Since caches are shared and coherent, a memory access of one process may evict from the cache another process' memory block with an address mapped to the same cache line. This property is exploited by several attacks to form side channels. We show that MAC learning in Software Defined Networks (SDNs) has a similar property in the sense that a MAC address discovered by one network device may be revoked by the discovery of the same address at another switch. This allows us to implement Macchiato, a covert channel for SDNs between any two network devices (including hosts); prior SDN covert channels required at least one malicious switch. We evaluate a prototype implementation of Macchiato and discuss how methods to improve the performance of cache side channels (such as deep neural networks) can also be used in Macchiato.
Languages for programming data planes like P4 sparked a plethora of new applications in the data plane. The dynamic, evolving environment makes it challenging to understand what performance can be expected when running a program in a specific data plane target. However, knowing this is crucial for network operators when upgrading their networks. We present a framework for the reproducible analysis and modeling of P4 program components. By defining and generating precise specifications of the experiments, we separate fully auto-generated components from testbed- or target-specific parts. Measurement results are used to derive performance models automatically. These can then be used to compare the measured with the theoretical performance, or to model the cost of entire paths through the data plane. In two case studies, we use our framework to discover and model selected behavior for a DPDK-based software target and for the NFP-4000 SmartNIC platform.
We present the design and prototyping of a framework to support multicast for remote direct memory accesses (RDMA), specifically the one-sided WRITE operation. We use P4 programmable hardware to augment fixed-functionRDMAtransport hardware found on commodity NICs to enable one-sided RDMA multicast with zero-CPU overhead. Finally, we outline the potential challenges and future directions in realizing the framework for large-scale data center deployments.
Microservices enable rapid service deployment and scaling. Integrating poorly-understood microservice components into Service Function Chains (SFCs) or graphs limits a provider's control over service delivery latency, however. Orchestration frameworks currently instantiate and place myriads of microservice components without knowing the impact of placement decisions on latency. In this paper, we explore challenges that service providers encounter in managing complex SFCs, and propose Invenio to empower providers to effectively place microservices without prior knowledge of service functionality. Invenio correlates user actions with procedure messages in network traces, and computes procedural affinity of communication among microservices for each user action. The procedural affinity values can then be used to make placement decisions to meet latency constraints of individual user actions. Our experiments with two microservice-based cellular network implementations demonstrate that placement with Invenio-computed affinity values significantly reduces failures by bounding message processing latency, resulting in up to 21% performance gain compared to message count-based placement algorithms, and up to 51% gain over default placement.
Existing network data plane verification approaches check network correctness with various models and algorithms. With respect to a specific scenario, it is hard to judge which network model provides sufficient functionality and suitable performance, because existing verification approaches are implemented with different languages and evaluated against different datasets on different hardware platforms in their papers. A network operator usually has to try out a number of complex verification approaches to find the best one for her/his network and intents. Mahjong has a modular system architecture, a unified input format, and three classic verification tools built-in. Leveraging its well-defined partition interfaces and straight-forward configuration file, not only existing approaches can be refactored and merged into Mahjong, new approaches can also be introduced and evaluated with ease.
