IP-enabled sensors can be globally addressable by any Internet-connected entity, and therefore, their protection presents different challenges than that of traditional sensors, as they are subject to any potential attacker in the Internet. For this reason, specific security protocols must be developed to address the security requirements of IP-enabled sensors. An interesting approach to achieve this aim is the Ladon security protocol, which allows resource-deprived devices to efficiently implement end-to-end authentication, authorisation and key establishment mechanisms. However, in so limited environments such as sensor networks, not only efficient protocols must be defined, but they must also be optimally parameterised. This paper constitutes a step forward in this direction. First, a state transition model of the Ladon protocol is presented to analytically describe its behaviour. Then, this model is used to select the most effective parameterisation of the protocol in terms of message retransmissions and execution of cryptographic operations. The obtained results show that the selected parameterisation allows maximising the probability of a successful secure session establishment, while keeping the overhead introduced by the protocol low. Additionally, the performance comparison carried out shows that Ladon outperforms alternative approaches to achieve the same objective in terms of message transmission and reception operations.

The possibility to deploy telecommunication services based on the availability of a fully flow-aware network is an appealing possibility. Concepts like Network Service Chaining and Network Function Virtualization expect the information to be manageable at the flow level. But, for this concept to be available for the development of user-centric applications, the access network should also be made flow-aware. In this paper we present the integration of a legacy DOCSIS based access network under an OpenFlow Control Framework by using the Hardware Abstraction Layer designed in the FP7 ALIEN project. The result is a dynamic wide area OpenFlow switch that spawns from the aggregation switch to the home equipment and hides all the complexity (including the provisioning) of the access technology to an unmodified and standard OpenFlow controller. As a result, the access network can react not only to any kind of user traffic but also to the connection of CPE to the network. The approach used is technology independent, and the results have been successfully demonstrated over a Cisco based DOCSIS access network.

This paper presents FlowNAC, a Flow-based Network Access Control solution that allows to grant users the rights to access the network depending on the target service requested. Each service, defined univocally as a set of flows, can be independently requested and multiple services can be authorized simultaneously. Building this proposal over SDN principles has several benefits: SDN adds the appropriate granularity (fine- or coarse-grained) depending on the target scenario and flexibility to dynamically identify the services at data plane as a set of flows to enforce the adequate policy. FlowNAC uses a modified version of IEEE 802.1X (novel EAPoL-in-EAPoL encapsulation) to authenticate the users (without the need of a captive portal) and service level access control based on proactive deployment of flows (instead of reactive). Explicit service request avoids misidentifying the target service, as it could happen by analyzing the traffic (e.g. private services). The proposal is evaluated in a challenging scenario (concurrent authentication and authorization processes) with promising results.

This paper describes an experimentally-tested approach towards programmability for legacy network elements in the software-defined networking architecture. As OpenFlow is a leading control-plane protocol enabling SDN in modern networks, yet not all equipment is compatible with this framework. This problem is addressed in ALIEN, the FP7 research project, where Hardware Abstraction Layer (HAL) for non-OpenFlow capable devices is introduced. This paper describes outcomes of the project, and specifically, gives a set of examples of the successful implementation of OpenFlow through the HAL on ‘alien’ devices.

Nowadays, several devices supporting OpenFlow versions beyond 1.0 are available on the market. However, existent OpenFlow testbeds like OFELIA do not provide support for such devices, therefore it is hard for the research community to explore and test the newest functionalities of the protocol in realistic environments. This paper gives a short overview of two different architectures investigated within the FP7 ALIEN project that both aim to overcome this limitation within the OFELIA experimental facility.

The rise of cloud services poses considerable challenges on the control of both cloud and carrier network infrastructures. While traditional telecom network services rely on rather static processes (often involving manual steps), the wide adoption of mobile devices including tablets, smartphones and wearables introduce previously unseen dynamics in the creation, scaling and withdrawal of new services. These phenomena require optimal flexibility in the characterization of services, as well as on the control and orchestration of both carrier and cloud infrastructure. This paper proposes a unified programmability framework addressing: the unification of network and cloud resources, the integrated control and management of cloud and network, the description for programming networked/cloud services, and the provisioning processes of these services. In addition proofs-of-concept are provided based on existing opensource control software components.

Since the appearance of OpenFlow, the Software Defined Networking has become a hot topic inside the networking industry and academia. One of the topics currently under study, is the adaptation of SDNs to the multi-domain environment, as current OpenFlow lacks of mechanisms by itself to accomplish that. In this scenario, the GN3plus JRA2T1 task group is investigating how to integrate SDN/OpenFlow with the Network Services Framework, which has been proven useful for its application in multi-domain environments. The research is focused on two different areas. The first one tackles with the establishment of end-to-end connections across different domains where at least one of the domains is SDN/OpenFlow-enabled. The second one aims to provide isolated slices to experimenters where the resources belong to different domains.

With the development of solutions like 6LoWPAN, the implementation of IP technology in sensor devices is already a reality. Therefore, sensors can be natively integrated in the Internet, becoming globally addressable by any other Internet-connected party. Despite the huge potential of this approach, it also gives place to new threats, being one of the most critical ones the effective protection of the information gathered by sensors from unauthorised remote access attempts. A suitable solution to address this issue is the Ladon security protocol, which provides resource-deprived devices with end-to-end authentication, authorisation and key establishment mechanisms. Once the critical security issue has been solved, additional concerns arise. Specially remarkable is the protection of user privacy in order to prevent potential eavesdroppers from tracking users’ access trends and obtaining behavioural patterns. In this regard, authentication and authorisation processes deserve an special consideration, since they imply conveying user identity-related information to the targeted services. In this paper, we present a privacy-enhanced Ladon protocol by integrating the original protocol with the PrivaKERB user privacy framework for Kerberos. Due to the severe resource limitations that characterise the targeted environments, a performance evaluation of the proposed solution is carried out in order to prove that it meets the performance requirements of the considered environments in terms of energy cost and additional delay for each secure session establishment. The obtained results show that privacy-enhanced Ladon is a secure and efficient solution to implement privacy-supporting authentication and authorisation processes in resource-deprived environments.

The upcoming development of the Internet of Things (IoT) envisions IP-enabled pacemakers and ICDs, giving place to a completely new scenario in the field of remote monitoring of patients implanted with these devices. Apart from the costs saved thanks to the reduction of in-clinic visits, this new approach will help improving the quality of life of chronic patients that depend on such devices. However, this scenario cannot be conceived without an effective mechanism to protect the privacy of the health information collected by implanted sensors, understanding privacy as the capacity to determine when, how and to what extent information is communicated to others. In this paper, we show how the Ladon authentication, authorization and key establishment protocol can be successfully applied to achieve this purpose. The Ladon protocol is based on Kerberos, but appropriately modified and extended to support independence of clock synchronization and authorization functionalities. In order to demonstrate the feasibility of introducing Ladon in the targeted scenarios, a prototype implementation based on general purpose sensors has been developed. The obtained results show that the performance penalty introduced by the protocol in terms of energy and time consumption is negligible.