Security and privacy are two major concerns in supporting roaming users across administrative domains. In current practices, a roaming user often uses encrypted tunnels, e.g., Virtual Private Networks (VPNs), to protect the secrecy and privacy of her communications. However, due to its encrypted nature, the traffic flowing through these tunnels cannot be examined and regulated by the foreign network's firewall, which may lead the foreign network widely open to various attacks from the Internet. This threat can be alleviated if the users reveal their traffic to the foreign network or the foreign network reveals its firewall rules to the tunnel endpoints. However, neither approach is desirable in practice due to privacy concerns. In this paper, we propose a Cross-Domain Cooperative Firewall (CDCF) that allows two collaborative networks to enforce each other's firewall rules in an oblivious manner. In CDCF, when a roaming user establishes an encrypted tunnel between his home network and the foreign network, the tunnel endpoint (e.g., a VPN server) can regulate the traffic and enforce the foreign network's firewall rules, without knowing these rules. The key ingredients in CDCF are the distribution of firewall primitives across network domains, and the enabling technique of efficient oblivious membership verification. We have implemented CDCF and integrated it with the OpenVPN software, and evaluated its performance using extensive experiments. Our results show that CDCF can protect the foreign network from encrypted tunnel traffic with minimal overhead.

A new opportunity to reuse existing broadband access infrastructure has arisen by the high penetration of IEEE 802.11 technology family. DSL routers and cable modems with built-in WLAN capabilities allow broadband private customers to share bandwidth with third parties in a safe and controlled way. The success of this approach is highly dependant on the performance of WiFi technology in urban areas. It is critical to experimentally evaluate IEEE 802.11 deployments in places such as houses, flats, parks and offices. This paper describes a solution that enables controlled sharing of existing broadband connections to increase wireless access coverage. The feasibility of our solution is pondered by performing a thorough study of urban networking using IEEE 802.11 technology. We evaluate the performance of this technology in urban environments and analyze the impact of typical factors such as (i) access point elevation in relation to the mobile client, (ii) inter-floor connectivity in urban buildings and (iii) widely used hardware. Using the collected data, we estimate the potential service range for those opening their broadband connections. The results suggest that sharing private connections could exponentially increase wireless coverage in urban areas