P4 Edge Node Enabling Stateful Traffic Engineering and Cyber Security

Paolucci, F.; Civerchia, Federico; Sgambelluri, Andrea; Giorgetti, A.; Cugini, F.; Castoldi, P.

doi:10.1364/jocn.11.000a84

Cited by 68 publications

(29 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Paolucci et al [27], [28] propose a DDoS mitigation mechanism that runs on P4 switches. A stateful mechanism detects and blocks DDoS port scan attacks with incremental TCP and UDP destination port numbers.…”

Section: ) Ddos Mitigation Mechanismsmentioning

confidence: 99%

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

et al. 2020

View full text Add to dashboard Cite

In this work, we present P4-IPsec, a concept for IPsec in software-defined networks (SDN) using P4 programmable data planes. The prototype implementation features ESP in tunnel mode and supports different cipher suites. P4-capable switches are programmed to serve as IPsec tunnel endpoints. We also provide a client agent to configure tunnel endpoints on Linux hosts so that site-to-site and host-tosite application scenarios can be supported which are the base for virtual private networks (VPNs). While traditional VPNs require complex key exchange protocols like IKE to set up and renew tunnel endpoints, P4-IPsec benefits from an SDN controller to accomplish these tasks. One goal of this experimental work is to investigate how well P4-IPsec can be implemented on existing P4 switches. We present a prototype for the BMv2 P4 software switch, evaluate its performance, and publish its source code on GitHub [1]. We explain why we could not provide a useful implementation with the NetFPGA SUME board. For the Edgecore Wedge 100BF-32X Tofino-based switch, we presented two prototype implementations to cope with a missing crypto unit. As another contribution of this paper, we provide technological background of P4 and IPsec and give a comprehensive review of security applications in P4, IPsec in SDN, and IPsec data plane implementations. According to our knowledge, P4-IPsec is the first implementation of IPsec for P4-based SDN.

show abstract

Section: ) Ddos Mitigation Mechanismsmentioning

confidence: 99%

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The four solutions found have used similar approaches to deal with the above problem. They exploit the data plane programmability to offload down to the network the process of filtering and counting traffic, previously performed by the DPI application on the SDN Controller.…”

Section: Related Workmentioning

confidence: 99%

“…In the most recent work, Paolucci et al, proposed a new node architecture with a P4 switch for an edge multilayer packet over optical node. This P4‐enabled node provides native support of a DPI solution and two P4‐based TE solutions for latency‐sensitive traffic: traffic offloading and dynamic optical bypass.…”

Section: Related Workmentioning

confidence: 99%

“…It is worth mentioning that the real‐time network applications are constrained to a small‐time budget (dozens of nanoseconds) and a limited memory space (eg, ≈50 MB SRAM and ≈5 MB TCAM) . In this scenario, traditional SDN solutions (eg, OpenFlow) are not recommended as they require the intervention of the SDN controller for all forwarding procedures based on network state or profile variation, leading to scalability and latency issues in the data plane . Facing this problem, we argue that the new concept of Programmable Data Plane can help us achieve this goal.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A real‐time attack defense framework for 5G network slicing

et al. 2020

View full text Add to dashboard Cite

Network Slicing (NS) is a key enabler to support 5G network services on-demand. However, since NS is a result of the recent advancement in Software-Defined Networking and Network Function Virtualization, it introduces new security issues which include attacks against an NS instance within an operator network and interslice security threats. In this scenario, identifying and mitigating attacks in real-time is of paramount importance to improve security aspects. However, it is far from being straightforward. Therefore, this work proposes the FrameRTP4, a P4-based framework that aims to deliver real-time attack detection and mitigation mechanisms in 5G NS scenarios. For this, it provides a P4-based switch that implements an Service Function Chaining protocol layer, an efficient and scalable Access Control List for the detection and mitigation of known attacks, and a monitoring system aiming to reduce the overhead induced on the control channel. Furthermore, it delivers an orchestrator that aims to control all switches in order to enable lifecycle management of NS instances and P4 table rules. Besides, it also performs some autonomous tasks such as the wildcard rules generation and the detection of new threats by using machine learning algorithms. Preliminary results point to the potential benefits of FrameRTP4 to be part of a 5G NS infrastructure. K E Y W O R D S5G, bloom filter, cybersecurity, network function virtualization, network slice, P4

show abstract

“…F. Paolucci et al [17] proposed the adoption of P4 technology in an SDN multilayer packet-over-optical network to enable advanced data plane programmability. In particular, the work proposed an edge node architecture that includes a P4 switch with support of deep packet inspection.…”

Section: Related Workmentioning

confidence: 99%

Lightweight edge authentication for software defined networks

et al. 2020

View full text Add to dashboard Cite

OpenFlow is considered as the most known protocol for Software Defined Networking (SDN). The main drawback of OpenFlow is the lack of support of new header definitions, which is required by network operators to apply new packet encapsulations. While SDN's logically centralized control plane could enhance network security by providing global visibility of the network state, it still has many side effects. The intelligent controllers that orchestrate the dumb switches are overloaded and become prone to failure. Delegating some level of control logic to the edge or, to be precise, the switches can offload the controllers from local state based decisions that do not require global network wide knowledge. Thus, this paper, to the best of our knowledge, is the first to propose the delegation of typical security functions from specialized middleboxes to the data plane. We leverage the opportunities offered by programming protocol-independent packet processors (P4) language to present two authentication techniques to assure that only legitimate nodes are able to access the network. The first technique is the port knocking and the second technique is the One-Time Password. Our experimental results indicate that our proposed techniques improve the network overall availability by offloading the controller as well as reducing the traffic in the network without noticeable negative impact on switches' performance.

show abstract

P4 Edge Node Enabling Stateful Traffic Engineering and Cyber Security

Cited by 68 publications

References 34 publications

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

A real‐time attack defense framework for 5G network slicing

Lightweight edge authentication for software defined networks

Contact Info

Product

Resources

About