Patent Publication Number: US-9432282-B2

Title: Network-based hyperspeed communication and defense

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application is a national phase entry of PCT/US2011/0042817 entitled NETWORK-BASED HYPERSPEED COMMUNICATION AND DEFENSE filed Jul. 1, 2011, which claims priority to U.S. Provisional Application Ser. No. 61/453,260 entitled NETWORK-BASED HYPERSPEED COMMUNICATION AND DEFENSE filed on Mar. 16, 2011, and U.S. Provisional Application Ser. No. 61/446,381 entitled NETWORK-BASED HYPERSPEED COMMUNICATION AND DEFENSE, filed on Feb. 24, 2011, both of which are each incorporated herein in their entireties. 
    
    
     BACKGROUND OF THE INVENTION 
     In all situations, early warning of an attack offers the best chance of defense against that attack. Having detailed information about the attack before it occurs provides a defender with more options to use in his or her defense. These principles are true regardless of when or how an attack occurs. When armed with early warning and information, effective and preemptive countermeasures may be efficiently employed. Unfortunately, the configuration of a network and the speed of electronic communications often prevent any substantive early warning or preemptive informational analysis. 
     The most common countermeasure employed by networks limits the speed of ingress (incoming) electronic communications by forcing the traffic through one or more filters at the ingress point in order to detect malicious or suspicious traffic. Currently, when malicious or suspicious traffic is identified, the particular signal or packet is quarantined. Each subsequent filter then adds another layer of delay, thereby imposing additional time costs on network traffic and electronic communications. Ultimately, malicious and suspicious attacks on computer networks are a common occurrence causing significant performance and financial loss, while redirecting resources and budgets. The alternative to filtering is to allow network security systems to react to an attack. 
     Users of networks want the fastest communication speeds for their signals and data packets as they transit the network. This is the optimal communications path. The competing needs for network security against the end users&#39; need for fast communications are one of the many balancing efforts network administrators face. Multiprotocol label switching (MPLS) networks are one solution where balancing the competing needs provides additional opportunities to satisfy the competing demands of security and speed. 
     MPLS networks are quickly becoming the standard for high-speed network backbones. MPLS networks used by major service providers offer a variety of high-priority paths (optimal) and low-priority paths (suboptimal) for customer traffic based on service level agreements. Thus, network administrators can meet the end users&#39; needs by modifying the choices the end user makes and pays for. 
     For each MPLS network, there is at least one optimal path corresponding to the optimum speed for each signal or packet. Similarly, there are usually several suboptimal paths corresponding to the suboptimal speeds of signals or packets, the suboptimal speeds being less than the optimum speed. Current MPLS network security limits all of these transmissions to some value below the absolute fastest or optimal speed technologically available, thereby causing the performance of the network to be slower. 
     Because MPLS networks have a plurality of nodes, there are numerous routes and paths electronic communication signals can travel. This also means networks have numerous ingress points, routes and paths for the malicious and suspicious traffic to traverse. Because each node adds the burden of filtering an electronic signal, the speed of the network dramatically slows down, and the electronic signal travels at an extremely low, suboptimal speed. Optimization of the system also suffers filtration limits. However, without filtration systems, the network and its nodes have limited ability to react to threats when attacked. 
     The foregoing issues show a need for one or more ways to protect networks, optimize the electronic signal speed, and provide early warning messages without the burden of multiple filters. 
     SUMMARY OF THE INVENTION 
     In one aspect, the following invention provides for a method for communicating a high-priority signal across a network ahead of a lower-priority signal. The method comprises the steps of:
         a. assigning a priority to each signal entering the network   b. identifying any harmful signal associated with any of the signals entering the network;   c. generating a high-priority signal in response to the identification of a harmful signal;   d. identifying and selecting at least one defensive technique for the network;   e. defining a plurality of electronic communication paths, each path capable of carrying a plurality of signals, wherein the step of defining the plurality of paths identifies at least one optimal communication path and at least one suboptimal communication path corresponding with the selected defensive technique;   f. electronically communicating the high-priority signal along the optimal communication path; and   g. delivering the high-priority signal along the optimal communication path to the desired destination prior to delivering any of the lower priority signals.       

     In another aspect, the invention provides a method for flexible high-priority electronic communication suitable for communicating a plurality of signals across a network, the network having a plurality of electronic communication paths and each signal having a signal priority. The method comprises the steps of:
         a. determining a priority for each signal, wherein at least one signal is a high-priority signal;   b. selecting at least one defensive technique, thereby defining a plurality of paths for electronically communicating the signals; and   c. employing one or more of the selected defensive techniques to optimize the electronic communication of the high-priority signal along at least one of the paths, thereby providing delivery of a transmitted high-priority signal faster than transmitted lower-priority signals to a desired destination.       

     In yet another aspect, the invention provides a method for delivering high-priority signals over a network faster than lower-priority signals. The method comprises:
         a. identifying a plurality of paths;   b. ranking each of the plurality of paths from an optimal path to at least one suboptimal path, wherein each path includes an origination node and a termination node;   c. identifying a reaction window, the reaction window defining a desired time difference between the optimal path and suboptimal paths;   d. selecting the optimal path and at least one suboptimal path from the plurality of paths satisfying the reaction window, the selection determined by the reaction window for each origination node and termination node; and   e. delivering the high-priority signal from the origination node to the termination node along the selected path.       

     Numerous objects and advantages of the invention will become apparent as the following detailed description of the preferred embodiments is read in conjunction with the drawings, which illustrate such embodiments. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a prior art illustration of a multiprotocol label switching (MPLS) network. 
         FIG. 2  depicts a prior art schematic of a virtual private network (VPN) consisting of two sites connected via a MPLS VPN service provider. 
         FIG. 3A  depicts a schematic of suboptimal routing in a local area network (LAN) spanning tree for users. 
         FIG. 3B  depicts a schematic of hyperspeed routing in a LAN spanning tree. 
         FIG. 4  depicts a schematic of hyperspeed routing in an enterprise network. 
         FIG. 5  depicts a schematic of hyperspeed routing in the Internet. 
         FIG. 6  depicts a schematic of an egress filtering configuration. 
         FIG. 7A  depicts a prior art schematic of a traditional serial detection filtering configuration. 
         FIG. 7B  depicts a schematic of a distributed, parallel filtering configuration. 
         FIG. 8  depicts a schematic of an egress filtering configuration employing an advance warning. 
         FIG. 9  depicts a schematic of a simplified teleportation configuration. 
         FIG. 10  depicts a schematic of a staged teleportation configuration. 
         FIG. 11  depicts a schematic of a predictive teleportation configuration. 
         FIG. 12  depicts a schematic of a quarantining network device configuration. 
         FIG. 13  depicts a schematic of a tagging configuration. 
         FIG. 14  depicts a schematic of a network holography configuration. 
         FIG. 15  depicts a graph of routing table size versus Δc for three notional networks. 
         FIG. 16A  depicts a graph of trends in performance metrics for actual Δc values versus increasing target Δc values. 
         FIG. 16B  depicts a graph of trends in performance metrics for path length difference values versus increasing target Δc values. 
         FIG. 16C  depicts a graph of trends in performance metrics for convergence time values versus increasing target Δc values. 
         FIG. 17  depicts a graph of actual Δc versus σ-link delay values. 
         FIG. 18A  depicts a graph of trends in performance metrics for actual Δc values versus increasing σ-link delay values. 
         FIG. 18B  depicts a graph of trends in performance metrics for path length difference values versus increasing σ-link delay values. 
         FIG. 18C  depicts a graph of trends in performance metrics for convergence time values versus increasing σ-link delay values. 
         FIG. 19  depicts a graph of routing table size versus node count. 
         FIG. 20A  depicts a graph of actual Δc values versus node count. 
         FIG. 20B  depicts a graph of path length difference values versus node count. 
         FIG. 20C  depicts a graph of convergence time values versus node count. 
         FIG. 21  depicts a graph of routing table size versus link count. 
         FIG. 22A  depicts a graph of actual Δc values versus link count. 
         FIG. 22B  depicts a graph of path length difference values versus link count. 
         FIG. 22C  depicts a graph of convergence time values versus link count. 
         FIG. 23  depicts a graph of routing table size versus link count with a restriction on the number of entries in the routing table. 
         FIG. 24A  depicts a graph of actual Δc values versus link count with a restriction on the number of entries in the routing table. 
         FIG. 24B  depicts a graph of path length difference values versus link count with a restriction on the number of entries in the routing table t. 
         FIG. 24C  depicts a graph of convergence time values versus link count with a restriction on the number of entries in the routing table. 
         FIG. 25  depicts an illustrative embodiment of the inventive method. 
     
    
    
     DETAILED DESCRIPTION 
     Inventive Overview 
     The inventive method uses a MPLS network and hyperspeed paths, also known as optimal paths, for command and control, and other high priority traffic. Suboptimal paths, which are slower than optimal paths, are typically used for all non high-priority traffic. This optimal and suboptimal path approach facilitates implementing sophisticated network defense techniques. For example, the time differential between the optimal and suboptimal paths provides a reaction window sufficiently long enough to implement one of many defenses. The communication delay is the amount of time between the origination node, or source node which identifies an attack, and the termination node, or destination node, that receives the warning. The reaction window is the difference in communication delay between the optimal path and a selected suboptimal path. The reaction window also includes the time needed to implement a defense against the identified attack. Data packets sent along hyperspeed paths arrive well in advance of malicious or suspicious traffic to alert network devices and initiate defensive actions. MPLS networks are well suited for this inventive method because MPLS networks logically separate the internal internet protocol (IP) control network from external IP networks that connect with the data plane. The example used herein describes a core MPLS network, but any type of network may adapt and employ the inventive method. The hyperspeed messages are electronic communication signals having at least one data packet. The traffic is the electronic communication carried by the network. 
     There are one or more optimal paths and a plurality of suboptimal paths between two nodes on the network. This provides for different reaction time windows. The reaction time windows vary, based upon malicious or suspicious traffic, and provide more or less time to implement defensive actions. Depending on its nature and priority, most traffic is sent along suboptimal paths. However, traffic deemed to be malicious or suspicious is sent along the slowest paths. Similarly, the hyperspeed paths are not solely reserved for command and control traffic. Some time-critical traffic, such as interactive voice and video communications, are also sent along faster suboptimal paths and/or hyperspeed paths. Network administrators must balance the speeds of different types of traffic, or risk reducing the reaction time window, thereby decreasing the time available to implement defensive actions. 
     At least three service differentiation techniques for introducing delays exist. A first service differentiation technique is the queue priority technique, which gives hyperspeed traffic the highest priority. A second service differentiation technique is the delay variation technique, which delays non-hyperspeed traffic for a set period-of-time in queues maintained at the network nodes. A third service differentiation technique is the route variation technique, which forces non-hyperspeed traffic to take slower, suboptimal paths. The third technique requires an algorithm that is discussed in detail hereinbelow. All three service differentiation techniques are useable individually, or in combination, to satisfy specific reaction time windows given the available network resources and constraints. To maximize the overall efficiency of the network, any use of a suboptimal path should incorporate the smallest delay necessary to obtain the desired reaction time window. Suboptimal paths are created by introducing delays in the network. 
     Inventive Overview—Core Capabilities 
     One of the core capabilities of the inventive method allows the network administrator to identify a threat, or target packet, and send a hyperspeed signal to any node in the network before a target packet arrives at a node under attack. The network administrator can do this in one of two ways. The first way has a single hyperspeed signal arriving before the target packet. The first way provides the network administrator the ability to track multiple target packets and to correlate information about all target packets, regardless of their locations in the network. The second way uses multiple hyperspeed signals, one for each target packet under observation. 
     Another core capability is the opportunity to collect intelligence, conduct surveillance of the network, and reconnoiter the network. Often, these actions are referred to as Intelligence, Surveillance, and Reconnaissance (ISR). In this context, Intelligence involves integrating time-sensitive information from all sources into concise, accurate and objective reports related to a threat situation. Reconnaissance refers to acquiring information about a threat, possibly a one-time endeavor. Surveillance refers to the systematic observation of a targeted area or group, usually over an extended time. In the event the network administrator needs ISR capabilities for any reason, the scope and speed of ISR is only limited by the connectivity of the nodes via hyperspeed paths, and the reaction time windows offered by these paths. 
     A third core capability relates to defensive actions. Hyperspeed signals allow the implementation of sophisticated network defenses. The advance warning provided by hyperspeed signaling enables a network to seemingly employ “precognition,” and react to an attack before it reaches the target. The different defenses are discussed in detail hereinbelow. 
     Hyperspeed signaling enables distributed filtering, teleporting packets, quarantining network devices, tagging and tracking suspicious packets, projecting holographic network topologies, and transfiguring networks. The distributed filtering defense allows network administrators to outsource detection mechanisms to various locations and/or organizations. Teleportation enables packets to be transported by masked or secret routes across a network without being detected. Quarantining enables a network device, segment or path to vanish before it can be affected by an attack. Tagging facilitates the tracking of suspicious traffic and the routing of other traffic accordingly. Network holography conceals a real network and projects an illusory topology. Transfiguration enables network topologies to be dynamically manipulated to adapt to the environment and context of the threat. 
     Hyperspeed Defense On Service Provider Networks 
     Referring to  FIG. 1 , network  10 , is illustrated as having nodes  12 . Nodes  12  are represented as A-F. In this case network  10  is a service provider network  10 . Node  12  A-F representations are associated with routers  14 A- 14 F. Links  16  are the connections between nodes  12 . In network  10 , as illustrated, node  12 A is the ingress node, and node  12 F is the egress node. Node  12 A is also referred to in  FIG. 1  as the source or origination node. Node  12 F is also referred to as the termination node or destination node. 
     Route  18  is the sequence of links  16  that an electronic signal travels between an origination or source node  12 A, and the intervening nodes  12 B and  12 C until it reaches a termination or destination node  12 F.  FIG. 1  illustrates route  18  as three links  16  between nodes  12  marked as A-B-C-F, which are also routers  14 A,  14 B,  14 C and  14 F. Similarly, nodes  12 D and  12 E are also routers  14 D and  14 E. Path  20  includes links  16  and queues associated with nodes  12 . Path  20  is illustrated in  FIG. 1  as three links  16  between and including nodes  12  marked as A-B-C-F, which are also routers  14 A,  14 B,  14 C and  14 F. The dashed line on  FIG. 1  represents path  20 . The path time is the sum of the delay times imposed by the constituent links  16  and queues comprising path  20 . 
     Network  10  illustrated in  FIG. 1  is representative of a multiprotocol label switching (MPLS) provider network. MPLS is an ideal technology for implementing hyperspeed signaling because it has built-in identification and service differentiation technologies. Labels in MPLS act like circuit identifiers in asynchronous transfer mode (ATM) to designate paths  20  taken by packets in the core of network  10 . 
     Virtual private network (VPN)  22 , consisting of two sites  24 , is connected via network  10  as illustrated in  FIG. 2 . VPN  22  in  FIG. 2  is a prior art illustration as part of a VPN service provider. An unlabeled internet protocol (IP) packet  25  traveling from site  24 A to site  24 B enters network  10  at router  14 A. Router  14 A is referred to as label edge router (LER)  14 A because it resides at the edge of an MPLS domain. LER  14 A examines the destination IP address, consults its IP routing table, applies a Label L1 thereto, and forwards packet  25  to router  14 B. Router  14 B is referred to as label switching router (LSR)  14 B because it resides within the MPLS domain. LSR  14 B is positioned to receive labeled IP packet  25  and detects Label L1. Using the Label L1, LSR  14 B immediately identifies the path for packet  25 , replaces Label L1 with Label L2, and forwards packet  25  to LSR  14 C. LSR  14 C functions in a manner similar to LSR  14 B, applies Label L3, and forwards packet  25  to LER  14 F. LER  14 F recognizes that packet  25  has reached the destination network, removes the label, and forwards the unlabeled IP packet  25  to site  24 B. 
     Using  FIG. 2  as an example, hyperspeed routing in MPLS uses labels to distinguish hyperspeed packets  25  from non-hyperspeed packets  25 . MPLS-capable routers  14  are equipped with quality of service (QoS) and traffic shaping features. LSRs  14  are configured to give hyperspeed packets  25  the highest priority based on the packet label. Likewise, LSRs are configured to delay hyperspeed packets  25  for a fixed period-of-time in forwarding queues. A non-limiting example of a delayed period-of-time is about 50 milliseconds. Because the label dictates the QoS and path  20 , non-hyperspeed packets  25  can be redirected along circuitous routes  18  by constructing the corresponding paths  20  using non-hyperspeed labels. The labels corresponding to optimal routes  18  are reserved for hyperspeed packets  25 . 
     Hyperspeed Defense on Local Area Networks (LAN) 
     The same hyperspeed communication process discussed above may be applied to a LAN. Hyperspeed signals are identified by reserving a special set of MAC addresses using fields in 802.1q (VLAN) headers or using 802.1p (Ethernet QoS), depending on the technologies supported by Ethernet switches  26 . To implement the hyperspeed communications, most Ethernet switches  26  would require specialized software. 
     Implemented in a similar manner to hyperspeed communications, queue priority is implemented by programming Ethernet switches  26  to forward hyperspeed frames ahead of all other frames in the memory of Ethernet switches  26 . Ethernet switches  26  supporting 802.1p are already equipped for queue priority. Implementing delay variation includes programming Ethernet switches  26  to place non-hyperspeed frames in a queue where the frames wait for a fixed period-of-time. 
     Route variation is implemented in several ways. One approach is to modify the Spanning Tree Protocol to calculate two spanning trees. The example in  FIGS. 3A and 3B  depicts two spanning trees in Ethernet LAN  28 . A non-optimal spanning tree used by non-hyperspeed frames is illustrated in  FIG. 3A .  FIG. 3B  illustrates the minimum spanning tree, which is used by hyperspeed frames. Lines  27  depict the Ethernet links. Dashed lines  27 A indicate that the link has been selected as part of the spanning tree. The approach for implementing route variation is limited because the reaction time window provided by the maximum spanning tree compared to that provided by the minimum spanning tree may not be sufficient to implement defensive actions. This problem is resolved by also applying the delay variation technique to obtain the desired reaction time window. 
     Alternatively, implementing route variation involves programming Ethernet switches  26  to store the loop count in an unused Ethernet header field, and to send frames in loops a fixed number of times. Another alternative employs Virtual LAN (VLAN)  28  hopping. This alternative is also applicable to enterprise networks, described hereinbelow. 
     Hyperspeed Defense on Enterprise Networks 
     Referring to  FIG. 4 , enterprise network  30  is illustrated. Because enterprise networks  30  are composed of LANs  28  using IP, the techniques for implementing hyperspeed signaling in LANs  28  are also applicable to enterprise networks  30 . However, the protocols that support enterprise networks  30 , such as IP, are manipulated to enable hyperspeed signaling in enterprise networks  30 . Larger enterprise networks  30  may apply the same service differentiation techniques used by service providers. Depending upon the size of enterprise network  30 , by way of a non-limiting example, and either singly or in combination, the protocols used include, IP, MPLS, as well as other older and newer protocols. 
     The type of service (ToS) field or an IP option can be used to distinguish hyperspeed packets  25  from other packets  25 . The features of routers  14  of enterprise network  30  determine particular service differentiation techniques available. If routers  14  have the proper features, the queue priority and delay variation techniques are implemented by configuring routers  14  to give priority to hyperspeed packets  25  and to delay non-hyperspeed packets  25  in queues. 
     Route variation is implemented by manipulating routing protocols (e.g., routing information protocol (RIP) and open shortest path first (OSPF)), or by applying a specialized hyperspeed routing protocol such as Δc protocol, which is discussed in detail hereinbelow.  FIG. 4  illustrates enterprise network  30  consisting of three LANs  28  connected by three IP routers  14 . Two LANS  28 A and  28 B are both VLANs  28 . To implement route variation, the routing table at router  14 A must be manipulated, or router  14 A must be programmed to send ordinary packets  25  to a next hop that does not correspond to the hyperspeed path. Thus, hyperspeed packets traveling from LAN  28 A to VLAN  28 B follow the optimal hop sequence identified by X-A-C-Y. Non-hyperspeed packets  25  follow the hop sequence identified by X-A-B-C-Y. Hop sequence X-A-C-Y represents Ethernet switch  26 X to router  14 A to router  14 C to Ethernet switch  26 Y. Similarly, hop sequence X-A-B-C-Y represents Ethernet switch  26 X to router  14 A to router  14 B to router  14 C to Ethernet switch  26 Y. 
     In the case of enterprise networks  30  employing VLANs  28 , Ethernet switches  26  are programmed to permit VLAN  28  hopping. Referring to  FIG. 4 , hyperspeed packets  25  traveling from VLAN  28 B to VLAN  28 C hop via Ethernet switch  26 Y without visiting router  14 C. On the other hand, non-hyperspeed packets  25  travel via the sequence of Y-C-Y, visiting router  14 C as expected. The sequence of Y-C-Y represents packet travel from VLAN  28 B to Ethernet switch  26 Y to router  14 C to Ethernet switch  26 Y to VLAN  28 C. 
     Enterprise networks  30  may contain VPNs  22 . The implementation of hyperspeed signaling in enterprise networks  30  with VPNs  22  that span multiple geographic locations may require the cooperation of one or more service providers. 
     Hyperspeed Defense on Internet 
     Internet protocols require modification of the software in routers  14  and Ethernet switches  26 . However, an altered protocol can be wrapped between service provider networks, LANs  28  and enterprise networks  30 . Other switches used with computer communications, such as ATM switches, fiber optics, etc., are understood to be used in place of, or in combination with Ethernet switches  26 . Hyperspeed packets  25  in the Internet are identified using ToS or optional IP fields. Since the Internet is composed of service provider networks  10 , hyperspeed signaling implementations for service provider networks  10  are employed. The same is true of LANs  28  and enterprise networks  30 . Enterprise networks, LANs, and participating providers perform hyperspeed routing without the cooperation of non-participating providers. Non-participating providers behave in the standard way while participating networks treat the non-participating providers as if they were links among the participating networks. 
     Cooperating service providers can also manipulate the Border Gateway Protocol (BGP) to create optimal and suboptimal paths  20  without advertising the optimal (hyperspeed) paths  20  to non-cooperating service providers.  FIG. 5  illustrates three autonomous systems (AS)  32  with Client  34 A connected to AS  32 A and Client  34 B connected to AS  32 C. Hyperspeed packets  25  traveling from Client  34 A to Client  34 B would follow the AS  32  sequence of AS  32 A to AS  32 C, while non-hyperspeed packets  25  would follow the AS  32  sequence of AS  32 A to AS  32 B to AS  32 C. 
     Hyperspeed Defense Techniques 
     As discussed earlier, hyperspeed signaling helps to implement sophisticated network  10  defense techniques. Some of these defense techniques include: distributed filtering, teleporting packets  25 , quarantining network devices, tagging and tracking suspicious packets  25 , projecting holographic network  10  topologies and transfiguring networks  10 . Due to the speeds required to react, all of the defensive techniques are automated. However, as used herein, the network administrator is identified as the actor, meaning that the network administrator sets the parameters used in the defensive technique. In some defensive techniques, the network administrator may also activate the technique (e.g., in teleportation, he may press “enter” when he wants the teleportation sequence to begin), or he may be the recipient of information (e.g., in tagging, he is notified when the target router is believed to be compromised). However, these actions are usually automated processes with defined responses. 
     Hyperspeed Defense Techniques—Distributed Filtering 
     Hyperspeed signaling supports a variety of distributed filtering configurations. The simplest configuration is “egress filtering” that can be used by service provider networks  10  and other entities that transport traffic between a plurality of networks  10 . As depicted in  FIG. 6 , when a malicious packet  25  is identified, a hyperspeed sentinel message  35  is sent to egress filter  36  to intercept malicious packet  25 . If the reaction time window is sufficiently large, sentinel message  35  arrives at egress filter  36  in advance of malicious packet  25  to permit the threat to be neutralized. Sentinel message  35  must contain sufficient information to identify malicious packet  25 . Malicious packet  25  is dropped at egress filter  36 , and the downstream network  10  is unaware of the attempted attack. 
     Hyperspeed sentinel messaging enhances flexibility and efficiency by distributing detection and filtration functionality. In addition, it enables service provider networks  10  and other networks  10  that employ multiple detection modalities to maintain low latency. A non-limiting example of other networks  10  includes enterprise networks  30 . 
     The traditional ingress filtering approach is illustrated in  FIG. 7A . This approach deploys detector-filters  38  in series, where each detector-filter  38  contributes to the overall delay. The traditional approach requires first detector-filter  38  to finish processing a packet  25  before second detector-filter  38  begins processing that packet. A non-limiting example of detector-filter  38  includes a firewall. Ingress node  12 A, route  18  and node  12 B are also depicted in  FIG. 7A . The distributed filtering approach illustrated in  FIG. 7B  is a parallel approach allowing all of detectors  40  to process the same packet  38  at the same time. The distributed filtering approach deploys detectors  40 , which are electronically communicating with hub  41 , and positioned to operate concurrently. Thus, the overall delay is the delay introduced by the single slowest detector  40  plus the delay required for egress filtering. 
     Referring to  FIG. 8 , an advance-warning configuration is illustrated, whereby a hyperspeed signal, referred to here as sentinel message  35 , is sent to the customer ingress node  12 B instead of the provider egress node  12 A after detector  40  identifies a threat or suspicious traffic. In this configuration, the service provider network  10  detects malicious packets  25 , but only alerts the customer network  10  about the incoming packets  25 . Since the customer network  10  has advance warning, the customer network  10  is able to use analysis device  37  to observe, analyze and/or block the malicious traffic. The same advance-warning configuration is applicable to peer networks  10 . 
     The advance-warning configuration enables networks  10  to outsource detection. Copies of suspicious packets are forwarded to a third party having sophisticated detection capabilities. For example, security service providers or government agencies may take advantage of the advance-warning configuration. In the case of security service providers, if the third party detects malicious activity, it can send a hyperspeed signal to trigger filtering. The third party is able to correlate packets observed from multiple client networks  10  and provides sophisticated detection services to its clients without compromising any information or data. Governmental agencies are able to use the same technique for national security related reasons. 
     Hyperspeed Defense Techniques—Teleportation 
     Hyperspeed routes  18  are used to teleport packets. Simple teleportation is illustrated in  FIG. 9 . An operator located at Node  12 A sends packet  25  along path  20  from node  12 A to router  14 B to router  14 F to node  12 G. Hop  39 A between node  12 A and router  14 B is visible. Hop  39 B between router  14 B to router  14 F involves teleportation, where hop  39 B does not appear to be visible to the casual observer. Hop  39 C between router  14 F and node  12 G is visible. To teleport packet  25  from router  14 B to router  14 F, packet  25  could, as a non-limiting example, be encrypted and encapsulated in a labeled internet control message protocol (ICMP) ping packet  25 , and sent to router  14 B along a hyperspeed path  20 , where it would be converted to its original form and forwarded to node  12 G along a normal path  20 . If the teleportation mechanism is to be further concealed, packet  25  could be fragmented and the fragments sent along different hyperspeed paths  20  to router  14 F (assuming that multiple hyperspeed paths  20  exist from router  14 B to router  14 F). Some non-limiting examples to enhance teleportation include encryption, encapsulation and fragmentation. 
     Another teleportation approach is analogous to stage magic. Stage magicians often use identical twins to create the illusion of teleportation. To set up the act, the magician positions one twin at the source while the other is hidden at the destination. During the act, the magician directs the first twin to enter a box and then secretly signals the other twin to reveal himself at the destination. The same approach is used to create the illusion of packet  25  teleportation. 
     The staged teleportation approach is illustrated in  FIG. 10 . The operator at node  12 A uses simple teleportation to secretly send packet  25 A from node  12 A to router  14 F along path  20 A, where packet  25 A is staged packet  25 A. This is Step 1. The operator then sends an identical packet  25 B from node  12 A to router  14 B along a normal path  20 B. Packet  25 B is dropped upon reaching router  14 B. This is Step 2. The operator next sends a hyperspeed signal from node  12 A to router  14 F along path  20 C. This is Step 3. The hyperspeed signal causes staged packet  25 A to move from router  14 F to node  12 G along a normal path  20 D. This is Step 4. A casual observer will see packet  25 B travel from node  12 A to router  14 B, and what he perceives to be packet  25 B subsequently travel from router  14 F to node  12 G. But, the casual observer will not see packet  25 B travel from router  14 B to router  14 F, because no such transmission takes place. Depending on the time-sensitivity of the operation, Step 1 can be put into place well in advance of executing Steps 2, 3 and 4. 
     An alternative variation of the teleportation approach modifies Step 1. An operator located at router  14 F sends a copy of packet  25  to node  12 A along a covert hyperspeed path  20 A using simple teleportation. Similar to the previous teleportation approach, a casual observer will see packet  25 B travel from node  12 A to router  14 B, and the perceived packet  25 B travel from router  14 F to node  12 G, but not from router  14 B to router  14 F. This teleportation approach helps conceal the real origins of network messages. 
     Another alternative of teleportation involves prediction.  FIG. 11  illustrates a customer pinging its remote sites according to a regular schedule. Under normal circumstances, each ping  39  might traverse path  20  comprising node  12 A to router  14 B to router  14 C to router  14 D to node  12 E, as shown in  FIG. 11 . However, with teleportation, the transport mechanism from router  14 B to router  14 C to router  14 D would be concealed. To teleport a customer ping  39 , routers  14 B and  14 D must be able to predict the ping schedule. When the customer sends ping  39 , router  14 B drops the ping, and router  14 D produces the ping at the predicted time. However, if router  14 B does not receive the expected ping, it notifies router  14 D immediately via a hyperspeed path  20 A. Router  14 D would most likely send an erroneous ping  39 , but it will know to discontinue teleportation until network  10  can predict the pinging schedule. 
     Hyperspeed Defense Techniques—Quarantining 
     Quarantining enables a targeted network device, segment or path  20  to disappear before it can be compromised by an attack. As illustrated in  FIG. 12 , node  12 A is the ingress node and communicates packet  25  to detector  40 . Packet  25  is a malicious packet  25  targeting node  12 B. Detector  40  then sends hyperspeed signals  35  to the appropriate network nodes  12 C to prevent malicious packet  25  traffic from reaching node  12 B, the targeted device. This quarantines the node  12 B, the targeted device, from attack. 
     If the attack reaches the targeted device before it is quarantined, the device is isolated before it can affect other parts of network  10 . The device is reconnected only after it is verified to be secure. Because the quarantine messages travel along hyperspeed paths  20 , the likelihood that the attack will be thwarted before it impacts the targeted device is increased. The same technique is used to quarantine network segments or deny the use of certain network paths  20 . 
     Hyperspeed Defense Techniques—Tagging 
     In a tagging defensive technique, a network administrator tracks path  20  taken by suspicious traffic. An analogy from nature is the ant leaving a trail of pheromones to indicate its path. A network administrator&#39;s system  43  sends diagnostic packets  25  via hyperspeed paths  20 B to nodes  12  along path  20  taken by a suspicious packet to observe its behavior. If, as illustrated in  FIG. 13 , suspicious packet  25  causes anomalous behavior at one of nodes  12 , illustrated as  12 B, the diagnostic packet  25  reports the anomaly via a hyperspeed signal  35  and the compromised device may be quarantined as described hereinabove. In extreme cases, all nodes  12  on path  20  taken by the suspicious packet will be quarantined until the situation is resolved. As illustrated, suspicious packet  25  enters network  10  at ingress node  12 A and travels through intermediate nodes  12 C until it hits target node  12 B. 
     Tagging is used to mitigate the effects of attacks that originate from multiple sources, including distributed denial-of-service attacks (DDoS) and other attacks. One of many examples is an attack that is fragmented into five benign packets  25 , and is executed only when all five packets  25  are assembled in sequence. Since a single stateful firewall with knowledge about the fragmented attack can detect and block one or more packets  25 , implementing a successful attack would require packets  25  to be sent from different locations. 
     The tagging mechanism counters the fragmented attack by quarantining the target node  12 B as soon as anomalous behavior is detected. Packets  25  that constitute the attack are traced back to their origins at perimeter  42  of network  10 . Filters  36  and detectors  40  must be appropriately re-configured to detect the attack. 
     Hyperspeed Defense Techniques—Network Holography 
     Networks  10  hide their internal structure by using private IP addresses. The hidden nature of the IP addresses enables hyperspeed signaling on networks  10  by projecting illusory internal structures or “holograms.” 
     Conventional holograms are created using lasers and special optics to record scenes. For example, when a cylindrical piece of glass is used, a scene is recorded from many angles. Once recorded, the original scene can be removed, but the hologram will project the recorded scene according to the viewing angle. If enough angles are recorded, the hologram creates the illusion that the original scene is still in place. 
     Similarly, the network administrator creates topology  44 , which is an illusory topology  44 , of network  10  and subsequently distributes the illusory topology  44  to edge nodes  12  of a real network  10 , as illustrated in  FIG. 14 . The presence of multiple hyperspeed paths  20  between pairs of edge nodes  12  helps simulate illusory topology  44 . Other nodes  12  may be included, but edge nodes  12  must be included to create the illusion. When probes (e.g., ping and traceroute) hit the real network  10 , edge nodes  12  respond to the probes as if network  10  has illusory topology  44 . The same topology  44  is simulated from substantially all angles (i.e., no matter where the probe enters network  10 ) to maintain the illusion. 
     Hyperspeed Defense Techniques—Transfiguration 
     Transfiguration enables networks  10  to cooperate, much like utilities in the electric power grid, to continue providing services during times of crisis. Network administrators manipulate their internal network  10  topologies, or modify the topologies  44  along perimeter  42  of cooperating networks  10 , to lend or lease additional resources as required. Additionally, administrators may modify topologies  44  at perimeter  42  near an attack. This method is analogous to moving the frontline forward or backward during a battle. 
     Links  16  and nodes  12  may need to be strategically quarantined, disabled or re-enabled based on circumstances. As resources are lost and gained, the roles of devices, especially at perimeter  42 , may change. Hyperspeed signaling enables topology  44  changes to occur seemingly instantaneously, and enables devices with special roles to operate in proxy where necessary at perimeter  42 . As resources become available, the window for hyperspeed signaling is adjusted as necessary to provide additional reaction time. The resource availability is a result of being regained after being compromised or being leased from other sources. 
     Hyperspeed Defense Techniques—Implementation 
     Implementing hyperspeed signaling in network  10  requires a protocol that applies the queue priority, delay variation and route variation service differentiation techniques appropriately to achieve the target reaction time window. The target reaction window is the desired reaction window where the electronically communicated high-priority signal arrives faster than all lower-priority signals transmitted within the time period. Of these techniques, implementing the route variation technique is relatively complicated. If a network administrator attempts to build explicitly routed paths  20  to satisfy the target reaction time window, the risk of error is high. In addition, if a link  16  or node  12  becomes unavailable, hyperspeed signaling along the affected paths  20  fails, unless new paths  20  are identified. 
     An automated protocol for constructing paths  20  that satisfy the target reaction time window in a dynamic network environment is desirable. An approach is to run Dijkstra&#39;s Algorithm repeatedly to discover multiple paths  20 , but the fastest and slowest loop-free paths  20  still may not accommodate the target window. Dijkstra&#39;s Algorithm finds the optimal route  18  from s to d by iteratively and greedily removing edges and nodes  12  from a set of unvisited elements until all nodes  12  are visited. A second approach is to modify routing information protocol (RIP) to track the best route  18  as well as the second-best route  18 . This approach can be further extended to track as many routes  18  as are necessary, but the number of routes  18  is difficult to determine based on the target window. The first two approaches can be applied in combination with the queue priority and delay variation techniques, but a protocol that works directly with the target window would be the most desirable. That protocol is referred to herein as the Δc Algorithm, and is illustrated by Equation 1 below. 
     Δc Algorithm Protocol 
     The Δc Algorithm gives the service providers the ability to specify a desired decision window. Thus, it provides a flexible means for delivering control traffic faster than data traffic while maintaining near-optimal speeds on network  10 . 
     The Δc Algorithm for a computer or telecommunications network  10  must be able to see the entire network  10  to allow the Δc Algorithm to properly execute using the complete topology thereof. There are at least two approaches for implementing the Δc Algorithm. One approach is developing a protocol like open shortest path first (OSPF), where information about topology  44  of network  10  is flooded to nodes  12 , thereby giving each node  12  a complete picture of network  10 , and facilitating independent execution of the Δc Algorithm. Another approach uses a protocol similar to RIP, where each node  12  in a distributed fashion depends on the routes  18  computed by its neighboring nodes  12  in order to compute new routes  18 . 
     Discussed below is the approach using a protocol similar to RIP articulating the Δc Algorithm as a distributed routing protocol, or Distributed Δc Protocol, for computer and telecommunications networks  10 . Also discussed below is the Δc Label Distribution Protocol (Δc-LDP), which is an adaptation of the Distributed Δc Protocol targeted for MPLS networks  10 . Δc-LDP constructs hyperspeed label switched paths (LSPs) in an MPLS network, facilitating the implementation of the above discussed reactive defense mechanisms such as quarantining compromised network devices before infections spread, teleporting packets  25  via concealed transport mechanisms, and projecting illusory internal topologies  44 . 
     The mathematical theory for expressing and manipulating route  18  restrictions and applicable proofs clarifying the types of restrictions compatible with Δc-LDP are presented below. Simulation results of Δc-LDP are also provided. The independent variables (target Δc, variance in link delays, number of links  16 , number of nodes  12  and application of route  18  restrictions) are varied while the dependent variables (routing table size, actual Δc and convergence time) are monitored in randomly-generated networks  10 . The simulation results show that the protocol operates well for practical values of Δc, with respect to average link cost (delay). 
     The Δc Algorithm discovers ranked optimal and suboptimal routes  18  in directed graphs (digraphs) based on a reaction window Δc. The Δc Algorithm offers MPLS service providers an effective means for delivering control traffic faster than data traffic, while maintaining near-optimal speeds on network  10 . The definitions and theorems underlying the algorithm are presented herein. For details about graph theory, refer to: G. Chartrand and L. Lesniak,  Graphs and Digraphs , Wadsworth and Brooks/Cole, Monterey, Calif., 1986. The following definitions identify the symbolic notation, and provide modified definitions to common definitions within the art. 
     Δc Algorithm Protocol—Definitions and Theorems 
     Definition 1. The length of a route is the number of constituent edges in a route. 
     Definition 2. The cost of a route is the sum of the costs of the constituent edges in a route. 
     Definition 3. If p= s, e i , . . . , e j , t  is a route from s to t, and q= t, e k , . . . , e l , d  is a route from t to d, then the concatenation p·q= s, e i , . . . , e j , t, e k , . . . , e l d  is route from s to d that is formed by following routes p and q in order. 
     Definition 4. R s→d  denotes the set of all routes from s∈N to d∈N in a network digraph Γ=(N, E). Note that S R s→d  is read “S contains a set of routes that share a common source s and destination d.” 
     Definition 5. If there exist three routes p, q, r∈S R s→d  such that cost (q)−cost (r)≧Δc for some Δc∈   +  and cost (p)&gt;cost (q), then p is a useless route in S with respect to reaction window Δc. Any other route in S is useful with respect to Δc. If the set S is not given explicitly, it is implied that S is the set of routes in Γ that share the same source and destination as route p. 
     Definition 6. If S R s→d  then ∇ Δc S={r∈S|r is useful in S with respect to Δc}. 
     The subscript “Δc” is often omitted hereinbelow for clarity. Thus, statement r∈∇S can be read as “r is useful in S.” ∇S S follows directly from the definition of ∇. 
     Theorem 1. Given a network digraph Γ=(N, E), if p· t ·q is the n th -optimal route from s∈N to d∈N through some intermediate t∈N, then both p and q must have a rank of n or better among optimal routes from s to t and t to d, respectively. 
     Proof. Let r=p· t ·q be the n th -ranked optimal route from s to d. Let p=p m  be the m th -ranked optimal route from s to t. Then, there exist routes p 1 , p 2 , . . . , p m-1  with costs c 1 , c 2 , . . . , c m-1 , each of which is less than cost (p). Also, there exist routes p 1 ·q, p 2 ·q, . . . , p m-1 ·q from s to d with costs c 1 +cost (q), c 2 +cost (q), . . . , c m-1 +cost (q) each of which is less than cost (p·q). Thus, there are at least m−1 routes that are more optimal than r, and thus, the rank of r, n, is at least m: n≧m. In other words, p must have a rank of n or better. The result for the rank of q is proved in a similar manner. 
     Lemma 1. Given a network digraph Γ=(N, E), if there exists an n th -optimal route of length l&gt;1, then there also exists an n th -optimal or better route of length l−1. 
     Proof. Assume that a route r= s, e 1 , t, e 2 , . . . , e l-1 , u, e l d  of length l&gt;1, and rank n exists for some arbitrary source and destination. The following two routes must also exist:  t, e 2 , . . . , e l d  of length l−1 that is formed by removing the first node and edge; and  s, e 1 , . . . , E l-1 , u  of length l−1 that is formed by removing the last node and edge. By Theorem 1, both these routes have rank n or better. 
     Theorem 2. Given a network digraph Γ=(N, E), if there exists an n th -optimal route of length l≧1, then there also exist n th -optimal or better routes of length m for every 0≦m&lt;1. 
     Proof. Theorem 2 is proved by the repeated application of Lemma 1. 
     Theorem 3. Given a network digraph Γ=(N, E) and some Δc∈   + , if q is a useless route, then both p·q and q·p are useless routes for any route p. 
     Proof. Let q be a route from some t∈N to some d∈N, and let p be a route from some s∈N to t. Because q is useless, there exist two routes q 1  and q 2  from t to d such that cost (q 2 )−cost (q 1 )≧Δc and cost (q)&gt;cost (q 2 ). Let r=p·q; r 1 =p·q 1 ; and r 2 =p·q 2 . Then, r, r 1  and r 2  are all routes from s to d with costs: cost (r)=cost (p)+cost (q); cost (r 1 )=cost (p)+cost (q 1 ); and cost (r 2 )=cost (p)+cost (q 2 ). Then, cost (r 2 )−cost (r 1 )=[cost (p)+cost (q 2 )]−[cost (p)+cost (q 1 )]=cost (q 2 )−cost (q 1 )≧Δc, and cost (q)&gt;cost (q 2 ) cost (p)+cost (q)&gt;cost (p)+cost (q 2 ) cost (r)&gt;cost (r 2 ). Thus, route r is useless. The result for q·p is proved in a similar manner. 
     Theorem 4. If p is a useful route in a set S R s→d , then p is a useful route in any set T S for which p∈T. Symbolically, p∈∇S R s→d   p∈∇T for all T S|p∈T. 
     Proof. Because p is useful, there are three possible cases: 
     Case 1. Three routes do not exist in S. Thus, for any T S, |T|&lt;3; consequently, p is useful in T. 
     Case 2. No two routes q, r∈S satisfy cost (q)−cost (r)≧Δc. If two such routes do not exist in S, then two such routes cannot exist in a T S; consequently, p is useful in T. 
     Case 3. Two routes q, r∈S exist such that cost (q)−cost (r)≧Δc, but for any q and r it is the case that cost (p)≦cost (q). Consider some T S. Any q and r in T are also in S. For any q and r in S, it must be the case that cost (q)−cost (r)≧Δc and cost (p)≦cost (q); consequently, cost (q)−cost (r)≧Δc and cost (p)≦cost (q) for q and r in T. Thus, p is useful in T. 
     Δc Algorithm 
     Equation 1 below, is the Δc Algorithm for targeting a specified reaction window. X is a two-dimensional matrix where entry X s, d   R s→d . 
     Step 
     
