PRISM: Protocol for Routing Intelligent Service Mapping - Application-Aware Traffic Steering for SD-WAN

1.1. Problem Statement

Software-Defined Wide Area Networks (SD-WAN) have emerged as a critical technology for enterprises and tactical networks requiring Intelligent traffic management across multiple WAN connections. However, existing SD-WAN solutions are predominantly proprietary, creating several challenges:¶

Vendor Lock-in:

Organizations deploying proprietary SD-WAN solutions¶

become dependent on a single vendor for features, updates, and interoperability.¶

Limited Interoperability:

Proprietary solutions cannot interoperate¶

with equipment from other vendors, limiting deployment flexibility and multi-vendor environments.¶

Opaque Operation:

Closed implementations prevent security auditing¶

and verification of traffic handling behavior.¶

Cryptographic Limitations:

Many commercial SD-WAN products do not¶

support government-mandated cryptographic standards such as CNSA 2.0.¶

An open-standard SD-WAN protocol would address these limitations by providing a vendor-neutral specification that enables interoperability, permits security auditing, and ensures compliance with required cryptographic standards.¶

SD-WAN functionality comprises two distinct concerns:¶

1. Tunnel Fabric Management: Creating, monitoring, and maintaining encrypted tunnels across multiple WAN links. [I-D.conduit-tunnel-fabric] addresses this function.¶

2. Application-Aware Traffic Steering: Identifying applications, tracking flows, enforcing policies, and selecting optimal paths based on application requirements. This function is addressed by PRISM.¶

1.2. Relationship to CONDUIT

PRISM and [I-D.conduit-tunnel-fabric] together form a complete open-standard SD-WAN solution with clear separation of responsibilities:¶

CONDUIT Responsibilities:¶

• IPsec tunnel lifecycle management (creation, deletion, rekeying)¶

• Tunnel health monitoring (probing, metrics collection)¶

• Metric publishing to SRv6/IGP¶

• IKEv2 security association management¶

PRISM Responsibilities:¶

• Application identification (deep packet inspection, heuristics)¶

• Flow tracking and management¶

• Policy definition and enforcement¶

• SLA monitoring and alerting¶

• Traffic class assignment for SRv6 steering¶

The relationship can be summarized as: PRISM decides WHAT traffic class each flow belongs to; SRv6 decides WHICH path to use based on Flex-Algo; CONDUIT ensures the paths EXIST and reports their quality.¶

1.3. Design Goals

PRISM is designed to meet the following goals:

 +==========================+======================================+
 | Parameter                | Requirement                          |
 +==========================+======================================+
 | Flow Scale               | 10 million concurrent flows per node |
 +--------------------------+--------------------------------------+
 | Application Signatures   | 5000+ applications recognized        |
 +--------------------------+--------------------------------------+
 | Classification Latency   | Less than 100 microseconds           |
 +--------------------------+--------------------------------------+
 | Policy Scale             | 100,000 policies per node            |
 +--------------------------+--------------------------------------+
 | SLA Measurement Accuracy | Within 1ms for latency metrics       |
 +--------------------------+--------------------------------------+
 | API Coverage             | 100% functionality via gRPC          |
 +--------------------------+--------------------------------------+
 | Cryptographic Suite      | Full CNSA 2.0 compliance             |
 +--------------------------+--------------------------------------+

1.4. Scope

This document specifies:¶

• Application identification mechanisms and signature format¶

• Flow tracking and management procedures¶

• Policy framework for traffic steering¶

• SLA definition and enforcement¶

• Integration with SRv6 for path selection¶

• Control protocol for distributed operation¶

• gRPC API for management and analytics¶

This document does not specify:¶

• Tunnel management (covered by [I-D.conduit-tunnel-fabric])¶

• SRv6 data plane operations (covered by [RFC8986])¶

• Specific application signatures (maintained separately)¶

• Deep packet inspection algorithms (implementation-specific)¶

2.1. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

2.2. Definitions

Application:

A network service or program identified by its traffic¶

characteristics, such as Microsoft Teams, Salesforce, or SSH.¶

Application Category:

A grouping of applications with similar¶

characteristics or business purposes, such as "unified communications" or "business critical".¶

Application Signature:

A set of patterns or heuristics used to¶

Identify a specific application from its network traffic.¶

Flow:

A unidirectional sequence of packets sharing common¶

identifying characteristics, typically a 5-tuple of protocol, source address, source port, destination address, and destination port.¶

