122 Software Networks
the upper layers. When one of the node’s addresses is no longer valid,
the ID is associated with another address. The intermediary layer
handles the link between the ID and the address. Therefore, the change
of address becomes transparent to the upper layers, which associate
only with the ID.
5.7.1. HIP (Host Identity Protocol)
HIP is an approach which totally separates the identifying function
from the localizing function of the IP address. HIP assigns new
cryptographic “Host Identities” (HIs) to the terminals.
In the HIP architecture, the HI is the terminal’s ID presented to the
upper layers, whereas the IP address only acts as a topological
address. As is indicated by Figure 5.13, a new layer, called the HIP, is
added between the network and transport layers. This HIP layer
handles the matching of the terminal’s HI and its active IP address.
When a terminal’s IP address changes because of mobility or
multihoming, the HI remains static to support that mobility and
multihoming.
The HI is the public key in a pair of asymmetrical keys generated
by the terminal. However, the HI is not directly used in the protocol,
because of its variable length. There are two formats of HI, using
cryptographic hashing on the public key. One representation of HI,
with 32 bits, called the LSI (Local Scope Identifier), is used for IPv4.
Another representation of HI, with 128 bits, called the HIT (Host
Identity Tag), is used for IPv5.
Before communicating with one another, the terminals use the HIP
base exchange protocol to establish the HIP association. HIP base
exchange is a cryptographic protocol which enables the terminals to
authenticate one another. As shown by Figure 5.14, the base exchange
comprises four messages that contain the communication context data,
such as the HITs, the public key, the security parameters of IPSec, etc.
I and R respectively represent the initiator and the responder of the
exchange. In order to protect the association against Denial-of-Service
(DoS) attacks, a puzzle is added into messages R1 and I2. As the HI
www.it-ebooks.info
the upper layers. When one of the node’s addresses is no longer valid,
the ID is associated with another address. The intermediary layer
handles the link between the ID and the address. Therefore, the change
of address becomes transparent to the upper layers, which associate
only with the ID.
5.7.1. HIP (Host Identity Protocol)
HIP is an approach which totally separates the identifying function
from the localizing function of the IP address. HIP assigns new
cryptographic “Host Identities” (HIs) to the terminals.
In the HIP architecture, the HI is the terminal’s ID presented to the
upper layers, whereas the IP address only acts as a topological
address. As is indicated by Figure 5.13, a new layer, called the HIP, is
added between the network and transport layers. This HIP layer
handles the matching of the terminal’s HI and its active IP address.
When a terminal’s IP address changes because of mobility or
multihoming, the HI remains static to support that mobility and
multihoming.
The HI is the public key in a pair of asymmetrical keys generated
by the terminal. However, the HI is not directly used in the protocol,
because of its variable length. There are two formats of HI, using
cryptographic hashing on the public key. One representation of HI,
with 32 bits, called the LSI (Local Scope Identifier), is used for IPv4.
Another representation of HI, with 128 bits, called the HIT (Host
Identity Tag), is used for IPv5.
Before communicating with one another, the terminals use the HIP
base exchange protocol to establish the HIP association. HIP base
exchange is a cryptographic protocol which enables the terminals to
authenticate one another. As shown by Figure 5.14, the base exchange
comprises four messages that contain the communication context data,
such as the HITs, the public key, the security parameters of IPSec, etc.
I and R respectively represent the initiator and the responder of the
exchange. In order to protect the association against Denial-of-Service
(DoS) attacks, a puzzle is added into messages R1 and I2. As the HI
www.it-ebooks.info