       
         
           
               
             
               
                   
               
               
                 [EQUATION 1] 
               
               
                   
               
             
            
               
                   
               
            
           
           
               
               
               
            
               
                   
                 a. 
                 Initialize all entries in X to     
               
               
                   
                 b. 
                 for all s ε N do X s, s ← {    s   } 
               
               
                   
                 c.  
                 repeat 
               
               
                   
                 d. 
                  for all s ε N, d ε N do  
               
               
                   
                 e. 
                   S ←U eεE     Γ       +     (s)  U rεX     head(e), d    {    s, e, head(e)    • r} 
               
               
                   
                   
                   
               
               
                   
                 f. 
                   X s, d ←∇(S U X s, d ) 
               
               
                   
                 g. 
                  end for 
               
               
                   
                 h. 
                 until X remains unchanged after a complete iteration. 
               
               
                   
               
            
           
         
       
     
     Equation 1, the Δc Algorithm, is limited by its centralized nature. Although it is modeled after distance-vector algorithms, the Δc Algorithm, as written, must be executed with full knowledge of the network topology. Consequently, the Δc Algorithm must be executed centrally, or like OSPF, the complete network topology must be “flooded” to all nodes, which subsequently execute the Δc Algorithm independently. 
     In the following, X m  denotes the contents of X after the m th  iteration of the repeat block starting at Line 3 in the Δc Algorithm. 
     Lemma 2. Given a connected network digraph Γ=(N, E) and a reaction window Δc∈   + , after m iterations of the Δc Algorithm, X s, d   m  is the set of all useful routes of length at most m from s∈N to d∈N. 
     Proof. The proof is established using induction. Consider the base case of m=0 iterations. The only non-empty sets in X 0  are those from Step 2 that contain exactly one element: the path from each node to itself. Thus, after one iteration, every path in any set in X 0  is useful. Additionally, since the only zero-length routes are the routes from a node to itself, every useful route of length 0 is an element of some set in X 0 . 
     For the inductive step, assume Lemma 2 holds after m iterations and consider Iteration m+1. By the inductive hypothesis, any entry X s, d   m  is the set of all useful routes from s to d of length at most m. Any route in S (Step 5), the set of candidate new routes, has a length of at most m+1. Thus, any route in S∪X s, d   m  has a length of at most m+1. 
     Any route in S is computed as  s, e  followed by a known route from head (e) to the destination d. Thus, the route is valid and has some cost. The operator ∇ Δc  selects all useful paths from s to d from the new and old routes, which are then assigned to X s, d   m+1 . The function drops all useless paths of length at most m+1. By Theorem 4, the application of ∇ Δc  does not drop any useful route, and by Theorem 3, the function does not drop any route that is part of a longer useful route. Thus, X s, d   m+1  is the set of all useful routes from s to d of length at most m+1. 
     Theorem 5. The Δc Algorithm terminates when every X s, d  is the set of all useful routes from s∈N to d∈N. 
     Proof. It is trivial to see that if the network has only one node, the algorithm will terminate. A connected digraph with at least two nodes must contain a cycle; thus, there are infinitely many routes from a source to a destination. Because N is a finite set, N×N is finite. For each (s, d)∈N×N, consider the optimal route r from s to d. Because there are a finite number of edges, one edge has the minimum (positive) cost; thus, there are a finite number of routes with cost less than cost (r)+Δc. Consequently, there are a finite number of useful routes for a given source and destination. 
     Let R be the set of all useful routes in the network. Then R is finite. Let l be the length of the longest route in R, and consider Iteration l. By Lemma 2, X s, d   l  is the set of useful routes from s to d of length at most l. Since l is the length of the longest useful route, l iterations are sufficient to ensure that X s, d  is the set of useful routes from s to d regardless of route length. 
     Consider Iteration l+1. Any route in S has a length of at most l+1. Pick a route q in S with length l+1, source s and destination d. If q exists, it is not an element of X s, d   l . Because X s, d   l  contains all useful routes, q must be a useless route and, therefore, is not selected by ∇ Δc . Any other route in S is already an element of X s, d   l . Thus, ∀s, d∈N: X s,d   l+1 =∇ Δc , (S∪X s, d   l )=X s, d   l , and X l+1 =X l , which causes the Δc Algorithm to terminate. 
     The Δc Algorithm does not terminate early. Consider the longest useful route and remove its first edge. By the contraposition of Theorem 3, the resulting route must be useful. The resulting route has length l−1; thus, X l−1 ≠X l , which prevents the algorithm from terminating at Iteration l. This result can be applied inductively over every previous iteration until the route length is reduced to zero. 
     Distributed Δc Protocol 
     The centralized Δc Algorithm, can be transformed into Equation 2, the Distributed Δc Protocol. The Δc Algorithm is modeled after distance-vector routing algorithms, such as RIP. Thus, the Distributed Δc Protocol distributes the workload similarly. 
     As shown in the Distributed Δc Protocol, each node is responsible for learning all routes for which it is the source. This learning step allows a neighboring node to share fragments of routes that may be used in Step 5 of the Δc Algorithm to compute S. Thus, any node s is responsible for the memory needed to store X s  when executing the Δc Algorithm. 
     For the sake of simplicity, assume that the network is static and predictable; and all the links are duplex, have a fixed cost and never fail. Implementing the Δc Algorithm in a distributed manner requires each node s begins by initializing the set of routes to itself with  s . Each node next sends its known routes to each of its upstream neighbors. Each node next uses the routes received from its downstream neighbors, calculates S and applies ∇ (Steps 5 and 6 of the Δc Algorithm) for all d∈N; the results are stored in X s . After every node has completed its calculations, each node once again sends its known routes. Eventually, the routing tables (X s ) converge, and the nodes can terminate the algorithm. 
     Synchronizing the process (i.e., ensuring that every node is at the same iteration) and knowing when to terminate requires additional communication among the routers. Fortunately, neither synchronization nor termination is necessary to compute the same routes as the Δc Algorithm, in a distributed environment. Thus, the Distributed Δc Protocol simply allows each node to emit its table periodically and indefinitely; hence, the reference to a Distributed Δc Protocol, and not a reference to the Δc Algorithm. The routing tables eventually converge to produce all the useful routes given some Δc. 
     Equation 2, the Distributed Δc Protocol, is formally described in terms of two routines that execute concurrently at each node s, where t is the update period. 
     Propagation Routine: 
     Step 
     
       
         
           
               
             
               
                   
               
               
                 [EQUATION 2] 
               
               
                   
               
             
            
               
                   
               
            
           
           
               
               
               
            
               
                   
                 a.  
                 Initialize all entries in X s  to     
               
               
                   
                 b.  
                 X s, s ← {    s   } 
               
               
                   
                 c. 
                 loop 
               
               
                   
                 d. 
                  for all e ε E   Γ     −  (s) do  
               
               
                   
                 e. 
                   send (e, X s ) 
               
