Host Identity Protocol Research Articles

Distributed mapping management of identifiers and locators in mobile‐oriented Internet environment

SUMMARYMany schemes have recently been proposed for the separation of identifier (ID) and locator (LOC), which include the Host Identity Protocol, the Identifier‐Locator Network Protocol, and the Locator Identifier Separation Protocol. However, all of these schemes were originally designed in fixed network environment, rather than mobile network environment. In particular, these schemes are based on a centralized map server that is used as an anchor point for mobile nodes, and thus intrinsically subject to some limitations in a mobile environment. In this paper, we propose a distributed ID‐LOC mapping management scheme in a mobile‐oriented Internet environment. In the proposed scheme, we assume that a host has a globally unique and hierarchical Host ID (HID) that contains the information of its home network domain. Each network domain has a distributed map server for distributed management of ID‐LOC mappings. For roaming support, each distributed map server maintains its own home HID register and visiting HID register, which are used to keep the mappings of HID and LOCs for mobile nodes in the distributed manner. By performance analysis, it is shown that the proposed distributed scheme can give better performance than the existing centralized schemes in terms of ID‐LOC binding update and data delivery costs. Copyright © 2012 John Wiley & Sons, Ltd.

Performance evaluation of user applications in the ITS scenario: An analytical assessment of the NeMHIP

Internet connectivity in the ITS context is a flourishing demand that has to be covered by efficient information and communication technologies. Thanks to the provision of this connectivity, not only end users will profit from communication services, but also services for controlling the operation of the vehicle will benefit from the Internet connectivity. Services related to the operation and control of the vehicles exchange sensitive data, so strong security properties have to be ensured for this type of services. In addition, because of the privacy concerns related to the end users, it is desired to provide this kind of services with an adequate security level. From the communication point of view, a vehicle can be regarded as a mobile network where nodes onboard obtain continuous and optimal Internet connectivity, so, its mobility has to be managed. In the same way, network mobility management protocols should not only avoid security leaks, but also they have to ensure an adequate security level. It is needless to say that the introduction of security properties cannot render not fulfilling service performance requirements. In fact, the trade-off between security and application performance is a must. ITS standardisation bodies have adopted the NEtwork MObility Basic Support (NEMO BS) protocol to manage the mobility of networks. However, it still presents shortcomings like lack of security support and routing problems, which leads to a bad performance. One of the most promising design approaches is to consider a base mobility management protocol that provides out of the box security and route optimisation support like the Host Identity Protocol (HIP). Different solutions based on HIP can be found to solve network mobility in the literature, but none of these solutions aim at solving securely and efficiently network mobility management. That is, the provision of security properties to the network mobility management itself and to the end-to-end data communications while not increasing the signalling overhead and the manageability level remains unsolved. In this paper, we present the NeMHIP. NeMHIP is a secure and efficient network mobility management protocol which is based on HIP. In order to demonstrate its feasibility, we have carried out a study by means of analytical modelling to assess the performance of user applications with stringent QoS requirements like VoIP. Results demonstrate that the introduction of the NeMHIP in the ITS context is feasible because security properties are ensured while application performance requirements are satisfied. Therefore, we successfully achieve the trade-off between security and performance.

