1. Host Identity Protocol

2. What is HIP A multi-addressing and mobility solution for the Internet
Also a security protocol for authentication and encryption
Add a new layer to separate transport and network layers
The new layers maps host identifiers to network address and vice versa

3. History •1999 : Idea discussed briefly at the IETF
•2001: Two BoFs, no WG created at that time
•02-03: development at the corridors
•2004: WG and RG created
• 2007 : first stable version

4. HIP Developed at IETF since 1999, first stable version in 2007
Inserts cryptographic namespace between Transport and Network Layer
No changes needed in applications or routers (changes reside in network stack of host)
Provides much more features than LISP
Aims for security, mobility, multi-homing
Host Identity Protocol Review paper by Pekka Nikander et al

5. Achievements Mobility Multi-Homing Security
NAT / IPv4 / IPv6 traversals

6. Host Identify Tag (HIT)
A public key is used to identify an end-host
A 128-bit host identify tag (HIT) is used for system call
HIT is a hash on public key and has a global scope
A 32-bit local scope identifier (LSI) is used for IPv4 compatibility

7. WHY To overcome the shortcoming of existing Internet, namely
The dual role of IP as both host identifier and locator
The lack of security with IP
To make end-host mobility and multi-homing very easy to implement

8. How it works
HIP introduces host identity layer between transport and network layers
HIP uses base exchange to perform authentication and establish session keys before communication.
Communication data are protected using IPsec ESP
HIP provides a readdressing mechanism to support IP changes with mobility and multi-homing

9. Architecture

10. Architecture
Transport layer communication is bound to host identity instead of IP
The binding between host identity and IP is dynamic and can have a one-to-many relationship
A host layer protocol is developed to make HIP work

11. Host Layer Protocol
A signal protocol between the communicating end-points
Perform mutual end-to-end authentication
It creates IPsec ESP Security Associations for integrity protection and encryption
Perform reachability verification
Consists of 7 message types, four of which are dedicated to the base exchange

12. More detailed layering
Transport Layer
End-to-end, HITs
IP layer
Mobility
Multi-homing
v4/v6 bridge
IPsec
HIP
Fragmentation
Forwarding
Hop-by-hop, IP addresses
Link Layer

13. Protocol overview I1: HITI, HITR or NULL
Initiator
Responder
I1: HITI, HITR or NULL
Control
R1: HITI, [HITR, puzzle, DHR, HIR]sig
I2: [HITI, HITR, solution, DHI, {HII}]sig
R2: [HITI, HITR, authenticator]sig
User data messages
Data

14. Base Exchange

15. Base Exchange
Step 1: Initiator (I) sends the first I1 packet, which contains own HIT and the HIT of the responder to the responder (R)
Step 2: R relies with message R1, which contains the HITs of I and itself as well as a puzzle based challenge for I to solve
Step 3: I solves the puzzle and sends in I2 the HITs of itself and R as well as the solution to the puzzle, and performs the authentication
Step 4: R now commits itself to the communication, and respond with HITs of I and itself, and performs the authentication.
After this, I and R have performed the mutual authentication and established Security Associations for ESP

16. Mobility with HIP
HIP provides dynamic binding between a Host ID and IP addresses.
A mobile node sends REA (readdressing) package to its peer to inform the change of address
The peer verifies the reachbility of the mobile node with the new address

17. Mobility with HIP

18. Multi-homing
A host can have multiple network interfaces

19. Multihoming with HIP
HIP provides one-to-many binding between a Host ID and IP
A multi-homing can send a series of available address to its peer and designate a preferred address
The peer host can choose communication address in case failover or based on load balance consideration
An update message is enough to make it work

20. Multihoming with HIP

21. Implementation
Involves kernel level programming since the host layer protocol works under the transport layer
Only base exchange is implemented in a HIPL project
HIP is implemented as a kernel module, which uses a user space daemon for cryptographic operations

22. Using HIP with ESP DNS server Client app Server app HIP daemon
HIT
DNS query
DNS server
Client app
DNS
library
Server app
DNS reply
connect(HITS)
HIT >  {IP addresses}
HIP daemon
HIP daemon
socket API
socket API
TCP SYN
to HITS
TCP SYN
from HITC
IPsec
SPD
IPsec
SAD
ESP protected TCP SYN
to IPaddrS
IPsec
SAD
IPsec
SPD
convert HITs to IP addresses
convert IP addresses to HITs

23. HIP as the new waist of TCP/IP
v4 app
v6 app
v4 app
v6 app
TCPv4
TCPv6
TCPv4
TCPv6
Host identity
IPv4
IPv6
IPv4
IPv6
Link layer
Link layer

24. Conclusion
HIP adds a layer between the transport and the network layers, thus separate the dual role of IP as both host identifier and locator
HIP supports IP change over time with ease and without disrupting communications
HIP provides strong endpoint authentication and communication encryption.

25. Thanks