               
                   
                 f. 
                  end for 
               
               
                   
                 g. 
                  wait t 
               
               
                   
                 h.  
                 end loop 
               
               
                   
               
            
           
         
       
     
     Update Routine: 
     Step 
     
       
         
           
               
               
               
             
               
                   
               
             
            
               
                   
                 1.  
                 loop 
               
               
                   
                 2. 
                  recv (e, X u ) 
               
               
                   
                 3. 
                  for all X u, d  ε X u  do 
               
               
                   
                 4. 
                   S←U rεX     u, d    {   s, e, u    • r} 
               
               
                   
                   
                   
               
               
                   
                 5. 
                   X s, d ←∇(S U X s, d ) 
               
               
                   
                 6. 
                  end for 
               
               
                   
                 7.  
                 end loop 
               
               
                   
               
            
           
         
       
     
     The send (e, X s ) statement transmits the object X s  along link e. The recv (e, X u ) statement receives an object in X u  and sets e to the link from which X u  was received. For information to be exchanged, the nodes executing these statements must be on opposite ends of link e. 
     The fundamental properties of ∇ show that the result of the Distributed Δc Protocol is the same as that of the Δc Algorithm. 
     Supporting Theorems and Proofs 
     Theorem 6. Given Γ=(N, E) and some Δc∈   + , for any R R s→d , if S∪T=R, then ∇R=∇(S∪∇T). 
     Proof. S∪T=R implies S R and T R. Also, if r∈,then r∉S r∈T and r∉T r∈S. Letting r∈∇R, then by definition, r∈R. 
     Case 1. r∈S. Thus, r∈S∪∇T 
     Case 2. r∈T. By Theorem 4, r∈∇T. Thus, r∈S∪∇T 
     By definition, ∇T T, so S∪∇T S∪T=R. By Theorem 4, r∈∇(S∪∇T). Thus, ∇R ∇(S∪∇T). 
     Let r∉∇R. 
     Case 1. r∉R. ∇(S∪∇T) R, so r∉∇(S∪∇T). 
     Case 2. r∈R. Thus, r is useless in R. By definition, there exist p, q∈R such that cost (p)−cost (q)≧Δc and cost (r)&gt;cost (p). Let p and q be the least-cost such routes in R. Consequently p, q∈∇R. 
     Case a. p∈S. Thus, p∈S∪∇T 
     Case b. p∈T. By Theorem 4, p∈∇T. Thus, p∈S∪∇T. 
     Cases a and b also apply to q, so p, q∈S∪∇T. Therefore, r is useless in S∪∇T, so r∉∇(S∪∇T). 
     The contraposition of the result in Cases 1 and 2 is r∈∇(S∪∇T) r∈∇R. Therefore, ∇(S∪∇T) ∇R. 
     Theorem 7. Given Γ=(N, E) and some Δc∈   + , for any R R s→d , if S∪T=R, then ∇R=∇/(∇S∪∇T). 
     Proof. S∪T=R implies S R and T R. Also, if r∈R, then r∉S r∈T and r∉T r∈S. Letting r∈∇R, then by definition r∈R. 
     Case 1. r∈S. By Theorem 4, r∈∇S. Thus, r∈∇S∪∇T. 
     Case 2. r∈T. By Theorem 4, r∈∇T. Thus, r∈n∇S∪∇T. 
     By definition, ∇S S, and ∇T T. Thus, ∇S∪∇T S∪T=R. Then, by Theorem 4, r∈∇(∇S∪∇T). Consequently, ∇R ∇(∇S∪∇T). 
     Let r∉∇R. 
     Case 1. r∉R. ∇(∇S∪∇T) R, so r∉∇(∇S∪∇T). 
     Case 2. r∈R. Thus, r is useless in R. By definition, there exist p, q∈R such that cost (p)−cost (q)≧Δc and cost (r)&gt;cost (p). Let p and q be the least-cost such routes in R. Consequently, p, q∈∇R. 
     Case a. p∈S. By Theorem 4, p∈∇S. Thus, p∈∇S∪∇T. 
     Case b. p∈T. By Theorem 4, p∈∇T. Thus, p∈∇S∪∇T. 
     Cases a and b also apply to q, sop, q∈∇S∪∇T. Therefore, r is useless in ∇S∪∇T, so r∉∇(∇S∪∇T). 
     The contraposition of the result in Cases 1 and 2 is r∈∇(∇S∪∇T) r∈∇R. Therefore, ∇(∇S∪∇T) ∇R. 
     An important corollary, designated as the first property of ∇ arises from Theorems 6 and 7. 
     Property 1. If S∪T=R, then ∇R=∇(S∪T)=∇(∇S∪∇T)=∇(S∪∇T)=∇(∇S∪∇T). 
     A second property follows by letting S=∅ and T=R in Theorem 6. 
     Property 2. ∇∇R=∇R. 
     A third property follows from applying Property 1 inductively. 
     Property 3. Given Γ=(N, E) and some Δc∈   + , for any R R s→d , and a family of sets {R 1 , R 2 , . . . , R n } such that ∪ i=1   n R i =R, it is the case that ∇(∪ i=1   n ∇R i )=∇R. 
     Proof. The proof follows by induction over n, the number of members in the family. There are three base cases: 
     Case a. n=0. Thus, R=∅. Since ∇R R, it must be that ∇R=∅. Additionally since there are no members in the family, the union ∪ i=1   n ∇R i  is also empty. Consequently, ∇(∪ i=1   0 ∇R i )=∇R. 
     Case b. n=1. Since there is only one member in the family, it must be the case that R 1 =R. Thus, the proposition reduces to ∇∇R=∇R, which is Property 2. Consequently, ∇(∪ i=1   1 ∇R i )=∇R. 
     Case c. n=2. Thus, the proposition reduces to ∇(∇R 1  ∪∇R 2 )=∇R, which is Theorem 7 for S=R 1  and T=R 2 . Consequently, ∇(∪ i=1   2 ∇R i )=∇R. 
     The inductive step assumes that the proposition holds for n=k−1 family members. That is, if X R s→d , and {X 1 , X 2 , . . . , X k-1 } is a family of sets such that ∪ i=1   k-1 X i =X, then ∇(∪ i=1   k-1 ∇X i )=∇X. The variables have been renamed for clarity. Proving the proposition for n=k members: Let R R s→d , and let {R 1 , R 2 , . . . , R k } be a family such that ∪ i=1   k R i R. Proving: 
     
       
         
           
             
               
                 
                   
                     ∇ 
                     
                       ( 
                       
                         
                           ⋃ 
                           
                             i 
                             = 
                             1 
                           
                           k 
                         
                         ⁢ 
                         
                           ∇ 
                           
                             R 
                             i 
                           
                         
                       
                       ) 
                     
                   
                   = 
                   
                     
                       ∇ 
                       R 
                     
                     . 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     3 
                   
                   ] 
                 
               
             
           
         
       
     
     Upon substituting ∪ i=1   k ∇R i  for R: 
     
       
         
           
             
               
                 
                   
                     ∇ 
                     
                       ( 
                       
                         
                           ⋃ 
                           
                             i 
                             = 
                             1 
                           
                           k 
                         
                         ⁢ 
                         
                           ∇ 
                           
                             R 
                             i 
                           
                         
                       
                       ) 
                     
                   
                   = 
                   
                     
                       ∇ 
                       
                         ( 
                         
                           
                             ⋃ 
                             
                               i 
                               = 
                               1 
                             
                             k 
                           
                           ⁢ 
                           
                             R 
                             i 
                           
                         
                         ) 
                       
                     
                     . 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     4 
                   
                   ] 
                 
               
             
           
         
       
     
     Upon separating the k th  terms, the following is obtained: 
     
       
         
           
             
               
                 
                   
                     ∇ 
                     
                       ( 
                       
                         
                           
                             ⋃ 
                             
                               i 
                               = 
                               1 
                             
                             
                               k 
                               - 
                               1 
                             
                           
                           ⁢ 
                           
                             ∇ 
                             
                               R 
                               i 
                             
                           
                         
                         ⋃ 
                         
                           ∇ 
                           
                             R 
                             k 
                           
                         
                       
                       ) 
                     
                   
                   = 
                   
                     
                       ∇ 
                       
                         ( 
                         
                           
                             
                               ⋃ 
                               
                                 i 
                                 = 
                                 1 
                               
                               
                                 k 
                                 - 
                                 1 
                               
                             
                             ⁢ 
                             
                               R 
                               i 
                             
                           
                           ⋃ 
                           
                             R 
                             k 
                           
                         
                         ) 
                       
                     
                     . 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     5 
                   
                   ] 
                 
               
             
           
         
       
     
     Upon applying Property 1, the following is obtained: 
     
       
         
           
             
               
                 
                   
                     ∇ 
                     
                       ( 
                       
                         
                           ∇ 
                           
                             ( 
                             
                               
                                 ⋃ 
                                 
                                   i 
                                   = 
                                   1 
                                 
                                 
                                   k 
                                   - 
                                   1 
                                 
                               
                               ⁢ 
                               
                                 ∇ 
                                 
                                   R 
                                   i 
                                 
                               
                             
                             ) 
                           
                         
                         ⋃ 
                         
                           ∇ 
                           
                             R 
                             k 
                           
                         
                       
                       ) 
                     
                   
                   = 
                   
                     
                       ∇ 
                       
                         ( 
                         
                           
                             
                               ⋃ 
                               
                                 i 
                                 = 
                                 1 
                               
                               
                                 k 
                                 - 
                                 1 
                               
                             
                             ⁢ 
                             
                               R 
                               i 
                             
                           
                           ⋃ 
                           
                             R 
                             k 
                           
                         
                         ) 
                       
                     
                     . 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     6 
                   
                   ] 
                 
               
             
           
         
       
     
     Letting X=∪ i=1   k-1 R i . Then, according to the inductive hypothesis, ∇(∪ i=1   k-1 ∇R i )=∇X. Upon substituting, the following is obtained:
 
∇( ∇X∪∇R   k )=∇( X∪R   k ).  [EQUATION 7]
 
     This result corresponds to Theorem 7 with S=X and T=R k . 
     The properties allow the free application of the ∇ Δc  operator to terms of union expressions to which ∇ is applied. The theorems and properties hold only when the value of Δc, the size of the reaction window, is identical in all uses of ∇ Δc . 
     As mentioned above, the Distributed Δc Protocol mimics the distribution scheme used by distance-vector protocols such as RIP. The Propagation Routine facilitates the distribution of learned routes to upstream nodes while the Update Routine prepends the applicable edge to each propagated route and re-evaluates the useful learned routes. If the routines loop sufficiently many times at each node and the network is connected, then each node eventually learns the best route to satisfy Δc for every destination. Beyond this point, any newly-learned routes are useless and are, therefore, filtered by ∇, thereby indicating route convergence for the network. 
     If the execution of the Distributed Δc Protocol is synchronized among the nodes, the computations are identical to those of the Δc Algorithm. Because of Properties 1, 2, and 3, however, asynchronous execution eventually yields the same result as synchronous execution. The application of ∇ in Step 5 of the Update Routine of the Distributed Δc Protocol to the intermediate results does not change the final result regardless of the order in which routes are computed and filtered as long as ∇ is the last operation performed. 
     One caveat involving the application of the Distributed Δc Protocol is that either the links are bidirectional or there is some mechanism that enables the nodes to send routing information to their upstream peers. This problem is apparent in that the Propagation Routine executes send using an inbound link, which is opposite to the normal flow of the data. 
     Δc Label Distribution Protocol 
     In a network, a node does not typically communicate complete routes to its neighbors. Instead, simple next hop information is distributed from node to node, thereby implicitly constructing paths. Non-limiting examples of the hop information may be an IP address in RIP or an outbound label in MPLS. The Distributed Δc Protocol is thus modified so that X s, d  no longer holds complete routes, but a set of tuples (l i , l o , e o , c) consisting of an incoming label, outbound label, outbound link and cost. 
     Two definitions are necessary to map labels to corresponding paths. Let L be a set of labels. Then, let Y s : L→(L∪{λ})×(E∪{λ}) be the function that maps incoming labels and edges to outgoing labels and edges at node s. Formally: 
     Definition 7. Y s (l i )=(l o ,e o ) (l i , l o , e o , c)∈X s, d  for some c∈   +  and d∈N. 
     Thus, the function to construct explicit routes originating from s is defined recursively as: 
     Definition 8. 
     
