Network scanning has been a standard measurement technique to understand a network’s security situations, e.g., revealing security vulnerabilities, monitoring service deployments. However, probing a large-scale scanning space with existing network scanners is both difﬁcult and slow, since they are all implemented on commodity servers and deployed at the network edge. To address this, we introduce IMap, a fast and scalable in-network scanner based on programmable switches. In designing IMap, we overcome key restrictions posed by computation models and memory resources of programmable switches, and devise numerous techniques and optimizations, including an address-random and rate-adaptive probe packet generation mechanism, and a correct and efﬁcient response packet processing scheme, to turn a switch into a practical high-speed network scanner. We implement an open-source prototype of IMap, and evaluate it with extensive testbed experiments and real-world deployments in our campus network. Evaluation results show that even with one switch port enabled, IMap can survey all ports of our campus network (i.e., a total of up to 25 billion scanning space) in 8 minutes. This demonstrates a nearly 4 times faster scanning speed and 1.5 times higher scanning accuracy than the state of the art, which shows that IMap has great potentials to be the next-generation terabit network scanner with all switch ports enabled. Leveraging IMap, we also discover several potential security threats in our campus network, and report them to our network administrators responsibly.

IMap: Fast and Scalable In-Network Scanning with Programmable Switches

The paper presents a Tbps-class anonymity router that supports both an anonymity protocol and IP by leveraging a programmable switch. The key design issue is to place both the compute-intensive header decryption function for anonymity protocol forwarding and the memory-intensive IP forwarding function on the processing pipes of a switch with satisfying its hardware requirements. A prototype router on a programmable switch achieves Tbps-scale forwarding. 

Feasibility of Network-layer Anonymity Protocols at Terabit Speeds using a Programmable Switch

Control and management plane applications such as serverless function orchestration and 4G/5G control plane functions are offloaded to smartNICs to reduce communication and processing latency. Such applications involve multiple inter-host interactions that were traditionally secured using SSL/TLS gRPC-based communication channels. Offloading the applications to smartNIC implies that we must also offload the security algorithms. Otherwise, we need to send the application messages to the host VM/container for crypto operations, negating offload benefits. We propose crypto externs for Netronome Agilio smartNICs that implement authentication and confidentiality (encryption/decryption) using the ChaCha stream cipher algorithm. AES and ChaCha are two popular cipher suites, but we chose ChaCha since none of the smartNICs have ChaCha-based crypto accelerators. However, smartNICs have restricted instruction set, and limited memory, making it difficult to implement security algorithms. This paper identifies and addresses several challenges to implement ChaCha crypto primitives successfully. Our evaluations show that our crypto extern implementation satisfies the scalability requirement of popular applications such as serverless management functions and host in-band network telemetry.

/pdf/implementing-chacha-based-crypto-primitives-on-programmable-2vukmf3t.pdf

Implementing ChaCha based crypto primitives on programmable SmartNICs

The paper presents a Tbps-class anonymity router that supports both an anonymity protocol and IP by leveraging a programmable switch. The key design issue is to place both the compute-intensive header decryption function for anonymity protocol forwarding and the memory-intensive IP forwarding function on the processing pipes of a switch with satisfying its hardware requirements. A prototype router on a programmable switch achieves Tbps-scale forwarding.

Recent advancements in programmable network hardware such as smartNICs (e.g., NPU, DPU, FPGA)1 and programmable switches (e.g., Intel Tofino) have created opportunities to save precious CPU cycles and achieve low latencies by offloading applications to these devices [1] –[3].

Microservice-based in-network security framework for FPGA NICs

Cyclic Redundancy Check (CRC) is a computationally inexpensive function readily available in many high-speed networking devices, and thus it is used extensively as a hash function in many data-plane applications. However, CRC is not a true cryptographic hash function, and it leaves applications vulnerable to attack. While cryptographically secure hash functions exist, there is no fast and efficient implementation for such functions on high-speed programmable switches. In this paper, we introduce an implementation of a secure keyed hash function optimized for commodity programmable switches and capable of running entirely within the data plane. We implement HalfSipHash on the Barefoot Tofino switch by using dependency management schemes to conserve pipeline stages and slicing semantics for concise circular bit shift operations. We show that our efficient implementation performs 67 million, 90 million, 150 million, and 304 million hashes per second for 32-byte, 24-byte, 16-byte, and 8-byte input strings, respectively.

Secure Keyed Hashing on Programmable Switches

In recent years, network attacks have exploded in frequency, scale and sophistication [5, 4, 6, 12, 3, 9]. Benign traffic volumes are also increasing exponentially [11], with many applications requiring increasingly stringent performance guarantees. With all these trends, network providers urgently require scalable defenses (handling large amounts of benign and adversarial traffic) that provide both accuracy (i.e., correctly identifying, blocking, and serving traffic) and performance (i.e., quickly dropping adversarial traffic to ensure low latency for benign clients).

Sophia Yoo

Papers

Secure Keyed Hashing on Programmable Switches

Sieve: Layered Network Defenses against Large-Scale Attacks