A Unified Framework for High-Speed, Secure SDN: A Data Plane Approach
Keywords:
Security Improvement, High Throughput, Software Defined Network (SDN), Data Plane Development Kit (DPDK), Vector Packet Processing (VPP)Abstract
The paper presents a scalable, software-centric architecture for secure, high-performance networking in the SDN environment. Our approach merges robust security with near line-rate throughput by integrating high-speed packet processing capabilities with optimized cryptographic operations into one cohesive SDN framework. At the heart of the architecture is the Data Plane Development Kit, which, through user-space processing, zero-copy buffering, advanced memory management, introduces low latency with reduced intruptions for packet handling. It integrates IPsec in such a way as to provide data confidentiality and integrity at the IP layer. The architecture takes advantage of vector packet processing to flexibly manipulate packets, adapt routing decisions on the fly, and make changes according to evolving network requirements. This forms one cohesive system that ties security with speed, giving operators agility to scale services, enforce policies, and protect sensitive data with software-driven efficiencies and minimal reliance on specialty hardware.
References
A. Haggag, "Network optimization for improved performance and speed for SDN and security analysis of SDN vulnerabilities," International Journal of Computer Networks and Communications Security, vol. 5, pp. 83-90, May 2019.
A. D. Al-Ani and N. I. Abdullah, "Software defined networks challenges and future direction of research," International Journal of Research, vol. 1, pp. 618-629, Jan 2019.
A. Coly, M. Mbaye, and S.-L. Gaston Berger University, "S-SDS: a framework for security deployment as service in software defined networks," May 2019.
G. Lopez-Millan, R. Marin-Lopez, and F. Pereniguez-Garcia, "Towards a standard SDN-based IPsec management framework," Journal of Computer Standards & Interfaces, vol. 66, May 2019, doi: 10.1016/j.csi.2019.103357.
Dpdk.org, "Poll Mode Driver - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: http://doc.dpdk.org/guides-24.03/prog_guide/poll_mode_drv.html.
L. Linguaglossa, D. Rossi, S. Pontarelli, C. Telecom ParisTech, V. University of Rome Tor, and I. Cisco Systems, "High-speed data plane and network functions virtualization by vectorizing packet processing," Journal of Computer Networks, vol. 149, pp. 187-199, Feb 2019, doi: 10.1016/j.comnet.2018.11.033.
J. Pak and K. Park, "A High-Performance implementation of an IoT system using DPDK," Journal of Applied Sciences, vol. 8, no. 4, p. 550, Apr 2018, doi: 10.3390/app8040550.
A. Belkhiri, M. Pepin, M. Bly, M. Polytechnique, and I. Ciena, "Performance analysis of DPDK-based applications through tracing," Journal of Parallel and Distributed Computing, vol. 173, pp. 1-19, Mar 2023, doi: 10.1016/j.jpdc.2022.10.012.
S. Kaur, K. Kumar, N. Aggarwal, E. University Institute of, and P. U. C. I. Technology, "A review on P4-Programmable data planes: Architecture, research efforts, and future directions," The International Journal for the Computer and Telecommunications, vol. 170, pp. 109-129, Mar 2021, doi: 10.1016/j.comcom.2021.01.027.
T. Döring, H. Stubbe, K. Holzinger, A. Chair of Network, and D. o. I. T. U. o. M. G. Services, "SmartNICs: Current trends in research and industry," May 2021.
X. Yang and L. Wang, "SDN Load Balancing Method based on K-Dijkstra," International Journal of Performability Engineering, vol. 14, no. 4, pp. 709-716, Apr 2018, doi: 10.23940/ijpe.18.04.p14.709716.
A. Kumar, D. Anand, and M. Chandigarh University, "Load balancing for software defined network using machine learning," Turkish Journal of Computer and Mathematics Education, vol. 12, no. 12, pp. 527-535, Apr 2021, doi: 10.17762/turcomat.v12i2.876.
D. Todorov, H. Valchanov, and V. Aleksieva, "Load Balancing model based on Machine Learning and Segment Routing in SDN," in 2020 International Conference Automatics and Informatics (ICAI), Varna, Bulgaria, Oct 2020, pp. 1-4, doi: 10.1109/ICAI50593.2020.9311385.
J. Spooner and S. Y. Zhu, "A review of solutions for SDN-Exclusive security issues," International Journal of Advanced Computer Science and Applications, vol. 7, no. 8, 2016.
