Next-generation edge nodes interfacing innovative IT clusters, 5G fronthaul, and internet of things (IoT) gateways to the optical metro/core network will require advanced and dynamic online quality of service (QoS) per-flow traffic treatment, assuring ultra-low latency requirements. However, current software-defined networking (SDN) implementations (e.g., OpenFlow) do not support forwarding procedures based on the network state, profile variations, and the history of flowstatistics at the node level. Currently, such procedures require intervention by the SDN controller, leading to scalability issues and additional latency in data plane forwarding. Moreover, severe security challenges are expected to affect such nodes and threaten IT resources. Thus, increasing bandwidths will require direct deep packet inspection to avoid involvement of the SDN controller, as performed currently, or dedicated and costly security systems. This paper leverages on the potential of the programming protocol-independent packet processors (P4) open source language, recently introduced by the inventors of OpenFlow, to program the data plane structure and behavior of an SDN switch. P4 is able to instantiate custom pipelines and stateful objects, enabling complex workflows, user-defined protocols/headers, and finite state machines enforcement. Moreover, P4 allows portable implementations over different hardware targets, thus opening the way to open source fully programmable devices. Special effort is dedicated to motivate and apply P4 within a multilayer edge scenario, proposing the architecture and the applicability of an SDN P4-enabled packet-over-optical node. Moreover, three specific multilayer use cases covering dynamic traffic engineering (TE) (e.g., traffic offload and optical bypass) and cybersecurity (e.g., distributed denial of service port scan) are discussed and addressed through P4-based solutions. Experimental evaluations have been conducted over a multilayer SDN network exploiting reference P4 software switches (i.e., the behavioralmodel version 2, or BMV2) and field-programmable gate arrays (FPGAs) at 10 gigabit Ethernet optical interfaces. Extensive results report effective dynamic TE and cybersecurity mitigation enforcement at P4 switches without any controller intervention, showing excellent scalability performance and overall latencies practically in line with current commercial OpenFlow switches.

P4 edge node enabling stateful traffic engineering and cyber security

Paolucci, F.;Civerchia, F.;Sgambelluri, A.;Giorgetti, A.;Cugini, F.;Castoldi, P.
2019-01-01

Abstract

Next-generation edge nodes interfacing innovative IT clusters, 5G fronthaul, and internet of things (IoT) gateways to the optical metro/core network will require advanced and dynamic online quality of service (QoS) per-flow traffic treatment, assuring ultra-low latency requirements. However, current software-defined networking (SDN) implementations (e.g., OpenFlow) do not support forwarding procedures based on the network state, profile variations, and the history of flowstatistics at the node level. Currently, such procedures require intervention by the SDN controller, leading to scalability issues and additional latency in data plane forwarding. Moreover, severe security challenges are expected to affect such nodes and threaten IT resources. Thus, increasing bandwidths will require direct deep packet inspection to avoid involvement of the SDN controller, as performed currently, or dedicated and costly security systems. This paper leverages on the potential of the programming protocol-independent packet processors (P4) open source language, recently introduced by the inventors of OpenFlow, to program the data plane structure and behavior of an SDN switch. P4 is able to instantiate custom pipelines and stateful objects, enabling complex workflows, user-defined protocols/headers, and finite state machines enforcement. Moreover, P4 allows portable implementations over different hardware targets, thus opening the way to open source fully programmable devices. Special effort is dedicated to motivate and apply P4 within a multilayer edge scenario, proposing the architecture and the applicability of an SDN P4-enabled packet-over-optical node. Moreover, three specific multilayer use cases covering dynamic traffic engineering (TE) (e.g., traffic offload and optical bypass) and cybersecurity (e.g., distributed denial of service port scan) are discussed and addressed through P4-based solutions. Experimental evaluations have been conducted over a multilayer SDN network exploiting reference P4 software switches (i.e., the behavioralmodel version 2, or BMV2) and field-programmable gate arrays (FPGAs) at 10 gigabit Ethernet optical interfaces. Extensive results report effective dynamic TE and cybersecurity mitigation enforcement at P4 switches without any controller intervention, showing excellent scalability performance and overall latencies practically in line with current commercial OpenFlow switches.
2019
File in questo prodotto:
File Dimensione Formato  
jocn-P4-REV.pdf

accesso aperto

Tipologia: Documento in Post-print/Accepted manuscript
Licenza: Creative commons (selezionare)
Dimensione 933.74 kB
Formato Adobe PDF
933.74 kB Adobe PDF Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11382/527715
 Attenzione

Attenzione! I dati visualizzati non sono stati sottoposti a validazione da parte dell'ateneo

Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 67
social impact