arXiv subjects

Garegin Grigoryan

Publications and source records attributed to Garegin Grigoryan.

10 recordsLinked to original sources

arXiv2026

Securing Load Balancing over QUIC

In-network load balancing outperforms traditional software load balancing while costing less. For instance, programmable switch ASICs can use hashing to select the backend server for the initial packet of each flow at the line rate. However, when the pool of available servers changes, ensuring that the subsequent flow packets are mapped to the same server is challenging due to the data plane's limited memory resources and performance requirements. With the emergence of the QUIC transport protocol, several works show how Connection ID fields (CIDs) can embed the server identifier for all non-initial packets. This approach requires modifications on the server side and violates the QUIC specification, which mandates that CIDs remain unlinkable. In this work, we show that stateless QUIC load balancing can be implemented inside the data plane with no changes to CIDs. Moreover, QUIC packets, except the initial client packet, can bypass the load balancer. We also investigate and mitigate attacks on QUIC in this scenario, including full load balancer bypass and 0-RTT IP spoofing.

cs.NI↗

arXiv2025

Extending the Control Plane of Container Orchestrators for I/O Virtualization

Single Root Input/Output Virtualization (SR-IOV) is a standard technology for forking a single PCI express device and providing it to applications while ensuring performance isolation. It enables container orchestrators to share a limited number of physical network interfaces without incurring significant virtualization overhead. The allocation of virtualized network devices to containers, however, needs to be more configurable based on the bandwidth needs of running applications. Moreover, container orchestrators' network control over the virtualized interfaces is limited by the abilities of SR-IOV. We explore the design considerations for a system with controlled SR-IOV virtualization and present ConRDMA, a novel architecture that enables fine control of RDMA virtualization for containers. Our evaluation shows that ConRDMA enables containers to use RDMA allocated bandwidth more efficiently and to select best-suited nodes to meet their varying communication requirements.

cs.NI↗

arXiv2025

P4Kube: In-Network Load Balancer for Kubernetes

Kubernetes Services such as LoadBalancer and NodePort expose applications running on pods within a Kubernetes cluster to external users. While the LoadBalancer Service requires an external load-balancing middleware, its alternative, NodePort Service, adds additional hops on the path between clients and the worker nodes. In this paper, we propose P4Kube, a framework consisting of a P4 data plane program and a Kubernetes plugin. Our solution effectively performs load balancing of requests to the worker nodes of a cluster based on the number of running replicas. In P4Kube, the data packets completely bypass the system's control plane. Unlike the previous work, to update its state, the P4Kube data plane works directly with the Kubernetes control plane without any involvement of the network control plane. Our experiments show up to 50% improvement in the average request time to the cluster compared to conventional approaches.

cs.NI↗

arXiv2023

Towards Greener Data Centers via Programmable Data Plane

The energy demands of data centers are increasing and are expected to grow exponentially. Reducing the energy consumption of data centers decreases operational expenses, as well as their carbon footprint. We design techniques to reduce data center power consumption by leveraging Software-Defined Networking (SDN) and programmable data plane concepts. Relying solely on in-data plane registers, our proposed system P4Green consolidates traffic in the least number of network switches and shifts workloads to the servers with the available renewable energy. Unlike existing SDN-based solutions, P4Green's operation does not depend on a centralized controller, making the system scalable and failure-resistant. Our proof-of-concept simulations show that traffic consolidation can reduce data centers' aggregation switch usage by 36% compared to standard data center load balancing techniques, while workload control can boost renewable energy consumption for 46% of the daily traffic.

cs.NI↗

arXiv2018

Toward incremental FIB aggregation with quick selections (FAQS)

Several approaches to mitigating the Forwarding Information Base (FIB) overflow problem were developed and software solutions using FIB aggregation are of particular interest. One of the greatest concerns to deploy these algorithms to real networks is their high running time and heavy computational overhead to handle thousands of FIB updates every second. In this work, we manage to use a single tree traversal to implement faster aggregation and update handling algorithm with much lower memory footprint than other existing work. We utilize 6-year realistic IPv4 and IPv6 routing tables from 2011 to 2016 to evaluate the performance of our algorithm with various metrics. To the best of our knowledge, it is the first time that IPv6 FIB aggregation has been performed. Our new solution is 2.53 and 1.75 times as fast as the-state-of-the-art FIB aggregation algorithm for IPv4 and IPv6 FIBs, respectively, while achieving a near-optimal FIB aggregation ratio.

