P4Ward: Fine-Grained Behavioral Policy Enforcement for Industrial Networks

Industrial Control Systems (ICS) are increasingly targeted by cyber-attacks, yet often lack cryptographic protections due to legacy devices and protocols. Network-based defenses— particularly the enforcement of behavioral policies—offer an effective means of reducing the attack surface. However, such approaches must support industrial protocols and payload inspection while maintaining scalability and low-latency overhead. In this paper, we present P4Ward, a framework that leverages Manufacturer Usage Description (MUD) for scalable, device-specific policy specification and uses P4-programmable hardware switches to enforce these policies at line rate, in conjunction with authentication where feasible. We implement a proof-of-concept supporting multiple industrial protocols, including Modbus and OPC UA, and evaluate its performance and security impact. Our results show that P4Ward achieves latency comparable to industrial-grade switches while enabling precise enforcement of flexible access control rules—such as validating application layer fields (e.g., function codes) and explicitly restricting write operations to authorized endpoints.