Since the appearance of OpenFlow, the Software Defined Networking has become a hot topic inside the networking industry and academia. One of the topics currently under study, is the adaptation of SDNs to the multi-domain environment, as current OpenFlow lacks of mechanisms by itself to accomplish that. In this scenario, the GN3plus JRA2T1 task group is investigating how to integrate SDN/OpenFlow with the Network Services Framework, which has been proven useful for its application in multi-domain environments. The research is focused on two different areas. The first one tackles with the establishment of end-to-end connections across different domains where at least one of the domains is SDN/OpenFlow-enabled. The second one aims to provide isolated slices to experimenters where the resources belong to different domains.

With the development of solutions like 6LoWPAN, the implementation of IP technology in sensor devices is already a reality. Therefore, sensors can be natively integrated in the Internet, becoming globally addressable by any other Internet-connected party. Despite the huge potential of this approach, it also gives place to new threats, being one of the most critical ones the effective protection of the information gathered by sensors from unauthorised remote access attempts. A suitable solution to address this issue is the Ladon security protocol, which provides resource-deprived devices with end-to-end authentication, authorisation and key establishment mechanisms. Once the critical security issue has been solved, additional concerns arise. Specially remarkable is the protection of user privacy in order to prevent potential eavesdroppers from tracking users’ access trends and obtaining behavioural patterns. In this regard, authentication and authorisation processes deserve an special consideration, since they imply conveying user identity-related information to the targeted services. In this paper, we present a privacy-enhanced Ladon protocol by integrating the original protocol with the PrivaKERB user privacy framework for Kerberos. Due to the severe resource limitations that characterise the targeted environments, a performance evaluation of the proposed solution is carried out in order to prove that it meets the performance requirements of the considered environments in terms of energy cost and additional delay for each secure session establishment. The obtained results show that privacy-enhanced Ladon is a secure and efficient solution to implement privacy-supporting authentication and authorisation processes in resource-deprived environments.

The upcoming development of the Internet of Things (IoT) envisions IP-enabled pacemakers and ICDs, giving place to a completely new scenario in the field of remote monitoring of patients implanted with these devices. Apart from the costs saved thanks to the reduction of in-clinic visits, this new approach will help improving the quality of life of chronic patients that depend on such devices. However, this scenario cannot be conceived without an effective mechanism to protect the privacy of the health information collected by implanted sensors, understanding privacy as the capacity to determine when, how and to what extent information is communicated to others. In this paper, we show how the Ladon authentication, authorization and key establishment protocol can be successfully applied to achieve this purpose. The Ladon protocol is based on Kerberos, but appropriately modified and extended to support independence of clock synchronization and authorization functionalities. In order to demonstrate the feasibility of introducing Ladon in the targeted scenarios, a prototype implementation based on general purpose sensors has been developed. The obtained results show that the performance penalty introduced by the protocol in terms of energy and time consumption is negligible.

The migration of railway signaling systems based on circuit switching toward Internet protocol (IP) is on the way. Consequently, new strategies to promote reliability in packet-?switching networks must be studied. In this article, we propose the use of multipath technology to enhance the availability and reliability of these communications. To our knowledge, this is the first time that multipath strategies are customized for the railway train-control domain. We present the basic requirements that a multipath protocol must fulfill to increase the reliability and evaluate different related multipath proposals and provide our own customized protocol, the reliable multipath transmission control protocol (RMPTCP). Finally, we demonstrate the availability improvement that our proposed multipath strategy introduces.

With the development of the 6LoWPAN standard, sensors can be natively integrated into the IP world, becoming tiny information providers that are directly addressable by any Internet-connected party. To protect the information gathered by sensors from any potential attacker on the Internet, it is essential to have trustworthy real-time information about the legitimacy of every attempt to interact with a sensor. Our approach to address this issue is Ladon, a new security protocol specifically tailored to the characteristics of low capacity devices. In this paper, we study the performance of Ladon, showing that it successfully meets the requirements of the targeted environments. To that end, we evaluate the delay and energy consumption of the execution of Ladon. The obtained results show that the cost of Ladon is bounded, even in situations of high packet loss rates (20–80%) and comparable to that of other protocols that implement fewer security features.

Internet connectivity in the ITS context is a flourishing demand that has to be covered by efficient information and communication technologies. Thanks to the provision of this connectivity, not only end users will profit from communication services, but also services for controlling the operation of the vehicle will benefit from the Internet connectivity. Services related to the operation and control of the vehicles exchange sensitive data, so strong security properties have to be ensured for this type of services. In addition, because of the privacy concerns related to the end users, it is desired to provide this kind of services with an adequate security level. From the communication point of view, a vehicle can be regarded as a mobile network where nodes onboard obtain continuous and optimal Internet connectivity, so, its mobility has to be managed. In the same way, network mobility management protocols should not only avoid security leaks, but also they have to ensure an adequate security level. It is needless to say that the introduction of security properties cannot render not fulfilling service performance requirements. In fact, the trade-off between security and application performance is a must. ITS standardisation bodies have adopted the NEtwork MObility Basic Support (NEMO BS) protocol to manage the mobility of networks. However, it still presents shortcomings like lack of security support and routing problems, which leads to a bad performance. One of the most promising design approaches is to consider a base mobility management protocol that provides out of the box security and route optimisation support like the Host Identity Protocol (HIP). Different solutions based on HIP can be found to solve network mobility in the literature, but none of these solutions aim at solving securely and efficiently network mobility management. That is, the provision of security properties to the network mobility management itself and to the end-to-end data communications while not increasing the signalling overhead and the manageability level remains unsolved. In this paper, we present the NeMHIP. NeMHIP is a secure and efficient network mobility management protocol which is based on HIP. In order to demonstrate its feasibility, we have carried out a study by means of analytical modelling to assess the performance of user applications with stringent QoS requirements like VoIP. Results demonstrate that the introduction of the NeMHIP in the ITS context is feasible because security properties are ensured while application performance requirements are satisfied. Therefore, we successfully achieve the trade-off between security and performance.

