In the era of high-performance cloud computations, networks need to ensure fast packet forwarding. This task is carried by TCAM forwarding chips that perform line-rate Longest Prefix Matches in a Forwarding Information Base (FIB). However, with the increasing number of prefixes in IPv4 and IPv6 routing tables the price of TCAM increases as well. In this work, we present a novel FIB compression technique by adding an aggregation layer into a FIB caching architecture. In Combined FIB Caching and Aggregation (CFCA), cache-hit ratio is maximized up to 99.94% with only 2.50% entries of the FIB, while the churn in TCAM is reduced by more than 40% compared to low-churn FIB aggregation techniques.

Ternary Content-Addressable Memory (TCAM) chips are used to store Forwarding Information Bases (FIB) in modern routers. TCAM provides next-hop lookup for IP packets at the line-rate. However, TCAM is expensive and energy-consuming; in addition, the constant FIB growth may lead to TCAM overflow problem. Yet only a small portion of FIB entries carries the most of network traffic. Thus, FIB caching, namely, installing the most popular entries in a fast memory, e.g., TCAM, may significantly minimize TCAM usage. To date, FIB caching architecture has not been widely deployed in backbone routers due to high cache-miss latency and the lack of an efficient cache replacement strategy. In this work, we leverage the concept of the programmable data plane to design a Programmable FIB Caching Architecture (PFCA) with two levels of cache. We present a pipeline-based algorithm to detect the least popular prefixes in a cache for a victim selection. We tested the prototype of PFCA using real traffic traces and an FIB with more than 599K entries, and showed that PFCA can be implemented using P4 programmable data plane language. Our results show that PFCA achieves 99.8% hit ratio for Level-1 cache with 20K entries and nearly 99.9% hit ratio for Level-2 cache with 40K entries. We also demonstrate that PFCA significantly reduces the number of BGP updates in the cache and thus makes the cache more stable.

Connected vehicle (CV) has emerged as a new computing and networking paradigm recently that can enable many beneficial CV applications. In this paper, we argue that Named Data Networking (NDN) presents a good synergy with the needs of CV applications. This drives us to propose an NDN based CV application framework with a distributed data service model. However, the fast mobility and vast moving area of vehicles lead to significant challenges on the efficiency and scalability of the underlying NDN backbone in the framework. To handle this issue, we propose a novel hierarchical hyperbolic NDN architecture (H2NDN). By taking advantage of the location dependency of CV applications, we design a hierarchical router topology and the associated namespace. This enables Interest packets from CV applications to be forwarded towards Data (cache) holders efficiently through static FIB configuration. However, the resultant hierarchical routing can easily overload high-level routers. Thus, we further integrate hyperbolic routing into the architecture through carefully designed hyperbolic planes in the hierarchical topology. As a result, the load is better balanced to ensure the overall scalability. Finally, extensive NDNsim based simulation with real traffic data proves the efficiency and scalability of the proposed H2NDN architecture.

Ternary Content-Addressable Memory (TCAM) chips are used to store Forwarding Information Bases (FIB) in modern routers. TCAM provides next hop lookup for IP packets at the line-rate. However, TCAM is expensive and energy-consuming; in addition, the constant FIB growth may lead to TCAM overflow problem. Yet only a small portion of FIB entries carries the most of the network traffic. Thus, FIB caching, namely, installing the most popular entries in a fast memory, e.g., TCAM, may significantly minimize TCAM usage. In this work, we leverage the concept of the programmable data plane to design a Programmable FIB Caching Architecture (PFCA) with two levels of cache. We present a pipeline-based algorithm to detect the least popular prefixes in a cache for victim eviction. We tested the prototype of PFCA using real traffic traces and an FIB with more than 599K entries. Our results show that PFCA achieves 99.8% hit ratio for Level-1 cache with 20K entries and nearly 99.9% hit ratio for Level-2 cache with 40K entries. We also demonstrate that PFCA significantly reduces the number of BGP updates in the cache and thus makes the cache more stable.

While there are various methods to detect application layer attacks or intrusion attempts on an individual end host, it is not efficient to provide all end hosts in the network with heavy-duty defense systems or software firewalls. In this work, we leverage a new concept of programmable data planes, to directly react on alerts raised by a victim and prevent further attacks on the whole network by blocking the attack at the network edge.

FIB aggregation is the most feasible solution to mitigate FIB overflow. We present FAQS, an algorithm that uses a single tree traversal to perform faster FIB aggregation and update handling. FAQS is 2.53 and 1.75 times faster than the-state-of-the-art FIB aggregation algorithm for IPv4 and IPv6 FIBs respectively while achieving a near-optimal aggregation ratio.