       
         
           
             
               
                 R 
                 s 
               
               ⁡ 
               
                 ( 
                 
                   1 
                   i 
                 
                 ) 
               
             
             = 
             
               { 
               
                 
                   
                     
                       
                         
                           〈 
                           s 
                           〉 
                         
                       
                       
                         
                           
                             if 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             
                               l 
                               o 
                             
                           
                           = 
                           λ 
                         
                       
                     
                     
                       
                         
                           
                             〈 
                             
                               s 
                               , 
                               
                                 e 
                                 o 
                               
                               , 
                               
                                 head 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     e 
                                     o 
                                   
                                   ) 
                                 
                               
                             
                             〉 
                           
                           · 
                           
                             
                               R 
                               
                                 head 
                                 ⁡ 
                                 
                                   ( 
                                   eo 
                                   ) 
                                 
                               
                             
                             ⁡ 
                             
                               ( 
                               
                                 l 
                                 o 
                               
                               ) 
                             
                           
                         
                       
                       
                         
                           otherwise 
                           , 
                         
                       
                     
                   
                   ⁢ 
                   
                     where 
                     ⁡ 
                     
                       ( 
                       
                         
                           l 
                           o 
                         
                         , 
                         
                           e 
                           o 
                         
                       
                       ) 
                     
                   
                 
                 = 
                 
                   
                     
                       Y 
                       s 
                     
                     ⁡ 
                     
                       ( 
                       
                         l 
                         i 
                       
                       ) 
                     
                   
                   . 
                 
               
             
           
         
       
     
     This definition captures the essence of connection-oriented networks and MPLS networks. The base case corresponds to a packet that has arrived at its destination. The recursive case corresponds to a packet that is forwarded by s along an outbound edge e o  to continue processing at the next hop. 
     The distributed protocol can now be formally refined to accommodate MPLS labels and generate hyperspeed LSPs. Note that newlabel ( ) in Equation 8, the Δc Label Distribution Protocol, below generates a unique label each time it is called. 
     Propagation Routine: 
     Step 
     
       
         
           
               
             
               
                   
               
               
                 [EQUATION 8] 
               
               
                   
               
             
            
               
                   
               
            
           
           
               
               
               
            
               
                   
                 a.  
                 Initialize all entries in X s  to     
               
               
                   
                 b.  
                 X s, s  ← {(newlabel( ), λ, λ, 0)} 
               
               
                   
                 c. 
                 loop 
               
               
                   
                 d. 
                  for all X s, d  ε X s  do  
               
               
                   
                 e. 
                   L s d  ← U (1     i     , l     o     , e     o     , c)εX     s, d    {(l i, c )} 
               
               
                   
                 f. 
                  end for 
               
               
                   
                 g. 
                  for all e ε E   Γ     −  (s) do 
               
               
                   
                 h. 
                   send (e, L s ) 
               
               
                   
                 i. 
                  wait t 
               
               
                   
                 j. 
                 end loop 
               
               
                   
               
            
           
         
       
     
     Update Routine: 
     Step 
     
       
         
           
               
               
               
             
               
                   
               
             
            
               
                   
                 1.  
                 loop 
               
               
                   
                 2. 
                  recv (e, L u ) 
               
               
                   
                 3. 
                  for all L u, d  ε L u  do 
               
               
                   
                 4. 
                   S← U (l     o     , c)εL     u, d    {(newlabel( ), l o , e, c + cost (e))} 
               
               
                   
                   
                   
               
               
                   
                 5. 
                   X s, d ←∇*(S U X s, d ) 
               
               
                   
                 6. 
                  end for 
               
               
                   
                 7.  
                 end loop 
               
               
                   
               
            
           
         
       
     
     Note that ∇ is not used precisely according to its definition, because its parameter should be a set of routes, not a set of tuples. However, the cost of a route is known from its associated tuple, so we let ∇* select the subset of tuples corresponding to useful routes. 
     Supporting Theorems and Proofs 
     Let A be the set of routes computed by the Distributed Δc Protocol, and B be the set of routes computed by the Δc Label Distribution Protocol. Let A n  be the subset of A that contains all routes in A of length n. To formally define B, consider the label l of each tuple in X (the tuple belongs to some X s ). B contains the route R s (l) for each such label. Consider the base case of routes of length zero. The Distributed Δc Protocol constructs these routes in Step 2 of the Propagation Routine. Likewise, the Δc Label Distribution Protocol populates the routing table with a λ entry in Step 2 of the Propagation Routine. Thus, there exists a label l such that R s (l)= s  constitutes the same route. Consequently, A 0 =B 0 . Note that the cost indicated in X s, s  for the Δc Label Distribution Protocol is indeed the correct cost of the route  s . 
     For the inductive step, assume A n-1 =B n-1  and consider A n  and B n . A route p in A n  is constructed in Step 4 of the Update Routine in the Distributed Δc Protocol. Thus, r in Step 4 is a route of length n−1 and exists in A n-1  and B n-1 . Clearly, cost (p)=cost (e)+cost (r). Considering Step 4 in the Update Routine of the Δc Label Distribution Protocol, it is clearly the case that an entry corresponding to the same route is constructed by the Δc Label Distribution Protocol. Let l be the label of this new entry in X s . Thus, since u=head (e), we have R s (l)= s, e, u ·R u (l o ). Because B n-1  is composed of routes constructed by R, let r=R u (l o ). Consequently, p=R s (l)∈B n , so A n   B n . The proposition B n   A n  is proved in a similar manner. Thus, A n =B n , and finally, A=B. Note that the cost indicated by the entry in X s, d  of the Δc Label Distribution Protocol is correct, assuming that the cost of the route of length n−1 is correct. Therefore, the Δc Label Distribution Protocol is a suitable substitute for the Distributed Δc Protocol, especially for MPLS networks. 
     Generally, it is infeasible to restart Δc-LDP every time the network topology changes. Instead, Δc-LDP should run constantly and adapt to changes in topology and link costs. Two modifications are necessary to enable Δc-LDP to adapt to network changes. First, if a neighbor advertises a label that the recipient router has recorded from an earlier advertisement, the recipient should adjust the cost in the existing entry to reflect the new advertisement. Second, if a neighbor sends an advertisement where some previously-advertised label is missing, the recipient router should delete the entry for the label. 
     When the cost of a link changes, the change is reflected in the next update. The change then cascades along all the affected paths, potentially changing the set of useful routes, until the network converges once again. If routes become useless, or a network link fails, the affected routes are not advertised in the next update. This causes the cascading deletion of route entries, which changes the set of useful routes, until the network converges once again. 
     Routes 
     Routes may need to be restricted in order to implement access control or traffic engineering. Route restrictions may also be required to reflect certain hardware limitations. By way of a non-limiting example, if cut-through switching is used on half-duplex links, then no link should be repeated consecutively in a route. 
     Because the Δc Algorithm is designed to work on strongly connected digraphs, an equivalent digraph must represent the restrictions. For the purpose of route restrictions, two digraphs are equivalent if they contain the same routes up to edge labels. Node names are not considered, and two edges may share the same label. A digraph Γ r  is said to implement a restriction r on another digraph Γ, if Γ r  contains all the routes in Γ allowed by r. 
     Because a sequence of edge labels (i.e., a route) can be treated as a string, and because walks in network digraphs work similarly to walks in state transition graphs, it is natural to represent route restrictions as regular expressions over the set of labeled links in a network. Because routes in networks can begin and end at any node, an equivalent digraph can implement only certain restrictions. Restrictions expressed in the form −(·*p·*), where p is a regular expression and the wildcard “·” denotes any label, are shown to be implementable. The “−” operator is not traditionally used in regular expressions; however, it is used here to indicate complementation. Thus, the rule −(·*p·*) denotes all the routes that do not contain p as a subroute. 
     Constructing an equivalent network digraph to enforce a rule r on a network Γ involves two steps. The first step is to construct a digraph Γ r * that represents the rule. Γ r * contains every possible edge label sequence that obeys r. The second step builds the equivalent digraph Γ r  that contains the intersection of the set of routes in Γ and the set of routes in Γ r *. Because the result is a digraph, the Δc Algorithm executes correctly under any restriction in the given form, as long as Γ r  is also strongly connected. Note that building Γ r  is not necessary to execute the Δc Algorithm on a restricted network; Γ r  is necessary only for proofs. The restriction can be enforced in any convenient manner. 
     Let r=−(·*p·*) where p is the prohibited subroute. Equation 9, the algorithm for constructing Γ r * (i.e., the first step in constructing the equivalent digraph) is specified below. 
     Step
         a. Build an NFA that accepts·*p·* (“·” requires an individual edge for each label in Γ).   b. Convert the NFA to a DFA.   c. Build the corresponding transition graph. [EQUATION 9]   d. Delete all double circles and corresponding incident edges.   e. Delete the start state indicator.       

     Theorem 8. The digraph Γ r * produced by Equation 9 contains walks that include every edge label sequence except those containing p. 
     Proof. Consider the Deterministic Finite (or Finite-state) Automaton (DFA) corresponding to the complement of L (·*p·*). It may be constructed by taking the DFA from Step b with the complement of its final states. Because the final state in the Non-deterministic Finite Automaton (NFA) has a self-loop for every possible label, any transition from a final state in the DFA ends in another final state. Similarly, the loop at the start state of the NFA causes every state in the DFA to involve the original start state. Therefore, no matter where a walk starts, if it contains p, then it must end in a final state of the DFA. Γ r * is essentially the complementary DFA. The final states in the DFA are dead states in the complementary DFA and are, consequently, deleted to create the digraph Γ r *. All the remaining nodes correspond to final states in the complementary DFA. Because all the nodes involve the original start state, and every node corresponds to a final state in the complementary DFA, walks that start and end at any node in Γ r * constitute the members of the complement of L (·*p·*). 
     A formula for building a digraph with the set of walks equal to the intersection of the sets of walks in two digraphs Γ 1 =(N 1 , E 1 ) and Γ 2 =(N 2 , E 2 ) is Γ=(N, E) where N=N 1 ×N 2  and E is defined such that if (n 1 , m 1 , l)∈E 1  and (n 2 , m 2 , l)∈E 2 , then ((n 1 , n 2 ), (m 1 , m 2 ), l)∈E. 
     Theorem 9. The set of routes in the digraph Γ is equal to the intersection of the sets of walks in the two original digraphs Γ 1  and Γ 2 . 
     Proof. The digraph Γ is constructed in a similar manner as a DFA that accepts the intersection of the languages accepted by two DFAs. Given the above formula, it is easy to show that for a walk (considering the sequence of edge labels) to exist in Γ, the same walk must exist in both Γ 1  and Γ 2 . Note that the formula may generate standalone nodes that can be deleted without affecting the result. 
     Thus, any rule expressed as −(·*p·*) can be implemented in any digraph Γ via an equivalent digraph. Consequently, Equation 1, the Δc Algorithm, is compatible with such restrictions. 
     Rule expressions can be made more expressive by introducing and ( ), or ( ) and complementation (−) operators. 
     Theorem 10. If the rule expressions r 1  and r 2  are compatible with Equation 1, the Δc Algorithm, then the rule expression r 1   r 2  is compatible with Equation 1. 
     Proof. Since r 1  and r 2  are compatible, they can be expressed as −(·*p·*) and −(·*q·*), respectively. Substituting these terms yields−(·*p·*) −(·*p·*), which can be simplified as −(·*(p+q)·*). A second proof involves the application of the two restrictions in sequence. First, apply r 1  to Γ to obtain Γ r     1   ; then, apply r 2  to Γ r     2    to obtain  . 
     Theorem 11. If the rule expressions r 1  and r 2  are compatible with Equation 1, the Δc Algorithm, then the rule expression r 1   r 2  is compatible with Equation 1. 
     Proof. Since r 1  and r 2  are compatible, they can be expressed as −(·*p·*) and −(·*q·*), respectively. Substituting these terms yields −(·*p·*) −(·*q·*). The regular expressions ·*p·* and ·*q·* represent regular languages. Because the two expressions begin and end with ·*, there exist two corresponding NFAs without λ transitions where the start and final states have self-loops for each symbol in the alphabet. Excluding λ transitions allows an NFA to be built that recognizes the intersection of the two regular languages. The start and final states in the resulting NFA also have self-loops for each symbol in the alphabet. Thus, there exists a regular expression corresponding to the intersection of L (·*p·*) and L (·*q·*) that begins and ends in ·*. Consequently, the equivalent rule expression can be expressed in the compatible form −(·*p·*). 
     Theorem 12. Even if the rule expression r is compatible with Δc, the rule expression −r may not be compatible with Δc. 
     Proof. Since r is compatible, it can be expressed as −(·*p·*). Substituting the term in −r yields·*p·*. Consider the case where p=a in a network with two labels, a and b. The rule expression requires all the paths to contain a. This effectively prohibits route b. The only compatible rule that prohibits b is −(·*b·*), but it also prohibits ab, which should be allowed by −r. Thus, rules containing the “−” operator (except those that are required to fit the form −(·*p·*)), may not be compatible with Δc. 
     Theorem 13. The route restriction where no link can appear consecutively in a route is compatible with Δc. 
     Proof. Consider a network with edge labels {l 1 , l 2 , . . . l n }. The restriction can be Expressed −(·*(l 1 l 1 ,+l 2 l 2 + . . . +l n l n )·*), which is compatible with Δc. 
     Different restrictions have different effects depending on the original network topology. For instance, the route restriction in Theorem 13 requires the original network to have at least one loop; otherwise, the result is a digraph that is not strongly connected. If the Δc Algorithm is applied to a digraph that is not strongly connected, it still finds valid routes if they exist, but it does not guarantee the existence of enough routes to satisfy the desired reaction window. 
     Δc-LDP Performance Analysis 
     Several aspects of the performance of the Δc-LDP were analyzed using network simulation experiments. The performance metrics include: 
     Routing Table Size: Routing Table Size is a metric indicating the additional memory that is required at each router (node) to track suboptimal paths. It is computed as the total number of routing table entries for all the nodes divided by the square of the node count. Where only optimal paths are computed, the metric is equal to one. 
     Actual Δc: Actual Δc is a metric indicating how close Δc-LDP comes to the target Δc without being less than the target Δc. For a given source and destination, the difference in delay corresponds to the difference of the costs of the greatest-cost paths and least-cost paths from the source to the destination. Since there are multiple source-destination combinations, the metric is computed as the average difference for all the combinations. 
     Path Length Difference. Path Length Difference is a metric indicating the number of additional hops a packet traveling along a subobtimal path must take compared with an optimal path. The metric is computed in the same way as the actual Δc, except that length is used instead of cost. 
     Convergence Time: Convergence Time is a metric measuring the time taken for network  10  to stabilize after Δc-LDP is started. Convergence is deemed to occur when no routing table changes are detected for a complete update period. 
     The primary variables considered in the simulation experiments include: 
     Target Δc: Target Δc is a variable defining the target reaction window. Different applications may have different requirements, so the effect of this variable on Δc-LDP execution is a consideration. 
     σ Link Delay: The standard deviation (σ) of the Link Delay addresses the different lengths, bandwidths and transmission delays for different links. Δc-LDP seeks to construct paths with target differences in delays. Thus, the effect of the standard deviation of link delays on Δc-LDP execution is of concern. 
     Node Count: The Node Count variable is used to evaluate the performance of Δc-LDP in large networks. 
     Link Count: Link Count variable is used to evaluate the performance of Δc-LDP. If there are a greater number of links, then there are a greater number of available alternate paths, whereby each of the alternate paths may have different costs. 
     Because the applicable restrictions apply only to links  16  and a simulation experiment focusing on link count yields results that are easy to interpret, the simulation experiment was performed eight (=2 3 ) times with different combinations of three restrictions. The applicable restrictions were: 
     No link can connect a node to itself: Having a self-loop gives a node an additional option for adding an arbitrary delay, but the overall effect is the same as having additional queuing memory. 
     No two links can connect the same two nodes: Two links between the same two nodes provide alternate paths with differing costs, but with the same sequence of hops. 
     No path can have the same link appear consecutively: It is counterintuitive for a router to “bounce” a packet back along the same link on which the packet was received. This restriction may be required for some network technologies (e.g., cut-through networks with half-duplex links). 
     Network Simulation 
     The simulation experiments employed a discrete event simulator. The simulator models the behavior of a network with bidirectional full-duplex links that queue packet transmission events according to a total delay computed based on the propagation delay, bandwidth and packet size. Network nodes discover the estimated link costs using ping packets. The simulation experiments implemented Δc-LDP with extensions to handle link costs changes and link failures. 
     Each simulation experiment was executed on a randomly generated network with varying link costs and a strongly connected topology. Link propagation delays were sampled from a normal distribution. Bandwidth was expressed in scientific notation, where the coefficient was sampled from a uniform distribution and the exponent was selected from a subset of integers with equal probability. 
     
