Switch Hardware Research Articles

PCNP: A RoCEv2 congestion control using precise CNP

With the development of data centers, the traditional TCP/IP network stacks have become inadequate in addressing the high bandwidth and low latency demands of diverse upper-layer applications. Some cloud providers deploy RoCEv2 (RDMA over Converged Ethernet v2) technology to accelerate network transmission in their data centers, and the reliable network transmission in RoCEv2 relies on congestion control protocols. Currently, traditional congestion control protocols primarily employ heuristic rate adjustment strategies, which often exhibit inadequate performance in terms of convergence, stability, and fairness. Furthermore, the latest congestion control protocols rely on the support of costly switch hardware, which hinders the incremental expansion of data centers. This paper proposes PCNP, a precise congestion control protocol, it extends standard CNP (Congestion Notification Packet) and introduces a bounded rate adjustment strategy that leverages receiver information to achieve precise rate adjustment within existing data centers. Simulation results demonstrate that PCNP effectively decreases the rate fluctuation during the convergence process and enhances fairness. In comparison to DCQCN, HPCC and PCN, PCNP reduces the standard deviation of flow completion time under the incast traffic by 90%, 91% and 91%, respectively. Additionally, it can reduce the tail flow completion time by up to 83%, 40% and 46%.

Dapper: Deploying Service Function Chains in the Programmable Data Plane Via Deep Reinforcement Learning

Network functions perform specific packet processing on network traffic. To meet operators' needs, forming service function chains (SFCs) is a fundamental technique used in today's ISPs and datacenter networks. Implementing SFCs in the programmable data plane with high throughput and low latency is a new approach to satisfy demands of ever-growing network traffic. Previous works have proposed different solutions to solve the problem, but they all inevitably have to make trade-offs between running time and performance. For example, an ILP (Integer Linear Programming) can optimize cost but suffers from long running time in large-scale network topologies. Heuristic algorithms depend strongly on manual designs and usually have a performance gap with the optimal solution. In this paper, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> , a framework for deploying SFCs in the programmable data plane using DRL (Deep Reinforcement Learning) with graph convolutional network. In order to expand the searching space to prevent the optimal value from being missed, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> allows the RL (Reinforcement Learning) agent to simultaneously extract features from both the substrate network and the hardware pipeline, and exploit a graph convolutional network to enhance performance. Moreover, a mask mechanism is also designed to accelerate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> and improve its scalability. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> has been implemented and extensively evaluated on both P4 hardware switches (equipped with Intel Tofino ASIC) and software switches (i.e., bmv2). Experimental results show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> can automatically generate deployment solutions in a few seconds of running time after training. They also demonstrate that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dapper</i> reduces hardware stage usage and the latency of SFCs by up to 17.8% and 50 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 73% respectively on average when compared with heuristics.

Compiling Service Function Chains via Fine-Grained Composition in the Programmable Data Plane

Service function chains (SFCs) are fundamental services in today's datacenters and ISP networks. Explosive volume of network traffic creates high demands for low latency and high performance. The emergence of programmable data planes has offered a new way to overcome the problem. However, limited by pipeline constraints in hardware architecture, implementing multiple network functions on programmable data planes is challenging. Besides, considering various types of network functions, e.g., stateful network functions, a general model is essential for abstracting distinct network functions. In this article, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> which provides a fine-grained SFCs deployment scheme in programmable data planes. Control flow graph (CFG) is proposed to abstract and analyze various network functions. Then we model pipeline constraints in the hardware architecture using an ILP (Integer Linear Programming), and model the SFCs deployment in the substrate network as a one big switch (OBS) problem. To reduce deployment cost, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> first composes multiple SFCs to a compound CFG for eliminating redundant logics within SFCs, further decomposes the compound CFG based on the resource limitation per stage, and finally maps the OBS into the substrate network. We have implemented <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> in both bmv2 software switch and P4 hardware switch (i.e., Intel Tofino ASIC). Evaluation results show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> reduces switch costs by 45.7% and decreases average latency by 22% without compromising throughput.

