... which enables a legacy native C OF application to be instantiated as a separate process, and ideally operated from a separate nonprivileged account The proxy interface adds a digital signature ... alias sets are a → c set (a ⇒ a ) (a, a ) (c) a → c set (c ⇒ b) (a, a ) (c, b) a → b forward packet (a, a ) (c, b) forward packet Role-based Source Authentication (4) and the derived rule is FortNOX ... our alias-set rule reduction approach FortNOX rule conflict analysis imposes minimal additional latency over standard NOX, with an average overhead of less than ms for evaluating a candidate flow...