Abstract: Examples herein describe a programmable traffic management engine that includes both programmable and non-programmable hardware components. The non-programmable hardware components are used to generate features that can then be used to perform different traffic management algorithms. Depending on which traffic management algorithm the PTM engine is configured to do, the PTM engine may use a subset (or all) of the features to perform the algorithm. The programmable hardware components in the PTM engine are programmable (e.g., customizable) by the user to perform a selected algorithm using some or all of the features provided by the non-programmable hardware components.

Abstract: Examples herein describe an acceleration framework that includes a hybrid congestion control (CC) engine where some components are implemented in software (e.g., a CC algorithm) while other components are implemented in hardware (e.g., measurement and enforcement modules and a flexible processing unit). The hardware components can be designed to provide measurements that can be used by multiple different types of CC algorithms. Depending on which CC algorithms are currently enabled, the hardware components can be programmed to perform measurement, processing, and enforcement tasks, thereby freeing the CPUs in the host to perform other tasks. In this manner, the hybrid CC engine can have the flexibility of a pure software CC algorithm with the advantage of performing many of the operations associated with the CC algorithm in hardware.

Abstract: Embodiments herein describe a describe an interface shell in a SmartNIC that reduces data-copy overhead in CPU-centric solutions that rely on hardware compute engine (which can include one or more accelerators). The interface shell offloads tag matching and address translation without CPU involvement. Moreover, the interface shell enables the compute engine to read messages directly from the network without extra data copy—i.e., without first copying the data into the CPU's memory.

Abstract: Mining proxy acceleration may include receiving, within a mining proxy, packetized data from a mining pool server and determining, using the mining proxy, whether the packetized data qualifies for broadcast processing. In response to determining that the packetized data qualifies for broadcast processing, the packetized data can be modified using the mining proxy to generate broadcast data. The broadcast data can be broadcast, using the mining proxy, to a plurality of miners subscribed to the mining proxy.

Abstract: Examples herein describe a programmable traffic management engine that includes both programmable and non-programmable hardware components. The non-programmable hardware components are used to generate features that can then be used to perform different traffic management algorithms. Depending on which traffic management algorithm the PTM engine is configured to do, the PTM engine may use a subset (or all) of the features to perform the algorithm. The programmable hardware components in the PTM engine are programmable (e.g., customizable) by the user to perform a selected algorithm using some or all of the features provided by the non-programmable hardware components.

Abstract: A device includes a programmable passive measurement hardware engine, a programmable active measurement hardware engine, and a configuration engine. The programmable passive measurement hardware engine is configured to collect statistical data, from data transmission at a network line rate, used for network measurement. The programmable active measurement hardware engine is configured to generate probe packets and wherein the programmable active measurement hardware engine is further configured to collect responses to the generated probe packets, wherein the collected responses are used for the network measurement. The configuration engine is configured to receive data settings and wherein the configuration engine is further configured to program the programmable passive measurement hardware engine and the programmable active measurement hardware engine with the received data settings.

Abstract: The application relates to controlling access in a software-defined network (SDN). A controller in the SDN receives an access request from an application program. The controller determines whether an operation on a resource as specified in the access request belongs to a permission list corresponding to the application program. The permission list includes a list of permitted operations on the resource by the application program. When the operation as specified in the access request belongs to the permission list, the controller sends a reply message allowing access by the application program. In this way, accesses by the application program are restricted according to the permission list, and malicious attacks from the application program can be prevented to ensure network security.

Abstract: The present disclosure relates to the communications field, and specifically, to a flow table processing method and an apparatus. The method includes: monitoring, by a switch, a flow table load of the switch; when the flow table load of the switch exceeds a preset threshold, determining, by the switch, a diffusion target of a target data flow according to a matching rule of a diffusive flow table; and when the determined diffusion target is a neighboring switch of the switch, forwarding, by the switch, the target data flow to the neighboring switch. When the flow table load of the switch exceeds the preset threshold, the switch may have been attacked. A data flow that fails to be matched to a flow entry is forwarded to the neighboring switch according to a diffusion probability, for processing by the neighboring switch.

Abstract: The present disclosure relates to a data flow forwarding abnormality detection method. In one example method, a switching device through which a to-be-detected data flow passes is determined by a controller. At least one flow entry in the switching device that matches the to-be-detected data flow is obtained. The at least one flow entry comprises actual traffic and a match field. The actual traffic is a value of a counter corresponding to the match field. An overdetermined equation set is established based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field. Based on the overdetermined equation set, a determination is made on whether the at least one flow entry is abnormal.

Abstract: The present disclosure discloses a message attack defense method and apparatus. The method includes: receiving, by a controller, a report message sent by at least one switch; respectively storing, by the controller in a switch queue corresponding to each switch, the received report message that is sent by each switch; and performing, by the controller, round-robin scheduling on the switch queue corresponding to each switch.

Abstract: The present disclosure relates to a data flow forwarding abnormality detection method. In one example method, a switching device through which a to-be-detected data flow passes is determined by a controller. At least one flow entry in the switching device that matches the to-be-detected data flow is obtained. The at least one flow entry comprises actual traffic and a match field. The actual traffic is a value of a counter corresponding to the match field. An overdetermined equation set is established based on the actual traffic and theoretical traffic of a data flow in the switching device that matches the match field. Based on the overdetermined equation set, a determination is made on whether the at least one flow entry is abnormal.

Abstract: The present disclosure relates to the communications field, and specifically, to a flow table processing method and an apparatus. The method includes: monitoring, by a switch, a flow table load of the switch; when the flow table load of the switch exceeds a preset threshold, determining, by the switch, a diffusion target of a target data flow according to a matching rule of a diffusive flow table; and when the determined diffusion target is a neighboring switch of the switch, forwarding, by the switch, the target data flow to the neighboring switch. When the flow table load of the switch exceeds the preset threshold, the switch may have been attacked. A data flow that fails to be matched to a flow entry is forwarded to the neighboring switch according to a diffusion probability, for processing by the neighboring switch.

Abstract: The application relates to controlling access in a software-defined network (SDN). A controller in the SDN receives an access request from an application program. The controller determines whether an operation on a resource as specified in the access request belongs to a permission list corresponding to the application program. The permission list includes a list of permitted operations on the resource by the application program. When the operation as specified in the access request belongs to the permission list, the controller sends a reply message allowing access by the application program. In this way, accesses by the application program are restricted according to the permission list, and malicious attacks from the application program can be prevented to ensure network security.

Abstract: The present disclosure discloses a message attack defense method and apparatus. The method includes: receiving, by a controller, a report message sent by at least one switch; respectively storing, by the controller in a switch queue corresponding to each switch, the received report message that is sent by each switch; and performing, by the controller, round-robin scheduling on the switch queue corresponding to each switch.