High-speed programmable data planes provide opportunities to implement data-driven fast reroute systems that quickly adapt to varying network conditions (e.g., congestion, failures) and improve network performance. The core of these systems has packet-processing algorithms running in the data plane that continuously look for traffic patterns (e.g., too many retransmissions) specific to a network condition (e.g., link failure) and take appropriate action (e.g., reroute). Despite their benefits, they also increase the potential attack surface. Adversaries can generate malicious traffic patterns resembling those anticipated by a fast reroute system and trick the system. Doing so would lead to poor network performance due to incorrect reroute decisions. In this paper, we propose a mechanism to detect whether the fast reroute systems are under the influence of malicious traffic patterns. Our key idea is to model the expected behavior using benign traffic features and use the model as a reference to determine whether the system is under the influence of adversaries. Using realistic attack traces, we demonstrate attacks on two fast reroute systems and successfully detect those attacks using the proposed detection mechanism.

High-speed programmable data planes provide opportunities to implement data-driven fast reroute systems that quickly adapt to varying network conditions (e.g., congestion, failures) and improve network performance. The core of these systems has packet-processing algorithms running in the data plane that continuously look for traffic patterns (e.g., too many retransmissions) specific to a network condition (e.g., link failure) and take appropriate action (e.g., reroute). Despite their benefits, it also increases the potential attack surface. Adversaries can generate malicious traffic patterns similar to those a fast reroute system is looking for and trick the system. Doing so would lead to poor network performance due to incorrect reroute decisions. In this paper, we propose a mechanism to detect whether the fast reroute systems are under the influence of malicious traffic patterns. Our key idea is to model the expected behavior using benign traffic features and use the model as a reference to determine whether the system is under the influence of adversaries. Using realistic attack traces, we demonstrate attacks on two fast reroute systems and successfully detect those attacks using the proposed detection mechanism.

High-speed programmable data planes (e.g., P4 switches, smartNICs) have enabled fast, accurate, data-driven network management systems. Such systems leverage the packet-processing capabilities of the data plane and implement algorithms that continuously monitor traffic and actuate data-driven responses. Despite the performance and cost benefits, such systems expose a larger attack surface, which can be exploited through targeted attacks. In this paper, we present possible DoS-like attacks on data-driven network management systems built on top of programmable data planes. We discuss general countermeasures and highlight promising approaches to detect and defend against such attacks.

Many IoT use cases have ultra-low latency and strong security requirements. But achieving both simultaneously is challenging. In this paper, as a use case, we consider the authentication of IoT devices for every transaction and develop a fast and secure authentication protocol. Our key idea is to leverage highly secure Physically Unclonable Functions (PUFs) and high-speed programmable switch and offload PUF-based authentication protocol to the switch. By doing so, it enables authentication of every transaction at network speed. In this paper, we demonstrate the feasibility of our idea by offloading the authentication protocol to a programmable switch with Tofino chip. Our preliminary experiments show that protocol offloading reduces authentication latency by 2-4 times and scales to a few hundred thousand IoT devices.