Information-flow Control


   Ensure that routing protocol doesn't "leak" information.

Idea: Denning's lattice model.

Rule: "read access" goes down the lattice only
e.g., don't advertise routes heard from one peer to another peer