The Experts below are selected from a list of 168 Experts worldwide ranked by ideXlab platform

Andreas Fiessler - One of the best experts on this subject based on the ideXlab platform.

  • LCN - FireFlow - High Performance Hybrid SDN-Firewalls with OpenFlow
    2018 IEEE 43rd Conference on Local Computer Networks (LCN), 2018
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann
    Abstract:

    Today, the most widely distributed type of Firewalls are Software Firewalls, running as applications on standard systems. Dedicated networking hardware like SDN switches has also been used to implement Firewall functionality, although their native classification capabilities are restricted to relatively simple checks, such as subnet tests. However, native SDN hardware can satisfy high performance requirements that would be challenging for standard Software Firewalls. This motivates to build a hybrid combination of fast SDN hardware with a standard Software Firewall. Our approach directly offloads simple rule policies instead of flows to the SDN switch, in order to exploit the limited storage capacity more efficiently. An effective packet diversion algorithm based on header space analysis avoids expensive communication with the back-end. This way, it can achieve the throughput of a native SDN switch while still being able to resort decisions to the full extent of a Software Firewall. Our evaluation demonstrates a 23-fold classification performance increase over a standard Software Firewall.

  • hypafilter enhanced hybrid packet filtering using hardware assisted classification and header space analysis
    IEEE ACM Transactions on Networking, 2017
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    Firewalls, key components for secured network infrastructures, are faced with two different kinds of challenges: first, they must be fast enough to classify network packets at line speed, and second, their packet processing capabilities should be versatile in order to support complex filtering policies. Unfortunately, most existing classification systems do not qualify equally well for both requirements: systems built on special-purpose hardware are fast, but limited in their filtering functionality. In contrast, Software filters provide powerful matching semantics, but struggle to meet line speed. This motivates the combination of parallel, yet complexity-limited specialized circuitry with a slower, but versatile Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. Therefore, we discuss approaches for partitioning and transforming rule sets for hybrid packet processing. As a result, we propose HyPaFilter+, a hybrid classification system consisting of an FPGA-based hardware matcher and a Linux netfilter Firewall, which provides a simple, yet effective hardware/Software packet shunting algorithm. Our evaluation shows up to 30-fold throughput gains over Software packet processing.

  • ANCS - HyPaFilter: A Versatile Hybrid FPGA Packet Filter
    Proceedings of the 2016 Symposium on Architectures for Networking and Communications Systems - ANCS '16, 2016
    Co-Authors: Andreas Fiessler, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    With network traffic rates continuously growing, security systems like Firewalls are facing increasing challenges to process incoming packets at line speed without sacrificing protection. Accordingly, specialized hardware Firewalls are increasingly used in high-speed environments. Hardware solutions, though, are inherently limited in terms of the complexity of the policies they can implement, often forcing users to choose between throughput and comprehensive analysis. On the contrary, complex rules typically constitute only a small fraction of the rule set. This motivates the combination of massively parallel, yet complexity-limited specialized circuitry with a slower, but semantically powerful Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. We therefore discuss approaches for partitioning and transforming rule sets for hybrid packet processing, and propose HyPaFilter, a hybrid classification system based on tailored circuitry on an FPGA as an accelerator for a Linux netfilter Firewall. Our evaluation demonstrates 30-fold performance gains in comparison to Software-only processing.

Bjorn Scheuermann - One of the best experts on this subject based on the ideXlab platform.

  • LCN - FireFlow - High Performance Hybrid SDN-Firewalls with OpenFlow
    2018 IEEE 43rd Conference on Local Computer Networks (LCN), 2018
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann
    Abstract:

    Today, the most widely distributed type of Firewalls are Software Firewalls, running as applications on standard systems. Dedicated networking hardware like SDN switches has also been used to implement Firewall functionality, although their native classification capabilities are restricted to relatively simple checks, such as subnet tests. However, native SDN hardware can satisfy high performance requirements that would be challenging for standard Software Firewalls. This motivates to build a hybrid combination of fast SDN hardware with a standard Software Firewall. Our approach directly offloads simple rule policies instead of flows to the SDN switch, in order to exploit the limited storage capacity more efficiently. An effective packet diversion algorithm based on header space analysis avoids expensive communication with the back-end. This way, it can achieve the throughput of a native SDN switch while still being able to resort decisions to the full extent of a Software Firewall. Our evaluation demonstrates a 23-fold classification performance increase over a standard Software Firewall.