The LOFT Attack: Overflowing SDN Flow Tables at a Low Rate

The emerging Software-Defined Networking (SDN) is being adopted by data centers and cloud service providers to enable flexible control. Meanwhile, the current SDN design brings new vulnerabilities. In this paper, we explore a stealthy attack that uses a minimum rate of attack packets to disrupt SDN data plane. To achieve this, we propose the LOFT attack that computes the lower bound of attack rate to overflow flow tables based on the inferred network configurations. Particularly, each attack packet always triggers or maintains consumption of one flow rule. LOFT can ensure the attack effect under various network configurations while reducing the possibility of being captured. We demonstrate its feasibility and effectiveness in a real SDN testbed consisting of commercial hardware switches. The experimental results show that LOFT incurs significant network performance degradation and potential network DoS at an attack rate of only tens of Kbps. To defeat the attack, we develop a data-to-control plane collaborative defense system named LOFTGuard, which is lightweight and transparent to SDN applications. Evaluations show that Guard effectively protects SDN against the attack and introduces a small overhead.

R-AQM: Reverse ACK Active Queue Management in Multitenant Data Centers

TCP incast has become a practical problem for high-bandwidth, low-latency transmissions, resulting in throughput degradation of up to 90% and delays of hundreds of milliseconds, severely impacting application performance. However, in virtualized multi-tenant data centers, host-based advancements in the TCP stack are hard to deploy from the operators’ perspective. Operators only provide infrastructure in the form of virtual machines, in which only tenants can directly modify the end-host TCP stack. In this paper, we present R-AQM, a switch-powered reverse ACK active queue management (R-AQM) mechanism for enhancing ACK-clocking effects through assisting legacy TCP. Specifically, R-AQM proactively intercepts ACKs and paces the ACK-clocked in-flight data packets, preventing TCP from suffering incast collapse. We implement and evaluate R-AQM in NS-3 simulation and NetFPGA-based hardware switch. Both simulation and testbed results show that R-AQM greatly improves TCP performance under heavy incast workloads by significantly lowering packet loss rate, reducing retransmission timeouts, and supporting 16 times (i.e., 60 to 1000) more senders. Meanwhile, the forward queuing delays are also reduced by 4.6 times.

A High-Performance Invertible Sketch for Network-Wide Superspreader Detection

Superspreaders (i.e., hosts with numerous distinct connections) remain severe threats to production networks. How to accurately detect superspreaders in real-time at scale remains a non-trivial yet challenging issue. We present SpreadSketch, an invertible sketch data structure for network-wide superspreader detection with the theoretical guarantees on memory space, performance, and accuracy. SpreadSketch tracks candidate superspreaders and embeds estimated fan-outs in binary hash strings inside small and static memory space, such that multiple SpreadSketch instances can be readily merged to provide a network-wide measurement view for recovering superspreaders and their estimated fan-outs. We present formal theoretical analysis on SpreadSketch in terms of space and time complexities as well as error bounds. We further extend SpreadSketch with a fast and small data structure that filters out the packets of high-frequency connections from sketch processing, so as to improve the update performance of SpreadSketch while maintaining the accuracy guarantees. Trace-driven evaluation shows that SpreadSketch achieves higher accuracy and performance over state-of-the-art sketches and remains accurate in detecting real-world worms and DDoS attacks. Furthermore, we prototype SpreadSketch in P4 and show its feasible deployment in commodity hardware switches.

Supporting Large Random Forests in the Pipelines of a Hardware Switch to Classify Packets at 100-Gbps Line Rate

Supporting Large Random Forests in the Pipelines of a Hardware Switch to Classify Packets at 100-Gbps Line Rate

Holistic Resource Scheduling for Data Center In-Network Computing

The recent trend towards more programmable switching hardware in data centers opens up new possibilities for distributed applications to leverage in-network computing (INC). Literature so far has largely focused on individual application scenarios of INC, leaving aside the problem of coordinating usage of potentially scarce and heterogeneous switch resources among multiple INC scenarios, applications, and users. Alas, the traditional model of resource pools of isolated compute containers does not fit an INC-enabled data center. This paper describes HIRE, a holistic INC-aware resource manager which allows for server-local and INC resources to be coordinated in unison. HIRE introduces a novel flexible resource (meta-)model to address heterogeneity and resource interchangeability, and includes two approaches for INC scheduling: (a) retrofitting existing schedulers; (b) designing a new one. For (a), HIRE presents a retrofitting API and demonstrates it with four state-of-the-art schedulers. For (b), HIRE proposes a flow-based scheduler, cast as a min-cost max-flow problem, where a unified cost model is used to integrate the different costs. Experiments with a workload trace of a 4000 machine cluster show that HIRE makes better use of INC resources by serving 8–30% more INC requests, while simultaneously reducing network detours by 20% and reducing tail placement latency by 50%.

