arXiv subjects

Giuseppe Bianchi

Publications and source records attributed to Giuseppe Bianchi.

At least 19 recordsLinked to original sources

arXiv2025

Synapse: Virtualizing Match Tables in Programmable Hardware

Efficient network packet processing increasingly demands dynamic, adaptive, and run-time resizable match table allocation to handle the diverse and heterogeneous nature of traffic patterns and rule sets. Achieving this flexibility at high performance in hardware is challenging, as fixed resource constraints and architectural limitations have traditionally restricted such adaptability. In this paper, we introduce Synapse, an extension to programmable data plane architectures that incorporates the Virtual Matching Table (VMT) framework, drawing inspiration from virtual memory systems in Operating Systems (OSs), but specifically tailored to network processing. This abstraction layer allows logical tables to be elastic, enabling dynamic and efficient match table allocation at runtime. Our design features a hybrid memory system, leveraging on-chip associative memories for fast matching of the most popular rules and off-chip addressable memory for scalable and cost-effective storage. Furthermore, by employing a sharding mechanism across physical match tables, Synapse ensures that the power required per key match remains bounded and proportional to the key distribution and the size of the involved shard. To address the challenge of dynamic allocation, we formulate and solve an optimization problem that dynamically allocates physical match tables to logical tables based on pipeline usage and traffic characteristics at the millisecond scale. We prototype our design on FPGA and develop a simulator to evaluate the performance, demonstrating its effectiveness and scalability.

cs.AR↗

arXiv2024

VaultFS: Write-once Software Support at the File System Level Against Ransomware Attacks

The demand for data protection measures against unauthorized changes or deletions is steadily increasing. These measures are essential for maintaining the integrity and accessibility of data, effectively guarding against threats like ransomware attacks that focus on encrypting large volumes of stored data, as well as insider threats that involve tampering with or erasing system and access logs. Such protection measures have become crucial in today's landscape, and hardware-based solutions like Write-Once Read-Many (WORM) storage devices, have been put forth as viable options, which however impose hardware-level investments, and the impossibility to reuse the blocks of the storage devices after they have been written. In this article we propose VaultFS, a Linux-suited file system oriented to the maintenance of cold-data, namely data that are written using a common file system interface, are kept accessible, but are not modifiable, even by threads running with (effective)root-id. Essentially, these files are supported via the write-once semantic, and cannot be subject to the rewriting (or deletion) of their content up to the end of their (potentially infinite) protection life time. Hence they cannot be subject to ransomware attacks even under privilege escalation. This takes place with no need for any underlying WORM device -- since ValutFS is a pure software solution working with common read/write devices (e.g., hard disks and SSD). Also, VaultFS offers the possibility to protect the storage against Denial-of-Service (DOS) attacks, possibly caused by un-trusted applications that simply write on the file system to make its device blocks busy with non-removable content.

cs.CR↗

arXiv2024

JITScanner: Just-in-Time Executable Page Check in the Linux Operating System

Modern malware poses a severe threat to cybersecurity, continually evolving in sophistication. To combat this threat, researchers and security professionals continuously explore advanced techniques for malware detection and analysis. Dynamic analysis, a prevalent approach, offers advantages over static analysis by enabling observation of runtime behavior and detecting obfuscated or encrypted code used to evade detection. However, executing programs within a controlled environment can be resource-intensive, often necessitating compromises, such as limiting sandboxing to an initial period. In our article, we propose an alternative method for dynamic executable analysis: examining the presence of malicious signatures within executable virtual pages precisely when their current content, including any updates over time, is accessed for instruction fetching. Our solution, named JITScanner, is developed as a Linux-oriented package built upon a Loadable Kernel Module (LKM). It integrates a user-level component that communicates efficiently with the LKM using scalable multi-processor/core technology. JITScanner's effectiveness in detecting malware programs and its minimal intrusion in normal runtime scenarios have been extensively tested, with the experiment results detailed in this article. These experiments affirm the viability of our approach, showcasing JITScanner's capability to effectively identify malware while minimizing runtime overhead.

