The Service-Based Architecture (SBA) of the fifth generation (5G) of cellular networks introduced great advancements in flexibility, efficiency, and performance of modern networks, thanks to the distribution and softwarization of core network entities called Network Functions (NFs). Due to the distributed nature of 5G systems, these NFs are usually located in different sites to provide better Quality of Service (QoS) or specific services, which poses a great challenge regarding security. However, even though the 3GPP standard identifies security requirements by leveraging Transport Layer Security (TLS) authentication and OAuth2.0 authorization, current experimental and commercial deployments often disregard these aspects for the sake of simplicity and performance. In fact, even though data and communication protection is crucial, the implementation of security protocols and mechanisms complicates the deployments and may reduce the efficiency of 5G systems. This paper presents a novel solution that implements TLS for authentication and encryption leveraging entanglement-based Quantum Key Distribution (QKD), ensuring that all the communications between NFs in the 5G core network are secured by QKD keys, and are therefore quantum-safe. Additionally, this paper presents a QKD key repository using the Network Repository Function (NRF), which stores and relays TLS session keys to authenticated consumer NFs to access producer NFs in a fast but quantum-safe process. The solution was validated in a real hardware environment, and obtained results demonstrate that the proposed solution enhances the security of the SBA communications in an efficient way, reducing an 85% the service request time compared to the traditional TLS-based procedure, as well as 29.96% fewer bytes transmitted throughout the process.

Network softwarization has significantly evolved since programmable data planes became topical in academia and industry. Programming Protocol-Independent Packet Processors (P4) is a language to define packet forwarding behavior. Forwarding devices that are programmed with the P4 language support a flexible way to define headers, parse graphs, and data plane logic. However, extending the data plane with additional functionalities has an impact on packet data plane latency. For this reason, this paper analyzes the key factors that affect data pane latency to packets processed by the Tofino-based target (Tofino Native Architecture (TNA)), which can be considered the de facto production-ready and P4-programmable Application-Specific Integrated Circuit (ASIC). Our work first provides an extensive set of latency measurements and, afterwards, it includes a set of data plane latency predictions using the model derived from the latency results and machine learning (ML) algorithms. We demonstrate that the PCA-lasso polynomial (PLP) obtains the best results among the algorithms tested. The best-case results show that PLP obtained an accuracy of 98.22% prediction accuracy when considering the parser, deparser, and the control block for traffic running at 10 G/s (SFP+) and 100 G/s (QSFP28). To the best of our knowledge, this is the first work that provides such a comprehensive profiling, including a method to predict data plane latency in production-grade Tofino ASIC-based switching hardware, which could be leveraged to yield accurate latency values prior to investment and deployment.

Quick handling of link failures remains a challenging issue in current communication networks, although it is crucial to many routing algorithms. Link failures are the leading cause of packet losses and delays, therefore, failure recovery is tied to stringent requirements for certain services, such as the sub-50 millisecond completion time for carrier-grade networks, which is sometimes difficult to achieve in traditional routing schemes. For this reason, fast recovery strategies are key pillars of modern communication networks. In this paper, we demonstrate the benefits of the devices with Programmable Data Planes (PDP) for fast reacting to link failures. We first review the link failure detection, reaction and recovery procedures and then we discuss the main fast failure recovery mechanisms employed by different types of devices in current communication networks. In addition, we present a novel method to measure the link failure reaction time of an Intel Tofino switch with PDP, as well as the results obtained when measuring such time using real hardware equipment. Our results show that such hardware devices provide a failure reaction time in the order of microseconds, with an average of 472.88 μs, which poses PDP as a key technology to achieve zero packet loss and zero delay failure recovery.

The use of advanced communications and smart mechanisms in industry is growing rapidly, making cybersecurity a critical aspect. Currently, most industrial communication protocols rely on the Transport Layer Security (TLS) protocol to build their secure version, providing confidentiality, integrity and authentication. In the case of UDP-based communications, frequently used in Industrial Internet of Things (IIoT) scenarios, the counterpart of TLS is Datagram Transport Layer Security (DTLS), which includes some mechanisms to deal with the high unreliability of the transport layer. However, the (D)TLS handshake is a heavy process, specially for resource-deprived IIoT devices and frequently, security is sacrificed in favour of performance. More specifically, the validation of digital certificates is an expensive process from the time and resource consumption point of view. For this reason, digital certificates are not always properly validated by IIoT devices, including the verification of their revocation status; and when it is done, it introduces an important delay in the communications. In this context, this paper presents the design and implementation of an in-network server certificate validation system that offloads this task from the constrained IIoT devices to a resource-richer network element, leveraging data plane programming (DPP). This approach enhances security as it guarantees that a comprehensive server certificate verification is always performed. Additionally, it increases performance as resource-expensive tasks are moved from IIoT devices to a resource-richer network element. Results show that the proposed solution reduces DTLS handshake times by 50–60 %. Furthermore, CPU use in IIoT devices is also reduced, resulting in an energy saving of about 40 % in such devices.

Digital certificates are regarded as the most secure and scalable way of implementing authentication services in the Internet today. They are used by most popular security protocols, including Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). The lifecycle management of digital certificates relies on centralized Certification Authority (CA)-based Public Key Infrastructures (PKIs). However, the implementation of PKIs and certificate lifecycle management procedures in Industrial Internet of Things (IIoT) environments presents some challenges, mainly due to the high resource consumption that they imply and the lack of trust in the centralized CAs. This paper identifies and describes the main challenges to implement certificate-based public key cryptography in IIoT environments and it surveys the alternative approaches proposed so far in the literature to address these challenges. Most proposals rely on the introduction of a Trusted Third Party to aid the IIoT devices in tasks that exceed their capacity. The proposed alternatives are complementary and their application depends on the specific challenge to solve, the application scenario, and the capacities of the involved IIoT devices. This paper revisits all these alternatives in light of industrial communication models, identifying their strengths and weaknesses, and providing an in-depth comparative analysis.