이동하는 차량 네트워크에서 멀티캐스팅 지원의 통합 HIP-PMIPv6 핸드오프 기법의 성능분석

본 논문에서 제안한 이동성 관리 기법은 PMIPv6(Proxy Mobile IPv6) 네트워크에서 HIP(Host Identity Protocol)과 멀티캐스팅을 기반으로 하며, 사용자는 서로 다른 관리 도메인간의 핸드오프가 허용된다. 이 기법의 주요 장점은 감소하는 시그널링 오버헤드와 패킷 손실을 가지는 두 가지 타입 노드의 도메인간 핸드오프를 가능하게 하는 것이다. 다시 말해서 이 기법은 네트워크 기반 이동성 지원기법인 멀티캐스팅 지원의 PMIPv6와 호스트 기반 이동성 지원방식인 HIP간의 상호작용을 가능하게 한다. 성능평가는 이 기법이 다른 전역적 이동성 관리 프로토콜과 비교하여 핸드오프 지연과 패킷 손실 측면에서 향상된다는 것을 입증한다. Our proposed mobility management scheme is based on Multicasting and HIP(Host Identity Protocol) in PMIPv6(Proxy Mobile IPv6) Networks, and allows users to handoff within and across different administrative domains. The main advantage of our scheme is to enable the inter-domain handoff of both types of nodes with a reduced signalling overhead and packet losses. Specifically, the scheme enables the interworking between host-based and network-based mobility support, by means of the interaction between PMIPv6 with Multicasting and HIP. Performance evaluations demonstrate that our scheme improves the handoff latency and packet losses compared to other global mobility management protocols.

Inter-subnet localized mobility support for host identity protocol

Host identity protocol (HIP) has security support to enable secured mobility and multihoming, both of which are essential for future Internet applications. Compared to end host mobility and multihoming with HIP, existing HIP-based micro-mobility solutions have optimized handover performance by reducing location update delay. However, all these mobility solutions are client-based mobility solutions. We observe that another fundamental issue with end host mobility and multihoming extension for HIP and HIP-based micro-mobility solutions is that handover delay can be excessive unless the support for network-based micro-mobility is strengthened. In this study, we co-locate a new functional entity, subnet-rendezvous server, at the access routers to provide mobility to HIP host. We present the architectural elements of the framework and show through discussion and simulation results that our proposed scheme has achieved negligible handover latency and little packet loss.

Security and Trust of Public Key Cryptography for HIP and HIP Multicast

Host Identity Protocol (HIP) gives cryptographically verifiable identities to hosts. These identities are based on public key cryptography and consist of public and private keys. Public keys can be stored, together with corresponding IP addresses, in DNS servers. When entities are negotiating on a HIP connection, messages are signed with private keys and verified with public keys. Even if this system is quite secure, there is some vulnerability concerning the authenticity of public keys. The authors examine some possibilities to derive trust in public parameters. These are DNSSEC and public key certificates (PKI). Especially, the authors examine how to implement certificate handling and what is the time complexity of using and verifying certificates in the HIP Base Exchange. It turned out that certificates delayed the HIP Base Exchange only some milliseconds compared to the case where certificates are not used. In the latter part of our article the authors analyze four proposed HIP multicast models and how they could use certificates. There are differences in the models how many times the Base Exchange is performed and to what extent existing HIP specification standards must be modified.

Analytical Evaluation of a HIP Registration Enhancement for NEMO Scenarios

Covering NEtwork MObility (NEMO) scenarios based on end-to-end mobility management protocols such as the Host Identity Protocol (HIP) is not straightforward. However, it has been demonstrated that HIP based NEMO solutions outperform NEMO Basic Support (NEMO BS), hence, HIP is being considered also for addressing NEMO scenario necessities. In this work we focus on the Registration Extension process of HIP, which is mandatory for providing reachability of HIP enabled mobile nodes. More specifically, we describe our proposal, the Bulk Registration process, which has been analytically modeled to show that it outperforms other registration approaches in more than 90% in terms of delay and signaling overhead. Obtained results are highly valuable for a common NEMO scenario where several nodes are present in a vehicle to control its operation.

Service Usage Accounting

In this article, a network-level, service-usage solution, which provides assured accounting information strongly bound to the host identity, so that the user is unable to repudiate the charges. To protect the user, the solution employs a granular approach, where evidence of service usage is provided in a piecemeal manner, i.e., pay as you go. An implementation of such a solution is presented, which is based on the employment of host identity protocol (HIP) and hash chains.

