A Lange, Stanislav %A Zinner, Thomas %A Pfaff, Benedikt %A Hock, David %B 7th International Conference on Communications and Electronics (ICCE) %C Hue, Vietnam %D 2018 %T Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks %X With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.
3.
Lange, S., Reinhart, L., Zinner, T., Hock, D., Gray, N., Tran-Gia, P.: Integrating Network Management Information into the SDN Control Plane. IEEE/IFIP Network Operations and Management Symposium (NOMS) (2018).
[ Abstract ] [ BibTeX ] [ EndNote ]
 
With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.
@inproceedings{info3-inproceedings-2018-10, abstract = {With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.}, author = {Lange, Stanislav and Reinhart, Lorenz and Zinner, Thomas and Hock, David and Gray, Nicholas and Tran-Gia, Phuoc}, booktitle = {IEEE/IFIP Network Operations and Management Symposium (NOMS)}, keywords = {myown 5g-net sys:hidden:inproceedings ngn sdnperf}, month = 4, title = {Integrating Network Management Information into the SDN Control Plane}, year = 2018 }
%0 Conference Paper %1 info3-inproceedings-2018-10 %A Lange, Stanislav %A Reinhart, Lorenz %A Zinner, Thomas %A Hock, David %A Gray, Nicholas %A Tran-Gia, Phuoc %B IEEE/IFIP Network Operations and Management Symposium (NOMS) %D 2018 %T Integrating Network Management Information into the SDN Control Plane %X With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.

2017

1.
Pfaff, B., Scherer, J., Hock, D., Gray, N., Zinner, T., Tran-Gia, P., Durner, R., Kellerer, W., Lorenz, C.: SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks, (2017).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.
@misc{info3-demo-2017-3, abstract = {Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.}, author = {Pfaff, Benedikt and Scherer, Johann and Hock, David and Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc and Durner, Raphael and Kellerer, Wolfgang and Lorenz, Claas}, booktitle = {In Proceedings of the SIGCOMM Posters and Demos}, keywords = {myown sys:hidden:demo ngn sardine}, month = 8, title = {SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks}, year = 2017 }
%0 Generic %1 info3-demo-2017-3 %A Pfaff, Benedikt %A Scherer, Johann %A Hock, David %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %A Durner, Raphael %A Kellerer, Wolfgang %A Lorenz, Claas %B In Proceedings of the SIGCOMM Posters and Demos %D 2017 %T SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks %X Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.
2.
Gray, N., Zinner, T., Tran-Gia, P.: Enhancing SDN Security by Device Fingerprinting, (2017).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.
@misc{info3-demo-2017-2, abstract = {Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.}, author = {Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc}, booktitle = {15th IFIP/IEEE International Symposium on Integrated Network Management (IM), Lisbon, Portugal, May 2017}, keywords = {myown sys:hidden:demo ngn sardine}, month = 5, title = {Enhancing SDN Security by Device Fingerprinting}, year = 2017 }
%0 Generic %1 info3-demo-2017-2 %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %B 15th IFIP/IEEE International Symposium on Integrated Network Management (IM), Lisbon, Portugal, May 2017 %D 2017 %T Enhancing SDN Security by Device Fingerprinting %X Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.
3.
Gray, N., Lorenz, C., Müssig, A., Gebert, S., Zinner, T., Tran-Gia, P.: A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs. Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017). , Göttingen, Germany (2017).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability
@inproceedings{info3-inproceedings-2017-2, abstract = {Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability}, address = {Göttingen, Germany}, author = {Gray, Nicholas and Lorenz, Class and Müssig, Alexander and Gebert, Steffen and Zinner, Thomas and Tran-Gia, Phuoc}, booktitle = {Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017)}, keywords = {myown sys:hidden:inproceedings sardine}, title = {A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs}, year = 2017 }
%0 Conference Paper %1 info3-inproceedings-2017-2 %A Gray, Nicholas %A Lorenz, Class %A Müssig, Alexander %A Gebert, Steffen %A Zinner, Thomas %A Tran-Gia, Phuoc %B Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017) %C Göttingen, Germany %D 2017 %T A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs %X Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability
4.
Lorenz, C., Hock, D., Scherer, J., Durner, R., Kellerer, W., Gebert, S., Gray, N., Zinner, T., Tran-Gia, P.: An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement. IEEE Communications Magazine. 55, 217–223 (2017).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.
@article{info3-article-2016-9, abstract = {In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.}, author = {Lorenz, Claas and Hock, David and Scherer, Johann and Durner, Raphael and Kellerer, Wolfgang and Gebert, Steffen and Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc}, journal = {IEEE Communications Magazine}, keywords = {myown sardine sys:hidden:article}, month = 3, number = 3, pages = {217 - 223}, title = {An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement}, volume = 55, year = 2017 }
%0 Journal Article %1 info3-article-2016-9 %A Lorenz, Claas %A Hock, David %A Scherer, Johann %A Durner, Raphael %A Kellerer, Wolfgang %A Gebert, Steffen %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %D 2017 %J IEEE Communications Magazine %N 3 %P 217 - 223 %T An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement %V 55 %X In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.