Real-time DDoS Detection and Mitigation in Software Defined Networks using Machine Learning Techniques

Software Defined Network (SDN) is the new era of networking technology based on a centralized controller that separates the switch hardware from its operating software. The most important challenge is the security of SDN and the most prominent attack is the Distributed Denial of Service (DDoS) attack. Some of the research work done so far detects DDoS attacks using a threshold, which is usually assumed without proper scientific reason and hence may not be always accurate. The mitigation techniques used by some researchers block the host from sending the network traffic beyond a threshold, by installing drop rules in the flow table of the switch connected to that host. Doing so will not only block the attack traffic but also the genuine ones from other applications of that host. In this paper, we propose a model that calculates the threshold limit for the type of applications sending data to a particular switch, in real-time using a machine learning (ML) model, and determines whether that application traffic is DDoS traffic. After the detection, only application type sending DDoS traffic is blocked while other genuine applications are allowed to send the network traffic without any interruption. The use of a dynamic threshold, based on the current network traffic, will help in detecting DDoS efficiently.

Data-plane security applications in adversarial settings

High-speed programmable switches have emerged as a promising building block for developing performant data-plane applications. In this paper, we argue that the resource constraints and programming model of hardware switches have led to developers adopting problematic design patterns, whose security implications are not widely understood. We bridge the gap by identifying the major challenges and common design pitfalls in switch-based applications in adversarial settings. Examining five recently-proposed switch-based security applications, we find that adversaries can exploit these design pitfalls to completely bypass the protection these applications were designed to provide, or disrupt system operations by introducing collateral damage.

Cheetah: A High-Speed Programmable Load-Balancer Framework With Guaranteed Per-Connection-Consistency

Large service providers use load balancers to dispatch millions of incoming connections per second towards thousands of servers. There are two basic yet critical requirements for a load balancer: <i>uniform load distribution</i> of the incoming connections across the servers, which requires to support advanced load balancing mechanisms, and <i>per-connection-consistency</i> (PCC), i.e, the ability to map packets belonging to the same connection to the same server even in the presence of changes in the number of active servers and load balancers. Yet, simultaneously meeting these requirements has been an elusive goal. Today&#x2019;s load balancers minimize PCC violations at the price of non-uniform load distribution. This paper presents Cheetah, a load balancer that supports advanced load balancing mechanisms <i>and</i> PCC while being scalable, memory efficient, fast at processing packets, and offers comparable resilience to clogging attacks as with today&#x2019;s load balancers. The Cheetah LB design guarantees PCC for <i>any</i> realizable server selection load balancing mechanism and can be deployed in both stateless and stateful manners, depending on operational needs. We implemented Cheetah on both a software and a Tofino-based hardware switch. Our evaluation shows that a stateless version of Cheetah guarantees PCC, has negligible packet processing overheads, and can support load balancing mechanisms that reduce the flow completion time by a factor of <inline-formula> <tex-math notation="LaTeX">$2-3 \times $ </tex-math></inline-formula>.

Safe, modular packet pipeline programming

The P4 language and programmable switch hardware, like the Intel Tofino, have made it possible for network engineers to write new programs that customize operation of computer networks, thereby improving performance, fault-tolerance, energy use, and security. Unfortunately, possible does not mean easy —there are many implicit constraints that programmers must obey if they wish their programs to compile to specialized networking hardware. In particular, all computations on the same switch must access data structures in a consistent order, or it will not be possible to lay that data out along the switch’s packet-processing pipeline. In this paper, we define Lucid 2.0, a new language and type system that guarantees programs access data in a consistent order and hence are pipeline-safe . Lucid 2.0 builds on top of the original Lucid language, which is also pipeline-safe, but lacks the features needed for modular construction of data structure libraries. Hence, Lucid 2.0 adds (1) polymorphism and ordering constraints for code reuse; (2) abstract, hierarchical pipeline locations and data types to support information hiding; (3) compile-time constructors, vectors and loops to allow for construction of flexible data structures; and (4) type inference to lessen the burden of program annotations. We develop the meta-theory of Lucid 2.0, prove soundness, and show how to encode constraint checking as an SMT problem. We demonstrate the utility of Lucid 2.0 by developing a suite of useful networking libraries and applications that exploit our new language features, including Bloom filters, sketches, cuckoo hash tables, distributed firewalls, DNS reflection defenses, network address translators (NATs) and a probabilistic traffic monitoring service.

