{"title":"Design of a secure packet processor","authors":"D. Chasaki, T. Wolf","doi":"10.1145/1872007.1872011","DOIUrl":"https://doi.org/10.1145/1872007.1872011","url":null,"abstract":"Programmability in the data path of routers provides the basis for modern router implementations that can adapt to new functional requirements. This programmability is typically achieved through software-programmable packet processing systems. One key concern with the proliferation of these programmable devices throughout the Internet is the potential impact of software vulnerabilities that can be exploited remotely. We present a design and proof-of-concept implementation of a packet processing system that uses two security techniques to defend against potential attacks: a processing monitor is used to track operations on each processor core to detect attacks at the processing instruction level; an I/O monitor is used to track operations of the router to detect attacks at the protocol level. Our prototype implementation on the NetFPGA system shows that these monitors can be implemented to operate at high data rates and with little additional hardware resources.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116198920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Power optimization for multimedia transcoding on multicore servers","authors":"Jilong Kuang, Danhua Guo, L. Bhuyan","doi":"10.1145/1872007.1872044","DOIUrl":"https://doi.org/10.1145/1872007.1872044","url":null,"abstract":"We design, implement and evaluate a power-efficient and traffic-aware transcoding system on multicore servers that appropriately adjusts the processor operating level. The system is capable of configuring the number of active cores and core frequency “on-the-fly” according to the varying traffic rate. Results on an AMD machine show that our system saves 51.0% power consumption compared to a native system without power-saving schemes. It also outperforms three other power-aware systems, CG [2] (clock gating), C-DVFS [3] (chip-wide DVFS) and Hybrid [1] (chip-wide DVFS + power-gating), by 19.5%, 10.5% and 5.5% reduction of power consumption, respectively.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130690496","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Simple two-priority, low-jitter scheduler","authors":"W. Olesinski, H. Eberle","doi":"10.1145/1872007.1872048","DOIUrl":"https://doi.org/10.1145/1872007.1872048","url":null,"abstract":"Many papers on emulations of Generalized Processor Sharing (GPS) have been published. The algorithms and their implementations are often very complex and/or generate a bursty output. In this paper, we present a simple two-priority scheduler that can be easily implemented in hardware, making it especially interesting for Networks on Chips (NoCs), and other applications dealing with stringent resource constraints.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"733 ","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"113982210","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
K. Ram, Jayaram Mudigonda, A. Cox, S. Rixner, Parthasarathy Ranganathan, J. R. Santos
{"title":"sNICh: Efficient last hop networking in the data center","authors":"K. Ram, Jayaram Mudigonda, A. Cox, S. Rixner, Parthasarathy Ranganathan, J. R. Santos","doi":"10.1145/1872007.1872040","DOIUrl":"https://doi.org/10.1145/1872007.1872040","url":null,"abstract":"Virtualization has fundamentally changed the data center network. The last hop of the network is no longer handled by a physical network switch, but rather is typically performed in software inside the server to switch among virtual machines hosted by that server. In this paper, we present the concept of a sNICh, which is a combination of a network interface card and switching accelerator for modern virtualized servers. The sNICh architecture exploits the proximity of the switching accelerator to the server by carefully dividing the network switching tasks between them. This division enables the sNICh to address the resource intensiveness of exclusively software-based approaches and the scalability limits of exclusively hardware-based approaches. Essentially, the sNICh hardware performs basic flow-based switching and the sNICh software handles flow setup based on packet filtering rules. The sNICh also minimizes I/O bus bandwidth utilization by transferring, whenever possible, inter-virtual machine traffic within the main memory. We also present a preliminary evaluation of this architecture using software emulation. We compare the performance of the sNICh with two existing software solutions in Xen, the Linux bridge and Open vSwitch. Our results show that the sNICh outperforms both of these existing solutions and also exhibits better scalability.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127078778","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
M. Schlansker, Yoshio Turner, J. Tourrilhes, A. Karp
{"title":"Ensemble routing for datacenter networks","authors":"M. Schlansker, Yoshio Turner, J. Tourrilhes, A. Karp","doi":"10.1145/1872007.1872036","DOIUrl":"https://doi.org/10.1145/1872007.1872036","url":null,"abstract":"This paper describes Hash-Based Routing (HBR), an architecture that enhances Ethernet to support dynamic management for multipath networks in scalable datacenters. This work enhances HBR to support flow ensemble management for large-scale networks of arbitrary topology. Ensemble routing eliminates measurement and control for individual flows and instead manages using summary data thus providing a unique capability for reactive datacenter-wide network management. HBR provides seamless interoperability with Ethernet and supports the attachment of unmodified L2 hosts and devices including FCoE devices within converged fabrics. Simulation experiments demonstrate efficient multipath routing for a variety of scalable topologies. Optimized routing maintains efficiency in the presence of network faults and implements spatial Quality of Service to dynamically provision physical network hardware among co-hosted tenants or applications.