1. Packets with Provenance Anirudh, Mukarram, Nick, Kaushik

2. Motivation Traffic classification, access control, etc. Today: Coarse and imprecise –IP addresses –Port numbers Instead: Classify traffic based on –Where traffic is coming from –What inputs that traffic has taken

3. Design Trusted tagging component on host Arbiter near network border

4. Applications Provisioning Blacklisting Exfiltration Secure network regions

5. Assumptions Network elements dont modify tags End host has a trusted component –Privileged process –Kernel module –Hypervisor –Outside the host

6. Tags: Structure and Function Local properties (container ID) History of interactions (taint set)

7. Accumulating Tags

8. Concerns Privacy concerns Packet overhead Overflow of taint set –Size of taint set could become quite large Storage overhead How to identify taints that reflect a certain class of traffic?

9. Current Function Internet 1.Host sends request over control channel to open with flow with taint set. 2. Traffic diverted to controller, which checks policy. 3. Controller inserts flow table entry, if policy compliant.