  We propose P4-MACsec to protect network links between P4 switches through
automated deployment of MACsec, a widespread IEEE standard for securing Layer 2
infrastructures. It is supported by switches and routers from major
manufacturers and has only little performance limitations compared to VPN
technologies such as IPsec. P4-MACsec introduces a data plane implementation of
MACsec including AES-GCM encryption and decryption directly on P4 switches.
P4-MACsec features a two-tier control plane structure where local controllers
running on the P4 switches interact with a central controller. We propose a
novel secure link discovery mechanism that leverages protected LLDP frames and
the two-tier control plane structure for secure and efficient management of a
global link map. Automated deployment of MACsec creates secure channel,
generates keying material, and configures the P4 switches for each detected
link between two P4 switches. It detects link changes and performs rekeying to
provide a secure, configuration-free operation of MACsec. In this paper, we
review the technological background of P4-MACsec and explain its architecture.
To demonstrate the feasibility of P4-MACsec, we implement it on the BMv2 P4
software switch and validate the prototype through experiments. We evaluate its
performance through experiments that focus on TCP throughput and round-trip
time. We publish the prototype and experiment setups on Github.

Networking and Internet Architecture