Industrial networks are introducing Internet of Things (IoT) technologies in their manufacturing processes in order to enhance existing methods and obtain smarter, greener and more effective processes. Global predictions forecast a massive widespread of IoT technology in industrial sectors in the near future. However, these innovations face several challenges, such as achieving short response times in case of time-critical applications. Concepts like in-network computing or edge computing can provide adequate communication quality for these industrial environments, and data plane programming has been proved as a useful mechanism for their implementation. Specifically, P4 language is used for the definition of the behavior of programmable switches and network elements. This paper presents a solution for industrial IoT (IIoT) network communications to reduce response times using in-network computing through data plane programming and P4. Our solution processes Message Queuing Telemetry Transport (MQTT) packets sent by a sensor in the data plane and generates an alarm in case of exceeding a threshold in the measured value. The implementation has been tested in an experimental facility, using a Netronome SmartNIC as a P4 programmable network device. Response times are reduced by 74% while processing, and delay introduced by the P4 network processing is insignificant. View Full-Text

Industry 4.0 heavily builds on massive deployment of Industrial Internet of Things (IIoT) devices to monitor every aspect of the manufacturing processes. Since the data gathered by these devices impact the output of critical processes, identity management and communications security are critical aspects, which commonly rely on the deployment of X.509 certificates. Nevertheless, the provisioning and management of individual certificates for a high number of IIoT devices involves important challenges. In this paper, we present a solution to improve the management of digital certificates in IIoT environments, which relies on partially delegating the certificate enrolment process to an edge server. However, in order to preserve end-to-end security, private keys are never delegated. Additionally, for the protection of the communications between the edge server and the IIoT devices, an approach based on Identity Based Cryptography is deployed. The proposed solution considers also the issuance of very short-lived certificates, which reduces the risk of using expired or compromised certificates, and avoids the necessity of implementing performance expensive protocols such as Online Certificate Status Protocol (OCSP). The proposed solution has been successfully tested as an efficient identity management solution for IIoT environments in a real industrial environment.

The market prediction for network deployments has positioned Software-Defined Networks (SDN) as the first of the options for changing local, transport, or cloud networks. Since the OpenFlow protocol gained traction and evolved in the last versions, the possibilities for expanding network capabilities to deploy custom services have risen considerably. With next-generation SDN (NG-SDN), flexibility has grown as data plane programming languages, such as P4, and Data-Control Plane Interface (DCPI) protocols like P4Runtime have appeared. Furthermore, the ability to program the data plane has opened the possibilities to develop new network telemetry approaches, such as In-band Network Telemetry (INT). A transition to partially incorporated SDN, also known as hybrid SDN, often involves considerable complexity, especially when legacy devices implement non-open standards and protocols. Therefore, incorporating programmable SDN devices and deploying network telemetry protocols on top of existing legacy devices is still challenging. This research focuses on deploying and integrating the INT protocol using programmable P4 switches over a hybrid SDN network. We describe and implement the required control plane applications and data plane configuration, and discuss the constraints that need to be managed so that P4 programmable switches can interact with the rest of the MPLS legacy devices. In this sense, we discuss P4 switch placement alternatives to maximize their performance and usability in a hybrid SDN network. Then, we validate the INT-based monitoring system by ensuring traffic forwarding using several INT header placements. In these tests, we demonstrate the feasibility of merging P4 switches running INT traffic and legacy devices, presenting the requirements to accomplish hybrid next-generation SDN (HNG-SDN) architectures. Besides, we provide new monitoring features, such as MPLS label verification, and we also use telemetry data to feed back traffic forwarding applications for traffic engineering purposes. We finally show the time that packets spend in the pipeline comparing different parsing and actions performed in different cases.

Electromagnetic (EM) disturbances and compatibility issues are the most common problems affecting communication and signaling systems. The duration of field testing to solve these railway EM interference (EMI) problems may vary between three and 12 months, with the cost of the complete process between €25,000 and €1.5 million [1]. Currently, the railway industry demands the building of strategies and tools to promote paths toward zero on-site testing [2] and reduce the duration of field tests; however, there is a lack of laboratory testing resources for these approaches.

The aim of this article is to present an architecture to support reconfigurable multimedia services for a practical emergency environment use case of rescue operations. Specifically, radio communication and video surveillance services are provided by means of a small device carried by a mobile vehicle. This solution is validated by implementing a digital mobile radio (DMR) standard radio hotspot and a video streaming server in an unmanned aerial vehicle (UAV) that conveys a device with scarce resources in order to minimize power consumption. To achieve a fast and flexible deployment of the envisioned services, a virtualization-based approach is proposed. Namely, a Kubernetes orchestrator is used to manage the life-cycle of services deployed on a small resource device, endowing the architecture with scalability and management flexibility. This article describes the executed performance tests that measured key parameters such as deployment time and recovery time after disconnection. Highly promising results were obtained, showing that the proposed architecture can be deployed in less than 4 minutes and can recover from network disconnections in less than 10 seconds. Thus, the performance, reliability and flexibility of the overall solution are demonstrated.