标题： 可编程数据平面用于网络安全 显示英文标题

标题： Programmable Data Planes for Network Security

摘要： 可编程数据平面的出现，特别是支持P4语言的交换机，通过实现定制化的线速数据包处理，改变了网络安全。这些交换机最初旨在实现灵活的转发，现在扮演着更广泛的角色：检测和缓解DDoS和欺骗等攻击，实施下一代防火墙策略，甚至支持网络内加密和机器学习。这些功能是通过诸如循环截断和查找表预计算等技术实现的，这些技术绕过了有限内存和受限指令集等架构限制。在本文中，我们系统地整理了基于可编程交换机构建的安全应用的最新进展，重点在于功能、挑战和架构解决方案。我们强调了使复杂的网络内安全功能在硬件平台的限制下可行的非显而易见的设计技术，并对剩余问题和新兴研究方向进行了评论。 显示英文摘要

摘要： The emergence of programmable data planes, and particularly switches supporting the P4 language, has transformed network security by enabling customized, line-rate packet processing. These switches, originally intended for flexible forwarding, now play a broader role: detecting and mitigating attacks such as DDoS and spoofing, enforcing next-generation firewall policies, and even supporting in-network cryptography and machine learning. These capabilities are made possible by techniques such as recirculate-and-truncate and lookup-table precomputation, which work around architectural constraints like limited memory and restricted instruction sets. In this paper, we systematize recent advances in security applications built on programmable switches, with an emphasis on the capabilities, challenges, and architectural workarounds. We highlight the non-obvious design techniques that make complex in-network security functions feasible despite the constraints of the hardware platform, and also comment on remaining issues and emerging research directions.