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"67 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122811798","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"NFA split architecture for fast regular expression matching","authors":"J. Korenek, V. Kosar","doi":"10.1145/1872007.1872024","DOIUrl":"https://doi.org/10.1145/1872007.1872024","url":null,"abstract":"Many hardware architectures have been designed to accelerate regular expression matching in network security devices, but most of them can achieve high throughput only for strings or small sets of regular expressions. We propose new NFA Split architecture which reduces the amount of consumed FPGA resources in order to match larger set of regular expressions. New algorithm is introduced to find non-collision sets of states and determine part of nondeterministic automaton which can be mapped to the memory based architecture. For all analysed sets of regular expressions, the algorithm was able to find non-collision sets with 67.8 % of states in average and reduces the amount of consumed flip-flops to 37.6 % and look-up tables to 63.9 % in average.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128401937","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The case for hardware transactional memory in software packet processing","authors":"Martin Labrecque, J. Steffan","doi":"10.1145/1872007.1872053","DOIUrl":"https://doi.org/10.1145/1872007.1872053","url":null,"abstract":"Software packet processing is becoming more important to enable differentiated and rapidly-evolving network services. With increasing numbers of programmable processor and accelerator cores per network node, it is a challenge to support sharing and synchronization across them in a way that is scalable and easy-to-program. In this paper, we focus on parallel/threaded applications that have irregular control-flow and frequently-updated shared state that must be synchronized across threads. However, conventional lock-based synchronization is both difficult to use and also often results in frequent conservative serialization of critical sections. Alternatively, we propose that Transactional memory (TM) is a good match to software packet processing: it both (i) can allow the system to optimistically exploit parallelism between the processing of packets whenever it is safe to do so, and (ii) is easy-to-use for a programmer. With the NetFPGA platform and four network packet processing applications that are threaded and share memory, we evaluate hardware support for TM (HTM) using the reconfigurable FPGA fabric. Relative to NetThreads, our two-processor four-way-multithreaded system with conventional lock-based synchronization, we find that adding HTM achieves 6%, 54% and 57% increases in packet throughput for three of four packet processing applications studied, due to reduced conservative serialization.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133350607","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"High speed pattern matching algorithm based on deterministic finite automata with faulty transition table","authors":"Jan Kastil, J. Korenek","doi":"10.1145/1872007.1872017","DOIUrl":"https://doi.org/10.1145/1872007.1872017","url":null,"abstract":"Regular expression matching is the time-critical operation of many modern intrusion detection systems (IDS). This paper proposes pattern matching algorithm to match regular expression against multigigabit data stream. As usually used regular expressions are only subjectively tested and often generates many false positives/ negatives, proposed algorithm support the possibility to reduce memory requirements by introducing small amount of faults into the pattern matching. Algorithm is based on the perfect hashing and is suitable for hardware implementation.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132467235","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Throughput of random arbitration for approximate matchings","authors":"L. Chen, N. Chrysos","doi":"10.1145/1872007.1872026","DOIUrl":"https://doi.org/10.1145/1872007.1872026","url":null,"abstract":"Exact matchings have been extensively studied in the past, but there is relatively little work about approximate matchings. We present a throughput analysis when random arbitration is used to obtain approximate matchings. We compute the throughput by the average available credits at outputs, which is obtained through a DTMC modeling. We also devise an iterative solving procedure for the DTMC of available output credits, based on the received grants at inputs. Both our analytical and simulation results show that applying random arbitration on the studied architecture containing a moderate buffer size (B > 8) yields almost hundred percent throughput.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123574118","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"TnT: Transparent Network Tracker for P2P applications","authors":"S. James, P. Crowley","doi":"10.1145/1872007.1872043","DOIUrl":"https://doi.org/10.1145/1872007.1872043","url":null,"abstract":"Peer-to-peer (P2P) applications are voracious bandwidth consumers, and ISPs have no effective options for curbing their bandwidth consumption. The Transparent Network Tracker (TnT) is a network device that fills this void: it identifies and monitors P2P traffic on the wire to support applications that control it. In this paper, we describe our TnT prototype and an associated ISP tracker application.","PeriodicalId":262685,"journal":{"name":"2010 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128990823","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}