No abstract

Abstract-Giving ISPs more fine-grain control over interdomain routing policies would help them better manage their networks and offer value-added services to their customers. Unfortunately, the current BGP route-selection process imposes inherent restrictions on the policies an ISP can configure, making many useful policies infeasible. In this paper, we present Morpheus, a routing control platform that is designed for configurability. Morpheus enables a single ISP to realize a much broader range of routing policies without requiring changes to the underlying routers or collaboration with other domains. Morpheus allows network operators to: (1) make flexible trade-offs between policy objectives through a weighted-sum based decision process, (2) realize customer-specific policies by supporting multiple routeselection processes in parallel, and allowing customers to influence the decision processes, and (3) configure the decision processes through a simple and intuitive configuration interface based on the Analytic Hierarchy Process, a decision-theoretic technique for balancing conflicting objectives. We also present the design, implementation, and evaluation of Morpheus as an extension to the XORP software router.

Security modifications to legacy network protocols are expensive and disruptive. This paper outlines an approach, based on external security monitors, for securing legacy protocols by deploying additional hosts that locally monitor the inputs and outputs of each host executing the protocol , check the behavior of the host against a safety specification , and communicate using an overlay to alert other hosts about invalid behavior and to initiate remedial actions. Trusted computing hardware provides the basis for trust in external security monitors. This paper applies this approach to secure the Border Gateway Protocol, yielding an external security monitor called N-BGP. N-BGP can accurately monitor a BGP router using commodity trusted computing hardware. Deploying N-BGP at a random 10% of BGP routers is sufficient to guarantee the security of 80% of Internet routes where both endpoints are monitored by N-BGP. Overall, external security monitors secure the routing infrastructure using trusted computing hardware and construct a security plane for BGP without having to modify the large base of installed routers and servers.

No abstract

Network routing in wireless ad hoc networks is liable to attacks that may have a grave impact on network operations. Such attacks can be targeted at the route discovery process or the data packet forwarding process. Although the protection of route discovery is a critical prerequisite to ensure the robustness of the routing process, secured route discovery by no means eliminates attacks on routing. We, accordingly, propose a secure data forwarding protocol that detects faulty links in the packet forwarding process, which enables the corresponding sources to progressively route packets over non-faulty paths.