Search Results (20)

The 5G Wireless and Wireline Convergence (5G-WWC) standards introduce critical network functions—notably the Access Gateway Function (AGF) and the User Plane Function (UPF)—to enable unified wired and wireless access through a single 5G core. However, deploying and integrating these functions across heterogeneous programmable hardware platforms remains a significant open architectural challenge. This paper presents a configurable integration framework that orchestrates AGF and UPF workloads on heterogeneous programmable data planes, specifically NVIDIA BlueField-2 Data Processing Units (DPUs) and P4-based switches. Unlike traditional, hardware-specific implementations, the framework provides a unified control plane that dynamically manages AGF-only, UPF-only, or Combined AGF/UPF deployments. A hardware abstraction mechanism decouples the control logic from pipeline-specific details, enabling the same control plane to drive different underlying hardware without modification. A Generic Flow Rule interface standardises communication between the control plane and each user-plane backend, while a merged DPU pipeline for Combined AGF/UPF eliminates the redundant GTP-U encapsulation and decapsulation steps inherent in a naively cascaded design. Experiments on NVIDIA BlueField-2 DPUs achieve near-100 Gbps throughput across all three TR-470 scenarios (AGF-only, UPF-only, and Collocated AGF/UPF). The Combined AGF/UPF configuration exhibits lower end-to-end latency than the separated AGF + UPF configuration, confirming both the feasibility and the efficiency of the proposed framework for next-generation high-performance programmable networks. Full article

Smart logistics systems generate massive amounts of data, such as images and videos, requiring real-time processing in edge clusters. However, the edge cluster systems face performance bottlenecks in reception and forwarding high-concurrency data streams from numerous smart terminals, resulting in degraded processing efficiency. To address this issue, a novel high-performance data stream model called CBPS-DPDK is proposed. CBPS-DPDK integrates the DPDK framework from Intel corporations with a content-based publish/subscribe model enhanced by semantic filtering. This model adopts a three-tier optimization architecture. First, the user-space data plane is restructured using DPDK to avoid kernel context switch overhead via zero-copy and polling. Second, semantic enhancement is introduced into the publish/subscribe model to reduce the coupling between data producers and consumers through subscription matching and priority queuing. Finally, a hierarchical load balancing strategy ensures reliable data transmission under high concurrency. Experimental results show that CBPS-DPDK significantly outperforms two baselines—OSKT (kernel-based data forwarding) and DPDK-only (DPDK). Relative to the OSKT baseline, DPDK-only achieves improvements of 37.5% in latency, 11.1% in throughput, and 9.1% in VMAF; CBPS-DPDK further increases these to 51.8%, 18.3%, and 11.2%, respectively. In addition, compared with the traditional publish–subscribe system NATS, CBPS-DPDK maintains lower delay, higher throughput, and more balanced CPU and memory utilization under saturated workloads, demonstrating its effectiveness for real-time, high-concurrency edge scenarios. Full article

Virtual private network (VPN) gateways are widely applied to provide secure end-to-end remote access and to relay reliable interconnected communication in cloud computing. As network convergence nodes, the performance of VPN gateways is limited by traditional methods of packet receiving and sending, the kernel protocol stack and the virtual network interface card. This paper proposes a generic high-performance architecture (GHPA) for VPN gateways in consideration of its generality and performance. In terms of generality, we redesign a generic VPN core framework by modeling a generic VPN communication model, formulating generic VPN core technologies and presenting corresponding core algorithms. In terms of performance, we propose a three-layer GHPA for VPN gateways by designing a VPN packet processing layer based on a data plane development kit (DPDK), implementing a user space basic protocol stack and applying our proposed generic VPN core framework. On the basis of the research work above, we implement a high-performance VPN (HP-VPN) and a traditional VPN (T-VPN) that complies with GHPA and traditional methods, respectively. Experimental results prove that the performance of HP-VPN based on GHPA is superior to T-VPN and other common VPNs in RTT, system throughput, packet forwarding rate and jitter. In addition, GHPA is extensible and applicable for other VPN gateways to improve their performance. Full article

Network security is paramount in today’s digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance. Full article

Concurrent access to large-scale video data streams in edge computing is an important application scenario that currently faces a high cost of network access equipment and high data packet loss rate. To solve this problem, a low-cost link aggregation video stream data concurrent transmission method is proposed. Data Plane Development Kit (DPDK) technology supports the concurrent receiving and forwarding function of multiple Network Interface Cards (NICs). The Q-learning data stream scheduling model is proposed to solve the load scheduling of multiple queues of multiple NICs. The Central Processing Unit (CPU) transmission processing unit was dynamically selected by data stream classification, as well as a reward function, to achieve the dynamic load balancing of data stream transmission. The experiments conducted demonstrate that this method expands the bandwidth by 3.6 times over the benchmark scheme for a single network port, and reduces the average CPU load ratio by 18%. Compared to the UDP and DPDK schemes, it lowers the average system latency by 21%, reduces the data transmission packet loss rate by 0.48%, and improves the overall system transmission throughput. This transmission optimization scheme can be applied in data centers and edge computing clusters to improve the communication performance of big data processing. Full article

