Nicholas Gray M. Sc.

• Moving Down the Stack: Performance Evaluation of Packet Processing Technologies for Stateful Firewalls Dietz, Katharina; Gray, Nicholas; Wolz, Manuel; Lorenz, Claas; Hoßfeld, Tobias; Seufert, Michael in 34th IEEE/IFIP Network Operations and Management Symposium (NOMS) (2023).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{info3-inproceedings-2023-2, address = {Miami, Florida}, author = {Dietz, Katharina and Gray, Nicholas and Wolz, Manuel and Lorenz, Claas and Hoßfeld, Tobias and Seufert, Michael}, booktitle = {34th IEEE/IFIP Network Operations and Management Symposium (NOMS)}, keywords = {ucn}, month = 5, title = {Moving Down the Stack: Performance Evaluation of Packet Processing Technologies for Stateful Firewalls}, year = 2023 }

  %0 Conference Paper %1 info3-inproceedings-2023-2 %A Dietz, Katharina %A Gray, Nicholas %A Wolz, Manuel %A Lorenz, Claas %A Hoßfeld, Tobias %A Seufert, Michael %B 34th IEEE/IFIP Network Operations and Management Symposium (NOMS) %C Miami, Florida %D 2023 %T Moving Down the Stack: Performance Evaluation of Packet Processing Technologies for Stateful Firewalls

• ML-based Performance Prediction of SDN using Simulated Data from Real and Synthetic Networks Dietz, Katharina; Gray, Nicholas; Seufert, Michael; Hoßfeld, Tobias in 33th IEEE/IFIP Network Operations and Management Symposium (NOMS) (2022).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{info3-inproceedings-2022-2, address = {Budapest, Hungary}, author = {Dietz, Katharina and Gray, Nicholas and Seufert, Michael and Hoßfeld, Tobias}, booktitle = {33th IEEE/IFIP Network Operations and Management Symposium (NOMS)}, keywords = {ucn}, month = 4, title = {ML-based Performance Prediction of SDN using Simulated Data from Real and Synthetic Networks}, year = 2022 }

  %0 Conference Paper %1 info3-inproceedings-2022-2 %A Dietz, Katharina %A Gray, Nicholas %A Seufert, Michael %A Hoßfeld, Tobias %B 33th IEEE/IFIP Network Operations and Management Symposium (NOMS) %C Budapest, Hungary %D 2022 %T ML-based Performance Prediction of SDN using Simulated Data from Real and Synthetic Networks

• Browser Fingerprinting: How to Protect Machine Learning Models and Data with Differential Privacy? Dietz, Katharina; Mühlhauser, Michael; Seufert, Michael; Gray, Nicholas; Hoßfeld, Tobias; Herrmann, Dominik in 1st International Workshop on Machine Learning in Networking (MaLeNe) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{info3-inproceedings-2021-16, address = {Lübeck, Germany (Virtual Conference)}, author = {Dietz, Katharina and Mühlhauser, Michael and Seufert, Michael and Gray, Nicholas and Hoßfeld, Tobias and Herrmann, Dominik}, booktitle = {1st International Workshop on Machine Learning in Networking (MaLeNe)}, keywords = {ucn}, month = 9, title = {Browser Fingerprinting: How to Protect Machine Learning Models and Data with Differential Privacy?}, year = 2021 }

  %0 Conference Paper %1 info3-inproceedings-2021-16 %A Dietz, Katharina %A Mühlhauser, Michael %A Seufert, Michael %A Gray, Nicholas %A Hoßfeld, Tobias %A Herrmann, Dominik %B 1st International Workshop on Machine Learning in Networking (MaLeNe) %C Lübeck, Germany (Virtual Conference) %D 2021 %T Browser Fingerprinting: How to Protect Machine Learning Models and Data with Differential Privacy?
• High Performance Network Metadata Extraction Using P4 for ML-Based Intrusion Detection Systems Gray, Nicholas; Dietz, Katharina; Seufert, Michael; Hoßfeld, Tobias in 22nd International Conference on High Performance Switching and Routing (HPSR) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{info3-inproceedings-2021-8, address = {Paris, France (Virtual Conference)}, author = {Gray, Nicholas and Dietz, Katharina and Seufert, Michael and Hoßfeld, Tobias}, booktitle = {22nd International Conference on High Performance Switching and Routing (HPSR)}, keywords = {ucn}, month = 6, title = {High Performance Network Metadata Extraction Using P4 for ML-Based Intrusion Detection Systems}, year = 2021 }