A. Pradhan and R. Mathew, "Solutions to vulnerabilities and threats in Software defined networking (SDN)," in Third International Conference on Computing and Network Communications, Jan 2020, vol. 171, pp. 2581-2589, doi: 10.1016/j.procs.2020.04.280.
Dpdk.org, "IPv4 Multicast Sample Application - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: http://doc.dpdk.org/guides-24.03/sample_app_ug/ipv4_multicast.html.
J. Kubálek and T. Brno University of, "High-speed DMA packet transfer in system DPDK," May 2018.
Dpdk.org, "Mempool Library - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: https://doc.dpdk.org/guides/prog_guide/mempool_lib.html.
Dpdk.org, "Mbuf Library - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: https://doc.dpdk.org/guides/prog_guide/mbuf_lib.html.
A. Baumstark and C. Pohl, "Lock-free data structures for data stream processing," Datenbank-Spektrum Journal, vol. 19, pp. 209-218, Oct 2019, doi: 10.1007/s13222-019-00329-4.
J. Kong, "DPDK Optimization on arm," Tools, Software and IDEs - Arm Community, 2022. [Online]. Available: https://community.arm.com/arm-community-blogs/b/tools-software-ides-blog/posts/dpdk-optimization-on-arm.
Dpdk.org, "RCPU Library - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: https://doc.dpdk.org/guides/prog_guide/rcu_lib.html.
Dpdk.org, "Cryptography Device Library - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: https://doc.dpdk.org/guides/prog_guide/cryptodev_lib.html.
Dpdk.org, "Security Library - Data Plane Development Kit 24.03.0 documentation." [Online]. Available: https://doc.dpdk.org/guides/prog_guide/rte_security.html.
E. Barker, Q. Dang, S. Frankel, K. Scarfone, and P. Wouters, "Guide to IPSEC VPNs," National Institute of Standards and Technology, Jun 2020, doi: 10.6028/NIST.SP.800-77r1.
M. Vajaranta, J. Kannisto, J. Harju, and T. Tampere University of, "IPSEC and IKE as functions in SDN controlled network," in 11th International Conference on Network and System Security, Helsinki, Finland, Aug 2017, pp. 521-530, doi: 10.1007/978-3-319-64701-2_39.
O. Abolade, A. Okandeji, A. Oke, M. Osifeko, and A. Oyedeji, "Overhead effects of data encryption on TCP throughput across IPSEC secured network," Journal of Scientific African, vol. 13, p. e00855, Sep 2021, doi: 10.1016/j.sciaf.2021.e00855.
Fd.io, "What is vector packet processing? - Vector Packet Processor 01 documentation." [Online]. Available: https://fdio-vpp.readthedocs.io/en/latest/overview/whatisvpp/what-is-vector-packet-processing.html.
D. Barach, L. Linguaglossa, D. Marion, P. Pfister, S. Pontarelli, and D. Rossi, "High-Speed Software Data Plane via Vectorized Packet Processing," IEEE Communications Magazine, vol. 56, no. 12, pp. 97-103, Dec 2018, doi: 10.1109/MCOM.2018.1800069.
Fd.io, "Scalar vs Vector packet processing - The Vector Packet Processor v24.06-rc1-0-gb3304b2b7 documentation." [Online]. Available: https://s3-docs.fd.io/vpp/24.06/aboutvpp/scalar-vs-vector-packet-processing.html.
Fd.io, "VPP Technology." [Online]. Available: https://fd.io/technology/.
Fd.io, "The Packet Processing Graph - The Vector Packet Processor v22.10-0-g07e0c05e6 documentation." [Online]. Available: https://docs.fd.io/vpp/22.10/aboutvpp/extensible.html?highlight=modular.
The Linux Foundation, "FD.io doubles packet throughput performance to terabit levels - Linux Foundation," Sep 13, 2022. [Online]. Available: https://www.linuxfoundation.org/press/press-release/fd-io-doubles-packet-throughput-performance-to-terabit-levels.
M. A. Jameel, T. Kanakis, S. Turner, A. Al-Sherbaz, and W. S. Bhaya, "A Reinforcement Learning-Based Routing for Real-Time Multimedia Traffic Transmission over Software-Defined Networking," International Journal of Electronics, vol. 11, no. 15, p. 2441, Aug 2022, doi: 10.3390/electronics11152441.
D. Harewood-Gill, T. Martin, and R. Nejabati, "The Performance of Q-Learning within SDN Controlled Static and Dynamic Mesh Networks," in 2020 6th IEEE Conference on Network Softwarization (NetSoft), Ghent, Belgium, 2020, pp. 185-189, doi: 10.1109/NetSoft48620.2020.9165530.