cs.CR↗

arXiv2024

COREC: Concurrent Non-Blocking Single-Queue Receive Driver for Low Latency Networking

Existing network stacks tackle performance and scalability aspects by relying on multiple receive queues. However, at software level, each queue is processed by a single thread, which prevents simultaneous work on the same queue and limits performance in terms of tail latency. To overcome this limitation, we introduce COREC, the first software implementation of a concurrent non-blocking single-queue receive driver. By sharing a single queue among multiple threads, workload distribution is improved, leading to a work-conserving policy for network stacks. On the technical side, instead of relying on traditional critical sections - which would sequentialize the operations by threads - COREC coordinates the threads that concurrently access the same receive queue in non-blocking manner via atomic machine instructions from the Read-Modify-Write (RMW) class. These instructions allow threads to access and update memory locations atomically, based on specific conditions, such as the matching of a target value selected by the thread. Also, they enable making any update globally visible in the memory hierarchy, bypassing interference on memory consistency caused by the CPU store buffers. Extensive evaluation results demonstrate that the possible additional reordering, which our approach may occasionally cause, is non-critical and has minimal impact on performance, even in the worst-case scenario of a single large TCP flow, with performance impairments accounting to at most 2-3 percent. Conversely, substantial latency gains are achieved when handling UDP traffic, real-world traffic mix, and multiple shorter TCP flows.

cs.NI↗

arXiv2023

Adaptive mitigation of the Air-Time pressure in LoRa multi-gateway architectures

LoRa is a promising technology in the current Internet of Things market, which operates in un-licensed bands achieving long-range communications and with ultra power devices. In this work we capitalize on the idea introduced in [1], i.e. balance the Air-Time of the different modulation spreading factors (SF), and adapt it to operate in a typical metropolitan scenario comprising multiple gateways (GWs) interconnected to a same network server. Our proposed approach, named ADaptive Mitigation of the AIr-time pressure in lORa (AD MAIORA), relies on a suitable measure of the per-spreading-factor load at each GW - quantified by means of a so-called pressure table -, and on a relevant heuristic algorithm which attempts to balance such a per-SF-pressure. Especially in cases of very loaded scenarios, where a high number of nodes insist on the same GWs, the use of AD MAIORA shows significant performance gains, up to a factor of 5 improvements with respect to the legacy LoRaWAN's Adaptive Data Rate.

eess.SP↗

arXiv2022

"Cellular Network Densification Increases Radio-Frequency Pollution": True or False?

A very popular theory circulating among non-scientific communities claims that the massive deployment of Base Stations (BSs) over the territory, a.k.a. cellular network densification, always triggers an uncontrolled and exponential increase of human exposure to Radio Frequency "Pollution" (RFP). To face such concern in a way that can be understood by the layman, in this work we develop a very simple model to compute the RFP, based on a set of worst-case and conservative assumptions. We then provide closed-form expressions to evaluate the RFP variation in a pair of candidate 5G deployments, subject to different densification levels. Results, obtained over a wide set of representative 5G scenarios, dispel the myth: cellular network densification triggers an RFP decrease (up to three orders of magnitude) when the radiated power from the BS is adjusted to ensure a minimum sensitivity at the cell edge. Eventually, we analyze the conditions under which the RFP may increase when the network is densified (e.g., when the radiated power does not scale with the cell size), proving that the amount of RFP is always controlled. Finally, the results obtained by simulation confirm the outcomes of the RFP model.

eess.SP↗

arXiv2021

Design and Experimental Assessment of Detection Schemes for Air Interface Attacks in Adverse Scenarios

