Design and Implementation of Security for HIMALIS Architecture of Future Networks

Abstract

SUMMARYFor flexibility in supporting mobility and multihoming in edge networks and scalability of the backbone routing system, future Internet is expected to be based on the concept of ID/locator split. Heterogeneity Inclusion and Mobility Adaptation through Locator ID Separation (HIMALIS) has been designed as a generic future network architecture based on ID/locator split concept. It can natively support mobility, multihoming, scalable backbone routing and heterogeneous protocols in the network layer of the new generation network or future Internet. However, HIMALIS still lacks security functions to protect itself from various attacks during the procedures of storing, updating, and retrieving of ID/locator mappings, such as impersonation attacks. Therefore, in this paper, we address the issues of security functions design and implementation for the HIMALIS architecture. We present an integrated security scheme consisting of mapping registration and retrieval security, network access security, communication session security, and mobility security. Through the proposed scheme, the hostname to ID and locator mapping records can be securely stored and updated in two types of name registries, domain name registry and host name registry. Meanwhile, the mapping records retrieved securely from these registries are utilized for securing the network access process, communication sessions, and mobility management functions. The proposed scheme provides comprehensive protection of both control and data packets as well as the network infrastructure through an effective combination of asymmetric and symmetric cryptographic functions. key words: ID/locator split architecture, security, new generation network, future network

Mobile and Multihomed Host Architecture for Supporting New Network-layer Forwarding Mechanism

“…In the current HIMALIS implementation, we have implemented the name registries by extending the bind version 9.8.2, they support a DNS-like hierarchical directory service. After the host obtains the destination host ID, locators, and public key, it initiates the signaling process to securely establish a session in the identity layer, also referred to as an ID session, in a secure manner [7]. Then, a session manager process generated by the signaling process maintains the hostname, ID, locator, and session key in the ID-to-locator mapping table.…”

“…In HIMALIS communication, to establish an identity-layer supporting secure data path between hosts, the host sends a session initiation request to the destination host. In the session initiation process, the destination host first verifies the existence of the source host by using name resolution process and then exchanges a session key to protect communication (see [7] for more detail). For every packet to send, the TUN/TAP module obtains multiple locators from the ID-to-LocList mapping table corresponding to the destination host ID and provides them to the router module.…”

HIMALIS-VI: Fast and Secure Mobility Management Scheme Based on HIMALIS for V2I Services in Future Networks

“…The HIMALIS which natively supports mobility, multi-homing, scalable backbone routing, and security of the data and control plane, is a representative generic architecture for the ID/locator split concept [7]. In the HIMALIS architecture, each host possesses its hostname and identifier (ID), and obtains its local locator (LLoc) and global locator (GLoc) from its edge network [7].…”

“…In the HIMALIS architecture, each host possesses its hostname and identifier (ID), and obtains its local locator (LLoc) and global locator (GLoc) from its edge network [7]. (The HIMALIS architecture allows each host to maintain multiple hostnames and IDs.…”

“…For communication support using IDs at the upper network layer, the identity header is attached between the network-and transport-layer headers. The detailed format of the ID header is described in Kafle et al [7].…”