A Cluster-Based Secure Active Network Environment

We introduce a cluster-based secure active network environment ((.'SANE) which separates the processing of IP packets from that of active packets in active routers. In this environment, the active code authorized or trusted by privileged users is executed in the secure execution environment (EE) of the activc router, while others are executed in the sccure EE of the nodes in the distributed shared memory (DSM) cluster. With the supports of a multi-process Java virtual machine and KcyNotc, untrusted active packets are controllcd to securely consume rcsource. The DSM consistency management makes that active packets can be parallelly proccssed in the DSM cluster as if they were processed one by one in ANTS (Active Network Transport System). We demonstrate that CSANE has good security and scalability, but imposing little changes on traditional routcrs.