FLOWGUARD: Building robust firewalls for software-defined networks

Hongxin Hu, Wonkyu Han, Gail-Joon Ahn, Ziming Zhao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

176 Scopus citations

Abstract

Software-Defined Networking (SDN) introduces significant granularity, visibility and flexibility to networking, but at the same time brings forth new security challenges. One of the fundamental challenges is to build robust firewalls for protecting OpenFlow-based networks where network states and traffic are frequently changed. To address this challenge, we introduce FlowGuard, a comprehensive framework, to facilitate not only accurate detection but also effective resolution of firewall policy violations in dynamic OpenFlow-based networks. FlowGuard checks network flow path spaces to detect firewall policy violations when network states are updated. In addition, FlowGuard conducts automatic and real-time violation resolutions with the help of several innovative resolution strategies designed for diverse network update situations. We also implement our framework and demonstrate the efficacy and efficiency of the proposed detection and resolution approaches in FlowGuard through experiments with a real-world network topology.

Original languageEnglish (US)
Title of host publicationHotSDN 2014 - Proceedings of the ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking
PublisherAssociation for Computing Machinery
Pages97-102
Number of pages6
ISBN (Print)9781450329897
DOIs
StatePublished - 2014
Event3rd ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking, HotSDN 2014 - Chicago, IL, United States
Duration: Aug 22 2014Aug 22 2014

Publication series

NameHotSDN 2014 - Proceedings of the ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking

Conference

Conference3rd ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking, HotSDN 2014
CountryUnited States
CityChicago, IL
Period8/22/148/22/14

Keywords

  • firewalls
  • openflow
  • security
  • software-defined networking

ASJC Scopus subject areas

  • Computer Graphics and Computer-Aided Design
  • Computer Vision and Pattern Recognition
  • Human-Computer Interaction
  • Software

Fingerprint Dive into the research topics of 'FLOWGUARD: Building robust firewalls for software-defined networks'. Together they form a unique fingerprint.

  • Cite this

    Hu, H., Han, W., Ahn, G-J., & Zhao, Z. (2014). FLOWGUARD: Building robust firewalls for software-defined networks. In HotSDN 2014 - Proceedings of the ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking (pp. 97-102). (HotSDN 2014 - Proceedings of the ACM SIGCOMM 2014 Workshop on Hot Topics in Software Defined Networking). Association for Computing Machinery. https://doi.org/10.1145/2620728.2620749