Programmable Data Planes Research Articles

JointNIDS: Efficient Joint Traffic Management for On-Device Network Intrusion Detection

Data plane programmability enables the embedding of a network intrusion detection system (NIDS) on programmable switches to dynamically control the efficiency of attack type detection and the overhead in the computation and network side. However, it is a challenging task to implement a feasible embedded detection model with advanced machine learning techniques such as deep learning. It is due to the limited support provided by programming languages on the data plane and the computing resource constraints at the edge. We propose a joint traffic classification architecture called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">JointNIDS</i> that splits a classification model into two sequential sub-models. In this model, the primary switch is dedicated to major attack classification. The secondary switch is used mainly for a further in-depth inspection of the rest of the minor traffic types. The presence of some partially overlapping hidden units in the two sequential switches can help to reduce the computational overhead at the edge, while increasing the packet inspection throughput. Experimental results on the P4 framework demonstrate that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">JointNIDS</i> has reduced attack detection time, while achieving a similar accuracy performance, as other counterpart algorithms. To further develop the proposed architecture, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">JointNIDS</i> implements an optimization step. It maximizes the amount of data to be inspected by a system, taking into account the constraints of computing resources and network bandwidth for a given performance requirement. We validate the effectiveness of collaborative joint optimization in various scenarios.

A Decision Tree-Based Online Traffic Classification Method for QoS Routing in Data Center Networks

In data center networks, how to ensure the quality of service (QoS) of traffic effectively has become an important optimization goal. Traffic classification has been widely studied to guarantee network flow QoS since it provides a basis for the network performance level requirement of different flow types. However, traditional network traffic classification methods, which can only identify traffic type offline, have no ability for online classification and the in-time QoS guarantee. To solve this problem, we propose an online traffic classification for QoS routing (OCQR) framework based on programmable data plane in this paper. Firstly, in order to improve the accuracy of flow classification and reduce the impact on line-rate packet forwarding, the way of machine learning model offline training and online deployment is used to classify the network flow in real time. Based on the hardware foundation of programmable switch and the complexity of machine learning algorithm, a CART decision tree model is used to classify network flows. Secondly, in order to actually deploy and run the decision tree model in the programmable switch with limited computing and storage resources, we prune the decision tree model and optimize the leaf nodes to reduce the size of the decision tree and improve the classification recall rate. Finally, by building a P4 simulation environment, the recall rate of OCQR’s classified scheduling of some application flows reaches more than 98%, which is consistent with the evaluation results of the offline dataset. At the same time, compared with the classification method based on SDN, OCQR does not require additional bandwidth occupation, so it has less impact on network performance.

Symbolic Analysis for Data Plane Programs Specialization

Programmable network data planes have extended the capabilities of packet processing in network devices by allowing custom processing pipelines and agnostic packet processing. While a variety of applications can be implemented on current programmable data planes, there are significant constraints due to hardware limitations. One way to meet these constraints is by optimizing data plane programs. Program optimization can be achieved by specializing code that leverages architectural specificity or by compilation passes. In the case of programmable data planes, to respond to the varying requirements of a large set of applications, data plane programs can target different architectures. This leads to difficulties when developers want to reuse the code. One solution to that is to use compiler optimization techniques. We propose performing data plane program specialization to reduce the generated program size. To this end, we propose to specialize in programs written in P4, a Domain Specific Language (DSL) designed for specifying network data planes. The proposed method takes advantage of key aspects of the P4 language to perform a symbolic analysis on a P4 program and then partially evaluate the program to specialize it. The approach we propose is independent of the target architecture. We evaluate the specialization technique by implementing a packet deparser on an FPGA. The results demonstrate that program specialization can reduce the resource usage by a factor of 2 for various packet deparsers.

