DetNetAuth: efficient authentication and integrity protection for deterministic networking
Daniel-Florin Dosaru, Nicolae Ţăpuş · 2023
Traditional computer networks provide a best-effort packet delivery service. Packets may be lost or delayed due to network congestion or security threats. Deterministic Networking (DetNet) aims to provide consistent and predictable delivery of data packets in real-time with extremely low data loss rates, bounded latency and jitter. Deploying DetNet in a standard IP based network presents multiple technical challenges and security concerns [1]. This paper presents a security solution that ensures the authentication and integrity protection for the DetNet data plane. We have implemented using the Data Plane Development Kit (DPDK) an efficient computation of the DetNetAuth header - a simplified version of the Authentication header [2] - that will be added after the layer 3 headers. The DetNetAuth header computation process is significantly accelerated compared to the state of the art IPSec Authentication Header (IPSec AH). The optimization technique involves pre-computing intermediate results for the HMAC function and the utilization of solely the layer 3 headers and the secret key for the HMAC computation. Our implementation can be used in networks where deterministic flows are desired, as it provides protection to a wide range of attacks: Replication-related (header manipulation), Spoofing and Replay attacks.