A Review of P4 Programmable Data Planes for Network Security

The exponential growth in the number of devices connected via the internet has led to the need to achieve granular programmability for increased performance, resilience, reduced latency, and jitter. Software Defined Networking (SDN) and Programming Protocol independent Packet Processing (P4) are designed to introduce programmability into the control and data plane of networks, respectively. Despite their individual potential and capabilities, the performance of combining SDN and P4 remains underexplored. This study presents a comprehensive evaluation of SDN with data plane programmability using P4 (SDN+P4) against traditional SDN with Open vSwitch (SDN+OvS), aimed at answering the hypothesis that combining SDN and P4 strengthens the control and data plane programmability and offers improved management and adaptability, which would provide a platform with faster packet processing with reduced jitter, loss, and processing overhead. Mininet was employed to emulate three distinct topologies: multi-path, grid, and transit-stub. Various traffic types were transmitted to assess performance metrics across the three topologies. Our results demonstrate that SDN+P4 outperform SDN+OvS significantly due to parallel processing, flexible parsing, and reduced overhead. The evaluation demonstrates the potential of SDN+P4 to provide a more resilient and stringent service with improved network performance for the future internet and its heterogeneity of applications.

<p>Software-Defined-Networking (SDN) simplifies the configuration complexity in the computer communication network by decoupling the control plane from the data plane in a switch. In SDN, the switch has the data plane only and is configured by the logically centralised controller which simplifies the forwarding of packets in the network. However, an SDN switch is sensitive to delay and loss of packets which significantly affects the network performance. This thesis uses queueing theory to conduct modelling and performance analysis of OpenFlow-based SDN switches. OpenFlow is the de-facto protocol for communication between an SDN switch and the controller. Using queueing theory, three aspects of packet processing in an SDN switch are explored. First, the existing research has primarily modelled the output buffer of an SDN switch using two buffer sharing mechanisms: the single shared buffer and the priority buffer. However, the effect of buffer dimensioning in these buffer sharing mechanisms has not been investigated. Buffer dimensioning helps in determining the minimum buffer capacity for a desired loss probability. The research in this thesis shows that the use of priority buffer in an SDN switch reduces the time to update flow tables than the shared buffer but at the cost of a higher buffer capacity. Second, much of the existing research has not investigated the impact of internal buffering of data packets whereby a fraction of a data packet header is sent to the controller instead of an entire data packet. To investigate the impact of internal buffering, the queueing model for an SDN switch with the internal buffer is developed. The investigation shows that at the time of congestion, the internal buffer in an SDN switch improves the network performance with lower delay and lower packet loss. Finally, existing research has focused on a software switch in SDN and very little research has studied the performance of a hardware switch. To characterise the performance of SDN-based hardware and software switches and identify the tradeoffs between them, a unified queueing model has been developed. The unified queueing model is an analytical tool for network engineers to predict delay and packet loss in their SDN deployments. The analysis shows the benefits of a hardware switch over a software switch. These benefits are lower delay and lower packet loss. However, the increasing involvement of the controller reduces the benefit of using a hardware switch, i.e. forwarding packets at the line speed rate. This research guides network designers and analysts in the selection of the shared or buffer model for an SDN switch for their desired Quality of Service (QoS). Furthermore, the developed queueing model for an SDN switch with the internal buffer studies the impact of internal buffering in an SDN switch. Finally, the unified queueing model helps in the selection of a software or hardware switch in SDN.</p>

Software-Defined Networking (SDN) promises the vision of more flexible and manageable networks, but requires certain level of programmability in the data plane. Such a flexible, programmable data plane implementation is OpenFlow (OF) which these days is seen as primary model of SDN data plane. In this paper we focus on the limitations of OF in packet switching performance. We share some measurement results we collected using an OF 1.3 prototype based on Intel's Data Plane Development Kit (DPDK) and we also describe some optimization ideas. While OF 1.0 can be implemented on high-speed Ethernet switch hardware it has certain disadvantages in the area of flexibility. On the other hand OF 1.3 offers good-enough flexibility, but the poor performance of OF 1.3 implementations seems to represent a roadblock to SDN adoption. In this paper we argue that contrast to the common view, the overhead of flexibility is relatively low. We also argue that the apparent difference between a programmable data plane and a state of the art layered data plane is not primarily due to flexibility itself, but because the lack of optimization in case of flexible implementations.