PHeavy: Predicting Heavy Flows in the Programmable Data Plane

Since heavy flows account for a significant fraction of network traffic, being able to predict heavy flows has benefited many network management applications for mitigating link congestion, scheduling of network capacity, exposing network attacks and so on. Existing machine learning based predictors are largely implemented on the control plane of Software Defined Networking (SDN) paradigm. As a result, frequent communication between the control and data planes can cause unnecessary overhead and additional delay in decision making. In this paper, we present <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pHeavy</i> , a machine learning based scheme for predicting heavy flows directly on the programmable data plane, thus eliminating network overhead and latency to SDN controller. Considering the scarce memory and limited computation capability in the programmable data plane, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pHeavy</i> includes a packet processing pipeline which deploys pre-trained decision tree models for in-network prediction. We have implemented <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pHeavy</i> in both bmv2 software switch and P4 hardware switch (i.e., Barefoot Tofino). Evaluation results demonstrate that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pHeavy</i> has achieved 85% and 98% accuracy after receiving the first 5 and 20 packets of a flow respectively, while being able to reduce the size of decision tree by 5.4x on average. More importantly, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pHeavy</i> can predict heavy flows at line rate on the P4 hardware switch.

Application Layer Packet Processing Using PISA Switches.

This paper investigates and proposes a solution for Protocol Independent Switch Architecture (PISA) to process application layer data, enabling the inspection of application content. PISA is a novel approach in networking where the switch does not run any embedded binary code but rather an interpreted code written in a domain-specific language. The main motivation behind this approach is that telecommunication operators do not want to be locked in by a vendor for any type of networking equipment, develop their own networking code in a hardware environment that is not governed by a single equipment manufacturer. This approach also eases the modeling of equipment in a simulation environment as all of the components of a hardware switch run the same compatible code in a software modeled switch. The novel techniques in this paper exploit the main functions of a programmable switch and combine the streaming data processor to create the desired effect from a telecommunication operator perspective to lower the costs and govern the network in a comprehensive manner. The results indicate that the proposed solution using PISA switches enables application visibility in an outstanding performance. This ability helps the operators to remove a fundamental gap between flexibility and scalability by making the best use of limited compute resources in application identification and the response to them. The experimental study indicates that, without any optimization, the proposed solution increases the performance of application identification systems 5.5 to 47.0 times. This study promises that DPI, NGFW (Next-Generation Firewall), and such application layer systems which have quite high costs per unit traffic volume and could not scale to a Tbps level, can be combined with PISA to overcome the cost and scalability issues.

Electrical Appliance Switching Controller by Brain Wave Spectrum Evaluation Using a Wireless EEG Headset

Disabled people are usually unable to interact with their surroundings efficiently, and performing tasks like switching an appliance on or off can be troublesome if the user is bedridden, for example. This article discusses an electrical appliance switching controller using a wireless EEG headset that is aimed to aid elderly people and the disabled. The system comprises of a MindLink EEG headset that is Bluetooth-connected to an Arduino microcontroller board. The system permits the user to separately switch on and off the 4 electrical devices connected to the power socket. The EEG signal is obtained to investigate the brain activity throughout the experiments done. Based on the brain wave signals read, attention and meditation are determined to be the most suitable for this project and is used to trigger the relay switching of the power socket. It is found that the response time to trigger the switching is slow as some users require practice or training to control their brain wave signals effectively. The work performed provides a rudimentary insight of a BCI system functionalities and presents a brainwave-controlled hardware switching for the bedridden or disabled patients.

Revisiting Network Telemetry in COIN: A Case for Runtime Programmability

Applications based on the compute-in-the-network (COIN) paradigm require flexible network telemetry data to drive effective allocation decisions. Telemetry systems collect such data based on queries specifying the precise traffic metrics or features required. Recent advances in programmable switch hardware have led to highly efficient methods to compute query results using in-network resources. However, current approaches fail to meet the simultaneous requirements of dynamic traffic loads, diverse query types, and query dynamics. In this work, we argue that telemetry systems should be cast as active runtime schedulers rather than static data sources. COIN-based applications can then dynamically submit telemetry queries on the fly and react to their results in a closed-loop fashion – enabling a new generation of telemetry-driven reactive applications. As a first step toward this vision, we present a single-switch telemetry operation scheduling method. Our empirical evaluation demonstrates that such a method can reduce overhead by an order of magnitude compared to worst case allocations. This initial exploration opens the door to a multi-tier scheduling framework combining switch hardware with software-based compute platforms to meet the telemetry demands of future COIN-based applications.

