This paper presents a scalable and efficient solution for secure network design that involves the selection and verification of network paths. The proposal addresses the challenges related to compliance policies by introducing a Proof-of-Transit (PoT) feasible implementation for path-aware programmable networks. Our approach relies on i) a source routing mechanism based on a fixed routeID representing a unique identifier per path, which serves as a key for PoT lookup tables; ii) the "in situ" that allows to collect telemetry information in the packet while the packet traverses a path. The former enables path selection with policy at the edge, while the later allows to perform path verification without extra probe-traffic. A P4 programmable language prototype demonstrates the effectiveness of this approach to protect against deviation attacks with low overhead. The results show its scalability considering the protocol overhead as the path length increases; a significant reduction in network’s forwarding state for fat-tree topologies depending on the workload per path (flows/path). Finally, experimental results show a RTT comparison evaluation, the impact of PoT computation, protection to path deviation and seamless path migration keeping flow protection.

Innovative traffic engineering functions and services require disrupting routing and forwarding mechanisms to be performed with low overhead over complex network topologies. Source routing (SR) is a prominent alternative to table-based routing for providing the needed expressiveness and agility by reducing the number of network states. This work proposes the M-PolKA, a topology-agnostic multipath source routing scheme and orchestration architecture for reliable communications, which explores special properties from the Residue Number System (RNS) polynomial arithmetic. A P4-based proof-of-concept is experimentally demonstrated using emulated and hardware prototypes. Also, use cases for revealing M-PolKA’s functionalities are tested in different scenarios in order to address problems, such as communication reliability improvement, agile path migration and fast failure reaction. Finally, low overhead for extra functionalities is observed when RNS-based SR is compared to traditional routing approaches.

Self-driving networks guided by machine-learning (ML) algorithms are the driving force for building networks of the future. ML is effective at making inferences about data that is too complex or too unpredictable for humans. The network softwarization enabled by a deep programmability approach opens up new opportunities to deploy ML at the programmable data plane. In this paper, we introduce the MAP4 as a framework that explores the feasibility of mapping ML models in programmable network devices. To achieve this, we rely on the P4 language to deploy a pre-trained model into a programmable switch, utilizing the ML model to accurately classify flows at line rate. Our approach demonstrates that ML models working as classifiers can better fit the data by using the new levels of network programmability from the P4 language. The results showed that with few packets, most of the flows are properly classified. In some use cases, with two packets in the flow, 97% of traffic can be correctly classified, and all classes are properly labeled with a maximum of four packets.

Deploying accurate machine learning algorithms into a high-throughput networking environment is a challenging task. On the one hand, machine learning has proved itself useful for traffic classification in many contexts (e.g., intrusion detection, application classification, and early heavy hitter identification). On the other hand, most of the work in the area is related to post-processing (i.e., training and testing are performed offline on previously collected samples) or to scenarios where the traffic has to leave the data plane to be classified (i.e., high latency). In this work, we tackle the problem of creating simple and reasonably accurate machine learning models that can be deployed into the data plane in a way that performance degradation is acceptable. To that purpose, we introduce a framework and discuss issues related to the translation of simple models, for handling individual packets or flows, into the P4 language. We validate our framework with an intrusion detection use case and by deploying a single decision tree into a Netronome SmartNIC (Agilio CX 2x10GbE). Our results show that high-accuracy is achievable (above 95%) with minor performance degradation, even for a large number of flows.

5G relies on its pervasive and convergent cloud-based architecture to accomplish its futuristic challenge of being the next-generation communication platform. However, the new perspectives opened by 5G networks do not go unnoticed. Regardless of their motivation or objectives, cyberattackers find in the new 5G ecosystem, including its tenancy-driven control plane, an attractive greenfield to create new types of denial of services attacks. In this article, we leverage on the virtualised environment of 5G to propose REPEL – an intelligent resource scaling strategy to mitigate DDoS signalling attacks preserving legitimate traffic. Our prevention-based approach uses games theory to build up a defence front line, able to keep services availability and discourage the attacker. To demonstrate the effectiveness and feasibility of our approach, we feed a queuing model with parameters obtained from a testbed, where simulated subscribers connect to a virtualised evolved packet core prototype. The final results show a dramatic signalling losses reduction, which can ensure the appropriate control plane availability under a DDoS attack.

Due to its ubiquitous use, WiFi may play an essential role in providing indoor connectivity for the new real-time services in several 5G verticals. However, there are still pressing issues to be addressed, requiring new mobility management schemes to guarantee reliable and low latency communications. In this paper, we propose a novel SDN-NFV based architecture with a low cost off-the-shelf WiFi that explores a multiconnectivity scheme at the user devices. In order to demonstrate the feasibility of our approach, we developed a prototype and performed experiments on seamless handover using: i) an SDNNFV based packet duplication solution; and ii) a source-routing solution for end-to-end communication. Results show that the proposed architecture can provide an efficient seamless handover, increasing the likelihood of delivering packets with minimal effects on latency.

Wireless networks have become in the last years a key enabling technology for cloud-enabled robots. Among those, the usage of WiFi is a first choice due to its almost ubiquitous use nowadays. However, WiFi suffers from crucial issues like spectrum interference, connectivity losses, long delay for client association and high latency handover. This work proposes a novel architectural split of the WiFi functionalities based on an enhanced software-defined wireless architecture. Cloud-enabled robots scenarios are addressed to derive results showing that the proposed architecture allows uninterrupted communication during handovers, and a quicker failover management.