Software Defined Networking (SDN) is the more reliable and flexible networking architecture. Due to its programmable nature, it is getting more popular in every research domain of Computing. Moreover, Named Data Networking (NDN) architecture is also more beneficial and emerging technology of Internet. NDN focuses on the content name instead of its location and replaces the usage of IP addresses. Lot of research has been made to integrate SDN and NDN due to their benefits of better management-ability, flexibility, less complexity, centralized control, decoupled control and data planes etc. Mobile Ad Hoc Network (MANET) is also getting more popular due to huge advancement in Mobile communication devices. Combining SDN and NDN in MANET will resolve lots of problems (i.e. forwarding, mobility, management etc.) which are difficult to tackle with single architecture. Broadcast Storm is always a challenging issue in Ad Hoc networks like MANET. In this paper, we proposed a Controller based Selective Forwarding (CSF) scheme by merging SDN, NDN and MANET to overcome the Broadcast Storm Problem (BSP) and other issues caused by BSP. CSF is evaluated using different simulation parameters which shows superiority over the Native ND-MANET in reference to BSP.

Software-Defined Networking (SDN) switch vendors are interested in extending switch data planes to support new and continuously evolving network protocols (e.g., NVGRE, VXLAN). Numerous commercial programmable data plane devices already enable a programmer to specify various aspects of the data plane including packet parsing, actions, and the layout of packet processing on the hardware device itself. Unlike OpenFlow-based devices, which only expose a series of fixed match-action table (MAT) abstraction, these specialized devices provide a more flexible abstraction for packet processing. Despite the increased programmability that these devices offer, however, the architecture of the target restricts the features that can be exposed to the programmer. Similarly, existing languages for programming the data planes in such devices (e.g., P4) assume a specific computational model, resembling the architecture of the device for which they are targeted for. Unfortunately, this model leads to similar limitations as in OpenFlow, where the high-level specification is coupled to the underlying device model.In this paper, we introduce NetASM, an intermediate representation for programmable data planes. NetASM is a device-independent language that is expressive enough to act as the target language for compilers for high-level languages, yet low-level enough to be efficiently assembled on various device architectures. It enables conventional compiler optimization techniques to significantly improve the performance and resource utilization of custom packet-processing pipelines on a variety of targets.

Software Defined Networking (SDN) is the new promise towards an easily configured and remotely controlled network. Based on Centralized control, SDN technology has proved its positive impact on the world of network communications from different aspects. Security in SDN, as in traditional networks, is an essential feature that every communication system should possess. In this paper, we propose an SDN security design approach, which strikes a good balance between network performance and security features. We show how such an approach can be used to prevent DDoS attacks targeting either the controller or the different hosts in the network, and how to trace back the source of the attack. The solution lies in introducing a third plane, the security plane, in addition to the data plane, which is responsible for forwarding data packets between SDN switches, and parallel to the control plane, which is responsible for rule and data exchange between the switches and the SDN controller. The security plane is designed to exchange security-related data between a third party agent on the switch and a third party software module alongside the controller. Our evaluation shows the capability of the proposed system to enforce different levels of real-time user-defined security with low overhead and minimal configuration.

