PlugFest 2014 organized by TCG took place at Fraunhofer SIT in Darmstadt

From April 1st to 3rd the PlugFest of the Trusted Computing Group (TCG) took place in Darmstadt at Fraunhofer SIT. Company representatives and researchers tested their developments in the area of IF-MAP during three days in order to analyze the interoperability between all different components. This time three participants of the current SIMU research project participated in the PlugFest. DECOIT GmbH tested its own open-source based IF-MAP Clients, macmon secure its NAC-based IF-MAP solution and the University of Applied Sciences and Arts Hannover its MAP server “irond”.

^

Generally, the PlugFest takes place twice a year and is organized by the Trusted Computing Group (TCG) who is in charge of conducting Juniper within the working group Trusted Network Connects (TNC). Normally, these tests take place in the USA, thus it was the third time that an exception was made. The PlugFest was already carried out successfully in the two past years in Darmstadt at Fraunhofer SIT. This time an unofficial SIMU partner meeting was held because the only participants were the project partners, the University of Applied Sciences and Arts Hannover, macmon secure gmbh, DECOIT GmbH and Fraunhofer SIT. 

The IF-MAP protocol is an extension of the TCG standard which deals with a secure connection to a network. While TNC aims at creating a trusted-environment, IF-MAP goes one step further by using metadata in order to keep central security information at hand. That way, constraints of security measures can be used as well, for example in order to assert if an attack on a company network takes place, although no direct protection fault is visible. For this purpose information of different security components, which in return need to possess an IF-MAP Client, is evaluated. The MAP-Server collects information of IF-MAP Clients and correlates the data with each other. Therefore, both components are necessary.

During the first few days the virtual machines (VM) were prepared and the switch platform was configured. After that first tests could be initiated and successful communication between the IF-MAP components could be reported. This time DECOIT GmbH brought own developed solutions of the IF-MAP Clients by Snort, Nagios, OpenVPN, iptables und Android. All five IF-MAP Clients developed by DECOIT were analysed in comparison to the MAP-Server invented by the University of Applied Sciences and Arts Hannover. All tests conducted by DECOIT were successful. macmon could report successful tests as well. The second day was used for the completion of all tests. Virtual machines of other providers that were not present that day were also tested in connection to own IF-MAP components. That way all further development to date could be evaluated positively.

The PlugFest was a great success for all participants, even if participation was relatively low this time. The tests were recorded and evaluated by "TCG Certification" and afterwards transferred to TCG. That way, interoperable components within the TNC and IF-MAP environment can be developed further. It is desirable that all previous IF-MAP producers keep on adding interesting specifications to their components. The SIMU project relies on IF-MAP functions with regard to security components in order to be able to apply these in a SIEM environment. Therefore, it would be desirable that other producers of the security environment recognized the meaningfulness and offered the IF-MAP Client in the future.