Improving efficiency and security of IIoT communications using in-network validation of server certificate

The use of advanced communications and smart mechanisms in industry is growing rapidly, making cybersecurity a critical aspect. Currently, most industrial communication protocols rely on the Transport Layer Security (TLS) protocol to build their secure version, providing confidentiality, integrity and authentication. In the case of UDP-based communications, frequently used in Industrial Internet of Things (IIoT) scenarios, the counterpart of TLS is Datagram Transport Layer Security (DTLS), which includes some mechanisms to deal with the high unreliability of the transport layer. However, the (D)TLS handshake is a heavy process, specially for resource-deprived IIoT devices and frequently, security is sacrificed in favour of performance. More specifically, the validation of digital certificates is an expensive process from the time and resource consumption point of view. For this reason, digital certificates are not always properly validated by IIoT devices, including the verification of their revocation status; and when it is done, it introduces an important delay in the communications. In this context, this paper presents the design and implementation of an in-network server certificate validation system that offloads this task from the constrained IIoT devices to a resource-richer network element, leveraging data plane programming (DPP). This approach enhances security as it guarantees that a comprehensive server certificate verification is always performed. Additionally, it increases performance as resource-expensive tasks are moved from IIoT devices to a resource-richer network element. Results show that the proposed solution reduces DTLS handshake times by 50–60 %. Furthermore, CPU use in IIoT devices is also reduced, resulting in an energy saving of about 40 % in such devices.

Tracking Normalized Network Traffic Entropy to Detect DDoS Attacks in P4

Distributed Denial-of-Service (DDoS) attacks represent a persistent threat to modern telecommunications networks: detecting and counteracting them is still a crucial unresolved challenge for network operators. DDoS attack detection is usually carried out in one or more central nodes that collect significant amounts of monitoring data from networking devices, potentially creating issues related to network overload or delay in detection. The dawn of programmable data planes in Software-Defined Networks can help mitigate this issue, opening the door to the detection of DDoS attacks directly in the data plane of the switches. However, the most widely-adopted data plane programming language, namely P4, lacks supporting many arithmetic operations, therefore, some of the advanced network monitoring functionalities needed for DDoS detection cannot be straightforwardly implemented in P4. This work overcomes such a limitation and presents two novel strategies for flow cardinality and for normalized network traffic entropy estimation that only use P4-supported operations and guarantee a low relative error. Additionally, based on these contributions, we propose a DDoS detection strategy relying on variations of the normalized network traffic entropy. Results show that it has comparable or higher detection accuracy than state-of-the-art solutions, yet being simpler and entirely executed in the data plane.

Named data network dynamic cache placement strategy based on programmable data plane

Named data network dynamic cache placement strategy based on programmable data plane

FINT: Flexible In-band Network Telemetry method for data center network

By embedding the state data maintained by the programmable data plane into user packets, the In-band Network Telemetry (INT) can greatly improve the freshness of measured data, such as capturing the micro-bursts in data center networks. However, because the existing INT schemes use fixed telemetry tasks and metadata adding strategies, INT cannot be adjusted in time according to the network state, thus lacking flexibility. To solve the above problems, we propose a Flexible In-band Network Telemetry method FINT. With the designed triple bitmap mechanism, telemetry tasks and parameters can be set dynamically at runtime, which providing flexibility without redeployment to improve telemetry efficiency and reduce the impact of telemetry on network performance. With the designed flexible INT field structure, the types of telemetry metadata carried by user packets can be flexibly selected without significantly adding the indication field. Based on this, to meet the limitation of packet length and reduces the impact on the flow completion time, a greedy telemetry metadata selection algorithm MSG is designed to preferentially select the telemetry metadata with maximum bit-width among the remaining telemetry metadata. The experimental results show that FINT is flexible in adjusting telemetry tasks and add telemetry metadata, and effectively reduce the average flow completion time of the mice flow carrying INT data in the network without significantly increasing the bandwidth consumption.

