What is ICING?

ICING is a new way of building a network in which the network can enforce participants' policies about the paths that their packets take. ICING started from the observation that while there were dozens of projects about expressing routing policy, there was no work about how to enforce policy. The core challenge is: if we assume an adversarial, decentralized, and high-speed environment, then when a packet arrives at a node, how can the node be sure that the packet followed an approved path?

Our solution, ICING, incorporates an optimized cryptographic construction that is compact, and requires negligible configuration state and no Public Key Infrastructure (PKI). We have demonstrated ICING's plausibility with a NetFPGA hardware implementation.

In addition, we have demonstrated the use of ICING in two contexts: in an overlay (called ICING-ON or PoComON) and at layer-3 (in a network architecture called ICING-L3).


External talks

Source code

The source code is available here. To replicate our experiments (or to compile the code), please extract the archive and follow the instructions in the README file. Please let us know if you have questions.



ICING is part of the NEBULA future Internet project and is supported by the following: ICING has also received support from the following: