Programmable Data Planes for Increased Digital Resilience in OT Networks

Critical national infrastructure is heavily reliant on operational technology (OT) to monitor and control physical industrial processes. Despite the importance of OT systems, they have inherently been designed to maintain safety assurance rather than mitigate security threats. Recent advances in programmable networks offer highly customizable and flexible solutions for cybersecurity. However, the integration of data plane and network stack programmability into OT environments has not been fully explored. The conventional programmable data plane (PDP) approach based on the P4 language and the reconfigurable match-action tables (RMT) switch model has proven highly effective for data center environments. However, performance is subject to specific target implementations, while the architectural model lacks inherent support for flexible and stateful functionality required by cybersecurity use cases. Alternative (host) network programmability paradigms, such as extended Berkley packet filter (eBPF), are gaining traction as more suitable to OT use cases. In this article, we explore the suitability of PDP and offload technologies for improved digital resilience in OT environments. We provide a comprehensive cross-comparison between PDP solutions and advocate that eBPF-based network programmability can achieve flexible, dynamic, and low-cost in-network functions for digital security and resilience. We present an eBPF-based proof-of-concept asset discovery service that is compared with alternative solutions. Furthermore, we discuss the OT network security functions enabled through eBPF to address potential future research directions.