cs.NI↗

arXiv2018

LAMP: Prompt Layer 7 Attack Mitigation with Programmable Data Planes

While there are various methods to detect application layer attacks or intrusion attempts on an individual end host, it is not efficient to provide all end hosts in the network with heavy-duty defense systems or software firewalls. In this work, we leverage a new concept of programmable data planes, to directly react on alerts raised by a victim and prevent further attacks on the whole network by blocking the attack at the network edge. We call our design LAMP, Layer 7 Attack Mitigation with Programmable data planes. We implemented LAMP using the P4 data plane programming language and evaluated its effectiveness and efficiency in the Behavioral Model (bmv2) environment.

cs.NI↗

arXiv2018

Enabling Cooperative IoT Security via Software Defined Networks (SDN)

Internet of Things (IoT) is becoming an increasingly attractive target for cybercriminals. We observe that many attacks to IoTs are launched in a collusive way, such as brute-force hacking usernames and passwords, to target at a particular victim. However, most of the time our defending mechanisms to such kind of attacks are carried out individually and independently, which leads to ineffective and weak defense. To this end, we propose to leverage Software Defined Networks (SDN) to enable cooperative security for legacy IP-based IoT devices. SDN decouples control plane and data plane, and can help bridge the knowledge divided between the application and network layers. In this paper, we discuss the IoT security problems and challenges, and present an SDN-based architecture to enable IoT security in a cooperative manner. Furthermore, we implemented a platform that can quickly share the attacking information with peer controllers and block the attacks. We carried out our experiments in both virtual and physical SDN environments with OpenFlow switches. Our evaluation results show that both environments can scale well to handle attacks, but hardware implementation is much more efficient than a virtual one.

cs.NI↗

arXiv2018

GRASP: a GReen energy Aware SDN Platform

The transition to renewable energy sources for data centers has become a popular trend in the IT industry. However, the volatility of renewable energy, such as solar and wind power, impedes the operation of green data centers. In this work, we leverage Software Defined Networking (SDN) to build GRASP, a platform that schedules job requests to distributed data centers according to the amount of green energy available at each site. GRASP can be re-configured with different scheduling algorithms to address diverse factors such as amounts of instantly available solar power, wind power and CPU load of data centers. We utilize realistic green energy datasets from National Solar Radiation Database and evaluate GRASP in the GENI testbed; in addition, we create necessary GENI artifacts to repeat our experiment. GRASP can serve as a practical platform to test various job scheduling mechanisms for distributed green data centers.

cs.NI↗

arXiv2018

VeriTable: Fast Equivalence Verification of Multiple Large Forwarding Tables

Due to network practices such as traffic engineering and multi-homing, the number of routes---also known as IP prefixes---in the global forwarding tables has been increasing significantly in the last decade and continues growing in a super linear trend. One of the most promising solutions is to use smart Forwarding Information Base (FIB) aggregation algorithms to aggregate the prefixes and convert a large table into a small one. Doing so poses a research question, however, i.e., how can we quickly verify that the original table yields the same forwarding behaviors as the aggregated one? We answer this question in this paper, including addressing the challenges caused by the longest prefix matching (LPM) lookups. In particular, we propose the VeriTable algorithm that can employ a single tree/trie traversal to quickly check if multiple forwarding tables are forwarding equivalent, as well as if they could result in routing loops or black holes. The VeriTable algorithm significantly outperforms the state-of-the-art work for both IPv4 and IPv6 tables in every aspect, including the total running time, memory access times and memory consumption.

cs.NI↗

arXiv2018

Toward a Programmable FIB Caching Architecture

The current Internet routing ecosystem is neither sustainable nor economical. More than 711K IPv4 routes and more than 41K IPv6 routes exist in current global Forwarding Information Base (FIBs) with growth rates increasing. This rapid growth has serious consequences, such as creating the need for costly FIB memory upgrades and increased potential for Internet service outages. And while FIB memories are power-hungry and prohibitively expensive, more than 70\% of the routes in FIBs carry no traffic for long time periods, a wasteful use of these expensive resources. Taking advantage of the emerging concept of programmable data plane, we design a programmable FIB caching architecture to address the existing concerns. Our preliminary evaluation results show that the architecture can significantly mitigate the global routing scalability and poor FIB utilization issues.

cs.NI↗