Evaluation of two integrated signalling schemes for the Ultra Flat Architecture using SIP, IEEE 802.21, and HIP/PMIP protocols

Telecommunication suppliers predict a huge mobile Internet traffic increase for the next decade. It seems to be technically challenging and expensive to adapt current mobile network architectures to the increasing traffic demand. Core network technology must scale to the demands under limited revenue growth. This work is to discuss a new, flat, fully distributed and convergent network architecture, called Ultra Flat Architecture. It is well scalable due to the distribution of IP and numerous control functions at intelligent gateways placed within or close to the base stations. This paper focuses on the detailed presentation of two relevant integrated signalling schemes of the architecture. These schemes extend the Ultra Flat Architecture to support legacy Internet applications including IMS compliant applications with all necessary network functions, such as security, mobility, and Quality of Service. Besides Session Initialization Protocol, layers 2 and 3 are taken into account as well, in the terminal attachment and handover procedures. IP mobility is provided by the Host Identity Protocol or the Proxy Mobile IP protocol in the two schemes. We analyse the suitability of the schemes using the Multiplicative Analytic Hierarchy Process. Both schemes have nearly the same performance, however the HIP-based scheme got slightly better scores under our evaluation criteria due to its stronger security and fewer functional modules to deploy.

A Real-Name Access Mechanism for the Next Generation Internet

With inherent design defects, the current Internet is facing with security threats and application bottlenecks. In this paper, a network security model of host real-name access was established by introducing host identity protocol and PKI system. It consisted of host authentication, host identifier management, and expansion domain name query. The source address and host name authentication, addressing and fine-grained access control were implemented by the model. It greatly improves the Internet security by providing an exploration scheme for construction of reliable next generation Internet.

HOP: Achieving Efficient Anonymity in MANETs by Combining HIP, OLSR, and Pseudonyms

Offering secure and anonymous communications in mobile ad hoc networking environments is essential to achieve confidence and privacy, thus promoting widespread adoption of this kind of networks. In addition, some minimum performance levels must be achieved for any solution to be practical and become widely adopted. In this paper, we propose and implement HOP, a novel solution based on cryptographic Host Identity Protocol (HIP) that offers security and user-level anonymity in MANET environments while maintaining good performance levels. In particular, we introduce enhancements to the authentication process to achieve Host Identity Tag (HIT) relationship anonymity, along with source/destination HIT anonymity when combined with multihoming. Afterward we detail how we integrate our improved version of HIP with the OLSR routing protocol to achieve efficient support for pseudonyms. We implemented our proposal in an experimental testbed, and the results obtained show that performance levels achieved are quite good, and that the integration with OLSR is achieved with a low overhead.

A Secure Networking Architecture for the Internet of Things

This article describes innovative and highly secure network architecture, dedicated to internet of things. We recommend that the infrastructure, there is a new label project, to support the upcoming launch of the standard Host Identity Protocol (HIP). Our main concern is to ensure the privacy of RFID tags, while enabling things to things communications.

Secure and Efficient IPv4/IPv6 Handovers Using Host-Based Identifier-Locator Split

Internet architecture is facing at least three major challenges. First, it is running out of IPv4 addresses. IPv6 offers a long-term solution to the problem by offering a vast amount of addresses but is neither supported widely by networking software nor has been deployed widely in different networks. Second, end-to-end connectivity is broken by the introduction of NATs, originally invented to circumvent the IPv4 address depletion. Third, the Internet architecture lacks a mechanism that supports end-host mobility and multihoming in a coherent way between IPv4 and IPv6 networks. We argue that an identifier-locator split can solve these three problems based on our experimentation with the Host Identity Protocol. The split separates upper layer identifiers from lower network layer identifiers, thus enabling network-location and IPversionindependent applications. Our contribution consists of recommendations to the present HIP standards to utilize cross-family mobility more efficiently based on our implementation experiences. To the best of our knowledge we are also the first ones to show a performance evaluation of HIP-based cross-family handovers.

