In-Network Congestion Management for Security and Performance
Abstract
It was during the early days of the ARPANET that researchers first realized the crucial role that congestion would play in the Internet’s performance. Since then, numerous scholars have dedicated themselves to developing a variety of algorithms to proactively manage it. Today, 50 years later, the Internet has undergone significant evolution. Yet, network congestion remains one of the biggest open challenges in current Internet design.
In this dissertation, we propose techniques aimed at managing network congestion while enhancing the performance and security of the Internet. Our approach is grounded in data-plane programmability—a recent techno- logical paradigm in the networking field that has fundamentally reshaped how we design and reason about network architectures. Additionally, we ad- dress state-of-the-art congestion types, such as pulse-wave denial-of-service (DoS) attacks, which pose a growing threat to existing infrastructures.
First, we introduce SP-PIFO and PACKS, two frameworks that enable programmable in-network congestion management on existing routers. Operators assign ranks to packets to indicate how they should be prioritized during congestion. SP-PIFO and PACKS then admit and schedule packets based on these ranks. To run on existing devices, they build on a set of priority queues and decide which packets to admit and how to map admitted packets to the different queues. SP-PIFO operates on a per-packet basis, while PACKS enhances SP-PIFO’s performance by incorporating rank-distribution information and queue-occupancy levels during enqueue.
Next, we present QVISOR, a hypervisor that extends SP-PIFO and PACKS to support multi-tenancy, allowing different tenants to specify their own pri- orities while sharing a common set of hardware resources. Within QVISOR, tenants define their traffic prioritization preferences, while the operator de- termines how the resources should be allocated. QVISOR then synthesizes a joint scheduling strategy and implements it on the underlying hardware.
Finally, we introduce ACC-Turbo, a pulse-wave denial-of-service defense that demonstrates the advantages of in-network congestion management in the context of security. ACC-Turbo detects attacks at line rate and in real time by applying online clustering techniques in the network and mitigates them on a per-packet basis using programmable packet scheduling.
People
BibTex
@PHDTHESIS{alcoz2024in-network,
copyright = {In Copyright - Non-Commercial Use Permitted},
year = {2024},
type = {Doctoral Thesis},
author = {Gran Alcoz, Alberto},
size = {168 p.},
abstract = {It was during the early days of the ARPANET that researchers first realized the crucial role that congestion would play in the Internet’s performance. Since then, numerous scholars have dedicated themselves to developing a variety of algorithms to proactively manage it. Today, 50 years later, the Internet has undergone significant evolution. Yet, network congestion remains one of the biggest open challenges in current Internet design.In this dissertation, we propose techniques aimed at managing network congestion while enhancing the performance and security of the Internet. Our approach is grounded in data-plane programmability—a recent techno- logical paradigm in the networking field that has fundamentally reshaped how we design and reason about network architectures. Additionally, we ad- dress state-of-the-art congestion types, such as pulse-wave denial-of-service (DoS) attacks, which pose a growing threat to existing infrastructures.First, we introduce SP-PIFO and PACKS, two frameworks that enable programmable in-network congestion management on existing routers. Operators assign ranks to packets to indicate how they should be prioritized during congestion. SP-PIFO and PACKS then admit and schedule packets based on these ranks. To run on existing devices, they build on a set of priority queues and decide which packets to admit and how to map admitted packets to the different queues. SP-PIFO operates on a per-packet basis, while PACKS enhances SP-PIFO’s performance by incorporating rank-distribution information and queue-occupancy levels during enqueue.Next, we present QVISOR, a hypervisor that extends SP-PIFO and PACKS to support multi-tenancy, allowing different tenants to specify their own pri- orities while sharing a common set of hardware resources. Within QVISOR, tenants define their traffic prioritization preferences, while the operator de- termines how the resources should be allocated. QVISOR then synthesizes a joint scheduling strategy and implements it on the underlying hardware.Finally, we introduce ACC-Turbo, a pulse-wave denial-of-service defense that demonstrates the advantages of in-network congestion management in the context of security. ACC-Turbo detects attacks at line rate and in real time by applying online clustering techniques in the network and mitigates them on a per-packet basis using programmable packet scheduling.},
keywords = {Networks; Computer networks; scheduling algorithms; NETWORK MONITORING (COMPUTER SYSTEMS)},
language = {en},
address = {Zurich},
publisher = {ETH Zurich},
DOI = {10.3929/ethz-b-000706071},
title = {In-Network Congestion Management for Security and Performance},
school = {ETH Zurich}
}Research Collection: 20.500.11850/706071