DragonKing: A Scalable and High-Throughput Rate Limiter by Enabling WF 2 Q+ on Programmable Switches for Cloud Networks

In contemporary cloud architectures, an increasing number of cloud service providers are adopting programmable switches to deliver cloud network services (e.g., load-balancing gateways) for millions of tenants. The rate limiters are essential for cloud networks to execute network policies such as congestion control and traffic isolation on programmable switches. Most existing rate limiters utilize the token bucket algorithm, which suffers from scalability issues and substantial control overhead, impacting bandwidth utilization. The WF2Q+ (Worst-case FairWeighted Fair Queueing Plus) algorithm, known for its scalability and accuracy, is gaining traction but faces challenges on programmable switches. The hardware limitations hinder key operations of WF2Q+ (sorting and scheduling) in a single switch pipeline. This paper introduces DRAGONKING, a novel rate-limiting system that enables WF2Q+ through a multi-pipeline sorting and scheduling design. DRAGONKING enhances scalability and throughput while maintaining high accuracy. It achieves this by strategically balancing bandwidth across multiple pipelines, allowing for timely packet scheduling. DRAGONKING is implemented and evaluated on Barefoot Tofino switch. Results show that DRAGONKING supports up to two million entries and delivers line-rate throughput, achieving 1.9× improvements compared with token bucket-based limiters. Moreover, it can maintain over 99% accuracy, precisely enforcing rate limits from 10 Gbps to 100 Gbps.