Session:

A bidirectional communication comprising two related flows¶

(forward and reverse directions).¶

Traffic Class:

A classification assigned to flows that maps to¶

specific SRv6 treatment, including path selection and QoS.¶

SLA (Service Level Agreement):

A set of performance thresholds that¶

define acceptable service quality for an application or traffic class.¶

Policy:

A rule that matches traffic based on specified conditions¶

and applies designated actions.¶

DPI (Deep Packet Inspection):

Analysis of packet contents beyond¶

layer 4 headers to identify applications.¶

PRISM Node:

A device implementing the PRISM protocol, typically co-¶

located with a CONDUIT node.¶

PRISM Controller:

A centralized management entity that distributes¶

policies and aggregates analytics from PRISM nodes.¶

3.1. System Overview

A PRISM deployment consists of the following components:¶

PRISM Controller:

A centralized or distributed management entity¶

responsible for policy management and distribution, application signature database maintenance, aggregated analytics, and reporting, and SLA monitoring dashboard.¶

PRISM Node:

A data plane element deployed at network edges¶

responsible for application identification, flow tracking, and classification, policy enforcement, per-flow metrics collection, and SRv6 traffic class assignment.¶

CONDUIT Node:

Co-located tunnel fabric manager providing IPsec¶

tunnel management and path quality metrics (feeds into SLA calculations).¶

SRv6 Data Plane:

Forwarding plane that executes traffic engineering¶

decisions based on traffic class assignments from PRISM.¶

3.2. Deployment Models

PRISM supports multiple deployment models:¶

Distributed Mode:

Each PRISM node operates independently. Policies¶

are configured locally on each node. No central controller required. Suitable for small deployments or disconnected operations.¶

Centralized Mode:

PRISM Controller manages all nodes. Policies¶

are defined centrally and distributed to nodes. Centralized analytics and reporting. Suitable for enterprise deployments.¶

Hierarchical Mode:

Regional controllers manage local nodes. Global¶

controller coordinates regional controllers. Policies can be global, regional, or local. Suitable for large distributed deployments.¶

Hybrid Mode:

Central controller for policy distribution. Local¶

autonomy for real-time decisions. Nodes operate independently if the controller is unreachable. Suitable for tactical/resilient deployments.¶

4.1. Identification Methods

PRISM employs multiple methods to identify applications:

   +=======================+=======+=============================+
   | Method                | Layer | Description                 |
   +=======================+=======+=============================+
   | Port-based            | L4    | Well-known ports (SSH=22)   |
   +-----------------------+-------+-----------------------------+
   | Protocol Signature    | L7    | Pattern matching in payload |
   +-----------------------+-------+-----------------------------+
   | TLS/SNI Analysis      | L7    | Server Name Indication      |
   +-----------------------+-------+-----------------------------+
   | DNS Correlation       | L7    | Map DNS queries to flows    |
   +-----------------------+-------+-----------------------------+
   | Certificate Analysis  | L7    | X.509 certificate fields    |
   +-----------------------+-------+-----------------------------+
   | Behavioral Heuristics | L3-L7 | Traffic patterns/timing     |
   +-----------------------+-------+-----------------------------+
   | Machine Learning      | L3-L7 | Trained classifiers         |
   +-----------------------+-------+-----------------------------+
   | IP Reputation         | L3    | Known service IP ranges     |
   +-----------------------+-------+-----------------------------+

Classification proceeds through methods in order of reliability until a confident identification is achieved.¶

4.2. Encrypted Traffic Analysis

For encrypted traffic (TLS/DTLS), PRISM uses metadata analysis without decryption:¶

TLS Server Name Indication (SNI):

The SNI field in the TLS¶

The client Hello message reveals the intended server hostname. This is the primary method for HTTPS classification.¶

TLS Certificate Analysis:

Server certificates contain identifying¶

information, including Common Name, Subject Alternative Names, Organization, and Issuer.¶

JA3/JA3S Fingerprinting:

TLS handshake characteristics create a unique¶

fingerprints for client and server implementations.¶

Encrypted Traffic Behavioral Analysis:

Statistical analysis of¶

packet sizes, timing, and directionality can identify applications without payload inspection.¶

IMPORTANT: PRISM does not perform TLS interception or decryption. All encrypted traffic analysis is performed on metadata and observable traffic characteristics.¶

4.3. Application Categories

Applications are organized into categories for policy management:

       +========================+============================+
       | Category               | Description                |
       +========================+============================+
       | unified-communications | Voice, video, messaging    |
       |                        | (Teams, Zoom, Webex)       |
       +------------------------+----------------------------+
       | business-critical      | Core business applications |
       |                        | (ERP, CRM, custom apps)    |
       +------------------------+----------------------------+
       | cloud-services         | SaaS applications (O365,   |
       |                        | Salesforce, Workday)       |
       +------------------------+----------------------------+
       | infrastructure         | Network services (DNS,     |
       |                        | NTP, SNMP)                 |
       +------------------------+----------------------------+
       | security               | Security tools (AV         |
       |                        | updates, SIEM)             |
       +------------------------+----------------------------+
       | file-transfer          | File sharing (SharePoint,  |
       |                        | Box, FTP)                  |
       +------------------------+----------------------------+
       | web-browsing           | General web traffic        |
       +------------------------+----------------------------+
       | streaming-media        | Video/audio streaming      |
       |                        | (YouTube, Spotify)         |
       +------------------------+----------------------------+
       | remote-access          | VPN, RDP, SSH              |
       +------------------------+----------------------------+
       | unknown                | Unclassified traffic       |
       +------------------------+----------------------------+

5.1. Flow Identification

A composite key identifies flows:¶

Standard 5-Tuple:¶

• IP Protocol (8 bits)¶

• Source IP Address (128 bits for IPv6)¶

• Destination IP Address (128 bits for IPv6)¶

• Source Port (16 bits)¶

• Destination Port (16 bits)¶

Extended Identifiers (optional):¶

• VLAN ID¶

• VRF/VPN ID¶

• Ingress interface¶

5.2. Flow Lifecycle

Flows progress through the following states:¶

NEW:

First packet observed. Application identification in progress.¶

Default traffic class applied.¶

CLASSIFYING:

Multiple packets observed. Application identification¶

in progress. May transition to ESTABLISHED once classification confidence exceeds threshold.¶

ESTABLISHED:

Application identified with sufficient confidence.¶

Traffic class assigned based on policy. SLA monitoring is active.¶

CLOSING:

Connection termination detected. Preparing to collect¶

final statistics.¶

CLOSED:

Flow terminated. Final statistics recorded. Entry¶

scheduled for removal after reporting.¶

6.1. Policy Model

PRISM policies follow a match-action model with the following structure:¶

• Policy ID: Unique identifier¶

• Name: Human-readable name¶

• Priority: Evaluation order (lower = higher priority)¶

• Match: Conditions that select applicable traffic¶

• Action: Operations to perform on matching traffic¶

• Schedule: Optional time-based activation¶

6.2. Match Conditions

Policies can match on:¶

• Source/destination IP address or prefix¶

• Port or port range¶

• Specific application ID or category¶

• Application risk level¶

• Protocol (TCP, UDP, etc.)¶

• DSCP value¶

• Time of day¶

• Ingress interface or zone¶

6.3. Actions

When a policy matches, the following actions may be applied:¶

Traffic Class Assignment:

Set traffic class (maps to SRv6 color),¶

set DSCP value¶

Path Selection:

Prefer specific path characteristics, avoid specific¶

paths, pin to a specific path¶

SLA Assignment:

Apply SLA profile, set violation actions¶

Bandwidth Management: Rate limit, bandwidth guarantee¶

Security:

Permit, deny, redirect to inspection¶

6.4. SLA Definitions

Standard SLA Profiles:

  +================+=========+========+======+====================+
  | Profile        | Latency | Jitter | Loss | Use Case           |
  +================+=========+========+======+====================+
  | realtime-voice | 150ms   | 30ms   | 1%   | VoIP               |
  +----------------+---------+--------+------+--------------------+
  | realtime-video | 200ms   | 50ms   | 1%   | Video conferencing |
  +----------------+---------+--------+------+--------------------+
  | interactive    | 300ms   | 100ms  | 2%   | Virtual desktop    |
  +----------------+---------+--------+------+--------------------+
  | transactional  | 500ms   | N/A    | 0.1% | Database, API      |
  +----------------+---------+--------+------+--------------------+
  | best-effort    | N/A     | N/A    | N/A  | General browsing   |
  +----------------+---------+--------+------+--------------------+

7.1. Traffic Class to SRv6 Color Mapping

PRISM assigns traffic classes that map to SRv6 policy colors:

