P4Ward Framework for Behavioral Policy Enforcement

This technical report presents P4Ward, a framework designed for fine-grained behavioral policy enforcement in Industrial Control Systems (ICS). The report outlines the increasing vulnerability of ICS to cyber-attacks due to legacy devices and protocols that often lack cryptographic protections. It details how P4Ward leverages Manufacturer Usage Description (MUD) for scalable, device-specific policy specification and employs P4-programmable hardware switches for policy enforcement at line rate. The implementation supports multiple industrial protocols, including Modbus and OPC UA, and evaluates the framework's performance and security impact. The findings indicate that P4Ward achieves latency comparable to industrial-grade switches while enabling precise enforcement of flexible access control rules. The report also assesses the characteristics and attack vectors in ICS, emphasizing the need for non-intrusive security solutions that can mitigate inherent weaknesses. It concludes with an open science statement regarding the open-sourcing of the implementation under the GPLv3 license.