  %0 Conference Paper %1 info3-inproceedings-2021-8 %A Gray, Nicholas %A Dietz, Katharina %A Seufert, Michael %A Hoßfeld, Tobias %B 22nd International Conference on High Performance Switching and Routing (HPSR) %C Paris, France (Virtual Conference) %D 2021 %T High Performance Network Metadata Extraction Using P4 for ML-Based Intrusion Detection Systems
• Dynamic Real-Time Stream Reservation with TAS and Shared Time Windows Grigorjew, Alexej; Gray, Nicholas; Hoßfeld, Tobias in 2nd International Workshop on Time-Sensitive and Deterministic Networking (TENSOR) (2021).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  Motivated by new use cases such as industrial automation and in-vehicle communication, Time-Sensitive Networking is further improving the layer~2 standards for real-time communication in Ethernet networks. As periodic traffic is a common requirement in such scenarios, the Time Aware Shaper (TAS) is a highly popular mechanism that allows the realization of real-time guarantees in synchronized networks. Most applications in literature suggest to configure the TAS for full stream isolation such that the lowest delays can be achieved. However, this ``zero-queuing'' strategy requires a high amount of computational resources and time, as the configuration of the gate control lists of each port is a complex task, which is not suitable for scenarios with dynamically changing requirements. This paper presents a novel approach with shared time windows. In combination with stream reservation techniques that are commonly applied for asynchronous mechanisms, the network is able to accept new streams during operation without complex reconfiguration, while still benefiting from some degree of isolation compared to conventional asynchronous shapers. The evaluation shows that, given the right circumstances, the number of accepted real-time streams can be improved significantly.

  @inproceedings{info3-inproceedings-2021-7, abstract = {Motivated by new use cases such as industrial automation and in-vehicle communication, Time-Sensitive Networking is further improving the layer 2 standards for real-time communication in Ethernet networks. As periodic traffic is a common requirement in such scenarios, the Time Aware Shaper (TAS) is a highly popular mechanism that allows the realization of real-time guarantees in synchronized networks. Most applications in literature suggest to configure the TAS for full stream isolation such that the lowest delays can be achieved. However, this ``zero-queuing'' strategy requires a high amount of computational resources and time, as the configuration of the gate control lists of each port is a complex task, which is not suitable for scenarios with dynamically changing requirements. This paper presents a novel approach with shared time windows. In combination with stream reservation techniques that are commonly applied for asynchronous mechanisms, the network is able to accept new streams during operation without complex reconfiguration, while still benefiting from some degree of isolation compared to conventional asynchronous shapers. The evaluation shows that, given the right circumstances, the number of accepted real-time streams can be improved significantly.}, author = {Grigorjew, Alexej and Gray, Nicholas and Hoßfeld, Tobias}, booktitle = {2nd International Workshop on Time-Sensitive and Deterministic Networking (TENSOR)}, keywords = {ngn}, month = 6, title = {Dynamic Real-Time Stream Reservation with TAS and Shared Time Windows}, year = 2021 }

  %0 Conference Paper %1 info3-inproceedings-2021-7 %A Grigorjew, Alexej %A Gray, Nicholas %A Hoßfeld, Tobias %B 2nd International Workshop on Time-Sensitive and Deterministic Networking (TENSOR) %D 2021 %T Dynamic Real-Time Stream Reservation with TAS and Shared Time Windows %X Motivated by new use cases such as industrial automation and in-vehicle communication, Time-Sensitive Networking is further improving the layer~2 standards for real-time communication in Ethernet networks. As periodic traffic is a common requirement in such scenarios, the Time Aware Shaper (TAS) is a highly popular mechanism that allows the realization of real-time guarantees in synchronized networks. Most applications in literature suggest to configure the TAS for full stream isolation such that the lowest delays can be achieved. However, this ``zero-queuing'' strategy requires a high amount of computational resources and time, as the configuration of the gate control lists of each port is a complex task, which is not suitable for scenarios with dynamically changing requirements. This paper presents a novel approach with shared time windows. In combination with stream reservation techniques that are commonly applied for asynchronous mechanisms, the network is able to accept new streams during operation without complex reconfiguration, while still benefiting from some degree of isolation compared to conventional asynchronous shapers. The evaluation shows that, given the right circumstances, the number of accepted real-time streams can be improved significantly.

• Simulative Evaluation of KPIs in SDN for Topology Classification and Performance Prediction Models Gray, Nicholas; Dietz, Katharina; Hoßfeld, Tobias in 2020 16th International Conference on Network and Service Management (CNSM) (2020).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  In recent years Software-defined Networking (SDN) has gained increased popularity by reducing the complexity of management operations and increasing the performance of networks. As a result, the number of purchasable SDN devices and their deployment in real world network constantly rises, making a thorough understanding of their behaviors and interactions even more important. In this work we analyze distributed controller architectures via simulation, identify Key Performance Indicators (KPIs), classify various network topologies with respect to their impact on SDN, as well as create a prediction model to estimate the overall performance of the overall SDN ecosystem, which can be used for network planning.

  @inproceedings{info3-inproceedings-2020-15, abstract = {In recent years Software-defined Networking (SDN) has gained increased popularity by reducing the complexity of management operations and increasing the performance of networks. As a result, the number of purchasable SDN devices and their deployment in real world network constantly rises, making a thorough understanding of their behaviors and interactions even more important. In this work we analyze distributed controller architectures via simulation, identify Key Performance Indicators (KPIs), classify various network topologies with respect to their impact on SDN, as well as create a prediction model to estimate the overall performance of the overall SDN ecosystem, which can be used for network planning.}, author = {Gray, Nicholas and Dietz, Katharina and Hoßfeld, Tobias}, booktitle = {2020 16th International Conference on Network and Service Management (CNSM)}, keywords = {sys:hidden:inproceedings}, title = {Simulative Evaluation of KPIs in SDN for Topology Classification and Performance Prediction Models}, year = 2020 }

  %0 Conference Paper %1 info3-inproceedings-2020-15 %A Gray, Nicholas %A Dietz, Katharina %A Hoßfeld, Tobias %B 2020 16th International Conference on Network and Service Management (CNSM) %D 2020 %T Simulative Evaluation of KPIs in SDN for Topology Classification and Performance Prediction Models %X In recent years Software-defined Networking (SDN) has gained increased popularity by reducing the complexity of management operations and increasing the performance of networks. As a result, the number of purchasable SDN devices and their deployment in real world network constantly rises, making a thorough understanding of their behaviors and interactions even more important. In this work we analyze distributed controller architectures via simulation, identify Key Performance Indicators (KPIs), classify various network topologies with respect to their impact on SDN, as well as create a prediction model to estimate the overall performance of the overall SDN ecosystem, which can be used for network planning.

• Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks Gray, Nicholas; Grigorjew, Alexej; Hoßfeld, Tobias; Shukla, Apoorv; Zinner, Thomas in IFIP/IEEE Symposium on Integrated Network and Service Management (IM) (2019).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.