In this letter, we propose three schemes designed to detect attacks over the air interface in cellular networks. These decision rules rely on the generalized likelihood ratio test, and are fed by data that can be acquired using common off-the-shelf receivers. In addition to more classical (barrage/smart) noise jamming attacks, we further assess the capability of the proposed schemes to detect the stealthy activation of a rogue base station. The evaluation is carried out through an experimentation of a LTE system concretely reproduced using Software-Defined Radios. Illustrative examples confirm that the proposed schemes can effectively detect air interface threats with high probability.

eess.SP↗

arXiv2021

Metronome: adaptive and precise intermittent packet retrieval in DPDK

The increasing performance requirements of modern applications place a significant burden on software-based packet processing. Most of today's software input/output accelerations achieve high performance at the expense of reserving CPU resources dedicated to continuously poll the Network Interface Card. This is specifically the case with DPDK (Data Plane Development Kit), probably the most widely used framework for software-based packet processing today. The approach presented in this paper, descriptively called Metronome, has the dual goals of providing CPU utilization proportional to the load, and allowing flexible sharing of CPU resources between I/O tasks and applications. Metronome replaces DPDK's continuous polling with an intermittent sleep&wake mode, and revolves around a new multi-threaded operation, which improves service continuity. Since the proposed operation trades CPU usage with buffering delay, we propose an analytical model devised to dynamically adapt the sleep&wake parameters to the actual traffic load, meanwhile providing a target average latency. Our experimental results show a significant reduction of the CPU cycles, improvements in power usage, and robustness to CPU sharing even when challenged with CPU-intensive applications.

cs.NI↗

arXiv2021

Anomaly Detection Algorithms for Location Security in 5G Scenarios

Location based services are expected to play a major role in future generation cellular networks, starting from the incoming 5G systems. At the same time, localization technologies may be severely affected by attackers capable to deploy low cost fake base stations and use them to alter localization signals. In this paper, we concretely focus on two classes of threats: noise-like jammers, whose objective is to reduce the signal-to-noise ratio, and spoofing/meaconing attacks, whose objective is to inject false or erroneous information into the receiver. Then, we formulate the detection problems as binary hypothesis tests and solve them resorting to the generalized likelihood ratio test design procedure as well as the Latent Variable Models, which involves the expectation-maximization algorithm to estimate the unknown data distribution parameters. The proposed techniques can be applied to a large class of location data regardless the subsumed network architecture. The performance analysis is conducted over simulated data generated by using measurement models from the literature and highlights the effectiveness of the proposed approaches in detecting the aforementioned classes of attacks.

cs.IT↗

arXiv2020

LOcAl DEcisions on Replicated States (LOADER) in programmable data planes: programming abstraction and experimental evaluation

Programmable data planes recently emerged as a prominent innovation in Software Defined Networking (SDN), by permitting support of stateful flow processing functions over hardware network switches specifically designed for network processing. Unlike early SDN solutions such as OpenFlow, modern stateful data planes permit to keep (and dynamically update) local per-flow states inside network switches, thus dramatically improving reactiveness of network applications to state changes. Still, also in stateful data planes, the control and update of non-local states is assumed to be completely delegated to a centralized controller and thus accessed only at the price of extra delay. Our LOADER proposal aims at contrasting the apparent dichotomy between local states and global states. We do so by introducing a new possibility: permit to take localized (in-switch) decisions not only on local states but also on replicated global states, thus providing support for network-wide applications without incurring the drawbacks of classical approaches. To this purpose, i) we provide high-level programming abstractions devised to define the states and the update logic of a generic network-wide application, and ii) we detail the underlying low level state management and replication mechanisms. We then show LOADER's independence of the stateful data plane technology employed, by implementing it over two distinct stateful data planes (P4 switches and OPP - Open Packet Processor - switches), and by experimentally validating both implementations in an emulated testbed using a simple distributed Deny-of-Service (DoS) detection application.

