This chapter presents the most significant approaches developed so far for addressing NEtwork MObility (NEMOi) management, including the most outstanding solution (NEMO BS) and highlighting their most interesting features. We also define the demanded key features to the NEMO protocols to be applied in the ITS context and provide an analysis of the fulfillment of these key features by the NEMO protocols. The proposals suggested so far can be can be classified in two different categories: on the one hand, NEMO solutions that consider MIPv6 as the base host mobility management protocol, and on the other hand, solutions that consider alternative base host mobility management protocols like SIP, LIN6 or HIP. Besides, we provide a taxonomy on MIPv6 based NEMO protocols classifying them considering which characteristics they aim to enhance. It is important to point out that the selection of the base host mobility management protocol is fundamental to have as much as possible demanded key features satisfied by the NEMO protocol to be applied in the ITS context.

Covering NEtwork MObility (NEMO) scenarios based on end-to-end mobility management protocols such as the Host Identity Protocol (HIP) is not straightforward. However, it has been demonstrated that HIP based NEMO solutions outperform NEMO Basic Support (NEMO BS), hence, HIP is being considered also for addressing NEMO scenario necessities. In this work we focus on the Registration Extension process of HIP, which is mandatory for providing reachability of HIP enabled mobile nodes. More specifically, we describe our proposal, the Bulk Registration process, which has been analytically modeled to show that it outperforms other registration approaches in more than 90% in terms of delay and signaling overhead. Obtained results are highly valuable for a common NEMO scenario where several nodes are present in a vehicle to control its operation.

With the goal of solving shortcomings of MIPv6, alternative protocols such as HIP have been proposed by the research community. In the same way as for MIPv6, solutions to cover NEMO scenarios based on HIP have been worked out. However, there is little agreement on which the best way is to handle NEMO scenarios when using HIP. In this work we analyze different HIP based NEMO solutions and define mathematical models for their analysis. These models are utilized for evaluating the signaling overhead of HIP based NEMO protocols in order to provide insight in the specification of the features a HIP based NEMO solution should fulfill.

In this paper we propose the use of the IEEE802.21 protocol in the railway context to enhance the highly frequent, repeated and foreseeable handovers between different radio access technologies. This standard specifies IEEE802 media access-independent mechanisms that optimize handovers between heterogeneous IEEE802 systems and between IEEE 802 systems and cellular systems. The global aim is to contribute to develop a seamless layer that provides independence to the application layers from the radio access technology underneath. A case study with two out of the most popular radio access technologies, IEEE802.11 and IEEE 802.16 is undertaken.

With the aim of tackling shortcomings of MIPv6, several host mobility management protocols, such as HIP have been released. In the same way as for MIPv6, HIP based protocols have been worked out for addressing necessities of NEMO scenarios. However, several limitations are still present, specially regarding secure mobility management. In this work, we highlight these limitations and outline the fundamentals of our protocol, NeMHIP.

Recent widespread deployment of different types of sensors and detectors has opened the door to a new way of understanding collaborative applications. The use of such devices allows information to be collected, used and disclosed on a massive scale and under very different conditions from which we are currently familiar with. Despite the huge potential of these collaborative environments, privacy is one of their most criticized aspects and probably the greatest barrier to their long-term success. To address this problem, we present a privacy-enhancing security model specifically tailored to the characteristics of ubiquitous and heterogeneous environments consisting of low capacity devices. This security model is based on the Kerberos symmetric key protocol which has been modified and extended to avoid using timestamps and to accomplish the authorization process. Finally, we present a validation of our proposal using an automated tool and we show a real world deployment use case.

Neutral Access Networks (NAN) have appeared as a new model to overcome some restrictions and lack of flexibility that are present currently in broadband access networks. NAN brings new business opportunities by opening this market to new stakeholders. Although the NAN model is accepted, there are some technical issues that need to be resolved to facilitate wider NAN deployment. This paper proposes a new technical approach to neutral access networks, which is based on Carrier Ethernet technology. The proposal allows the user to independently select both the service provider and the network operator that will be used to deliver the service. To achieve this, a shared infrastructure is needed, which takes NAN as reference model. The main contributions of this proposal are the following: an Ethernet-based approach for neutral access networks; a mechanism for users to select which network operator is used to access each/target service provider; and an AAA (Authentication, Authorization and Accounting) infrastructure and access control policy profile to control service delivery over selected/requested NAN. Finally, a working prototype is described for validation of the proposal.