  @inproceedings{info3-demo-2019-1, abstract = {Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.}, author = {Gray, Nicholas and Grigorjew, Alexej and Hoßfeld, Tobias and Shukla, Apoorv and Zinner, Thomas}, booktitle = {IFIP/IEEE Symposium on Integrated Network and Service Management (IM)}, keywords = {sardine}, month = 3, title = {Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks}, year = 2019 }

  %0 Conference Paper %1 info3-demo-2019-1 %A Gray, Nicholas %A Grigorjew, Alexej %A Hoßfeld, Tobias %A Shukla, Apoorv %A Zinner, Thomas %B IFIP/IEEE Symposium on Integrated Network and Service Management (IM) %D 2019 %T Gray, Nicholas, et al. "Highlighting the Gap Between Expected and Actual Behavior in P4-enabled Networks %X Modern networks increasingly rely on Software-defined Networking (SDN) and Network Function Virtualization (NFV) to augment their flexibility in high load scenarios. To further enhance the performance, a part of the functionality is often offloaded to forwarding devices, which are used as hardware accelerators and are configured by high level programming languages such as P4. However, hardware vendors use sophisticated technologies to implement these standards, which need to be understood by the programmer to avoid unintended behavior. In this demonstration we highlight the severe consequences of only relying on the network programming language when ignoring the device-specific limitations. We show this by the example of a Denial of Service attack against a P4-enabled SmartNIC. Finally, we discuss possible mitigations to this attack and stress the importance of an overall understanding of the entire system.

• Integrating Network Management Information into the SDN Control Plane Lange, Stanislav; Reinhart, Lorenz; Zinner, Thomas; Hock, David; Gray, Nicholas; Tran-Gia, Phuoc in IEEE/IFIP Network Operations and Management Symposium (NOMS) (2018).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.

  @inproceedings{info3-inproceedings-2018-10, abstract = {With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.}, author = {Lange, Stanislav and Reinhart, Lorenz and Zinner, Thomas and Hock, David and Gray, Nicholas and Tran-Gia, Phuoc}, booktitle = {IEEE/IFIP Network Operations and Management Symposium (NOMS)}, keywords = {sdnperf}, month = 4, title = {Integrating Network Management Information into the SDN Control Plane}, year = 2018 }

  %0 Conference Paper %1 info3-inproceedings-2018-10 %A Lange, Stanislav %A Reinhart, Lorenz %A Zinner, Thomas %A Hock, David %A Gray, Nicholas %A Tran-Gia, Phuoc %B IEEE/IFIP Network Operations and Management Symposium (NOMS) %D 2018 %T Integrating Network Management Information into the SDN Control Plane %X With software defined networking (SDN), operators benefit from a higher flexibility, cost efficiency, as well as programmability of their networks. Since modern networks are comprised of a multitude of heterogeneous devices and also include non-SDN legacy devices, network management systems (NMSs) are often used in order to monitor and configure the network. Although both, the SDN controller and the NMS, have a centralized view of the network, they operate at different time scales and deal with information at different levels of granularity. In this work, we investigate the impact on the network performance when an NMS regularly provides information to an SDN controller. To this end, we design, implement, and compare three interaction mechanisms based on the ONOS controller. These represent different trade-offs regarding the complexity of the resulting system and its performance. In addition to the default ONOS controller, we develop two extended versions. One performs hash-based load balancing on equal cost paths while the other utilizes external NMS information via ONOS's intent and annotation framework to optimize control plane decisions. In addition to evaluations that show a significant performance improvement when using the optimized controllers, we present a parameter study that highlights the performance impact of network characteristics like the flow interarrival time, the flow duration, and the number of active flows.
• Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks Gray, Nicholas; Lange, Stanislav; Zinner, Thomas; Pfaff, Benedikt; Hock, David in 7th International Conference on Communications and Electronics (ICCE) (2018).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.

  @inproceedings{info3-inproceedings-2018-33, abstract = {With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.}, address = {Hue, Vietnam}, author = {Gray, Nicholas and Lange, Stanislav and Zinner, Thomas and Pfaff, Benedikt and Hock, David}, booktitle = {7th International Conference on Communications and Electronics (ICCE)}, keywords = {sardine}, month = 7, title = {Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks}, year = 2018 }

