TagFlow: A Hybrid Control and P4 Data Plane for Scalable IoT Device Validation and Connectivity

The proliferation of heterogeneous Internet of Things (IoT) devices has intensified the challenge of securing network admission and service access at scale. Existing SDN-based frameworks rely on fine grained identity based flow rules installed across multiple switches, leading to excessive TCAM utilization and high control overhead. P4-based data plane solutions offer line-rate packet processing but lack the stateful validation and policy intelligence required for IoT device validation and admission into the network. This work introduces TagFlow, a hybrid control and P4 data plane architecture for scalable IoT device validation and service connectivity. The control plane performs device validation and generates a cryptographically derived Device–Service Binding Tag (DSBT) that encodes the authorized device to service association. Ingress P4 switches embed this tag into packets, while downstream switches perform exact-match lookups on the DSBT using high-capacity, low-cost SRAM, eliminating TCAM dependency for policy enforcement. This design achieves secure, low-latency admission and service-level control with significantly reduced memory footprint. A proof-of-concept implementation using BMv2 P4 switches and a P4Runtime based control framework in Mininet demonstrates the feasibility and scalability of TagFlow in realizing efficient IoT service connectivity.