Security and privacy are two major concerns in supporting roaming users across administrative domains. In current practices, a roaming user often uses encrypted tunnels, e.g., Virtual Private Networks (VPNs), to protect the secrecy and privacy of her communications. However, due to its encrypted nature, the traffic flowing through these tunnels cannot be examined and regulated by the foreign network's firewall, which may lead the foreign network widely open to various attacks from the Internet. This threat can be alleviated if the users reveal their traffic to the foreign network or the foreign network reveals its firewall rules to the tunnel endpoints. However, neither approach is desirable in practice due to privacy concerns. In this paper, we propose a Cross-Domain Cooperative Firewall (CDCF) that allows two collaborative networks to enforce each other's firewall rules in an oblivious manner. In CDCF, when a roaming user establishes an encrypted tunnel between his home network and the foreign network, the tunnel endpoint (e.g., a VPN server) can regulate the traffic and enforce the foreign network's firewall rules, without knowing these rules. The key ingredients in CDCF are the distribution of firewall primitives across network domains, and the enabling technique of efficient oblivious membership verification. We have implemented CDCF and integrated it with the OpenVPN software, and evaluated its performance using extensive experiments. Our results show that CDCF can protect the foreign network from encrypted tunnel traffic with minimal overhead.

Providing packet-level quality of service (QoS) is critical to support both rate-sensitive and delay-sensitive applications in the bandwidth-constrained, shared-channel, multihop wireless networks. This problem is challenging due to the unique issues such as location-dependent contention, inherent conflict between ensuring fairness and maximizing channel utilization, and the distributed nature of packet scheduling in such networks. In order to address these issues, we have taken a new self-organizing approach to QoS solutions for such networks. In this approach, local decision makers self-organize themselves and coordinate among one another, and collectively achieve the desired global property. Some features of our approach include fully localized design, coordination among local decision makers, intentional and optimized information propagation, scaling property and achievable global property. Two key contributions of this work are: (a) a model-referenced self-organizing design methodology for multihop wireless networks; and (b) a table-driven approach and a backoff-based approach to distributed packet scheduling that provides QoS performance bounds in terms of fairness, throughput and delay, maximizes channel spatial reuse, and arbitrates the conflict between fairness and maximal channel utilization. oth proposed designs work within the CSMA/CA MAC framework. We also compare the performance of these two approaches through simulations. Our extensive simulation results have confirmed the effectiveness of the proposed design.