A mobile ad hoc network (MANET) is an infrastructure-free network where mobile devices are connected wirelessly and can move in arbitrary directions. Mobile ad hoc networks can be utilized in many applications, ranging from sensor networks, autonomous vehicles, battlefield communication, to disaster rescue operations, etc. However, existing TCP/IP based Internet architecture that supports MANET has many limitations, such as dependency on end-to-end IP address-based communication and out-of-band security mechanisms, to enable it to work in an efficient and secured manner. The emerging Named Data Networking (NDN) architecture can help address many such problems fundamentally. NDN is a new information centric network architecture that features name-based data, in-network caching, and built-in security. To test and verify the features of this new paradigm, in this paper, we set up several real and low-interference mobile ad hoc environments using Raspberry Pi-based mini cars and built NDN applications on top of the infrastructure. We examined the performance of the NDN applications with various network settings in both static and mobile modes and demonstrated the effectiveness of NDN architecture in terms of in-network caching and information centric features.

Internet of Things (IoT) is becoming an increasingly attractive target for cybercriminals. We observe that many attacks to IoTs are launched in a collusive way, such as brute-force hacking usernames and passwords, to target at a particular victim. However, most of the time our defending mechanisms to such kind of attacks are carried out individually and independently, which leads to ineffective and weak defense. To this end, we propose to leverage Software Defined Networks (SDN) to enable cooperative security for legacy IP-based IoT devices. SDN decouples control plane and data plane, and can help bridge the knowledge divided between the application and network layers. In this paper, we discuss the IoT security problems and challenges, and present an SDN-based architecture to enable IoT security in a cooperative manner. Furthermore, we implemented a platform that can quickly share the attacking information with peer controllers and block the attacks. We carried out our experiments in both virtual and physical SDN environments with OpenFlow switches. Our evaluation results show that both environments can scale well to handle attacks, but hardware implementation is much more efficient than a virtual one.

Due to network practices such as traffic engineering and multi-homing, the number of routes-also known as IP prefixes-in the global forwarding tables has been increasing significantly in the last decade and continues growing in a super linear trend. One of the most promising solutions is to use smart Forwarding Information Base (FIB) aggregation algorithms to aggregate the prefixes and convert a large table into a small one. Doing so poses a research question, however, i.e., how can we quickly verify that the original table yields the same forwarding behaviors as the aggregated one? We answer this question in this paper, including addressing the challenges caused by the longest prefix matching (LPM) lookups. In particular, we propose the VeriTable algorithm that can employ a single tree/trie traversal to quickly check if multiple forwarding tables are forwarding equivalent, as well as if they could result in routing loops or black holes. The VeriTable algorithm significantly outperforms the state-of-the-art work for both IPv4 and IPv6 tables in every aspect, including the total running time, memory access times and memory consumption.

While there are various methods to detect application layer attacks or intrusion attempts on an individual end host, it is not efficient to provide all end hosts in the network with heavy-duty defense systems or software firewalls. In this work, we leverage a new concept of programmable data planes, to directly react on alerts raised by a victim and prevent further attacks on the whole network by blocking the attack at the network edge. We call our design LAMP, Layer 7 Attack Mitigation with Programmable data planes. We implemented LAMP using the P4 data plane programming language and evaluated its effectiveness and efficiency in the Behavioral Model (bmv2) environment.

Several approaches to mitigating the Forwarding Information Base (FIB) overflow problem were developed and software solutions using FIB aggregation are of particular interest. One of the greatest concerns to deploy these algorithms to real networks is their high running time and heavy computational overhead to handle thousands of FIB updates every second. In this work, we manage to use a single tree traversal to implement faster aggregation and update handling algorithm with much lower memory footprint than other existing work. We utilize 6-year realistic IPv4 and IPv6 routing tables from 2011 to 2016 to evaluate the performance of our algorithm with various metrics. To the best of our knowledge, it is the first time that IPv6 FIB aggregation has been performed. Our new solution is 2.53 and 1.75 times as fast as the-state-of-the-art FIB aggregation algorithm for IPv4 and IPv6 FIBs, respectively, while achieving a near-optimal FIB aggregation ratio.

The current Internet routing ecosystem is neither sustainable nor economical. More than 711K IPv4 routes and more than 41K IPv6 routes exist in current global Forwarding Information Base (FIBs) with growth rates increasing. This rapid growth has serious consequences, such as creating the need for costly FIB memory upgrades and increased potential for Internet service outages. And while FIB memories are power-hungry and prohibitively expensive, more than 70% of the routes in FIBs carry no traffic for long time periods, a wasteful use of these expensive resources. Taking advantage of the emerging concept of programmable data plane, we design a programmable FIB caching architecture to address the existing concerns. Our preliminary evaluation results show that the architecture can significantly mitigate the global routing scalability and poor FIB utilization issues.

Named Data Networking (NDN) is a newly proposed content-centric network architecture that naturally supports efficient content distribution by routing data names instead of conventional IP prefixes. Taking advantage of the unique feature-adaptive forwarding in NDN and the centralized management and control in Software Defined Networking (SDN), we design and develop SDAR, a Software Defined Intra-Domain Routing Control Platform in NDN, that can manage network-wide routers and various dynamics effectively. To the best of our knowledge, it is the first time that we combine SDN and NDN ideas to implement adaptive forwarding via intra-domain multi-path routing algorithms. More specifically, we made the following contributions: (1) Designed an efficient communication model between routers and the controller within a single administrative domain; (2) Prototyped a centralized platform for handling different types of network dynamics, such as link failures and cost changes; (3) Ported multiple existing single-path and multi-path routing algorithms to the platform for robust and adaptive intra-domain routing; (4) Evaluated the effectiveness of SDAR through NS3/ndnSIM simulation with realistic settings.

The paper proposes and implements a flexible and lightweight BGP injector (mBGPInjector) that can announce both offline and real-time BGP routes to multiple peers with various filtering options. mBGP Injector also supports dynamical BGP configuration changes, such as online bringing a peer down or up, applying custom filtering rules and announcing or withdrawing arbitrary BGP routes. The implemented mBGP Injector is a lightweight perl program that consists of a few functions to read, analyze and direct BGP routes to corresponding connected BGP peers in a large size of network (eBGP or iBGP). Experiments with our mBGP Injector tool satisfy the requirements we need for research and education and demonstrate effectiveness under realistic workloads. In addition, we designed and tested the tool in Global Environment for Network Innovations (GENI) environment, where researchers and educators can take advantage of shared resource request files to repeat the same experiments without involvement of ponderous settings and configurations.

The fast growth of global routing table size has been causing concerns that the Forwarding Information Base (FIB) will not be able to fit in existing routers' expensive line-card memory, and upgrades will lead to higher cost for network operators and customers. FIB Aggregation, a technique that merges multiple FIB entries into one, is probably the most practical solution since it is a software solution local to a router, and does not require any changes to routing protocols or network operations. While previous work on FIB aggregation mostly focuses on reducing table size, this work focuses on algorithms that can update compressed FIBs quickly and incrementally. Quick update is critical to routers because they have very limited time to process routing updates without impacting packet delivery performance. We have designed three algorithms: FIFA-S for smallest table size, FIFA-T for shortest running time, and FIFA-H for both small tables and short running time, and operators can use the one best suited to their needs. These algorithms significantly improve over existing work in terms of reducing routers' computation overhead and limiting impact on the forwarding plane while maintaining a good compression ratio.

The global routing table size has been increasing rapidly, outpacing the upgrade cycle of router hardware. Recently aggregating the Forwarding Information Base (FIB) emerges as a promising solution since it reduces FIB size significantly in the short term and it is compatible with any long-term architectural solutions.Because FIB entries change dynamically with routing updates, an important component of any FIB aggregation scheme is to handle routing updates efficiently while shrinking FIB size as much as possible. In this paper, we first propose two incremental FIB aggregation algorithms based on the ORTC scheme. We then quantify the tradeoffs of the proposed algorithms, which will help operators choose the algorithms best suited for their networks.

The rapid growth of global routing tables has raised concerns among many Internet Service Providers. The most immediate concern regarding routing scalability is the size of the Forwarding Information Base (FIB), which seems to be growing at a faster pace than router hardware can support. This paper focuses on one potential solution to this problem - FIB aggregation, i.e., aggregating FIB entries without affecting the forwarding paths taken by data traffic. Compared with alternative solutions to the routing scalability problem, FIB aggregation is particularly appealing because it is a purely local software optimization limited within a router, requiring no changes to routing protocols or router hardware. To understand the feasibility of using FIB aggregation to extend router lifetime, we present several FIB aggregation algorithms and evaluate their performance using routing tables and updates from tens of networks. We find that FIB aggregation can reduce the FIB table size by as much as 70% with small computational overhead. We also show that the computational overhead can be controlled through various mechanisms.

Internet routing tables have been growing rapidly due to factors such as edge-site multihoming, traffic engineering, and disjoint address allocations. To address the routing scalability problems caused by this rapid growth, we propose an evolutionary approach that is incrementally deployable and provides immediate benefits to any adopting ASes. The basic premise of the approach is that route aggregation removes from routing tables the unnecessary topological details about remote portions of the Internet. We demonstrate that aggregation can be applied incrementally starting from local scopes within individual routers and individual ASes, and gradually expanded to the global Internet scope. The evaluation studies show that route aggregation is effective in addressing FIB scalability problems within a router and within a network.