  %0 Conference Paper %1 info3-inproceedings-2018-33 %A Gray, Nicholas %A Lange, Stanislav %A Zinner, Thomas %A Pfaff, Benedikt %A Hock, David %B 7th International Conference on Communications and Electronics (ICCE) %C Hue, Vietnam %D 2018 %T Evaluation of a Distributed Control Plane for Managing Heterogeneous SDN-enabled and Legacy Networks %X With the increasing number of devices, protocols and applications, today’s networks are becoming more and more complex. Hence, Software-defined Networking (SDN) tries to ad- dress this issue by separating the data from the control plane and by providing centralized interfaces for network configuration. As legacy devices cannot be replaced instantly due to high costs, both network segments have to be operated in coexistence with defined joints at their edges. To ensure a smooth operation, both controlling instances of these segments are required to exchange information. In this work, we design and implement a data model for storing the information needed to keep the controller and a Network Management System (NMS) synchronized, which are responsible for configuring the SDN-enabled network and the legacy devices respectively. For this, we implement and evaluate a total of three different synchronization strategies by the example of an SDN-based Bring Your Own Device (BYOD) use case. Index Terms—SDN, NMS, Management, Integration, Hetero- geneous Networks, Distributed Control Plane.
• Bridging the Gap Between Programming and Implementation of Networking Devices Grigorjew, Alexej; Gray, Nicholas; Hoßfeld, Tobias; Shukla, Apoorv; Zinner, Thomas in Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies (2018).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{info3-inproceedings-2018-49, author = {Grigorjew, Alexej and Gray, Nicholas and Hoßfeld, Tobias and Shukla, Apoorv and Zinner, Thomas}, booktitle = {Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies}, keywords = {ngn}, month = 12, title = {Bridging the Gap Between Programming and Implementation of Networking Devices}, year = 2018 }

  %0 Conference Paper %1 info3-inproceedings-2018-49 %A Grigorjew, Alexej %A Gray, Nicholas %A Hoßfeld, Tobias %A Shukla, Apoorv %A Zinner, Thomas %B Student Workshop of the 14th International Conference on emerging Networking EXperiments and Technologies %D 2018 %T Bridging the Gap Between Programming and Implementation of Networking Devices

• SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks Pfaff, Benedikt; Scherer, Johann; Hock, David; Gray, Nicholas; Zinner, Thomas; Tran-Gia, Phuoc; Durner, Raphael; Kellerer, Wolfgang; Lorenz, Claas (2017, August).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.

  @misc{info3-demo-2017-3, abstract = {Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.}, author = {Pfaff, Benedikt and Scherer, Johann and Hock, David and Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc and Durner, Raphael and Kellerer, Wolfgang and Lorenz, Claas}, booktitle = {In Proceedings of the SIGCOMM Posters and Demos}, keywords = {sardine}, month = 8, title = {SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks}, year = 2017 }

  %0 Generic %1 info3-demo-2017-3 %A Pfaff, Benedikt %A Scherer, Johann %A Hock, David %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %A Durner, Raphael %A Kellerer, Wolfgang %A Lorenz, Claas %B In Proceedings of the SIGCOMM Posters and Demos %D 2017 %T SDN/NFV-enabled Security Architecture for Fine-grained Policy Enforcement and Threat Mitigation for Enterprise Networks %X Network Functions Visualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hardware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster's instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability.
• Enhancing SDN Security by Device Fingerprinting Gray, Nicholas; Zinner, Thomas; Tran-Gia, Phuoc (2017, May).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.

  @misc{info3-demo-2017-2, abstract = {Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.}, author = {Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc}, booktitle = {15th IFIP/IEEE International Symposium on Integrated Network Management (IM), Lisbon, Portugal, May 2017}, keywords = {sardine}, month = 5, title = {Enhancing SDN Security by Device Fingerprinting}, year = 2017 }