  • hypafilter enhanced hybrid packet filtering using hardware assisted classification and header space analysis
    IEEE ACM Transactions on Networking, 2017
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    Firewalls, key components for secured network infrastructures, are faced with two different kinds of challenges: first, they must be fast enough to classify network packets at line speed, and second, their packet processing capabilities should be versatile in order to support complex filtering policies. Unfortunately, most existing classification systems do not qualify equally well for both requirements: systems built on special-purpose hardware are fast, but limited in their filtering functionality. In contrast, Software filters provide powerful matching semantics, but struggle to meet line speed. This motivates the combination of parallel, yet complexity-limited specialized circuitry with a slower, but versatile Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. Therefore, we discuss approaches for partitioning and transforming rule sets for hybrid packet processing. As a result, we propose HyPaFilter+, a hybrid classification system consisting of an FPGA-based hardware matcher and a Linux netfilter Firewall, which provides a simple, yet effective hardware/Software packet shunting algorithm. Our evaluation shows up to 30-fold throughput gains over Software packet processing.

  • ANCS - HyPaFilter: A Versatile Hybrid FPGA Packet Filter
    Proceedings of the 2016 Symposium on Architectures for Networking and Communications Systems - ANCS '16, 2016
    Co-Authors: Andreas Fiessler, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    With network traffic rates continuously growing, security systems like Firewalls are facing increasing challenges to process incoming packets at line speed without sacrificing protection. Accordingly, specialized hardware Firewalls are increasingly used in high-speed environments. Hardware solutions, though, are inherently limited in terms of the complexity of the policies they can implement, often forcing users to choose between throughput and comprehensive analysis. On the contrary, complex rules typically constitute only a small fraction of the rule set. This motivates the combination of massively parallel, yet complexity-limited specialized circuitry with a slower, but semantically powerful Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. We therefore discuss approaches for partitioning and transforming rule sets for hybrid packet processing, and propose HyPaFilter, a hybrid classification system based on tailored circuitry on an FPGA as an accelerator for a Linux netfilter Firewall. Our evaluation demonstrates 30-fold performance gains in comparison to Software-only processing.

Andrew W. Moore - One of the best experts on this subject based on the ideXlab platform.

  • hypafilter enhanced hybrid packet filtering using hardware assisted classification and header space analysis
    IEEE ACM Transactions on Networking, 2017
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    Firewalls, key components for secured network infrastructures, are faced with two different kinds of challenges: first, they must be fast enough to classify network packets at line speed, and second, their packet processing capabilities should be versatile in order to support complex filtering policies. Unfortunately, most existing classification systems do not qualify equally well for both requirements: systems built on special-purpose hardware are fast, but limited in their filtering functionality. In contrast, Software filters provide powerful matching semantics, but struggle to meet line speed. This motivates the combination of parallel, yet complexity-limited specialized circuitry with a slower, but versatile Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. Therefore, we discuss approaches for partitioning and transforming rule sets for hybrid packet processing. As a result, we propose HyPaFilter+, a hybrid classification system consisting of an FPGA-based hardware matcher and a Linux netfilter Firewall, which provides a simple, yet effective hardware/Software packet shunting algorithm. Our evaluation shows up to 30-fold throughput gains over Software packet processing.

  • ANCS - HyPaFilter: A Versatile Hybrid FPGA Packet Filter
    Proceedings of the 2016 Symposium on Architectures for Networking and Communications Systems - ANCS '16, 2016
    Co-Authors: Andreas Fiessler, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    With network traffic rates continuously growing, security systems like Firewalls are facing increasing challenges to process incoming packets at line speed without sacrificing protection. Accordingly, specialized hardware Firewalls are increasingly used in high-speed environments. Hardware solutions, though, are inherently limited in terms of the complexity of the policies they can implement, often forcing users to choose between throughput and comprehensive analysis. On the contrary, complex rules typically constitute only a small fraction of the rule set. This motivates the combination of massively parallel, yet complexity-limited specialized circuitry with a slower, but semantically powerful Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. We therefore discuss approaches for partitioning and transforming rule sets for hybrid packet processing, and propose HyPaFilter, a hybrid classification system based on tailored circuitry on an FPGA as an accelerator for a Linux netfilter Firewall. Our evaluation demonstrates 30-fold performance gains in comparison to Software-only processing.

Sven Hager - One of the best experts on this subject based on the ideXlab platform.

  • LCN - FireFlow - High Performance Hybrid SDN-Firewalls with OpenFlow
    2018 IEEE 43rd Conference on Local Computer Networks (LCN), 2018
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann
    Abstract:

    Today, the most widely distributed type of Firewalls are Software Firewalls, running as applications on standard systems. Dedicated networking hardware like SDN switches has also been used to implement Firewall functionality, although their native classification capabilities are restricted to relatively simple checks, such as subnet tests. However, native SDN hardware can satisfy high performance requirements that would be challenging for standard Software Firewalls. This motivates to build a hybrid combination of fast SDN hardware with a standard Software Firewall. Our approach directly offloads simple rule policies instead of flows to the SDN switch, in order to exploit the limited storage capacity more efficiently. An effective packet diversion algorithm based on header space analysis avoids expensive communication with the back-end. This way, it can achieve the throughput of a native SDN switch while still being able to resort decisions to the full extent of a Software Firewall. Our evaluation demonstrates a 23-fold classification performance increase over a standard Software Firewall.