With the increasing awareness of privacy protection, Virtual Private Networks (VPNs) are widely used to build a more secure communication tunnel. However, a traffic hijacking attack called blind in/on-path has seriously threatened the security of VPNs. Inspired by Moving Target Defense (MTD), Moving VPN architecture (MVPN) is designed to defend against such attacks. MVPN includes multiple nodes to encrypt and decrypt traffic to enhance reliability. Thus, the consistency judgment algorithm is proposed to make MVPN obtain the ability to perceive attacks. Moreover, according to the judgment result and the state update strategy, the MVPN state is dynamically changed so as to achieve the purpose of active defense. In addition, this paper also designs the multichannel packet classification mechanism and availability assurance strategy, which not only ensures the security and availability of the system but also reduces the performance loss caused by the defense strategy. The simulation verifies that MVPN architecture can reduce the success rate of blind in/on-path attacks by five orders of magnitude. In addition, we implemented and deployed MVPN based on the fast-forwarding framework of the Data Plane Development Kit (DPDK). Experiments in the real environment also show that the MVPN system can effectively prevent attackers from carrying out blind in/on-path attacks. Full article

Digitalization is one of the factors that affects the acceleration of the application of telecommunications technologies such as 5G. The 5G technology that has been developed today does not yet meet different performance and manageability standards, particularly for data center networks as a supportive technology. Software-defined networking (SDN) and network function virtualization (NFV) are two complementary technologies that are currently used by almost all data centers in the telecommunications industry to rectify performance and manageability issues. In this study, we deliver an integrated SDN-NFV architecture to simplify network management activities in telecommunication companies. To improve network performance at the computing level, we performed a modification of a networking system at the computing level, underlying NFV devices by replacing the default virtual switch with a data plane development kit (DPDK) and single root I/O virtualization (SR-IOV). This study evaluated the proposed architecture design in terms of network performance and manageability. Based on 30 days of observation in prime time, the proposed solution increased throughput up to 200 Mbps for the server leaf and 1.6 Gbps for the border leaf compared to the legacy architecture. Meanwhile, the latency decreased to 12 ms for the server leaf and 17 ms for the border leaf. For manageability, we tested three different scenarios and achieved savings of 13 min for Scenario 1, 22 min for Scenario 2 and 9 min for Scenario 3. Full article

Since ETSI introduced the architectural framework of network function virtualization (NFV), telecom operators have paid more attention to the synergy of NFV and cloud computing. With the integration of the NFV cloud platform, telecom operators decouple network functions from the dedicated hardware and run virtualized network functions (VNFs) on the cloud. However, virtualization degrades the performance of VNF, resulting in violating the performance requirements of the telecom industry. Most of the existing works were not conducted in a cloud computing environment, and fewer studies focused on the usage of enhanced platform awareness (EPA) features. Furthermore, few works analyze the performance of the service function chain on a practical cloud. This paper facilitates the OpenStack cloud with different EPA features to investigate the performance effects of VNFs on the cloud. A comprehensive test framework is proposed to evaluate the verification of functionality, performance, and application testing. Empirical results show that the cloud system under test fulfills the requirements of service level agreement in Rally Sanity testcases. The throughput of OVS-DPDK is up to 8.2 times as high as that of OVS in the performance test. Meanwhile, the hardware-assisted solution, SR-IOV, achieves the throughput at near the line rate in the end-to-end scenario. For the application test, the successful call rate for the vIMS service is improved by up to 14% while applying the EPA features on the cloud. Full article

With the expansion of network scales, the B/S architecture of monolithic applications is gradually being replaced by microservices. The unbundling of services has led to exponential growth in the size of APIs. When handling massive microservice requests, the commercial NIC shows limitations in three aspects: deterministic, programmability, and data copy. To ensure that each microservice node handles requests efficiently, flexibly, and precisely, this paper proposes a programmable deterministic multi-queue FPGA Accelerator. The Accelerator relies on the instantiated 1000 queues and the queue management unit to extend the rule-based RSS algorithm for the serverless-friendly programmability of packet distribution. A PTP hardware clock is added to collaborate with the queue management unit to control the deterministic delivery. To improve the sending and receiving efficiency of network node data, a driver adapted to the FPGA accelerator is designed to realize zero-copy. Experiments conducted on a 100 Gbps FPGA show that the Accelerator can support the multi-queue transmission with various packet sizes, define the forwarding behavior, and almost approach the line rate on an 8-core FPGA device. In addition, it can forward packets with low latency close to that of the current state-of-the-art ovs-DPDK. This Accelerator overcomes, to some extent, the limitations of commercial NICs when oriented to microservice architectures. Full article

Recently, many new network paths have been introduced while old paths are still in use. The trade-offs remain vague and should be further addressed. Since last decade, the Internet is playing a major role in people’s lives, and the demand on the Internet in all fields has increased rapidly. In order to get a fast and secure connection to the Internet, the networks providing the service should get faster and more reliable. Many network data paths have been proposed in order to achieve the previous objectives since the 1970s. It started with the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) and later followed by several more modern paths including Quick UDP Internet Connections (QUIC), remote direct memory access (RDMA), and the Data Plane Development Kit (DPDK). This raised the question on which data path should be adopted and based on which features. In this work, we try to answer this question using different perspectives such as the protocol techniques, latency and congestion control, head of line blocking, the achieved throughput, middleboxes consideration, loss recovery mechanisms, developer productivity, host resources utilization and targeted application. Full article