  %0 Generic %1 info3-demo-2017-2 %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %B 15th IFIP/IEEE International Symposium on Integrated Network Management (IM), Lisbon, Portugal, May 2017 %D 2017 %T Enhancing SDN Security by Device Fingerprinting %X Software-defined Networking (SDN) provides an increased flexibility and cost savings by separating the data from the control plane. Despite these benefits, this separation also results in a greater attack surface as new devices and protocols are deployed. OpenFlow is one of these protocols and enables the communication between the switch and the controller. Ideally this connection takes place over an encrypted TLS channel, but as this feature is marked optional, it is not supported by all devices. This allows an attacker to eavesdrop and alter the communication, hence resulting in a comprised network. In this work, we demonstrate a new approach for authentication based on device fingerprinting to enhance the security in scenarios, where cryptographic mechanisms are unavailable.
• A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs Gray, Nicholas; Lorenz, Class; Müssig, Alexander; Gebert, Steffen; Zinner, Thomas; Tran-Gia, Phuoc in Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017) (2017).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability

  @inproceedings{info3-inproceedings-2017-2, abstract = {Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability}, address = {Göttingen, Germany}, author = {Gray, Nicholas and Lorenz, Class and Müssig, Alexander and Gebert, Steffen and Zinner, Thomas and Tran-Gia, Phuoc}, booktitle = {Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017)}, keywords = {sardine}, title = {A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs}, year = 2017 }

  %0 Conference Paper %1 info3-inproceedings-2017-2 %A Gray, Nicholas %A Lorenz, Class %A Müssig, Alexander %A Gebert, Steffen %A Zinner, Thomas %A Tran-Gia, Phuoc %B Workshop on Software-Defined Networking and Network Function Virtualization for Flexible Network Management (SDNFlex 2017) %C Göttingen, Germany %D 2017 %T A Priori State Synchronization for Fast Failover of Stateful Firewall VNFs %X Network Functions Virtualization (NFV) replaces physical middleboxes with software instances running network functions in cloud environments. To support this new paradigm, it is necessary to port the code basis from highly specialized hardware devices to virtual machines running on COTS hard- ware. In order to fully exploit the inherent capabilities of cloud environments it is further necessary to redesign the software to support a large amount of distributed, cooperating function instances instead of single, isolated and monolithic instances. This development can be observed for network functions like stateful firewalling. Until now, available software firewalls lack support for active/active operation in clustered environments, which hinders horizontal scalability. This is due to the fact that the required synchronization of connection states among the cluster’s instances is an impediment that still has to be resolved. Therefore, this work investigates different synchronization strategies and mechanisms, which allow to share connection states among the cluster to maintain scalability and high-availability
• An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement Lorenz, Claas; Hock, David; Scherer, Johann; Durner, Raphael; Kellerer, Wolfgang; Gebert, Steffen; Gray, Nicholas; Zinner, Thomas; Tran-Gia, Phuoc in IEEE Communications Magazine (2017). 55(3) 217–223.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.

  @article{info3-article-2016-9, abstract = {In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.}, author = {Lorenz, Claas and Hock, David and Scherer, Johann and Durner, Raphael and Kellerer, Wolfgang and Gebert, Steffen and Gray, Nicholas and Zinner, Thomas and Tran-Gia, Phuoc}, journal = {IEEE Communications Magazine}, keywords = {sys:hidden:article}, month = 3, number = 3, pages = {217 - 223}, title = {An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement}, volume = 55, year = 2017 }

  %0 Journal Article %1 info3-article-2016-9 %A Lorenz, Claas %A Hock, David %A Scherer, Johann %A Durner, Raphael %A Kellerer, Wolfgang %A Gebert, Steffen %A Gray, Nicholas %A Zinner, Thomas %A Tran-Gia, Phuoc %D 2017 %J IEEE Communications Magazine %N 3 %P 217 - 223 %T An SDN/NFV-enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement %V 55 %X In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Despite these attacks, the main security systems, e.g., network firewalls, have remained rather unchanged. Due to the tight integration into the physical network’s infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. Therefore, in this work, we analyze and compare different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.

• Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++ Gray, Nicholas; Zinner, Thomas; Gebert, Steffen; Tran-Gia, Phuoc in 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) (2016).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.

