An all-important step in the ambitious pursuit towards autonomous networks has been the introduction of Software Defined Networking which has advocated the concept of separating a network’s control plane from the data plane and creating a programmable controller with a wider view of the network. This innovation proved to be very promising, but the non-programmable data plane quickly became a limitation.  The next step was brought by the emergence of the programmable switch architecture and P4, a language specifically designed for defining the behaviour of programmable network devices. P4 is a remarkably powerful language that allows the software developer to define almost any packet-processing functionality, all while abstracting away from the specifics of the target’s hardware architecture. Despite its many benefits, P4 brings with it an additional layer of complexity for the network administrators, which may find themselves overwhelmed by having to learn a new programming language. This report tackles this issue by presenting a prototype that is capable of synthesizing small P4 programs from pairs of input & output packets. Under the hood, the proposed solution uses a bottom-up enumerative synthesizer called Probe. This synthesizer was re-implemented, improved, and tailored to leverage the particularities of the problem domain.

Data planes are responsible for forwarding packets in a network. The P4 language is used for programming programmable data planes. Such data planes give more flexibility to programmers by allowing them to define how the packets should be processed. However, these data planes might also be more vulnerable to malicious attacks than traditional (non-programmable) data planes. That is because software is usually more prone to errors as compared to the hardware. Different research has already analyzed various aspects of the security of the P4 language. However, the security vulnerabilities of P4 programs have not been researched in depth. The main contribution of this paper is providing examples of attacks on P4 programs by using manipulated packet data. In this research, it was attempted to corrupt three P4 programs by manipulating packet data. Two of the three attempts were successful. The paper concludes that some P4 programs can be corrupted by malicious packets.

In software defined networking a controller can control where the data-plane routes packets to. Programmable data-planes make networks even more flexible, as the algorithms on the data-plane can be updated. The P4 programming language can be used to program data-planes, and the P4Runtime data-plane API can be used for controller to data-plane communication. The possibility of man-in-the-middle attacks when using P4Runtime was investigated. Man-in-the-middle attacks are possible either between the controller and data-plane, or between two hosts on the network. A virtual network in Mininet was used to try and demonstrate the difference between secure and insecure channels in these two scenarios. A malicious controller can take control of a switch in order to use it for man-in-the-middle attacks when the P4Runtime channel is insecure, but not in a secure channel. The man-in-the-middle attack between the controller and switch was not achieved due to the switches in Mininet only running on localhost and not being able to run the controller in-band. It was concluded that it is indeed recommended to only use secure P4Runtime channels, and possible extensions to this research could be to attempt the same experiment using a different setup or to research the effects that a successful man-in-the-middle attack can have.

P4 programmable data-planes provide operators with a flexible method to set up data-plane forwarding logic. To deploy networks with confidence, a switch's forwarding logic should correspond with its intended behavior. Programs loaded onto programmable data-planes don't necessarily go through as much testing as traditional fixed-function devices from large manufacturers. Security is therefore of utmost importance. The main question this research attempts to answer, is whether a single compromised P4 switch can corrupt the entire (P4) network. In this scenario the attacker already has access to the compromised switch, and the assumption is made that all devices blindly trust each other. Two load balancing schemes are investigated, Clove-ECN and HULA. The former performs load balancing on the hosts, and results show that switches can transparently influence traffic flow by manipulating the ECN bits. The latter is designed for implementation on the data-plane, e.g. using P4, and we can conclude that HULA is susceptible to attacks by spoofing probe packets with false data.

DDoS attacks are becoming more common and sophisticated. Only recently, in 2017, Google claims they have mitigated an attack which sent 2.54 Tbps of traffic to their servers. In order to prevent these attacks, more and more robust defence mechanisms need to be put in place to withstand the malicious traffic and secure the networks. Programmable data planes allow the users to specify which rules the headers of a packet need to follow and what happens if they are different. With this freedom, achieving more secure networks becomes possible. The use of the programming language P4 makes it easy to modify the functionality of the switches and limit the behaviour of the network in order to reduce the attack surface. This paper describes certain attacks and mitigation techniques for them, such as DoS attacks and SYN-flood attacks. The paper will list existing defence techniques and enumerate their advantages and drawbacks. There will be two proof of concept detection and mitigation techniques in P4, and these implementations will be compared to already existing ones. The P4 implementations will be provided as well as comparison and performance graphs.

After software defined networking (SDN) separated the control-plane from the dataplane, P4 was proposed as a solution to be able to program the data-plane. The programmable data plane (PDP) is very useful to alter the behaviour of programmable network devices. The drawback, however, is that without virtualization only one single P4 program can run at a time on the PDP. Compiler based and hypervisor based approaches can be used to virtualize the P4 data-plane to let P4 programs run alongside each other. This increases the flexibility when compared to P4, but can potentially come with added risks. Hypervisor based approaches share resources, while compiler based approaches try to minimize the sharing of resources. This opens up hypervisor based approaches, like HyperVDP and Hyper4, to attacks from a corrupt P4 program. Because of the resource sharing, when one of the virtualized P4 programs in HyperVDP is corrupted, there potentially is a risk that the other virtualized programs also get influenced. This paper will attempt to answer the question; can a malicious P4 program corrupt behaviour of another P4 program while running alongside each other. This will be done by laying out a method to answer this question using HyperVDP. A repository containing the updated source code of HyperVDP will also be created and provided to allow for a stable framework.