The increasing severity of Internet threats and the rapid digitization process worldwide have made network security more important than ever. Proactive defense technologies, such as threat traceback, have become essential for protection. However, current threatener traceback systems are not feasible due to lack of sufficient information, low reliability of traceback results, and an inability to meet both universality and lightweight. To address these issues, a practical threatener traceback model in IPv6 networks (Trace6) has been developed using the unique features of the huge IPv6 address space and extended address field. Trace6 proposes user information generated addresses that are rich in user information to determine the mapping relationship between natural persons and addresses. It introduces and combines two technologies, user authentication and address verification, to strengthen the determined mapping relationship. Furthermore, Trace6 enhances the address lease after Portal authentication and distinguishes the address status to ensure that it is both universal and lightweight. The experimental results from the prototype system’s tests indicate that Trace6 can further ensure reliability, universality, and lightweight while maintaining effectiveness.

QUIC is a new transmission protocol parallel with TCP. Compared to TCP, QUIC has advantages, but still, apparent bottlenecks need to be optimized. The optimization method follows the TCP research route. The mainstream is the hardware offloading technology, which offloads the computing-intensive functional modules to the network equipment, and the hardware processing replaces the host CPU for computing. However, the performance of hardware offloading is high, but the versatility and programmability are not guaranteed. To overcome the limitation above, we proposed an offloading model named NanoBPF, based on the RISC multicore DPU. The model modified the boot code of the Bootloader, guided and activated the BPF code as a runtime environment, and offloaded the QUIC's cryption module, which is high CPU occupancy. The model prototype is verified by dual host interconnection and Docker-based simulation topology. Experimental results showed that the offloading of en/decryption improved the throughput by nearly 13% and guaranteed fairness with TCP under certain conditions.

Reconfigurable match tables (RMT) is a pro-grammable pipeline architecture for packet processing. The ar-chitecture searches for action instructions by matching keywords in the packet header vector to modify the packet header. Among them, exact matching uses hash matching, while mask matching is currently more widely implemented using the Ternary Content Addressable Memory (TCAM). TCAM has high classification performance, but its high cost and power consumption make it difficult to scale to large-scale rule sets. MBitTree, a decision tree based on multi-bit cutting implemented on FPGA, is considered to be one of the most scalable packet classification algorithms due to its fast classification speed and low memory footprint. Therefore, MBitTree is applied in the matching action stage of RMT to improve the mask matching and reduce the memory overhead of RMT. According to the characteristics of RMT pipeline, MBitTree is mapped and optimized to improve pipeline efficiency and make full use of hardware resources. In addition, for the first time, we propose to move the key extractor in each stage of RMT to the action engine of the previous stage to save the memory overhead and processing time caused by the key extractor in each stage. We implement a prototype RMT based on MBitTree matching on FPGA, and the implementation results show that our method can achieve a throughput of over 200 Gbps for 10K rule sets and greatly reduce the memory overhead.