  @inproceedings{info3-inproceedings-2016-20, abstract = {SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.}, address = {Abu Dhabi, United Arab Emirates}, author = {Gray, Nicholas and Zinner, Thomas and Gebert, Steffen and Tran-Gia, Phuoc}, booktitle = {8th EAI International Conference on Mobile Networks and Management (MONAMI 2016)}, keywords = {sendate}, month = 10, title = {Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++}, year = 2016 }

  %0 Conference Paper %1 info3-inproceedings-2016-20 %A Gray, Nicholas %A Zinner, Thomas %A Gebert, Steffen %A Tran-Gia, Phuoc %B 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) %C Abu Dhabi, United Arab Emirates %D 2016 %T Simulation Framework for Distributed SDN-Controller Architectures in OMNeT++ %X SDN introduces the seperation of network control and network data plane. The control plane is removed from distributed network entities and logically centralized as the SDN controller. To provide resilience and performance such a logically centralized controller may again be physically distributed. Scenarios featuring distributed controller architectures include data center deployments, where controller instances synchronize states on small distances and delays, or continental WAN deployments with long distances and delays between controllers. The contribution of this paper is an OMNET++ based simulation framework for assessing the performance of distributed SDN controller architectures. Relevant protocols and controller applications are modelled with a high level of detail. Further, an exemplary implementation of two different controller architectures, namely Hyperflow and Kandoo, is included. Initial results based on the provided implementations are presented.
• Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart Gebert, Steffen; Müssig, Alexander; Lange, Stanislav; Zinner, Thomas; Gray, Nicholas; Tran-Gia, Phuoc in 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) (2016).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{info3-inproceedings-2016-19, address = {Abu Dhabi, United Arab Emirates}, author = {Gebert, Steffen and Müssig, Alexander and Lange, Stanislav and Zinner, Thomas and Gray, Nicholas and Tran-Gia, Phuoc}, booktitle = {8th EAI International Conference on Mobile Networks and Management (MONAMI 2016)}, keywords = {sardine}, month = 10, title = {Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart}, year = 2016 }

  %0 Conference Paper %1 info3-inproceedings-2016-19 %A Gebert, Steffen %A Müssig, Alexander %A Lange, Stanislav %A Zinner, Thomas %A Gray, Nicholas %A Tran-Gia, Phuoc %B 8th EAI International Conference on Mobile Networks and Management (MONAMI 2016) %C Abu Dhabi, United Arab Emirates %D 2016 %T Processing Time Comparison of a Hardware-Based Firewall and its Virtualized Counterpart
• Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking Gebert, Steffen; Zinner, Thomas; Gray, Nicholas; Durner, Raphael; Lorenz, Class; Lange, Stanislav (2016, September).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.

  @misc{info3-demo-2016-1, abstract = {Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.}, address = {Würzburg, Germany}, author = {Gebert, Steffen and Zinner, Thomas and Gray, Nicholas and Durner, Raphael and Lorenz, Class and Lange, Stanislav}, booktitle = {28th International Teletraffic Congress (ITC 28)}, keywords = {sardine}, month = 9, title = {Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking}, year = 2016 }

  %0 Generic %1 info3-demo-2016-1 %A Gebert, Steffen %A Zinner, Thomas %A Gray, Nicholas %A Durner, Raphael %A Lorenz, Class %A Lange, Stanislav %B 28th International Teletraffic Congress (ITC 28) %C Würzburg, Germany %D 2016 %T Demonstrating a Personalized Secure-By-Default Bring Your Own Device Solution Based on Software Defined Networking %X Network virtualization is one classical use-case for Software Defined Networks (SDN). By programmatically instantiating virtual networks, traffic from one or more devices can be separated or connectivity can be established as needed. S- BYOD, which is presented in this demonstration, applies the SDN concept to Bring Your Own Device (BYOD) scenarios and offers personalized virtual networks that are set up and extended on demand. This is done once the user authenticates, activates access to additional applications, or as soon as applications scale out and involve more servers. The described proof-of-concept implementation explores, to what degree an agent-less BYOD solution, based only on SDN, can lower the attack surface by explicit user opt-ins for particular services. Further, an assessment of the number of required rules within the flow tables of switches completes this work.