       
         
           
               
             
               
                 TABLE 1 
               
             
            
               
                   
               
               
                 Simulation variables. 
               
            
           
           
               
               
               
            
               
                   
                 Variables 
                 Value 
               
               
                   
                   
               
               
                   
                 Node Count 
                 2 
               
               
                   
                 Link Count 
                 1 
               
               
                   
                 Target Δc 
                 0.004 sec 
               
               
                   
                 Update Period 
                    1 sec 
               
               
                   
                 Mean Link Delay 
                 0.002 sec 
               
               
                   
                 σ Link Delay 
                 0.0001 sec  
               
               
                   
                 Route Restrictions 
                 Disabled 
               
               
                   
                 Duplicate Links 
                 Disabled 
               
               
                   
                 Self Loops 
                 Disabled 
               
               
                   
                   
               
            
           
         
       
     
     Each simulation experiment used ten samples for each value of a variable, and computed the mean and standard deviation of each performance metric. Since it would have been cost and time prohibitive to test Δc-LDP for all possible combinations of values of the variables, a few representative samples were selected, and the results were used to guide the selection of new samples. The simulation experiments and the results obtained are discussed below. Unless otherwise specified, the variables are set as shown in Table 1. 
     Target Δc 
     The simulation investigated whether the Routing Table Size metric grows linearly with respect to Target Δc. One starting assumption was that actual Δc would also vary linearly because Δc-LDP was designed to find an Actual Δc that is nearest to the Target Δc. Additional starting assumptions were the Path Length Difference and Convergence Time metrics would vary linearly because the link costs were selected to have a low variance in this simulation experiment. 
     The simulation was repeated for three network sizes. The first network had two nodes with one link connecting them. The second network had three nodes and two links, and the third network had four nodes and three links. 
     Referring to  FIG. 15 , in the case of the two-node network (n=2), the Routing Table Size metric grows linearly with respect to Target Δc. However, when additional nodes are introduced, Routing Table Size grows much faster. Without intending to be bound by theory, for the three-node network (n=3), it appears that Routing Table Size doubles for every 0.005 increment in Target Δc, suggesting exponential growth. The simulation for the four-node network (n=4) was terminated early (with Target Δc=0.015 sec) due to the expense of the particular simulation. 
     Given that average link cost is 0.002 seconds, the results of the simulation experiment indicate that the desired delay should not exceed the average link cost by very much. As the requested delay (Target Δc) grows, Δc-LDP has to branch among many more possible paths to discover the quickest path with the requested delay. The amount of branching can quickly consume router memory in the case of networks whose nodes have many links. 
     Referring to  FIGS. 16A-C , the trends for the three performance metrics are respectively illustrated as: Actual Δc, Path Length Difference and Convergence Time for increasing values of Target Δc. The performance metrics illustrated vary linearly. 
     σ Link Delay 
     This simulation investigated if increasing σ Link Delay would improve Δc-LDP performance. Because Δc-LDP seeks to produce paths with different costs, having a wider selection of link costs potentially improves performance. 
     The simulation was performed using a four-node, three-link network with Target Δc=0.01 sec, which is about five times the average link cost (Mean Link Delay). The simulation was performed starting with a standard deviation (σ) of zero for randomly generated link delays. The standard deviation was incremented by 0.0001 for each subsequent run. 
       FIG. 17  shows the effect on the Actual Δc metric. Δc-LDP tends to perform better with respect to the Actual Δc metric when the link delays have greater variance. In this situation, Δc-LDP has wider choices when searching for paths with a given Target Δc. Thus, when link delays vary more widely, Δc-LDP can more closely match the Target Δc. 
     Referring to  FIGS. 18A-C , the effect of increasing a Link Delay on the other three performance metrics is shown. Δc-LDP becomes more erratic as the link costs vary more widely. However, a standard deviation of zero (i.e., all links have the same exact costs) caused Δc-LDP to perform poorly. Without wishing to be limited by theory, we believe that at least part of poor performance is because Δc-LDP sees many paths with the same total costs and treats ties equally. A path is not useless unless its cost is greater than a path that already meets the criteria, so Δc-LDP tends to keep a large list of ties. The first increment in a Link Delay greatly improves performance, but additional increments appear to degrade performance. Without wishing to be limited by theory, we believe that at least part of the performance degradation is caused by links with delays that are near zero (relative to other link delays). When the link costs vary too greatly, some delays are sampled near zero causing Δc-LDP to “panic,” whereby Δc-LDP generates numerous paths that traverse the near-zero link repeatedly. The mass of routing information then propagates throughout the network, overwhelming router memory. 
     Node Count 
     The previous simulations addressed the effects of network size on Δc-LDP performance. The following simulations attempt to distinguish the effects of the Node Count and Link Count variables on Δc-LDP performance. 
     The Node Count simulation was performed on a nine-link network with Target Δc=0.004 sec, which is about twice the average link cost (Mean Link Delay). Starting with a node count of three, each iteration adds another node for a total eight iterations. The last iteration involving a network with ten nodes operates on trees. Further iterations would require an increase in the number of links. 
       FIG. 19  shows the effect on the Routing Table Size metric. This metric compares the routing table size for Δc-LDP with standard optimal routing (Dijkstra&#39;s Algorithm). Thus, the metric already compensates for the number of nodes in the network. Nevertheless,  FIG. 19  shows a decrease in Routing Table Size as more nodes are added to the network. Since there are more nodes in the network, but the same number of links, the links become more widely spread within the network, and any given node tends to have fewer incident links. Thus, the number of paths a node needs to consider tends to decrease, so the Routing Table Size metric also decreases. 
     The total number of paths in the network, however, increases because there are more destinations. Examining the three-node network, there are 40 times more paths per node than optimal routing, corresponding to 360 routing table entries. For the ten-node network, there are about 500 routing table entries. 
       FIG. 20A  shows the effect on the Actual Δc metric. As the network gains more nodes, the overall accuracy of Δc-LDP diminishes. Because the number of links is held constant, additional nodes result in fewer links per node. Thus, at each node there are fewer options for a path to take, so there are fewer paths in the network per source and destination. Without wishing to be limited by theory, we believe that with fewer paths, the alternate path is likely to fall further from Target Δc than it would if there were more paths. 
       FIG. 20B  shows the effect on the Path Length Difference metric. This metric is not substantially affected by the Node Count variable. Because the Target Δc is about twice the Mean Link Delay, the value of Path Length Difference must be two or more. Without wishing to be limited by theory, we believe that when there are more nodes, it is more likely that an alternate path will require three additional links. This is similar to the trends seen above in the case of the Actual Δc metric. 
       FIG. 20C  shows the effect on the Convergence Time metric. Larger networks require more time to converge. Without intending to be bound by theory, on the average, it appears that each additional node requires one or two more iterations. 
     Link Count 
     The Link Count simulation was performed to clarify the effects of the Link Count variable on Δc-LDP performance. Specifically, the simulation identified whether extra links improve the performance measured in terms of Actual Δc and Path Length Difference, but degrade the performance measured in terms of Routing Table Size and Convergence Time. The simulation was conducted on a seven-node network. Starting with six links, the link count was incremented by one in every subsequent run until the network had twenty links. 
       FIG. 21  shows the effect on the Routing Table Size metric.  FIG. 21  demonstrates a linear relationship between Link Count and Routing Table Size. Without intending to be bound by theory, the behavior is likely because new links provide Δc-LDP with additional options with computing paths. These additional options require additional entries in the routing table. 
       FIG. 22A  shows that additional links improve the accuracy of Δc-LDP. The additional path options provided by new links enable Δc-LDP to find a path close to Target Δc. 
       FIG. 22B  shows that the Link Count variable does not have a predictable effect on the Path Length Difference metric. Based on the results of the previous simulation experiments, it was anticipated that the metric would improve as the Link Count value increased, but the simulation results suggest that there is no discernible effect. 
       FIG. 22C  shows that additional links cause Δc-LDP to converge more rapidly. The expected result was the convergence time would degrade. Without intending to be bound by theory, the reason for improved convergence is that additional links cause Δc-LDP to explore more options early in its execution; whereas, with the few links Δc-LDP takes more time to traverse the network. The alternate paths act as “shortcuts” through the network. 
     Route Restrictions 
     The Route Restrictions simulation repeated the simulation involving the Link Count variable eight more times, once for each combination of network and route restrictions. The maximum number of links tested in these experiments was thirteen. The time required to simulate Δc-LDP on a network with many links but few nodes can be prohibitive. 
     The results show the restrictions on the network structure (i.e., restrictions on self-loops and duplicate links) have little effect on Δc-LDP with respect to the established metrics. Conversely, precluding immediate link repetition in computed paths greatly affects the performance with respect to all the metrics. In the following graphs, the lines corresponding to unrestricted paths are labeled u, and those corresponding to restricted paths are labeled r. Because a seven-node, six-link network is a tree (i.e., a graph without loops), the route restriction prevents the construction of any alternative path. Thus, the data point at l=6 for any r-labeled line is invalid. 
       FIG. 23  shows that the restriction decreases the number of entries in the routing table. As the number of links increase, however, the distinction diminishes. Naturally, restricting the paths causes fewer paths to be considered, so fewer routing table entries are required. More links provide more alternate paths, which reduces the effect of the restriction. By the time there are thirteen links, the r and u groups are difficult to distinguish. 
       FIG. 24A  shows that the restriction decreases the accuracy of Δc-LDP. As discussed above, the restriction yields fewer options for Δc-LDP that, in turn, force Δc-LDP to select less-optimal alternate paths. 
       FIG. 24B  reveals a similar trend. Without intending to be bound by theory, because there are fewer paths to pick from, it is more likely that these paths will have longer lengths. Additionally, since the restriction prevents a path from immediately turning around, Δc-LDP must traverse loops requiring roundabout paths. By the time there are twelve links, however, Δc-LDP with restrictions performs on par with Δc-LDP without restrictions. 
       FIG. 24C  reveals yet another similar trend. Because the restricted Δc-LDP created more round-about paths, the paths have more hops. Each hop in a path requires at least one additional iteration. Once again, adding more links diminished the effect. 
     Simulation Result Discussion 
     The performance of Δc-LDP is greatly affected by the Mean Link Delay and Target Δc variables. In general, varying link costs (delays) is good, but Target Δc should not exceed about three times the cost of the fastest link in the network, unless there are restrictions in place to prevent fast links from being overused. Generally, route restrictions should be avoided. 
     Δc-LDP seeks to find the alternative least-cost path whose cost is at least Target Δc greater than the optimal path. The presence of additional links offer more opportunities for Δc-LDP to optimize paths. On the other hand, additional links generate more intermediate paths that consume router memory and increase path computation time. Balancing available resources, resilience to link failure and path optimization can require trial and error procedures. Finally, while the simulation experiments were conducted using Δc-LDP, the results would hold for all implementations of the Δc Algorithm. 
     The Distributed Δc Protocol is designed to create optimal and suboptimal routes in general computer and telecommunications networks. The Δc Label Distribution Protocol (Δc-LDP) is an adaption of the Distributed Δc Protocol that is specifically designed to construct hyperspeed label switched paths in MPLS networks, enabling service providers to implement sophisticated reactive defense mechanisms. Simulation experiments of Δc-LDP for a variety of network and protocol configurations demonstrate that it operates well for practice values of Δc with respect to average link costs (delay). 
     Implementation 
     Using the foregoing description, one embodiment of the invention communicates a signal, or packet  25 , across network  10  ahead of a lower-priority signal, or packet  25 . The invention comprises the step of assessing each signal, or packet  25 , as it enters network  10  at node  12 , origination node  12  or source node  12 . Origination node  12  and source node  12  may be referred to as origination point and source point. The final node  12  is also termination node  12 , which is also referred to as the termination point. The assessing step employs filters  36  and/or detectors  40 . 
     The signal, or packet  25 , is analyzed as part of the assessing step. After assessing each signal, a priority is assigned to the signal. At least one path  18  is a high-priority path  18 , and the signal, or packet  25 , may use this high-priority path  18  if the assessment deems it is necessary. 
     If a fast preliminary assessment is used, it may deem a signal, or packet  25 , more or less harmful or suspicious prior to assigning a priority thereto. Most signals entering network  10  from outside are deemed to be suspicious solely because they come from outside network  10 . In the event one or more of the signals, or packets  25 , are assessed to be harmful, suspicious or malicious, a lower-priority is assigned thereto. Signals, or packets  25 , coming from inside network  10  (e.g., command and control packets  10  that are part of the defensive techniques or from network administrators) are typically assigned high-priority (hyperspeed). 
     After the preliminary assessment, the signal, or packet  25 , is assigned a priority and allowed to enter network  10 . As the signal, or packet  25 , travels toward its destination, the complete assessment is still taking place at detectors  40 . If the complete assessment determines that the signal, or packet  25 , is indeed malicious, a high-priority signal is immediately generated and transmitted. Because the high-priority sentinel signal travels at “hyperspeed” and the malicious packet travels at “normal” speed, the sentinel signal will arrive at the destination first and destroy the malicious packet. Other signals, or packets  25 , are assigned a high-priority if the nature of the signal warrants such a priority. 
     In one embodiment, each high-priority signal and each low-priority signal comprise a plurality of packets  25 . Each packet  25  is encrypted and/or encapsulated in another packet  25 , and then each packet  25  is transmitted along the optimal communications path  20  to a stage point, where it is converted to its original form and forwarded further along a normal path  20 . 
     In another embodiment, a plurality of optimal communications paths  20  are employed. Packets  25  are fragmented and the fragments are teleported along a plurality of optimal communications paths  20 . As previously discussed packet  25  may be an Internet Control Message Protocol packet  25 . 
     Although, it is preferred to reserve the optimal path  20  for high-priority signals, there may be defensive techniques that require use of an optimal path  20 . 
     At least one technique is identified and selected for network  10 . The service differentiation techniques discussed above provide for a group of defensive techniques from which one or more may be selected and implemented. The service differentiation techniques are selected from a group consisting of a queue priority, a delay variation, a route variation, or combinations thereof. Defensive techniques are selected from the group consisting of precognition, distributed filtering, teleporting packets, quarantining network devices, tagging and tracking suspicious packets, projecting holographic network topologies, transfiguring networks, and combinations thereof. The overall defensive strategy may include a combination of techniques, at least one selected from each group of service differentiation techniques and defensive techniques. 
     In one embodiment, the optimum defensive technique is defined by using the steps of assessing, analyzing and selecting, which embody the foregoing discussions on defensive techniques. As part of the identifying step, a defensive technique for exploiting a reaction window associated with the signals is selected. 
     A plurality of electronic communication paths  20  are defined for network  10 . Each path  20  is capable of carrying a plurality of signals, or packets  25 . While defining the plurality of paths  20 , at least one optimal communication path  20  and at least one suboptimal communication path  20  corresponding with the selected defensive technique are identified. The high-priority signal is communicated along the optimal communication path  20  where it is delivered to the desired destination prior to delivery of any of the lower priority signals. The lower-priority signals are communicated along suboptimal communication routes  18  or paths  20 . In one embodiment, the high-priority signal delivers a signal, packet  25 , acting as a sentinel message to at least the termination point within the reaction window to enable the deployment of a defensive technique. 
     During the analyzing step discussed above, marketable data is identified. The marketable data identifies the type of data contained in the signal, or packet  25 , and associates that data with the type of use. Marketable data is selected from the group consisting of online games, music, video, telecommunications, video communications, streaming video, cloud computing services and applications, business communications, network command, control and optimization, or combinations thereof. 
     The invention provides for an embodiment with flexible electronic communication of high-priority signals, or packets  25 , using a method that is suitable for communicating a plurality of signals across network  10 . In this case, network  10  has a plurality of electronic communications paths  20  and each signal has a signal priority. The signal priorities range from high-priority to low-priority. The variety of electronic communications paths  20  provide for part of the flexibility of the invention. Similarly, the plurality of defensive techniques provide for flexibility. Adaptability of the invention to different threats, such as harmful threats, malicious threats or suspicious threats provides for additional flexibility. 
     A priority is determined for each signal, and, when required, at least one signal is a high-priority signal. A defensive technique is selected, thereby defining the plurality of paths  20  for electronically communicating the signals. One or more of the previously discussed selected service differentiation techniques are employed to optimize the electronic communication of the high-priority signal along at least one of paths  20 , thereby providing delivery of a transmitted high-priority signal faster than transmitted lower-priority signals to a desired destination. Defensive techniques are discussed above. 
     Another embodiment to delivering high-priority signals over network  10  faster than lower-priority signals is described as part of this invention. In this embodiment, a plurality of paths  20  are identified. Each of the plurality of paths  20  are ranked from an optimal path  20  to at least one suboptimal path  20 , wherein each path  20  includes an origination node  12  and a termination node  12 . A reaction window is identified and defines a desired time difference between optimal path  20  and suboptimal paths  20 . Optimal path  20  and at least one suboptimal path  20  are selected from the plurality of paths satisfying the reaction window. The selecting of optimal path  20  and at least one suboptimal path  20  are determined by the reaction window for each origination node  12  and termination node  12 . The high-priority signal is delivered from origination node  12  to termination node  12  along the selected path  20 . 
     The embodiment includes a step of selecting a plurality of suboptimal paths  20  that satisfy the reaction window, and a step of selecting a suboptimal path  20  having the smallest reaction window. As part of the identifying a reaction window, each path  20  at each node  12  in network  10  is identified, where nodes  12  are between origination node  12  and termination node  12 . From this identification of each path  20  at each node  12 , optimal path  20  and suboptimal paths  20  for each node  12  are also identified. Once paths  20  are identified at each node  12 , the ranking step further ranks each optimal path  20  and suboptimal path  20  from each node  12 . The identity of optimal and suboptimal paths  20  across the network  10  are continuously updated, thereby maintaining a ranked set of optimal paths  20  and suboptimal paths  20 . 
     In the foregoing embodiments, network  10   l  is selected from the group consisting of local area networks, service provider networks, enterprise networks, the Internet, cloud infrastructures, and combinations thereof. The foregoing embodiments are also applicable to almost any network. Some non-limiting examples include networks having video content providers, market traders, commodities traders, music providers, etc. 
     Another non-limiting example implementing an embodiment of the inventive method is illustrated in  FIG. 25  and described hereinbelow.  FIG. 25  is a modified version of the MPLS network illustrated in  FIG. 2  and depicting the application of the route variation service differentiation technique. Using the Δc Algorithm of Equation 1 and the Distributed Δc Protocol of Equation 2, the network administrator programs the network control system to operate as described in the illustrative example. 
     Applying the route variation technique via the Δc-LDP of Equation 8, at least two MPLS Label Switched Paths  20  (LSPs) are constructed from Label Edge Router (LER)  14 A to LER  14 F. Two examples of the numerous paths  20  that may be constructed in network  10  are presented in this example. The optimal (hyperspeed) path  20 A is the path A-B-C-F, representing the label switched paths (LSPs) through LER  14 A, label switching router (LSR)  14 B, LSR  14 C, and LER  14 F, in that order. Similarly, the suboptimal path  20 B (reserved for normal and suspicious traffic) is the path of A-D-E-F, where D is LSR  14 D, and E is LSR  14 E. 
     In this non-limiting example, the selected defensive technique is egress filtering, so hub  41  with three attached detectors  40 A,  40 B, and  40 C is placed before LER  14 A. The slowest detector, illustrated by detector  40 B for this example, requires about 50 milliseconds to complete an examination, and the delay from detector  40 B to LER  14 A is about 3 milliseconds. Thus, the target Δc is 53 milliseconds. 
     Optimal path  20 A, the path of A-B-C-F, has a delay of about 30 milliseconds, and suboptimal path  20 B, the path of A-D-E-F, has a delay of about 85 milliseconds, giving an actual Δc of about 55 milliseconds for traffic traveling from LER  14 A to LER  14 F. Note that a similar configuration would exist for traffic traveling from LER  14 F to LER  14 A to thwart attacks from site  24 B to site  24 A, but these details are omitted in this example for brevity. 
     In the non-limiting example, an attacker with access to site  24 A sends malicious traffic to site  24 B in attempt to gain access to site  24 B. The malicious traffic, in the form of malicious packet  25 , takes route  18 B which is suboptimal path  20 B, whereby it passes hub  41  and enters network  10  via LER  14 A at time=0 milliseconds. At this point, network  10  is not aware that the traffic is malicious. Hub  41  sends copies of the traffic to each detector  40 A,  40 B, and  40 C. All three detectors  40  begin examining the traffic simultaneously at time=0 milliseconds, because the delay from hub  41  to each detector  40  is the same as the delay from hub  41  to LER  14 A. In this example, detector  40 C determines that the traffic is malicious after about 20 milliseconds of examination, which is at time=about 20 milliseconds, so it immediately sends sentinel message  35  to LER  14 F. Sentinel message  35  takes optimal path  20 A, which is the hyperspeed path and route  18 A. The delay for sending sentinel message  35  from detector  40 C to LER  14 A is about 3 milliseconds, so sentinel message  35  enters network  10  at time=about 23 milliseconds. The delay of path  20 A is 30 milliseconds, so sentinel message  35  arrives at  14 F at time=about 53 milliseconds. LER  14 F records the traffic identifier provided by sentinel message  35 . The delay of suboptimal path  20 B is about 85 milliseconds, so malicious packet  25  arrives at LER  14 F at time=about 85 milliseconds, which is about 30 milliseconds after the arrival of sentinel message  35 . LER  14 F quickly identifies the malicious packet  25  and destroys it, thereby preventing it from affecting site  24 B. 
     Other embodiments of the current invention will be apparent to those skilled in the art from a consideration of this specification or practice of the invention disclosed herein. Thus, the foregoing specification is considered merely exemplary of the current invention with the true scope thereof being defined by the following claims.