The routing fabric

Abstract

One routing hub, a spoke for each purpose, a hybrid edge with a primary link, a secondary and a VPN behind them, and egress that leaves only through inspection. Choose a flow, take anything down, and the cheapest path that is still legal is computed again: failing over, failing closed, or refused by policy.

A network a team joins by declaring intent is only safe if every path is computed from policy, not remembered from a diagram.

Its figure in the paper: § III.A →

The fabric · click a link or a node to take it down

Cost: primary 1, secondary 2, VPN 5 per hop. The hub is the only crossing between spokes.

The route

Flow

A rule allows production to reach data through the hub

routed

on-premises → link A → hub → production at cost 3.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 4 attempted · 0 refused

Peer two spokes directly
Production reaches data without the hub, because a direct peering would be quicker.
Send egress around inspection
Inspection is down, so production's internet traffic takes any path it can find.
Reach production from non-production
Every link is up and a rule allows production to data; try non-production to production.
Transit through a spoke
The hub's attachment to production is gone; try reaching production through the data spoke.

Setting up the instrument…

Declared limits

The topology is illustrative: no ranges, regions or real link counts.
Costs are relative weights chosen to show preference, not measured latency.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.A

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →