Securing P4 Programs by Information Flow Control
By: Anoud Alshnakat , Amir M. Ahmadian , Musard Balliu and more
Potential Business Impact:
Keeps secret data safe in computer networks.
Software-Defined Networking (SDN) has transformed network architectures by decoupling the control and data-planes, enabling fine-grained control over packet processing and forwarding. P4, a language designed for programming data-plane devices, allows developers to define custom packet processing behaviors directly on programmable network devices. This provides greater control over packet forwarding, inspection, and modification. However, the increased flexibility provided by P4 also brings significant security challenges, particularly in managing sensitive data and preventing information leakage within the data-plane. This paper presents a novel security type system for analyzing information flow in P4 programs that combines security types with interval analysis. The proposed type system allows the specification of security policies in terms of input and output packet bit fields rather than program variables. We formalize this type system and prove it sound, guaranteeing that well-typed programs satisfy noninterference. Our prototype implementation, Tap4s, is evaluated on several use cases, demonstrating its effectiveness in detecting security violations and information leakages.
Similar Papers
Programmable Data Planes for Network Security
Cryptography and Security
Makes network devices smarter and safer.
Real-Time In-Network Machine Learning on P4-Programmable FPGA SmartNICs with Fixed-Point Arithmetic and Taylor
Distributed, Parallel, and Cluster Computing
Lets computers learn from network traffic instantly.
Some optimization possibilities in data plane programming
Networking and Internet Architecture
Makes computer networks faster and smarter.