cs.NI↗

arXiv2020

hXDP: Efficient Software Packet Processing on FPGA NICs

FPGA accelerators on the NIC enable the offloading of expensive packet processing tasks from the CPU. However, FPGAs have limited resources that may need to be shared among diverse applications, and programming them is difficult. We present a solution to run Linux's eXpress Data Path programs written in eBPF on FPGAs, using only a fraction of the available hardware resources while matching the performance of high-end CPUs. The iterative execution model of eBPF is not a good fit for FPGA accelerators. Nonetheless, we show that many of the instructions of an eBPF program can be compressed, parallelized or completely removed, when targeting a purpose-built FPGA executor, thereby significantly improving performance. We leverage that to design hXDP, which includes (i) an optimizing-compiler that parallelizes and translates eBPF bytecode to an extended eBPF Instruction-set Architecture defined by us; a (ii) soft-CPU to execute such instructions on FPGA; and (iii) an FPGA-based infrastructure to provide XDP's maps and helper functions as defined within the Linux kernel. We implement hXDP on an FPGA NIC and evaluate it running real-world unmodified eBPF programs. Our implementation is clocked at 156.25MHz, uses about 15% of the FPGA resources, and can run dynamically loaded programs. Despite these modest requirements, it achieves the packet processing throughput of a high-end CPU core and provides a 10x lower packet forwarding latency.

cs.AR↗

arXiv2020

Will the Proliferation of 5G Base Stations Increase the Radio-Frequency "Pollution"?

A common concern among the population is that installing new 5G Base Stations (BSs) over a given geographic region may result in an uncontrollable increase of Radio-Frequency "Pollution" (RFP). To face this dispute in a way that can be understood by the layman, we develop a very simple model, which evaluates the RFP at selected distances between the user and the 5G BS locations. We then obtain closed-form expressions to quantify the RFP increase/decrease when comparing a pair of alternative 5G deployments. Results show that a dense 5G deployment is beneficial to the users living in proximity to the 5G BSs, with an abrupt decrease of RFP (up to three orders of magnitude) compared to a sparse deployment. We also analyze scenarios where the user equipment minimum detectable signal threshold is increased, showing that in such cases a (slight) increase of RFP may be experienced.

cs.NI↗

arXiv2020

Is It Safe Living in the Vicinity of Cellular Towers? Analysis of Long-Term Human EMF Exposure at Population Scale

We focus on the ElectroMagnetic Field (EMF) exposure safety for people living in the vicinity of cellular towers. To this aim, we analyze a large dataset of long-term EMF measurements collected over almost 20 years in more than 2000 measurement points spread over an Italian region. We evaluate the relationship between EMF exposure and the following factors: (i) distance from the closest installation(s), (ii) type of EMF sources in the vicinity, (iii) Base Station (BS) technology, and (iv) EMF regulation updates. Overall, the exposure levels from BSs in the vicinity are below the Italian EMF limits, thus ensuring safety for the population. Moreover, BSs represent the lowest exposure compared to Radio/TV repeaters and other EMF sources. However, the BS EMF exposure in proximity to users exhibits an increasing trend over the last years, which is likely due to the pervasive deployment of multiple technologies and to the EMF regulation updates. As a side consideration, if the EMF levels continue to increase with the current trends, the EMF exposure in proximity to BSs will saturate to the maximum EMF limit by the next 20 years at a distance of 30 meters from the closest BS.

cs.NI↗

arXiv2020

Killing the Password and Preserving Privacy with Device-Centric and Attribute-based Authentication

