Dottorato in TECNOLOGIE DELL'INFORMAZIONE E DELLE COMUNICAZIONI (ICT)

Titolo della tesi: Segment Routing v6: Performance and Security applied research

Segment Routing (SR) is a loose source routing protocol that provides complete control over the forwarding paths by combining simple network instructions. The v6 of the protocol is instantiated on an IPv6 data plane and represents the focus of my research activity. SRv6 has several key features that can be leveraged to re-design weak network- ing models, such as Kubernetes, in order to address container networking issues and to improve their performances. Nevertheless, the protocols also hides some vulnerabilities that has been investigated and exploited to move an attack and to evaluate the resulting impact. In sight of this, per-flow state, which is probably the most significant peculiar- ity of Segment Routing approach, can be considered at the same time a light and a shadow in new networking paradigms scenario. My work has developed along this line. ∗∗∗ The dissertation is composed by four part: Part 1 introduces the actual networking context and the Segment Routing protocol. Part 2 explores the advantages of container technology and how SRv6 could be leveraged to support a Service Function Chaining in a Kubernetes cluster with an appreciated performance improvement. Part 3 discuss SRv6 vulnerabilities and presents the results of some attack simu- lations. Part 4 reports the conclusions of this applied research activity.