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

Functional Split of In-Network Deep Learning for 6G: A Feasibility Study

In existing mobile network systems, the data plane (DP) is mainly considered a pipeline consisting of network elements end-to-end forwarding user data traffics. With the rapid maturity of programmable network devices, however, mobile network infrastructure mutates towards a programmable computing platform. Therefore, such a programmable DP can provide in-network computing capability for many application services. In this paper, we target to enhance the data plane with in-network deep learning (DL) capability. However, in-network intelligence can be a significant load for network devices. Then, the paradigm of the functional split is applied so that the deep neural network (DNN) is decomposed into sub-elements of the data plane for making machine learning inference jobs more efficient. As a proof-of-concept, we take a Blind Source Separation (BSS) problem as an example to exhibit the benefits of such an approach. We implement the proposed enhancement in a full-stack emulator and we provide a quantitative evaluation with professional datasets. As an initial trial, our study provides insightful guidelines for the design of the future mobile network system, employing in-network intelligence (e.g., 6G).

Telemetry and AI-based security P4 applications for optical networks [Invited

This paper presents the potentials and challenges of programmable packet-optical nodes encompassing coherent pluggable modules applied in the context of optical metro networks. Two innovative applications of P4-based data plane programmability are then presented. The first targets the monitoring and processing of optical telemetry data/metadata directly in the forwarding plane. The second one focuses on the deployment of deep neural networks in P4 chipsets, effectively supporting in-network distributed cyber security functionalities in packet-optical nodes.

A Programmable SRv6 Processor for SFC

A reconfigurable match table (RMT) is a programmable pipeline architecture for packet processing. In order to enable the programmable data plane to support segment routing IPv6 (SRv6) and other network protocols, this paper extends the deparser based on RMT. The paper uses the extended deparser and two RMT pipelines to build a protocol-independent network slice programmable data plane model named as the programmable SRv6 processor. We design it primarily for segment identifier (SID) processing of SRv6. We have proved that it can support SRv6, multiple semantics for SIDs, micro segment ID, multi-protocol label switching, and a service function chain (SFC). This architecture has broad application prospects. Experimental results on an FPGA showed that the extended deparser could achieve 100 Gbps throughput for 512B packets with few resources.

Filter‐Sketch: A two‐layer sketch for entropy estimation in the data plane

Entropy-based approaches have been shown to aid various network measurement applications such as load balancing, anomaly detection, and traffic classification. Existing methods that assume out-of-band detection and/or use switches merely as accelerators require frequency communication between data and control plane, which increase the burden on the network and are no longer sufficient. To track these challenges, the authors design and implement a switch-native approach for entropy estimation that can run detection function entirely inline on data plane. The authors first present Filter-Sketch, a two-layer sketch that supports frequency estimation with small and static memory allocation by separating elephant flow and mice flow. Then, the authors propose a mechanism based on memory-optimized longest-prefix match (LPM) to attain entropy at a line rate that completely executes in the programmable data plane. The trace-driven evaluation shows that Filter-Sketch achieves higher accuracy than the existing data plane algorithm in entropy estimation, where the relative error decreases by 0.65 on average.

Memory Network Architecture for Packet Processing in Functions Virtualization

Packet processing tasks in network functions require high-performance memory systems to understand the packet information, update the packet content, and search the databases. While network virtualization is expected to bring flexible and adaptive network with reduced cost by using commercial off-the-shelf (COTS) hardware and programmable data plane technology, network function performance suffers from the poor memory systems in COTS computers and lack of scalability in programmable hardware devices. This paper proposes a memory network architecture for packet processing based on memory-centric, disaggregated computing. Unlike processor-centric architecture in today’s COTS computers, the memory network consists of multiple memory devices, where processing for the incoming packets is completed. The proposed architecture reduces packet processing latency by eliminating communication between the processor devices and the memory devices. Also, the proposed architecture provides scalability of hardware resources by dynamic memory device allocation depending on the complexity of the network function, memory-intensiveness of packet processing, and traffic load. The numerical results show that the proposed architecture reduces accumulated latency for memory accesses and increases throughput compared to the conventional, processor-centric architectures, where every memory access requires communication between the processor devices and the memory devices. The proposed architecture also reduces latency and increases throughput by allocating additional memory devices to memory-intensive tasks.