Software-Defined Networking (SDN) has redefined the architectural blueprint for designing networks suitable for future applications. Today, the idea of a centralized control plane managing its underlying resources is common for architectures in mobile and industrial networks. Guaranteeing resources availability for optimal operation of the control plane is of vital importance in SDN, since compromising the controller may result in an unforeseen behaviour in the data plane. This work focuses on the SDN reactive configuration mechanism, that although originally designed for the efficient handling of changing conditions in the data plane, it can be easily misused to overload the control plane. Aiming at addressing this problem, the PDP (Programmable Data Plane)-based Controller Protection Protocol (PCPP) is presented. This protocol introduces a mechanism that efficiently filters spoofed requests at the network edge. In PCPP, end-stations require to solve a challenge before sending any connection request to the controller. The challenge answer is checked at the edge switches, which only forward valid requests to the controller. PCPP is implemented using P4, a language for programming PDP-capable devices, and its evaluation is carried out using BMv2 software switches. The results demonstrate the effectiveness of PCPP at protecting bandwidth and processing resources in the control plane against spoofed requests. A comparison against an state-of-the-art alternative not only highlights the higher efficiency of PCPP, but also its application flexibility.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

In this paper, we consider IP fast recovery from single-link failures in a given network topology. The basic idea is to replace some existing routers with a designated switch. When a link fails, the affected router will send all the affected traffic to the designated switch (through pre-configured IP tunnels), which will deliver the affected traffic to its destination without using the failed link. The goal of the approach is to achieve faster failure recovery than traditional routing protocols that employ reactive computing upon link failures. Software-Defined Networking (SDN) switches can serve as the designated switches because they can flexibly redirect affected traffic to other routes, instead of only to the shortest paths in the network. However, SDN switches are very expensive. Our objective is to minimize the number of SDN switches needed and to guarantee that the network can still recover from any single-link failure. For networks with uniform link costs, we show that using normal non-SDN switches with IP tunneling capability as designated switches can guarantee recovery from any single-link failure. For networks with general link costs, we find that not all single-link failures can be recovered by using non-SDN switches as designated switches; by using SDN switches only when necessary, we can reduce the total number of SDN switches needed compared to an existing work. We conduct extensive simulations to verify our proposed approaches.

Software-Defined Networking (SDN) decouples the control plane and the data plane in network switches and routers, which enables the rapid innovation and optimization of routing and switching configurations. However, traditional routing mechanisms in SDN, based on the Dijkstra shortest path, do not take the capacity of nodes into account, which may lead to network congestion. Moreover, security resource utilization in SDN is inefficient and is not addressed by existing routing algorithms. In this paper, we propose RouteGuardian, a reliable security-oriented SDN routing mechanism, which considers the capabilities of SDN switch nodes combined with a Network Security Virtualization framework. Our scheme employs the distributed network security devices effectively to ensure analysis of abnormal traffic and malicious node isolation. Furthermore, RouteGuardian supports dynamic routing reconfiguration according to the latest network status. We prototyped RouteGuardian and conducted theoretical analysis and performance evaluation. Our results demonstrate that this approach can effectively use the existing security devices and mechanisms in SDN.

With the growth of network applications such as 5G and artificial intelligence, network security techniques, i.e., the techniques that detect various attacks (e.g., well-known denial-of service (DDoS) attacks) and prevent production networks (e.g., data center networks) from being attacked, become increasingly essential for network management and have gained great popularity in the networking community. Generally, these techniques are built on proprietary hardware appliances, i.e., middleboxes, or the paradigm that combines both software-defined networking (SDN) and network function virtualization (NFV) to implement security functions. However, the techniques built on middleboxes are proven to be hard-to-manage, costly, and inflexible, thereby making them an out-of-date choice in network security. For the techniques built on SDN and NFV, they virtualize and softwarize security functions on commodity servers, leading to non-trivial performance degradation. Fortunately, the recent emergence of programmable switches brings new opportunities of empowering network security techniques with the characteristics of easy-tomanage, low cost, high flexibility, and Tbps-level performance. In this survey, we focus on this promising trend in network security. More precisely, this survey first presents the preliminaries of programmable switches, which are the primary driver of next-generation network security techniques. Next, we comprehensively review existing techniques built on programmable switches, classify these techniques, and discuss their background, motivation, design, implementation, and limitations case-by-case. Finally, we summarize open issues and future research directions in this promising research topic of network security.

Software-defined networking (SDN) scheme decouples network control plane and data plane, which can improve the flexibility of traffic management in networks. OpenFlow is a promising implementation instance of SDN scheme and has been applied to enterprise networks and data center networks in practice. However, it has less effort to spread SDN control scheme over the Internet to conquer the ossification of inter-domain routing. In this paper, we further innovate to the SDN inter-domain routing inspired by the OpenFlow protocol. We apply SDN flow-based routing control to inter-domain routing and propose a fine-granularity inter-domain routing mechanism, named SDI (Software Defined Inter-domain routing). It enables inter-domain routing to support the flexible routing policy by matching multiple fields of IP packet header. We also propose a method to reduce redundant flow entries for inter-domain settings. And, we implement a prototype and deploy it on a multi-domain testbed.

The proposed Internet paradigm The Flying Ad Hoc Network (FANET), Named Data Network (NDN), and Software Defined Network (SDN) have attracted the interest of the scientific community. The TCP/IP protocol is the present Internet standard, while NDN is the future internet architecture that builds on it. Data availability is improved via NDN, which substitutes named data for the nodes' addresses. SDN is a good option for communicating effectively, utilizing resources effectively, and supporting developing technologies. The SDN has attracted interest because of its high-level programmability and flexibility. Numerous applications in the military, business, and civil sectors make extensive use of FANE T. The broadcast characteristic of NDN causes an issue known as a broadcast storm in dense FANET environments. The issue is caused by duplicate packets, which raises the overall amount of traffic and retransmissions. FANET has a problem with the timely and quick transmission of essential packets. In this paper, we suggested a new scheme named "Novel Adaptive Broadcast Storm Avoidance (NABA)" for SDN and NDN-enabled FANET, which uses a controller to lessen the broadcast issue. Our scheme made use of the SDN controller's effective flow management to regulate the broadcast storm and facilitate packet transfers. Additionally, we divided up the packet into categories based on priority. The priority of the packet is determined by the naming criterion. In terms of the overall number of Interests and content retrieval time, the findings show that NAB A performs better than native NDN floods.

Software Defined Networking (SDN) is a new paradigm proposed to meet the requirements of new networking concepts such as cloud computing and data center networking. SDN decouples control and data planes and uses a logically centralized controller to manage the underlying network resources. In this paper, a joint server and route selection mechanism is proposed for SDN networks, where current and past statistics of network resource utilization are taken into account to allocate a server and a corresponding routing path for each incoming flow. The proposed mechanism periodically and automatically updates the link cost metrics of link state routing protocol to achieve the load balancing in the network. The proof of concept has been implemented using Mininet to emulate OpenFlow enabled switches and OpenDaylight as an SDN controller. Using the real IP traffic, we successfully demonstrated that the proposed system evenly distributes traffic flows among network links and servers.

This paper is based on the fair analysis on the economic benefits of software defined networking. The paper will explain vividly the concept of software defined networking and its applications together with the economic advantage(s) with respect to both the client perspective and server perspective. In general, SDN provides lower hardware and operational cost in an excessive traffic load of nowadays users. It has tighter security and faster response time with improved management and planning of server controller. SDN when deployed provides better service(s) with respect to lowering cost and of course with better efficiency. Software Defined Network (SDN) is a great revolutionary idea to change IT Industry of which includes cloud computing and many others. The beauty of its architecture is the decoupling of the essential control and data planes from the application layer, thus the underlying infrastructure is abstracted but the network intelligence is logically centralized with state. This architecture gives access to the enterprise to control, program, automate, scale and secure the network according to the business needs, together with securing a safe benefit in competiveness that has risen due to fast advancement in technology. This architecture is even more important to fulfilling the demands of various clients in the current model of networking. The concept of SDN has the potential to change the current networking model. With SDN, for network services, the underlying network infrastructure can be abstracted by the administrators for many applications. In theory, it can be shown that SDN has many benefits over current IT systems but in practical systems, IT companies are reluctant to work with, tend to oppose nor are they ready to deploy SDN. In this paper, the economic benefits are explored and discussed without bias, and it will be shown that new protocol of SDN provides many economic benefits and guidance to IT companies to establish more secure and efficient network.