Verifying and enforcing network paths with icing

Jad Naous, Michael Walfish, Antonio Nicolosi, David Mazières, Michael Miller, Arun Seehra

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

We describe a new networking primitive, called a Path Verification Mechanism (pvm). There has been much recent work about how senders and receivers express policies about the paths that their packets take. For instance, a company might want fine-grained control over which providers carry which traffic between its branch offices, or a receiver may want traffic sent to it to travel through an intrusion detection service. While the ability to express policies has been well-studied, the ability to enforce policies has not. The core challenge is: if we assume an adversarial, decentralized, and high-speed environment, then when a packet arrives at a node, how can the node be sure that the packet followed an approved path? Our solution, icing, incorporates an optimized cryptographic construction that is compact, and requires negligible configuration state and no PKI. We demonstrate icing's plausibility with a NetFPGA hardware implementation. At 93% more costly than an IP router on the same platform, its cost is significant but affordable. Indeed, our evaluation suggests that icing can scale to backbone speeds.

Original languageEnglish (US)
Title of host publicationProceedings of the 7th Conference on Emerging Networking EXperiments and Technologies, CoNEXT'11
DOIs
StatePublished - 2011
Event7th ACM International Conference on Emerging Networking EXperiments and Technologies, CoNEXT'11 - Tokyo, Japan
Duration: Dec 6 2011Dec 9 2011

Publication series

NameProceedings of the 7th Conference on Emerging Networking EXperiments and Technologies, CoNEXT'11

Other

Other7th ACM International Conference on Emerging Networking EXperiments and Technologies, CoNEXT'11
CountryJapan
CityTokyo
Period12/6/1112/9/11

Keywords

  • NetFPGA
  • consent
  • default-off
  • path enforcement

ASJC Scopus subject areas

  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Verifying and enforcing network paths with icing'. Together they form a unique fingerprint.

Cite this