Active Networks, being programmable, promise greater flexibility than current networks. Programmability, however, may introduce safety and security risks. This paper describes the design and implementation of a security architecture for the active network PLANet. Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN, with an environment of general-purpose service routines governed by trust management. In particular, a technique is used which expands or contracts a packet's service environment based on its level of privilege, termed namespace-based security. The design and implementation of an active-network firewall and virtual private network is used as an application of the security architecture. Measurements of the system show that the addition of the firewall imposes an approximately 34% latency overhead and as little as a 6.7% space overhead to incoming packets.

[ .pdf ]

@article{HicksKS03,
  author = {Michael Hicks and Angelos D. Keromytis and Jonathan M. Smith},
  title = {A Secure {PLAN}},
  journal = {{IEEE Transactions on Systems, Man, and Cybernetics, Part C}},
  month = {August},
  volume = 33,
  number = 3,
  pages = {413--426},
  year = 2003,
  note = {Special Issue on Technologies Promoting Computational Intelligence, Openness and Programmability in Networks and {I}nternet Services, Part {I}}
}

This file was generated by bibtex2html 1.99.