  • hypafilter enhanced hybrid packet filtering using hardware assisted classification and header space analysis
    IEEE ACM Transactions on Networking, 2017
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    Firewalls, key components for secured network infrastructures, are faced with two different kinds of challenges: first, they must be fast enough to classify network packets at line speed, and second, their packet processing capabilities should be versatile in order to support complex filtering policies. Unfortunately, most existing classification systems do not qualify equally well for both requirements: systems built on special-purpose hardware are fast, but limited in their filtering functionality. In contrast, Software filters provide powerful matching semantics, but struggle to meet line speed. This motivates the combination of parallel, yet complexity-limited specialized circuitry with a slower, but versatile Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. Therefore, we discuss approaches for partitioning and transforming rule sets for hybrid packet processing. As a result, we propose HyPaFilter+, a hybrid classification system consisting of an FPGA-based hardware matcher and a Linux netfilter Firewall, which provides a simple, yet effective hardware/Software packet shunting algorithm. Our evaluation shows up to 30-fold throughput gains over Software packet processing.

  • ANCS - HyPaFilter: A Versatile Hybrid FPGA Packet Filter
    Proceedings of the 2016 Symposium on Architectures for Networking and Communications Systems - ANCS '16, 2016
    Co-Authors: Andreas Fiessler, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    With network traffic rates continuously growing, security systems like Firewalls are facing increasing challenges to process incoming packets at line speed without sacrificing protection. Accordingly, specialized hardware Firewalls are increasingly used in high-speed environments. Hardware solutions, though, are inherently limited in terms of the complexity of the policies they can implement, often forcing users to choose between throughput and comprehensive analysis. On the contrary, complex rules typically constitute only a small fraction of the rule set. This motivates the combination of massively parallel, yet complexity-limited specialized circuitry with a slower, but semantically powerful Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. We therefore discuss approaches for partitioning and transforming rule sets for hybrid packet processing, and propose HyPaFilter, a hybrid classification system based on tailored circuitry on an FPGA as an accelerator for a Linux netfilter Firewall. Our evaluation demonstrates 30-fold performance gains in comparison to Software-only processing.

Claas Lorenz - One of the best experts on this subject based on the ideXlab platform.

  • LCN - FireFlow - High Performance Hybrid SDN-Firewalls with OpenFlow
    2018 IEEE 43rd Conference on Local Computer Networks (LCN), 2018
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann
    Abstract:

    Today, the most widely distributed type of Firewalls are Software Firewalls, running as applications on standard systems. Dedicated networking hardware like SDN switches has also been used to implement Firewall functionality, although their native classification capabilities are restricted to relatively simple checks, such as subnet tests. However, native SDN hardware can satisfy high performance requirements that would be challenging for standard Software Firewalls. This motivates to build a hybrid combination of fast SDN hardware with a standard Software Firewall. Our approach directly offloads simple rule policies instead of flows to the SDN switch, in order to exploit the limited storage capacity more efficiently. An effective packet diversion algorithm based on header space analysis avoids expensive communication with the back-end. This way, it can achieve the throughput of a native SDN switch while still being able to resort decisions to the full extent of a Software Firewall. Our evaluation demonstrates a 23-fold classification performance increase over a standard Software Firewall.

  • hypafilter enhanced hybrid packet filtering using hardware assisted classification and header space analysis
    IEEE ACM Transactions on Networking, 2017
    Co-Authors: Andreas Fiessler, Claas Lorenz, Sven Hager, Bjorn Scheuermann, Andrew W. Moore
    Abstract:

    Firewalls, key components for secured network infrastructures, are faced with two different kinds of challenges: first, they must be fast enough to classify network packets at line speed, and second, their packet processing capabilities should be versatile in order to support complex filtering policies. Unfortunately, most existing classification systems do not qualify equally well for both requirements: systems built on special-purpose hardware are fast, but limited in their filtering functionality. In contrast, Software filters provide powerful matching semantics, but struggle to meet line speed. This motivates the combination of parallel, yet complexity-limited specialized circuitry with a slower, but versatile Software Firewall. The key challenge in such a design arises from the dependencies between classification rules due to their relative priorities within the rule set: complex rules requiring Software-based processing may be interleaved at arbitrary positions between those where hardware processing is feasible. Therefore, we discuss approaches for partitioning and transforming rule sets for hybrid packet processing. As a result, we propose HyPaFilter+, a hybrid classification system consisting of an FPGA-based hardware matcher and a Linux netfilter Firewall, which provides a simple, yet effective hardware/Software packet shunting algorithm. Our evaluation shows up to 30-fold throughput gains over Software packet processing.