This chapter presents the most significant approaches developed so far for addressing NEtwork MObility (NEMOi) management, including the most outstanding solution (NEMO BS) and highlighting their most interesting features. We also define the demanded key features to the NEMO protocols to be applied in the ITS context and provide an analysis of the fulfillment of these key features by the NEMO protocols. The proposals suggested so far can be can be classified in two different categories: on the one hand, NEMO solutions that consider MIPv6 as the base host mobility management protocol, and on the other hand, solutions that consider alternative base host mobility management protocols like SIP, LIN6 or HIP. Besides, we provide a taxonomy on MIPv6 based NEMO protocols classifying them considering which characteristics they aim to enhance. It is important to point out that the selection of the base host mobility management protocol is fundamental to have as much as possible demanded key features satisfied by the NEMO protocol to be applied in the ITS context.

Covering NEtwork MObility (NEMO) scenarios based on end-to-end mobility management protocols such as the Host Identity Protocol (HIP) is not straightforward. However, it has been demonstrated that HIP based NEMO solutions outperform NEMO Basic Support (NEMO BS), hence, HIP is being considered also for addressing NEMO scenario necessities. In this work we focus on the Registration Extension process of HIP, which is mandatory for providing reachability of HIP enabled mobile nodes. More specifically, we describe our proposal, the Bulk Registration process, which has been analytically modeled to show that it outperforms other registration approaches in more than 90% in terms of delay and signaling overhead. Obtained results are highly valuable for a common NEMO scenario where several nodes are present in a vehicle to control its operation.

With the goal of solving shortcomings of MIPv6, alternative protocols such as HIP have been proposed by the research community. In the same way as for MIPv6, solutions to cover NEMO scenarios based on HIP have been worked out. However, there is little agreement on which the best way is to handle NEMO scenarios when using HIP. In this work we analyze different HIP based NEMO solutions and define mathematical models for their analysis. These models are utilized for evaluating the signaling overhead of HIP based NEMO protocols in order to provide insight in the specification of the features a HIP based NEMO solution should fulfill.

In this paper we propose the use of the IEEE802.21 protocol in the railway context to enhance the highly frequent, repeated and foreseeable handovers between different radio access technologies. This standard specifies IEEE802 media access-independent mechanisms that optimize handovers between heterogeneous IEEE802 systems and between IEEE 802 systems and cellular systems. The global aim is to contribute to develop a seamless layer that provides independence to the application layers from the radio access technology underneath. A case study with two out of the most popular radio access technologies, IEEE802.11 and IEEE 802.16 is undertaken.

With the aim of tackling shortcomings of MIPv6, several host mobility management protocols, such as HIP have been released. In the same way as for MIPv6, HIP based protocols have been worked out for addressing necessities of NEMO scenarios. However, several limitations are still present, specially regarding secure mobility management. In this work, we highlight these limitations and outline the fundamentals of our protocol, NeMHIP.

Recent widespread deployment of different types of sensors and detectors has opened the door to a new way of understanding collaborative applications. The use of such devices allows information to be collected, used and disclosed on a massive scale and under very different conditions from which we are currently familiar with. Despite the huge potential of these collaborative environments, privacy is one of their most criticized aspects and probably the greatest barrier to their long-term success. To address this problem, we present a privacy-enhancing security model specifically tailored to the characteristics of ubiquitous and heterogeneous environments consisting of low capacity devices. This security model is based on the Kerberos symmetric key protocol which has been modified and extended to avoid using timestamps and to accomplish the authorization process. Finally, we present a validation of our proposal using an automated tool and we show a real world deployment use case.

Neutral Access Networks (NAN) have appeared as a new model to overcome some restrictions and lack of flexibility that are present currently in broadband access networks. NAN brings new business opportunities by opening this market to new stakeholders. Although the NAN model is accepted, there are some technical issues that need to be resolved to facilitate wider NAN deployment. This paper proposes a new technical approach to neutral access networks, which is based on Carrier Ethernet technology. The proposal allows the user to independently select both the service provider and the network operator that will be used to deliver the service. To achieve this, a shared infrastructure is needed, which takes NAN as reference model. The main contributions of this proposal are the following: an Ethernet-based approach for neutral access networks; a mechanism for users to select which network operator is used to access each/target service provider; and an AAA (Authentication, Authorization and Accounting) infrastructure and access control policy profile to control service delivery over selected/requested NAN. Finally, a working prototype is described for validation of the proposal.