文档介绍：works (mentsonsecurity-workdesign)MartinCasado(Stanford)TalGarfinkel(Stanford)AdityaAkella(CMU/Stanford)MichaelFreedman(NYU)DanBoneh(Stanford)NickMcKeown(Stanford)ScottShenker(ICSI/Berkeley)淘宝网I’GenerallyexploitthisopportunitytopontificateRemember..thisisCleanSlateMaybealittle“out-there”Maybealittle“wrong”Supposedtofomentideasanddiscussion (sopleaseinterruptme)(google,ebay,.)Getaswideexposure(mostly)eWantsomeprotectionfromevil-doersPrivate(mercial,financialetc.)SpecialpurposeLimiteduserbaseKnowswhat’srunningwhere Fundamentallydifferent (butusesametechnologies)esstoindividualusers (workresources)Abilitytodeterminelocationofindividualusers (pliance) (moreonthislater)esstousersdeterminelocationofindividualusersandstrictlydefineconnectivitybetweenusers,hosts,services,esstousersdeterminelocationofindividualusersandstrictlydefineconnectivitybetweenusers,hosts,services,esstoinformationSupportedbyIPMotivationPunchLineAttemptingtodoallthesethingstoday …butwithoutthesupportofthearchitecture Resultis:workDefiningConnectivityWhy?AttemptatlimitingresourcestothatwhichisneededLimitdamageofinternalmalware,perimeterbreach,orinsider Today:UselotsoffilteringMAC,IP,transportPhysicalports(VLANs)Deeppacketinspection()esscontrollistsonservices (workaware…butcouldbe!)DefiningConnectivity(workonlyreallyawareofaddressesFirewallrulesembedstopologyintoconfigurationstateDifficulttomovemachinesHardtoreadandunderstand (100klinesofproprietary,differentconfigurations)Forwardingpathunawareoffilteringrules ponentnotgood (hencehave“works)Higherlevelfilteringcanbeunderminedbylowerlevels ()