Design and Implementation of Enhanced Programmable Data Plane Supporting ICN Mobility

Information-centric networking (ICN) separates the identifier and locator of network entities, providing a natural advantage in supporting mobility. To gain the advantage of ICN to support mobility, an urgent challenge is the problem of practical implementation with performance optimization. Software-defined networking (SDN) can be regarded as infrastructure to implement ICN mobility. However, it is difficult for the centralized SDN controller to quickly process mobile signaling. Therefore, this paper proposes enhanced programmable data plane supporting ICN mobility. By offloading mobility-related control plane functions from the controller to the data plane, the data plane can locally process mobile signaling without interacting with the controller. We propose an offloading mechanism for control plane functions, based on a rule table, where the controller authorizes the data plane to process the mobile signaling by loading the programmable rule table to data plane’s control element, and the control element intercepts the mobile signaling, matches the predefined rule table, and executes a series of application logic actions. In addition, we propose an improved SmartSplit algorithm to manage the rule table and speed up packets matching the rule table. Based on Intel’s Data Plane Development Kit (DPDK), we implement the enhanced programmable data plane. Our experimental results prove that the proposed enhanced programmable data plane has a stronger ability to process mobile signaling and reduce latency.

MultiSec: A Multi-Protocol Security Forwarding Mechanism Based on Programmable Data Plane

With the development of network technology, various network protocols different from TCP/IP have emerged. The heterogeneous integrated network has been proposed to realize the interconnection between heterogeneous networks running different protocols. However, current protocol conversion mechanisms often can only handle a few pre-defined protocols and do not support the flexible expansion of new protocols, which cannot meet the needs of the efficient convergence of different heterogeneous networks. Addirionally, due to the lack of security mechanisms, data in the core network is confronted with the risk of stealing and tampering. Our aim is to provide a protocol-extensible protocol conversion and secure transmission integration mechanism, MultiSec, for heterogeneous converged networks. First, based on the programmable data plane, the parser is reconfigured to realize multi-protocol parsing. Furthermore, the encryption mechanism implemented in the P4 extern is proposed and unified to the data plane together with the protocol conversion mechanism. Finally, the MultiSec prototype is implemented on a programmable software switch and accelerated by a dedicated encryption card. Experiments show that MultiSec successfully realizes multi-protocol conversion and data encryption, and the system performance is significantly improved with the help of an encryption card.

DDrops: Detecting silent packet drops on programmable data plane

Silent packet drops are common in data center networks, and are a major cause of network performance anomalies (NPAs) that have significant impacts on application performance and network management. However, existing solutions using coarse-grained statistics and flow-level telemetry either fail to provide precise location of packet drops or incur large overhead. This paper presents dDrops, a packet-level telemetry based on programmable data plane to detect and retrieve details of silent packet drops immediately when they happen. dDrops can dynamically adapt to varying ratios of silent packet drops for different ports on a switch to improve performance of silent packet drops detection. Moreover, a dynamic memory management scheme is also designed to efficiently use the limited memory on the data plane of switch. dDrops has been implemented on both P4 hardware programmable switches (based on Intel Tofino ASIC) and BMv2. Extensive experiment results show that dDrops is able to detect and locate the silent packet drops within 5 ms (including detailed information of dropped packets), and reduce the memory consumption by up to 50%.

Entropy-Driven Adaptive INT and Its Applications in Network Automation of IP-Over-EONs

Recently, IP over elastic optical network (IP-over-EON) has become a promising architecture for metro and core networks. This work studies how to visualize both layers of an IP-over-EON in real time, at different granularities (<i>e.g.</i>, at flow-level, lightpath-level, and link-level), and with self-adaptivity. Specifically, we consider the multilayer application of in-band telemetry (INT) and propose entropy-driven adaptive INT (namely, EntropyINT). We introduce stateful processing to programmable data plane (PDP) switches for EntropyINT, such that they can make local decisions to determine whether and what type of telemetry data about the IP and EON layers should be encoded in each packet. The local decisions are designed to be based on the amount of information that can be conveyed by telemetry data to the network automation system. Meanwhile, we make EntropyINT cooperate with out-of-band monitoring, to detect and locate exceptions in the EON layer. Our proposal is implemented in a real-world testbed of IP-over-EON, to evaluate its assistance to network automation. Experimental results verify the effectiveness of our proposal, and indicate that the telemetry data collected by EntropyINT and out-of-band monitoring can better assist the machine learning in network automation, for status prediction and anomaly detection.

