Secure in-Band Network Telemetry for the SCION Internet Architecture on Tofino

Today's Internet frequently suffers from unreliable packet forwarding and security vulnerabilities, while it largely depends on the Border Gateway Protocol (BGP) that obscures routing complexities from end-hosts. Path-Aware Networking (PAN) is a novel paradigm that aims to overcome BGP's limitations by offering end-hosts control over packet routing. However, an optimal path choice based on PAN requires realtime performance data about the different path options. Programmable data planes and Software-Defined Networking (SDN) enable to add real-time telemetry data to user packets. However, existing implementations are limited to single administrative domains, lacking the security and privacy required for interdomain telemetry. This paper proposes the first hardware implementation of Inter-Domain In-band Network Telemetry (ID-INT), extending the P4-based SCION border router targeting Tofino 2. Leveraging SCION's path-aware features and robust security mechanisms, like the DRKey system for secure key derivation, our ID-INT implementation on Tofino ensures telemetry data authenticity and integrity. We demonstrate the benefits of ID-INT on Tofino by evaluating the Deadline-aware Multipath Transport Protocol (DMTP) as an example application utilizing ID-INT data to improve its responsiveness to network conditions. Our testbed experiments show that ID-INT enables DMTP to dynamically adjust the sending rate based on instantaneous queue length data, highlighting ID-INT's practical benefits in enhancing an application's performance.