Information-centric networking (ICN) separates the identifier and locator of network entities, providing a natural advantage in supporting mobility. To gain the advantage of ICN to support mobility, an urgent challenge is the problem of practical implementation with performance optimization. Software-defined networking (SDN) can be regarded as infrastructure to implement ICN mobility. However, it is difficult for the centralized SDN controller to quickly process mobile signaling. Therefore, this paper proposes enhanced programmable data plane supporting ICN mobility. By offloading mobility-related control plane functions from the controller to the data plane, the data plane can locally process mobile signaling without interacting with the controller. We propose an offloading mechanism for control plane functions, based on a rule table, where the controller authorizes the data plane to process the mobile signaling by loading the programmable rule table to data plane’s control element, and the control element intercepts the mobile signaling, matches the predefined rule table, and executes a series of application logic actions. In addition, we propose an improved SmartSplit algorithm to manage the rule table and speed up packets matching the rule table. Based on Intel’s Data Plane Development Kit (DPDK), we implement the enhanced programmable data plane. Our experimental results prove that the proposed enhanced programmable data plane has a stronger ability to process mobile signaling and reduce latency. Full article

Network monitoring is important to improve network performance and security. The separation of the data plane and the control plane of SDN gives the network flexibility. This flexibility facilitates network management and gives rise to the need for accurate and fine-grained management of networks. However, the traditional software-based flow monitoring cannot easily keep up with today’s high-speed networks such as 100 GbE, even with the help of high-performance frameworks such as DPDK. To meet the need for fine-grained management of high-speed networks, an accurate hardware-based flow monitor design is presented in this paper. In our design, the FPGA-based pipelined cuckoo hashing is used to achieve efficient storage of flow entries. The flow information is accurately recorded without any sampling. The proposed design can achieve a higher performance than the non-sketch CPU-based methods and higher accuracy than sketch methods. Compared with other state-of-the-art flow monitors, the proposed design can achieve a performance of 100 Gbps while maintaining high accuracy. Full article

In the stateful data plane, the switch can record the state and forward packets based on the local state. This approach makes it possible to integrate complex network applications into the data plane, thus reducing the amount of communication required between the switch and the controller. However, due to the time it takes to look up the state for packets, packet-forwarding latency has increased. With increased network traffic, a large number of states may be recorded in the switch, and the problem of increased packet-forwarding latency caused by the lookup state becomes more serious. In this paper, we propose the multi-scope state area (MSSA) for recording state inside the switch, which can achieve a fixed-time state lookup in a large-scale state. MSSA divides the state sharing scope by associating with the switch’s multiple match–action tables, and the shared scope is used to determine the state area for recording state. When processing a packet, the state required will only be in a limited number of states that are recorded in a few state areas. We implemented a prototype pipeline that supports MSSA based on Intel’s DPDK framework and investigated the effect of state type, number, location, and comparison method on state search/insertion time. The results show that the cost of MSSA search state is constant, regardless of the number of states, and MSSA has a high space utilization rate. Full article

Software-defined networking (SDN) separates the control plane and the data plane, which provides network applications with global network topology and the flexibility to customize packet forwarding rules. SDN has a wide range of innovative applications in 5G, Internet of Things, and information center networks. However, the match-action programming model represented by OpenFlow/Protocol Oblivious Forwarding (POF) in SDN can only process limited types of data such as packets and metadata, making it hard to fulfill future network applications. In this paper, data type and data location are added in the matching fields and actions to make the match-action table (MAT) compatible with multiple types of data, hence improving the data plane’s programmability. Data type helps the MAT to perceive multiple types of data, allowing them to be processed by a single MAT. Data location allows MAT to be decoupled from data meaning, quickly locating specific data in the switch. Based on Intel’s Data Plane Development Kit (DPDK), we design and implement a pipeline that is compatible with multiple types of data processing. Protocol and data type oblivious match-action tables and atomic instructions are included in the pipeline. Experiments show that representing data with data type and data location makes the pipeline compatible with multiple types of data without sacrificing forwarding performance, fulfilling the needs of network applications to handle a variety of types of data while avoiding repeating hardware design. Full article

With the development of SDN, packet classifiers nowadays need to be provided with low update latency besides fast lookup performance because switches need to respond to update control messages from controllers in time to guarantee real-time service in SDN implementations. Classification in this scenario is called online packet classification. In this paper, we put forward an improved trie-based algorithm for online packet classification (ITOC), in which we provide a trie selection strategy to avoid occasional high update latency in the update process of online trie-based algorithms. Experiments are conducted to validate the effectiveness of our optimization and compare the performance of ITOC with the offline methods, DPDK ACL. Experimental results demonstrate that ITOC has the same level of lookup speed with DPDK ACL and greatly decreased the update latency as well. The update latency of ITOC is only 6.85% of DPDK ACL library in the best case. Full article