2016

1.
Gray, N., Zinner, T., Gebert, S., Tran-Gia, P.: Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++. 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016). , Abu Dhabi, United Arab Emirates (2016).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.
@inproceedings{info3-inproceedings-2016-20, abstract = {SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.}, address = {Abu Dhabi, United Arab Emirates}, author = {Gray, Nicholas and Zinner, Thomas and Gebert, Steffen and Tran-Gia, Phuoc}, booktitle = {8th EAI International Conference on Mobile Networks and Management (MONAMI 2016)}, keywords = {myown sendate-planets sys:hidden:inproceedings sendate}, month = 10, title = {Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++}, year = 2016 }
%0 Conference Paper %1 info3-inproceedings-2016-20 %A Gray, Nicholas %A Zinner, Thomas %A Gebert, Steffen %A Tran-Gia, Phuoc %B 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) %C Abu Dhabi, United Arab Emirates %D 2016 %T Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++ %X SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.
2.
Gebert, S., Müssig, A., Lange, S., Zinner, T., Gray, N., Tran-Gia, P.: Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart. 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016). , Abu Dhabi, United Arab Emirates (2016).
[ BibTeX ] [ EndNote ] [ Download ]
 
@inproceedings{info3-inproceedings-2016-19, address = {Abu Dhabi, United Arab Emirates}, author = {Gebert, Steffen and Müssig, Alexander and Lange, Stanislav and Zinner, Thomas and Gray, Nicholas and Tran-Gia, Phuoc}, booktitle = {8th EAI International Conference on Mobile Networks and Management (MONAMI 2016)}, keywords = {myown sys:hidden:inproceedings sardine}, month = 10, title = {Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart}, year = 2016 }
%0 Conference Paper %1 info3-inproceedings-2016-19 %A Gebert, Steffen %A Müssig, Alexander %A Lange, Stanislav %A Zinner, Thomas %A Gray, Nicholas %A Tran-Gia, Phuoc %B 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) %C Abu Dhabi, United Arab Emirates %D 2016 %T Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart
3.
Gebert, S., Zinner, T., Gray, N., Durner, R., Lorenz, C., Lange, S.: Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking, (2016).
[ Abstract ] [ BibTeX ] [ EndNote ] [ Download ]
 
Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.
@misc{info3-demo-2016-1, abstract = {Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.}, address = {Würzburg, Germany}, author = {Gebert, Steffen and Zinner, Thomas and Gray, Nicholas and Durner, Raphael and Lorenz, Class and Lange, Stanislav}, booktitle = {28th International Teletraffic Congress (ITC 28)}, keywords = {myown sys:hidden:demo sardine}, month = 9, title = {Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking}, year = 2016 }
%0 Generic %1 info3-demo-2016-1 %A Gebert, Steffen %A Zinner, Thomas %A Gray, Nicholas %A Durner, Raphael %A Lorenz, Class %A Lange, Stanislav %B 28th International Teletraffic Congress (ITC 28) %C Würzburg, Germany %D 2016 %T Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking %X Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.