Hierarchical Electrode Switching Device Design for Distributed Single-Channel Electrical Resistivity Tomography System

An electrode switching device (ESD) is one of the most important components of electrical resistivity tomography (ERT). It is a ligament and relay between a testing circuit and testing electrodes. Existing ESD uses a plane structure to realize the interconnection between ports and testing electrodes. Taking Wenner testing as an example, each electrode needs four additional switches. In this report, a new hardware saving ESD (HESD) is made with a hierarchical structure for a single-channel distributed ERT. HESD has two-layered switches to realize the conversion process. The first layer of 16 switches can realize four pairs of unrepeated connection between four ports—AMNB and four Lines—L1–L4. The second layer establishes the non-overlapping joints between four lines—L1–L4 and four testing electrodes. Each electrode only needs one switch for an 1D test, which has been wildly used in soil science, ocean probing, and contaminated surveys, and an odd number layer test. With the newly designed HESD, three fourths of the cost of hardware (switch) was saved compared with the conventional ESD. In addition, with two more switches, HESD was able to complete a 2D survey. The new two-layer HESD saves hardware costs and shows advantages in maintenance, system tests, and miniaturization, especially when many electrodes are required in an ERT system, which is very common in practice.

Structure and non‐blocking properties of bidirectional unfolded two‐stage switches

Two-stage switch networks are an emerging design option for relatively small-capacity space switches. They are classified into two categories: folded and unfolded. Although folded switches have been well studied, research on unfolded two-stage switch networks (UTSNs) remains limited. Here, non-blocking UTSNs are considered. First, a new UTSN design is presented that consists of input and output switch modules (ISMs and OSMs) using bidirectional switching techniques. The proposed UTSN is represented by B(n, m, r), where n, m, and r denote the number of input ports of the ISM, number of OSMs, and number of ISMs, respectively. Second, the maximum number of rearrangements for B(n, n, r) is proved to be ⌊ ( r − 1 ) / 2 ( n − 1 ) ⌋ in general, whereas it is limited to two when n ≥ r. The strictly non-blocking condition for B(n, m, r) to be m ≥ n + 1 is also determined. Finally, it is shown that the switch hardware complexity becomes minimal at n = N / 2 and saturates at N2/2 as N → ∞.

Comparison of Software Defined Networking with Traditional Networking

The Internet has caused the advent of a digital society; wherein almost everything is connected and available from any place. Thus, regardless of their extensive adoption, traditional IP networks are yet complicated and arduous to operate. Therefore, there is difficulty in configuring the network in line with the predefined procedures and responding to the load modifications and faults through network reconfiguring. The current networks are likewise vertically incorporated to make matters far more complicated: the control and data planes are bundled collectively. Software-Defined Networking (SDN) is an emerging concept which aims to change this situation by breaking vertical incorporation, promoting the logical centralization of the network control, separating the network control logic from the basic switches and routers, and enabling the network programming. The segregation of concerns identified between the policies concept of network, their implementation in hardware switching and data forwarding is essential to the flexibility required: SDN makes it less complicated and facilitates to make and introduce new concepts in networking through breaking the issue of the network control into tractable parts, simplifies the network management and facilitate the development of the network. In this paper, the SDN is reviewed; it introduces SDN, explaining its core concepts, how it varies from traditional networking, and its architecture principles. Furthermore, we presented the crucial advantages and challenges of SDN, focusing on scalability, security, flexibility, and performance. Finally, a brief conclusion of SDN is revised.

C2QoS: Network QoS guarantee in vSwitch through CPU-cycle management

Cyber–Physical–Social–System (CPSS) relies on cloud and edge computing for service deployment and acceleration. As an enabling technology of CPSS, network virtualization allows different services to be deployed on a single physical server and provides them with differentiated network performance based on service-level-agreement (SLA). Unfortunately, current virtual switches (vSwitches) cannot guarantee this functionality due to the common resource competition and unpredictable processing capacity. As a software process on the server, vSwitch is allocated limited dedicated CPU cores to implement traffic forwarding for all services. But the QoS strategy inheriting from the hardware switch, does not consider the forwarding tasks’ competition for CPU cores in terms of utilization and timing, thus cannot guarantee the SLA. To solve this critical issue, we propose a CPU-cycle based QoS (C2QoS) strategy to realize the isolation and guarantee of service network performance by managing the usage and scheduling of the IO-dedicated CPU cores in vSwitch. C2QoS includes a CPU-cycle based token bucket mechanism to strictly limit service’s network bandwidth and a hierarchical batch scheduling mechanism to achieve hierarchical latency. Experimental results show that, compared with existing strategies, C2QoS can strictly guarantee the network bandwidth of the services and reduce the service latency by up to 80%.