Secure State Migration in the Data Plane
Secure State Migration in the Data Plane
复制标题
DOI：
10.1145/3405669.3405822
复制
发表时间：
2020-08
期刊：
影响因子：
--
通讯作者：
Jiarong Xing;Ang Chen;T. S. E. Ng
中科院分区：
文献类型：
--
作者：
Jiarong Xing;Ang Chen;T. S. E. Ng
可编程数据平面支持以硬件速度进行有状态分组处理-这是许多最新系统的核心新功能。然而，有效管理数据平面状态的协议和系统仍未得到充分探索。本文研究了安全状态迁移问题，它可以作为状态管理任务的重要组成部分。它无需软件控制器即可有效地将数据平面状态从源交换机传输到目的地，同时提供强大的真实性加密保证。我们的协议P4Sync解决了几个技术挑战，例如在VM迁移中采用内存复制技术，将每个数据包的安全操作卸载到数据平面，以及在一批数据包上摊销重量级加密开销。我们的初步验证表明，P4Sync具有较低的流量和内存开销。
Programmable data planes enable stateful packet processing at hardware speeds---a new capability central to many recent systems. However, protocols and systems that effectively manage data plane state remain underexplored. This paper considers the problem of secure state migration, which can serve as an important building block for state management tasks. It delivers data plane state from a source switch to a destination effectively without a software controller, while providing strong cryptographic guarantees on authenticity. Our protocol, P4Sync, tackles several technical challenges, such as adapting memory copy techniques in VM migration, offloading per-packet security operations to the data plane, and amortizing heavyweight cryptographic overheads over a batch of packets. Our initial validation shows that P4Sync has low traffic and memory overheads.