In-Network Congestion Management for Security and Performance
OPEN ACCESS
Loading...
Author / Producer
Date
2024
Publication Type
Doctoral Thesis
ETH Bibliography
yes
Citations
Altmetric
OPEN ACCESS
Data
Rights / License
Abstract
It was during the early days of the ARPANET that researchers first realized the crucial role that congestion would play in the Internet’s performance. Since then, numerous scholars have dedicated themselves to developing a variety of algorithms to proactively manage it. Today, 50 years later, the Internet has undergone significant evolution. Yet, network congestion remains one of the biggest open challenges in current Internet design.
In this dissertation, we propose techniques aimed at managing network congestion while enhancing the performance and security of the Internet. Our approach is grounded in data-plane programmability—a recent techno- logical paradigm in the networking field that has fundamentally reshaped how we design and reason about network architectures. Additionally, we ad- dress state-of-the-art congestion types, such as pulse-wave denial-of-service (DoS) attacks, which pose a growing threat to existing infrastructures.
First, we introduce SP-PIFO and PACKS, two frameworks that enable programmable in-network congestion management on existing routers. Operators assign ranks to packets to indicate how they should be prioritized during congestion. SP-PIFO and PACKS then admit and schedule packets based on these ranks. To run on existing devices, they build on a set of priority queues and decide which packets to admit and how to map admitted packets to the different queues. SP-PIFO operates on a per-packet basis, while PACKS enhances SP-PIFO’s performance by incorporating rank-distribution information and queue-occupancy levels during enqueue.
Next, we present QVISOR, a hypervisor that extends SP-PIFO and PACKS to support multi-tenancy, allowing different tenants to specify their own pri- orities while sharing a common set of hardware resources. Within QVISOR, tenants define their traffic prioritization preferences, while the operator de- termines how the resources should be allocated. QVISOR then synthesizes a joint scheduling strategy and implements it on the underlying hardware.
Finally, we introduce ACC-Turbo, a pulse-wave denial-of-service defense that demonstrates the advantages of in-network congestion management in the context of security. ACC-Turbo detects attacks at line rate and in real time by applying online clustering techniques in the network and mitigates them on a per-packet basis using programmable packet scheduling.
Permanent link
Publication status
published
External links
Editor
Contributors
Examiner : Vanbever, Laurent
Examiner : McKeown, Nick
Examiner : Alizadeh, Mohammad
Book title
Journal / series
Volume
Pages / Article No.
Publisher
ETH Zurich
Event
Edition / version
Methods
Software
Geographic location
Date collected
Date created
Subject
Networks; Computer networks; scheduling algorithms; NETWORK MONITORING (COMPUTER SYSTEMS)
Organisational unit
09477 - Vanbever, Laurent / Vanbever, Laurent