Host Identity Protocol (HIP): Connectivity, Mobility, Multi-Homing, Security, and Privacy over IPv4 and IPv6 Networks

The Host Identity Protocol (HIP) is an inter-networking architecture and an associated set of protocols, developed at the IETF since 1999 and reaching their first stable version in 2007. HIP enhances the original Internet architecture by adding a name space used between the IP layer and the transport protocols. This new name space consists of cryptographic identifiers, thereby implementing the so-called identifier/locator split. In the new architecture, the new identifiers are used in naming application level end-points (sockets), replacing the prior identification role of IP addresses in applications, sockets, TCP connections, and UDP-based send and receive system calls. IPv4 and IPv6 addresses are still used, but only as names for topological locations in the network. HIP can be deployed such that no changes are needed in applications or routers. Almost all pre-compiled legacy applications continue to work, without modifications, for communicating with both HIP-enabled and non-HIP-enabled peer hosts. The architectural enhancement implemented by HIP has profound consequences. A number of the previously hard networking problems become suddenly much easier. Mobility, multi-homing, and baseline end-to-end security integrate neatly into the new architecture. The use of cryptographic identifiers allows enhanced accountability, thereby providing a base for easier build up of trust. With privacy enhancements, HIP allows good location anonymity, assuring strong identity only towards relevant trusted parties. Finally, the HIP protocols have been carefully designed to take middle boxes into account, providing for overlay networks and enterprise deployment concerns. This article provides an in-depth look at HIP, discussing its architecture, design, benefits, potential drawbacks, and ongoing work.

Enterprise Network Packet Filtering for Mobile Cryptographic Identities

Firewalls are an essential component of the Internet and enterprise network security policy enforcement today. The configurations of enterprise firewalls are typically rather static. Even if client’s IP addresses can be dynamically added to the packet filtering rules, the services allowed through the firewall are commonly still fixed. In this paper, we present a transparent firewall configuration solution based on mobile cryptographic identifiers of Host Identity Protocol (HIP). HIP allows a client to protect the data transfer with IPsec ESP, and supports dynamic address changes for mobile clients. The HIP-based firewall learns the identity of a client when it communicates with the server over HIP. The firewall configures the necessary rules based on HIP control messages passing through the firewall. The solution is secure and flexible, and introduces only minimal latency to the initial HIP connection establishment.

SHIP: Cross-layer mobility management scheme based on Session Initiation Protocol and Host Identity Protocol

In the all-IP wireless networks, mobility management is a crucial issue, and it can be operated at different layers in the traditional Transmission Control Protocol/Internet Protocol (TCP/IP) stack. Session Initiation Protocol (SIP) is an application layer protocol used for the signaling and the mobility management without any modifications of the lower layer protocols, especially in the voice over IP environment. However, since it always gets the lowest priority in the networking model, it will produce the large handoff latency, the packet loss, and the handoff blocking probability. To provide an efficient mobility management, SIP can be combined with other protocols. In this paper, we propose a cross-layer mobility management scheme based on SIP and the Host Identity Protocol (HIP) which is a new protocol designed to provide secure and continuous communications between two nodes by separating the identifier and the locator roles of the traditional IP address. In the proposed scheme, the mobile node and the correspondent node use their host identity tags to establish the session connections, and the mobile nodes uses the HIP location update scheme instead of the SIP location update scheme to update its IP address when it moves to a new subnet. We discuss the proposed scheme's architecture and the major mobility procedures, including the session setup, the handoff and the location update in this paper. We also develop an analytical model to study the handoff performance of the proposed scheme, the typical SIP, and the hybrid SIP/Mobile IP, respectively. The analytical results demonstrate that the proposed scheme outperforms the typical SIP and the hybrid SIP/Mobile IP in terms of the handoff latency, the packet loss, and the handoff blocking probability.

