P4Knocking: Offloading host-based firewall functionalities to the network

Eder Ollora Zaballa; David Franco; Zifan Zhou; Michael Stübert Berger

doi:10.1109/icin48450.2020.9059298

P4Knocking: Offloading host-based firewall functionalities to the network

Eder Ollora Zaballa, David Franco, Zifan Zhou, Michael Stübert Berger

University of the Basque Country

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

Abstract

The introduction of Software-Defined Networks (SDN) and the evolution towards programmable data planes bring the opportunity to offload several functions to the data plane. In this context, the P4 programming language opens the door to the customization of data planes. It can provide packet processing functionalities that can be applied to improve network security among other areas. This paper presents P4Knocking, a P4-based port knocking implementation that can externally open ports that appear to be closed. The goal of bringing port knocking capabilities to the network is to seamlessly deploy firewall functions in the data plane, reliving hosts from dealing with unintended traffic. Our work presents a total of four implementations that involve data and control planes in different degrees. In this case, P4Knocking can provide a more transparent and efficient way to deploy the port knocking service compared to a host-based port knocking implementation. In fact, it requires no specific purpose externs apart from registers, hence its higher portability and flexibility with local or remote control planes.

Original language	English
Title of host publication	Proceedings of 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN)
Publisher	IEEE
Publication date	2020
Pages	7-12
ISBN (Print)	9781728151274
DOIs	https://doi.org/10.1109/icin48450.2020.9059298
Publication status	Published - 2020
Event	23rd Conference on Innovation in Clouds, Internet and Networks and Workshops - Paris, France Duration: 24 Feb 2020 → 27 Feb 2020 Conference number: 23

Conference

Conference	23rd Conference on Innovation in Clouds, Internet and Networks and Workshops
Number	23
Country/Territory	France
City	Paris
Period	24/02/2020 → 27/02/2020

Keywords

Port knocking
Security
Programmable
SDN
P4

Access to Document

10.1109/icin48450.2020.9059298

OpenUrl availability

Full text

Cite this

@inproceedings{138f9b3f650440248b8cee1f8aa2fa01,

title = "P4Knocking: Offloading host-based firewall functionalities to the network",

abstract = "The introduction of Software-Defined Networks (SDN) and the evolution towards programmable data planes bring the opportunity to offload several functions to the data plane. In this context, the P4 programming language opens the door to the customization of data planes. It can provide packet processing functionalities that can be applied to improve network security among other areas. This paper presents P4Knocking, a P4-based port knocking implementation that can externally open ports that appear to be closed. The goal of bringing port knocking capabilities to the network is to seamlessly deploy firewall functions in the data plane, reliving hosts from dealing with unintended traffic. Our work presents a total of four implementations that involve data and control planes in different degrees. In this case, P4Knocking can provide a more transparent and efficient way to deploy the port knocking service compared to a host-based port knocking implementation. In fact, it requires no specific purpose externs apart from registers, hence its higher portability and flexibility with local or remote control planes.",

keywords = "Port knocking, Security, Programmable, SDN, P4",

author = "{Ollora Zaballa}, Eder and David Franco and Zifan Zhou and Berger, {Michael St{\"u}bert}",

year = "2020",

doi = "10.1109/icin48450.2020.9059298",

language = "English",

isbn = "9781728151274",

pages = "7--12",

booktitle = "Proceedings of 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN)",

publisher = "IEEE",

address = "United States",

note = "23rd Conference on Innovation in Clouds, Internet and Networks and Workshops, ICIN 2020 ; Conference date: 24-02-2020 Through 27-02-2020",

}

Ollora Zaballa, E, Franco, D, Zhou, Z & Berger, MS 2020, P4Knocking: Offloading host-based firewall functionalities to the network. in Proceedings of 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN). IEEE, pp. 7-12, 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops, Paris, France, 24/02/2020. https://doi.org/10.1109/icin48450.2020.9059298

P4Knocking: Offloading host-based firewall functionalities to the network. / Ollora Zaballa, Eder; Franco, David; Zhou, Zifan et al.
Proceedings of 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN). IEEE, 2020. p. 7-12.

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

TY - GEN

T1 - P4Knocking: Offloading host-based firewall functionalities to the network

AU - Ollora Zaballa, Eder

AU - Franco, David

AU - Zhou, Zifan

AU - Berger, Michael Stübert

N1 - Conference code: 23

PY - 2020

Y1 - 2020

N2 - The introduction of Software-Defined Networks (SDN) and the evolution towards programmable data planes bring the opportunity to offload several functions to the data plane. In this context, the P4 programming language opens the door to the customization of data planes. It can provide packet processing functionalities that can be applied to improve network security among other areas. This paper presents P4Knocking, a P4-based port knocking implementation that can externally open ports that appear to be closed. The goal of bringing port knocking capabilities to the network is to seamlessly deploy firewall functions in the data plane, reliving hosts from dealing with unintended traffic. Our work presents a total of four implementations that involve data and control planes in different degrees. In this case, P4Knocking can provide a more transparent and efficient way to deploy the port knocking service compared to a host-based port knocking implementation. In fact, it requires no specific purpose externs apart from registers, hence its higher portability and flexibility with local or remote control planes.

AB - The introduction of Software-Defined Networks (SDN) and the evolution towards programmable data planes bring the opportunity to offload several functions to the data plane. In this context, the P4 programming language opens the door to the customization of data planes. It can provide packet processing functionalities that can be applied to improve network security among other areas. This paper presents P4Knocking, a P4-based port knocking implementation that can externally open ports that appear to be closed. The goal of bringing port knocking capabilities to the network is to seamlessly deploy firewall functions in the data plane, reliving hosts from dealing with unintended traffic. Our work presents a total of four implementations that involve data and control planes in different degrees. In this case, P4Knocking can provide a more transparent and efficient way to deploy the port knocking service compared to a host-based port knocking implementation. In fact, it requires no specific purpose externs apart from registers, hence its higher portability and flexibility with local or remote control planes.

KW - Port knocking

KW - Security

KW - Programmable

KW - SDN

KW - P4

U2 - 10.1109/icin48450.2020.9059298

DO - 10.1109/icin48450.2020.9059298

M3 - Article in proceedings

SN - 9781728151274

SP - 7

EP - 12

BT - Proceedings of 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN)

PB - IEEE

T2 - 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops

Y2 - 24 February 2020 through 27 February 2020

ER -

P4Knocking: Offloading host-based firewall functionalities to the network

Abstract

Conference

Keywords

Access to Document

OpenUrl availability

Fingerprint

Cite this