    +===============+=======+===========+=======================+
    | Traffic Class | Color | Flex-Algo | Description           |
    +===============+=======+===========+=======================+
    | realtime      | 100   | 128       | Voice, real-time C2   |
    +---------------+-------+-----------+-----------------------+
    | video         | 200   | 129       | Video conferencing    |
    +---------------+-------+-----------+-----------------------+
    | interactive   | 300   | 128       | VDI, interactive apps |
    +---------------+-------+-----------+-----------------------+
    | business      | 400   | default   | Business applications |
    +---------------+-------+-----------+-----------------------+
    | best-effort   | 0     | default   | Default treatment     |
    +---------------+-------+-----------+-----------------------+

7.2. Dynamic Path Selection

PRISM influences path selection through traffic class assignment, not direct path manipulation. The sequence is:¶

1. PRISM classifies flow and assigns traffic class¶

2. Traffic class maps to SRv6 color¶

3. SRv6 color maps to SR policy¶

4. SR policy specifies Flex-Algo or explicit path¶

5. SRv6 data plane forwards accordingly¶

This maintains clean separation: PRISM determines the application requirements, SRv6 satisfies them.¶

8.1. SLA Metrics

PRISM monitors:¶

Latency: End-to-end delay. Measured via TCP timestamps or probes.¶

Jitter: Variation in packet delay. Calculated per [RFC3550].¶

Packet Loss:

Percentage not delivered. Inferred from TCP¶

retransmissions.¶

Throughput:

Bytes per second over measurement interval.¶

8.2. Remediation Actions

When SLA violations are detected:¶

Alert Only:

Generate alert, no corrective action.¶

Reclassify:

Move the flow to a different traffic class.¶

Path Switch:

Signal SRv6 to prefer the alternate path.¶

Escalate: Notify the external system to take action.¶

9.1. Transport

PRISM control messages are transported via UDP on port 4796.¶

All control messages are authenticated using HMAC-SHA-384.¶

9.2. Message Header

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Version    |     Type      |            Flags              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Length             |           Reserved            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                         Node ID (64 bits)                     +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Sequence Number                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                      Timestamp (64 bits)                      +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                      HMAC-SHA-384 (384 bits)                  |
+                                                               +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Total header size: 72 octets (consistent with CONDUIT)

9.3. Message Types

 +=======+===============+========================================+
 | Value | Name          | Description                            |
 +=======+===============+========================================+
 | 0x01  | HELLO         | Node discovery and capability exchange |
 +-------+---------------+----------------------------------------+
 | 0x02  | HELLO_ACK     | Response to HELLO                      |
 +-------+---------------+----------------------------------------+
 | 0x10  | POLICY_PUSH   | Policy distribution from controller    |
 +-------+---------------+----------------------------------------+
 | 0x11  | POLICY_ACK    | Policy receipt acknowledgment          |
 +-------+---------------+----------------------------------------+
 | 0x20  | FLOW_REPORT   | Flow statistics report                 |
 +-------+---------------+----------------------------------------+
 | 0x21  | FLOW_SYNC     | Flow state synchronization (HA)        |
 +-------+---------------+----------------------------------------+
 | 0x30  | SLA_ALERT     | SLA violation notification             |
 +-------+---------------+----------------------------------------+
 | 0x31  | SLA_CLEAR     | SLA violation cleared                  |
 +-------+---------------+----------------------------------------+
 | 0x40  | APP_SIGNATURE | Application signature update           |
 +-------+---------------+----------------------------------------+
 | 0x0F  | ERROR         | Error notification                     |
 +-------+---------------+----------------------------------------+

12.1. Privacy Considerations

PRISM performs deep packet inspection, which raises privacy concerns. PRISM analyzes metadata of encrypted traffic but does not decrypt contents. Organizations SHOULD define data retention policies.¶

12.2. Application Identification Risks

Sophisticated actors may attempt to evade identification. Implementations SHOULD employ multiple identification methods and provide mechanisms to review classifications.¶

12.3. Policy Security

Policies MUST be authenticated using HMAC-SHA-384. Policy changes SHOULD require appropriate authorization and be logged for audit.¶

13.1. UDP Port Allocation

This document requests the allocation of UDP port 4796 for PRISM control messages.¶

13.2. Application Category Registry

This document requests the creation of a "PRISM Application Categories." registry with initial values from 0x01 (unified-communications) through 0xFF (unknown).¶