Secure and policy-compliant source routing


	BibTex \| RIS \| RefWorks Download

, ,

Abstract—In today’s Internet, inter-domain route control remains elusive; nevertheless, such control could improve the performance, reliability, and utility of the network for end users and ISPs alike. While researchers have proposed a number,of source routing techniques to combat this limitation, there has thus far been no way for independent ASes to ensure that such traffic does not circumvent local traffic policies, nor to accurately determine the correct party to charge for forwarding the traffic. We present Platypus, an authenticated source routing system built around the concept of network capabilities, which allow for accountable, fine-grained path selection by cryptographically at- testing to policy compliance at each hop along a source route. Ca- pabilities can be composed to construct routes through multiple ASes and can be delegated to third parties. Platypus caters to the needs of both end users and ISPs: users gain the ability to pool their resources and select routes other than the default, while ISPs maintain control over where, when, and whose packets traverse their networks. We describe the design and implementation of an extensive Platypus policy framework that can be used to address several issues in wide-area routing at both the edge and the core, and evaluate its performance and security. Our results show that incremental deployment of Platypus can achieve immediate gains. Index Terms—Source routing, authentication, overlay networks,

Journal: IEEE/ACM Transactions on Networking - TON , vol. 17, no. 3, pp. 764-777, 2009

DOI: 10.1145/1569732.1569739

Cumulative Annual

View Publication