Current authentication methods on the Web have serious weaknesses. First, services heavily rely on the traditional password paradigm, which diminishes the end-users' security and usability. Second, the lack of attribute-based authentication does not allow anonymity-preserving access to services. Third, users have multiple online accounts that often reflect distinct identity aspects. This makes proving combinations of identity attributes hard on the users. In this paper, we address these weaknesses by proposing a privacy-preserving architecture for device-centric and attribute-based authentication based on: 1) the seamless integration between usable/strong device-centric authentication methods and federated login solutions; 2) the separation of the concerns for Authorization, Authentication, Behavioral Authentication and Identification to facilitate incremental deployability, wide adoption and compliance with NIST assurance levels; and 3) a novel centralized component that allows end-users to perform identity profile and consent management, to prove combinations of fragmented identity aspects, and to perform account recovery in case of device loss. To the best of our knowledge, this is the first effort towards fusing the aforementioned techniques under an integrated architecture. This architecture effectively deems the password paradigm obsolete with minimal modification on the service provider's software stack.

cs.CR↗

arXiv2019

Capture Aware Sequential Waterfilling for LoraWAN Adaptive Data Rate

LoRaWAN (Long Range Wide Area Network) is emerging as an attractive network infrastructure for ultra low power Internet of Things devices. Even if the technology itself is quite mature and specified, the currently deployed wireless resource allocation strategies are still coarse and based on rough heuristics. This paper proposes an innovative "sequential waterfilling" strategy for assigning Spreading Factors (SF) to End-Devices (ED). Our design relies on three complementary approaches: i) equalize the Time-on-Air of the packets transmitted by the system's EDs in each spreading factor's group; ii) balance the spreading factors across multiple access gateways, and iii) keep into account the channel capture, which our experimental results show to be very substantial in LoRa. While retaining an extremely simple and scalable implementation, this strategy yields a significant improvement (up to 38%) in the network capacity over the legacy Adaptive Data Rate (ADR), and appears to be extremely robust to different operating/load conditions and network topology configurations.

cs.NI↗

arXiv2019

Quantum Internet: Networking Challenges in Distributed Quantum Computing

The Quantum Internet is envisioned as the final stage of the quantum revolution, opening fundamentally new communications and computing capabilities, including the distributed quantum computing. But the Quantum Internet is governed by the laws of quantum mechanics. Phenomena with no counterpart in classical networks, such as no-cloning, quantum measurement, entanglement and teleporting, impose very challenging constraints for the network design. Specifically, classical network functionalities, ranging from error-control mechanisms to overhead-control strategies, are based on the assumption that classical information can be safely read and copied. But this assumption does not hold in the Quantum Internet. As a consequence, the design of the Quantum Internet requires a major network-paradigm shift to harness the quantum mechanics specificities. The goal of this work is to shed light on the challenges and the open problems of the Quantum Internet design. To this aim, we first introduce some basic knowledge of quantum mechanics, needed to understand the differences between a classical and a quantum network. Then, we introduce quantum teleportation as the key strategy for transmitting quantum information without physically transferring the particle that stores the quantum information or violating the principles of the quantum mechanics. Finally, the key research challenges to design quantum communication networks are described.

quant-ph↗

arXiv2018

Quantum Internet: from Communication to Distributed Computing!

In this invited paper, the authors discuss the exponential computing speed-up achievable by interconnecting quantum computers through a quantum internet. They also identify key future research challenges and open problems for quantum internet design and deployment.

quant-ph↗

arXiv2017

D-STREAMON: from middlebox to distributed NFV framework for network monitoring

Many reasons make NFV an attractive paradigm for IT security: lowers costs, agile operations and better isolation as well as fast security updates, improved incident responses and better level of automation. On the other side, the network threats tend to be increasingly complex and distributed, implying huge traffic scale to be monitored and increasingly strict mitigation delay requirements. Considering the current trend of the net- working and the requirements to counteract to the evolution of cyber-threats, it is expected that also network monitoring will move towards NFV based solutions. In this paper, we present D- StreaMon an NFV-capable distributed framework for network monitoring realized to face the above described challenges. It relies on the StreaMon platform, a solution for network monitoring originally designed for traditional middleboxes. An evolution path which migrates StreaMon from middleboxes to Virtual Network Functions (VNFs) has been realized.

cs.NI↗