Unveiling the Mystery of Internet Packet Forwarding

Abstract

Validating the network paths taken by packets is critical in constructing a secure Internet architecture. Any feasible solution must both enforce packet forwarding along end-host specified paths and verify whether packets have taken those paths. However, the current Internet supports neither enforcement nor verification. Likely due to the radical changes to the Internet architecture and a long-standing confusion between routing and forwarding, only limited solutions for path validation exist in the literature. This survey article aims to reinvigorate research on the essential topic of path validation by crystallizing not only how path validation works but also where seemingly qualified solutions fall short. The analyses explore future research directions in path validation aimed at improving security, privacy, and efficiency.

Can I Reach You? Do I Need To? New Semantics in Security Policy Specification and Testing

“…Path validation in networks is a critical task for security and reliability of the networks [9]. Path validation is the combination of two main sub-tasks: path enforcement and path verification [9].…”

“…Path validation in networks is a critical task for security and reliability of the networks [9]. Path validation is the combination of two main sub-tasks: path enforcement and path verification [9]. For the former, a source node should be able to specify the path (or paths) that a packet must follow to reach a destination node, and the intermediate hops on the path should be able to enforce the path when processing the packet.…”

Increasing the Transparency, Accountability and Controllability of multi-domain networks with the UPIN framework

“…Path-Aware Networking (PAN) enables end-hosts to select the path they want for their data to follow at the level of ASs [20]. This functionality has been actively investigated and discussed under the Internet Research Task Force (IRTF) and the IETF in the last years [7]. PAN is already considered indispensable for constructing a secure Internet architecture and is implemented in several experimental Internet designs, such as SCION and NEBULA [2].…”

“…PAN is already considered indispensable for constructing a secure Internet architecture and is implemented in several experimental Internet designs, such as SCION and NEBULA [2]. A PAN consists of two essential properties, namely Path Enforcement and Path Verification [7]. Path Enforcement consists of enforcing that selected path preferences are followed and Path Verification adds the capability of retrieving the paths taken by network packets for auditing.…”

“…Path Enforcement can be achieved with the current Internet protocol suite, for instance using Segment Routing (SR) [10] and Multiprotocol Label Switching (MPLS) networks. Path Verification on the other hand, currently cannot be easily achieved without changing the packet processing logic of routers [7] or without any sort of tracing capabilities.…”