Host Identity Protocol

What is HIP A multi-addressing and mobility solution for the Internet Also a security protocol for authentication and encryption Add a new layer to separate transport and network layers The new layers maps host identifiers to network address and vice versa

History •1999 : Idea discussed briefly at the IETF •2001: Two BoFs, no WG created at that time •02-03: development at the corridors •2004: WG and RG created • 2007 : first stable version

HIP Developed at IETF since 1999, first stable version in 2007 Inserts cryptographic namespace between Transport and Network Layer No changes needed in applications or routers (changes reside in network stack of host) Provides much more features than LISP Aims for security, mobility, multi-homing Host Identity Protocol Review paper by Pekka Nikander et al

Achievements Mobility Multi-Homing Security NAT / IPv4 / IPv6 traversals

Host Identify Tag (HIT) A public key is used to identify an end-host A 128-bit host identify tag (HIT) is used for system call HIT is a hash on public key and has a global scope A 32-bit local scope identifier (LSI) is used for IPv4 compatibility

WHY To overcome the shortcoming of existing Internet, namely The dual role of IP as both host identifier and locator The lack of security with IP To make end-host mobility and multi-homing very easy to implement

How it works HIP introduces host identity layer between transport and network layers HIP uses base exchange to perform authentication and establish session keys before communication. Communication data are protected using IPsec ESP HIP provides a readdressing mechanism to support IP changes with mobility and multi-homing

Architecture

Architecture Transport layer communication is bound to host identity instead of IP The binding between host identity and IP is dynamic and can have a one-to-many relationship A host layer protocol is developed to make HIP work

Host Layer Protocol A signal protocol between the communicating end-points Perform mutual end-to-end authentication It creates IPsec ESP Security Associations for integrity protection and encryption Perform reachability verification Consists of 7 message types, four of which are dedicated to the base exchange

More detailed layering Transport Layer End-to-end, HITs IP layer Mobility Multi-homing v4/v6 bridge IPsec HIP Fragmentation Forwarding Hop-by-hop, IP addresses Link Layer

Protocol overview I1: HITI, HITR or NULL Initiator Responder I1: HITI, HITR or NULL Control R1: HITI, [HITR, puzzle, DHR, HIR]sig I2: [HITI, HITR, solution, DHI, {HII}]sig R2: [HITI, HITR, authenticator]sig User data messages Data

Base Exchange

Base Exchange Step 1: Initiator (I) sends the first I1 packet, which contains own HIT and the HIT of the responder to the responder (R) Step 2: R relies with message R1, which contains the HITs of I and itself as well as a puzzle based challenge for I to solve Step 3: I solves the puzzle and sends in I2 the HITs of itself and R as well as the solution to the puzzle, and performs the authentication Step 4: R now commits itself to the communication, and respond with HITs of I and itself, and performs the authentication. After this, I and R have performed the mutual authentication and established Security Associations for ESP

Mobility with HIP HIP provides dynamic binding between a Host ID and IP addresses. A mobile node sends REA (readdressing) package to its peer to inform the change of address The peer verifies the reachbility of the mobile node with the new address

Mobility with HIP

Multi-homing A host can have multiple network interfaces

Multihoming with HIP HIP provides one-to-many binding between a Host ID and IP A multi-homing can send a series of available address to its peer and designate a preferred address The peer host can choose communication address in case failover or based on load balance consideration An update message is enough to make it work

Multihoming with HIP

Implementation Involves kernel level programming since the host layer protocol works under the transport layer Only base exchange is implemented in a HIPL project HIP is implemented as a kernel module, which uses a user space daemon for cryptographic operations

Using HIP with ESP DNS server Client app Server app HIP daemon HIT DNS query DNS server Client app DNS library Server app DNS reply connect(HITS) HIT ----- >  {IP addresses} HIP daemon HIP daemon socket API socket API TCP SYN to HITS TCP SYN from HITC IPsec SPD IPsec SAD ESP protected TCP SYN to IPaddrS IPsec SAD IPsec SPD convert HITs to IP addresses convert IP addresses to HITs

HIP as the new waist of TCP/IP v4 app v6 app v4 app v6 app TCPv4 TCPv6 TCPv4 TCPv6 Host identity IPv4 IPv6 IPv4 IPv6 Link layer Link layer

Conclusion HIP adds a layer between the transport and the network layers, thus separate the dual role of IP as both host identifier and locator HIP supports IP change over time with ease and without disrupting communications HIP provides strong endpoint authentication and communication encryption.

Thanks