Probabilistic model checking for the quantification of DoS security threats

Secure authentication features of communication and electronic commerce protocols involve computationally expensive and memory intensive cryptographic operations that have the potential to be turned into denial-of-service (DoS) exploits. Recent proposals attempt to improve DoS resistance by implementing a trade-off between the resources required for the potential victim(s) with the resources used by a prospective attacker. Such improvements have been proposed for the Internet Key Exchange (IKE), the Just Fast Keying (JFK) key agreement protocol and the Secure Sockets Layer (SSL/TLS) protocol. In present article, we introduce probabilistic model checking as an efficient tool-assisted approach for systematically quantifying DoS security threats. We model a security protocol with a fixed network topology using probabilistic specifications for the protocol participants. We attach into the protocol model, a probabilistic attacker model which performs DoS related actions with assigned cost values. The costs for the protocol participants and the attacker reflect the level of some resource expenditure (memory, processing capacity or communication bandwidth) for the associated actions. From the developed model we obtain a Discrete Time Markov Chain (DTMC) via property preserving discrete-time semantics. The DTMC model is verified using the PRISM model checker that produces probabilistic estimates for the analyzed DoS threat. In this way, it is possible to evaluate the level of resource expenditure for the attacker, beyond which the likelihood of widespread attack is reduced and subsequently to compare alternative design considerations for optimal resistance to the analyzed DoS threat. Our approach is validated through the analysis of the Host Identity Protocol (HIP). The HIP base-exchange is seen as a cryptographic key-exchange protocol with special features related to DoS protection. We analyze a serious DoS threat, for which we provide probabilistic estimates, as well as results for the associated attacker and participants' costs.

Experimental Measurements of Host Identity Protocol for Mobile Nodes′ Networks

The role of Internet Protocol (IP) is becoming more and more problematic especially with the new requirements of mobility and multihoming. Host Identity protocol (HIP) defines a new protocol between the network and transport layers in order to provide a better management to those requirements. The protocol defines a new namespace based on cryptographic identifiers which enable the IP address roles dissociation. Those new identifiers identify hosts rather than IP addresses. Because HIP is a quite recent protocol, we propose to present an experimental evaluation of its basic characteristics.

Supporting Adaptive Context-Aware Services and Novel Handover Scheme for Smart Ubiquitous Communication System

Since people communicate with each other by mobile phones more and more frequently in daily lives, they pay more attention on the quality and rating of communication and the battery consumption when using the mobile phones. In order to provide users the services with low price, high communication quality and less battery consumption in any environments, this paper selects the users’ acceptable communication services upon communication quality, communication rating and battery consumption when using mobile phones according to the users’ communication habits. Besides, in order to solve the problems of overhead and latency when the users switch network bases in the use of network phones, we propose a Novel Handover Scheme based on Host Identity Protocol et al. (Fan, A Novel handover scheme for HIP mobile networks. Master Thesis, National Dong Hwa University in Taiwan, 2007) to accelerate handover speed to fulfill Smart Ubiquitous Communication System.

Dial "M" for middlebox managed mobility

Users can be served by multiple network-enabled terminal devices, each of which in turn can have multiple network interfaces. This multihoming at both the user and device level presents new opportunities for mobility handling. Mobility can be handled by utilizing devices, namely, middleboxes that can provide intermediary routing or adaptation services. This article presents an approach to enabling this kind of mobility handling using the concept of personal networks (PNs). Personal networks (PNs) consist of dynamic conglomerations of terminal and middlebox devices tasked to facilitate the delivery of information to and from a single human user. This concept creates the potential to view mobility handling as a path selection problem because there may be multiple valid terminal device and middlebox configurations that can successfully carry a given communication session. We present details and an evaluation of our approach, based on an extension of the Host Identity Protocol, which demonstrate its simplicity and effectiveness.

Design and Evaluation of DNS as Location Manager for HIP

Host Identity Protocol (HIP) is designed to provide secure and continuous communication by separating the identifier and locator roles of the Internet Protocol (IP) address. HIP also has efficient solutions to support host mobility. In this paper, we propose a location management scheme based on Domain Name System (DNS) for HIP. In the proposed scheme, a new DNS HIP resource record is used to translate a domain name into a host identity tag and an IP address. We also develop an analytical model to study the performance of DNS as location manager in terms of success rate, which takes into account the velocity of mobile nodes, the radius of a subnet, the regional network size, the packet transmission delay between the mobile node and the rendezvous server, and the packet processing delay at the DNS and the rendezvous server. The performance results show that for a reasonable range, the DNS is a feasible solution for location management with high success rate for HIP.