P4DM: Measure the Link Delay with P4.

Network management strategies depend on a timely and accurate knowledge of the network performance measures. Among these, one of the most relevant is the delay of the links, which unfortunately is not easy to measure with accuracy, especially when considering multi-hop paths. This is a classical networking problem, for which several solutions have been proposed. Nonetheless, we argue in this manuscript that there is still some room for improving accuracy and effectiveness in the measurement. This paper proposes a new solution based on the exploitation of the P4 data plane programming language. The basic idea is to handle lightweight probe packets that are forged ad-hoc at the edge of a link and processed at the other edge. Hosts generate the probe packets that are then exploited by the P4 programs in the switches to implement the measure. This approach provides an accurate and reliable measure of the link transit time, also effective in multi-hop links. In this latter case, we show that the measurement is not influenced much by the packet loss when the network is overloaded, thus providing more reliable results with respect to more conventional tools such as the classical ping utility. The manuscript explains the proposed P4 solution; then, it provides a comparison with several other approaches found in the literature, showing that outperform most of them, and finally show the behavior of the proposed methodology when facing a multi hop network path on a congested network to prove its robustness.

Guest Editorial: Managing Next-Generation Networks for Intelligent Services and Applications

Next-generation networks (NGNs) integrate the functionalities of a plethora of established and emerging technologies such as 5G, artificial intelligence (AI), edge intelligence, network softwarization, and data plane programmability. NGNs promise to achieve ultra-fast data rates and minimal latency in wireless communication and networking. They enable smart and autonomous services and applications through AI and machine learning (ML). Coupled with advances in end-user devices, NGNs enable a plethora of smart services and user-defined applications. Given the rise in system complexity and the exponential increase in the amount of data exchanged through networks, new state-of-the-art NGN management solutions are needed. By adapting cooperative and distributed management solutions, more reliable and efficient services and applications are conveyed to end users. Moreover, with distributed learning solutions, NGNs could be optimized to support the dynamic nature of network configuration and enable end-to-end system automation. For instance, the integration of federated learning (FL), deep reinforcement learning (DRL), and blockchain to NGNs can support scalable, secure, and diversified services and applications. Furthermore, through data plane programmability, network intelligence could be implemented directly on programmable devices in the network core. An intelligent forwarding plane would enable faster reaction to network events without depending on time-consuming exchange between the data and control planes.

M-Emu: A Platform for Multicast Emulation

Network layer multicast research is an important field of network research that requires simulators or emulators to support Software-Defined Networking (SDN) as well as to provide a specific structure at the network layer to facilitate packet forwarding, such as a multicast tree. The existing emulation platforms cannot effectively support the emulation of certain key multicast technologies, such as the Grafting Point (GP)-selection method and Rendezvous Point (RP)-selection method, for the following reasons: First, the programmable data plane of the existing emulation platform has many defects, such as the inability to process packet scheduling tasks, the prohibition of dynamic memory allocation and loops with unknown iteration counts, which make it difficult to deploy complex multicast protocols and algorithms. Secondly, at present, no emulation platform integrates network layer multicast emulation functions. As a result, users need to develop the multicast tree construction and maintenance mechanism in advance, which makes experiments laborious. To solve the above problems, based on NS4, we designed a multicast emulation platform, M-Emu. M-Emu presents a Service-Forwarding Architecture, which enables the data plane to deploy arbitrary complex protocols and algorithms. Based on the Service-Forwarding Architecture, M-Emu integrates a Multicast-Emulation Framework, which has a complete multicast tree construction and maintenance mechanism. We explain in detail how the various parts of M-Emu cooperate to complete the multicast emulation with an example and prove that M-Emu is efficient in CPU and memory consumption, etc., through a large number of experiments.