Secure Name Resolution for Identifier-to-Locator Mappings in the Global Internet

Abstract

Abstract-A recent trend in clean-slate network design has been to separate the role of identifiers from network locators. An essential component to such a separation is the ability to resolve names into network addresses. One challenge facing name resolution is securing the name resolution service. This paper examines the security of a clean-slate name resolution service suitable for mobile networking. We begin with a high-level threat analysis, and identify several types of attacks that may be used against name resolution services. We then present secure protocols that together form a secure global name resolution service. Specifically, we present a secure update protocol that allows users to update their network addresses as they migrate and that includes several checkpoints that prevents spoofing, collusion, stale identifiers and false identifier announcements. Since the primary function behind a name resolution service is to respond to address-lookup queries, we also present a secure query protocol. Finally, we address the security risks associated with IP Holes that can arise in a global name resolution service.

A policy-driven approach to access control in future internet name resolution services

“…If another user B wants to communicate with A, it sends a query message to the GNRS asking for A's network address before their communication, and the GNRS will return A's mapping to B. How to secure GNRS protocol is presented in [13] and therefore beyond the scope of this paper.…”

“…a human readable name, such as Annie's laptop), a network-level identifier (GUID) and a route-able topological address (referred to as a network address, or NA for short). Two core name resolution services are proposed for attribute translation: a Name Certificate & Resolution Service (NCRS) translates between user-level descriptors and GUIDs, while a Global Name Resolution Service (GNRS) provides the mapping between GUIDs and the corresponding NAs [13].…”

“…This future Internet architecture adopts identifier and locator separation [19] to support mobility and has already integrated several security features in its core design. As a complement to the current security enforcement mechanisms [13] in MobilityFirst, we have developed a suite of access regulations that operate at the GNRS. Our regulation mechanisms support spatio-temporal access control (STAC), in which the accessibility to the protected resource/object depends on the location and time characteristics of the subject.…”

Engaging undergraduates in research that speaks their language

“…A GNRS messaging protocol enables communication between network routers and name resolution servers so that content may be forwarded toward the current NAs of the mobile destination. A name certification and resolution service (NCRS) acts as a distributed system of public key infrastructure (PKI) that is responsible for certifying and validating GUIDs and resolving human readable names to GUID [13]. The NCRS is also responsible for maintaining access rights for all protected and personal content.…”

A Security Framework for the Internet of Things in the Future Internet Architecture

“…Therefore, we can apply the same philosophy of preventing GNRS false announcement attacks to location forgery attacks in the context of the IoT. These protection mechanisms are presented in [37] and hence we will not discuss them in this paper due to the space limitation.…”