@article {12089,
	title = {Secure quality of service handling: SQoSH},
	journal = {IEEE Communications Magazine},
	volume = {38},
	year = {2000},
	month = {2000/04//},
	pages = {106 - 112},
	abstract = {Proposals for programmable network infrastructures, such as active networks and open signaling, provide programmers with access to network resources and data structures. The motivation for providing these interfaces is accelerated introduction of new services, but exposure of the interfaces introduces many new security risks. We describe some of the security issues raised by active networks. We then describe our secure active network environment (SANE) architecture. SANE was designed as a security infrastructure for active networks, and was implemented in the SwitchWare architecture. SANE restricts the actions that loaded modules can perform by restricting the resources that can be named; this is further extended to remote invocation by means of cryptographic credentials. SANE can be extended to support restricted control of quality of service in a programmable network element. The Piglet lightweight device kernel provides a {\textquotedblleft}virtual clock{\textquotedblright} type of scheduling discipline for network traffic, and exports several tuning knobs with which the clock can be adjusted. The ALIEN active loader provides safe access to these knobs to modules that operate on the network element. Thus, the proposed SQoSH architecture is able to provide safe, secure access to network resources, while allowing these resources to be managed by end users needing customized networking services. A desirable consequence of SQoSH{\textquoteright}s integration of access control and resource control is that a large class of denial-of-service attacks, unaddressed solely with access control and cryptographic protocols, can now be prevented},
	keywords = {Acceleration, Access control, active networks, ALIEN active loader, Clocks, Computer network management, cryptographic credentials, cryptography, customized networking services, Data security, Data structures, denial-of-service attacks, interfaces, Kernel, loaded modules, network resources, network traffic, open signaling, packet switching, Piglet lightweight device kernel, programmable network element, programmable network infrastructures, Programming profession, Proposals, quality of service, remote invocation, resource control, restricted control of quality of service, SANE, scheduling, scheduling discipline, secure active network environment architecture, secure quality of service handling, security infrastructure, security risks, SQoSH, SwitchWare architecture, telecommunication security, tuning knobs, virtual clock},
	isbn = {0163-6804},
	doi = {10.1109/35.833566},
	author = {Alexander,D. S and Arbaugh, William A. and Keromytis,A. D and Muir,S. and Smith,J. M}
}
@article {12101,
	title = {A secure active network environment architecture: realization in SwitchWare},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {37 - 45},
	abstract = {An active network is a network infrastructure which is programmable on a per-user or even per-packet basis. Increasing the flexibility of such network infrastructures invites new security risks. Coping with these security risks represents the most fundamental contribution of active network research. The security concerns can be divided into those which affect the network as a whole and those which affect individual elements. It is clear that the element problems must be solved first, since the integrity of network-level solutions will be based on trust in the network elements. In this article we describe the architecture and implementation of a secure active network environment (SANE), which we believe provides a basis for implementing secure network-level solutions. We guarantee that a node begins operation in a trusted state with the AEGIS secure bootstrap architecture. We guarantee that the system remains in a trusted state by applying dynamic integrity checks in the network element{\textquoteright}s runtime system, using a novel naming system, and applying node-to-node authentication when needed. The construction of an extended LAN is discussed},
	keywords = {access protocols, AEGIS secure bootstrap architecture, architecture, Authentication, Collaboration, Communication switching, dynamic integrity checks, extended LAN, Functional programming, implementation, integrity, Intelligent networks, IP networks, Local area networks, network infrastructure, network infrastructures, network operating systems, network-level solutions, node, node-to-node authentication, packet switching, Proposals, ramming system, SANE, secure active network environment architecture, security of data, Switches, SwitchWare, trusted state, Web and internet services},
	isbn = {0890-8044},
	doi = {10.1109/65.690960},
	author = {Alexander,D. S and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