Next Generation Broadband Access Networks (NGBAN), the next evolutionary step of current broadband access, have experienced a great evolution in the last few years. The NGBAN architecture is based on the reference model introduced by the Broadband Forum in TR-144, while the Next Generation Services (NGS) are based on the Ethernet Services defined by the Metro Ethernet Forum in its 6.1 technical specification. In this context, network convergence means that the same network must be capable of transporting all the existent telecommunication services (voice, video and data). This paper introduces Carrier-Grade Ethernet as transport technology to achieve convergence in provider networks. A new approach for network convergence is also presented, the bridging virtualization, which uses the concept of instances to deal with service requests. Then, a secure instantiation mechanism for NGBAN is explained, which is based on the EAPoL protocol (IEEE 802.1X). Finally, a profile-based configuration service is introduced, which defines the services through XML profiles inspired on the MEF specifications (UNI, EVC per UNI and EVC).

Broadband access networks have experienced a significant evolution in the last few years, in terms of convergence, QoS, security or ubiquity. In this context, Carrier Ethernet has appeared as a technology which claims to address all this aspects, and whose deployment is supported by the Metro Ethernet Forum and Broadband Forum. Nowadays, providers tend to offer multi-play services (voice, video and data) over the same network and service delivery is shifting from traditional scenarios to new ones, in which services are provided by third-party entities. A new secure and dynamic scenario is presented, in which end users can access simultaneously a variable number of services. These users are authenticated and authorized per service before access is granted to them. Extensions to IEEE 802.1X standard are introduced: the service port and EAPoM protocol are the two main contributions to this new scenario. Furthermore, a profile based configuration procedure allows the secure configuration of nodes. The main restriction of 802.1X is that the access control is done by user instead of by service. This proposal introduces the service port as the basic element for policy enforcement of access control that enables the operation of the EAPoM protocol. This splits the logical port into new ports, each of which has its own associated AAA process that rules the access to each service. This multiplicity of authentication processes is supported by EAPoM, which is able to differentiate multiple EAP processes from the same customer. A working prototype has been implemented in a Linux-based environment.

Currently, research community efforts are being carried out to develop new generation wireless mobile networks that provide broadband data communication in the high speed vehicular scenario. ITU-R (International Telecommunication Union, Radiocommunication Section) has proposed the IMT-Advanced (International Mobile Telecommunications) technical requirements for supporting such usage scenarios. IMT- Advanced identifies those mobile communication systems with capabilities which go further than those of IMT-2000. The IEEE 802.16 standard, supported under the WiMAX network, has evolved from a fixed scenario, in IEEE 802.16d, towards a mobile typical vehicular (up to 120 km/h) with IEEE 802.16e. In the near future, the IEEE 802.16m specification will cover the mobility classes and scenarios supported by the IMT-Advanced, including the high-speed vehicular scenario (up to 350 km or even up to 500 km/h). IEEE802.16 initial standards adopted DOCSIS (Data Over Cable Service Interface Specification) QoS (Quality of Service) mechanisms. Similarly, the IEEE802.16 MAC (Medium Access Control) Security Sublayer, responsible for providing security mechanisms such as privacy, authentication, and encryption over the air link, was also based on DOCSIS standard. However, DOCSIS is a wired based technology and QoS mechanisms in fixed wireless technologies, while sharing many details with QoS mechanisms for wired technologies, faces some extra limitations including: bandwidth limitations, longer end to end delays and higher packet losses due to channel-induced bit errors. Additionally, QoS mechanisms in mobile broadband wireless technologies represent a step further in complexity. The time variability and unpredictability of the channel become more acute and the main challenge arises from the need to hand over sessions from one cell to another as the user moves across their coverage boundaries. During this handover process, it is still necessary to provide session continuity and to offer the previously negotiated end-to-end QoS and security levels.

Recent widespread of small electronic devices with a low capacity microprocessor and wireless communication capabilities integrated, has given place to the emergence of new communication scenarios, mainly characterized by their heterogeneity and ubiquity. As an example, in the near future, it will be very common for users to access and control electrical appliances or high performance sensors in remote locations just by using their mobile phone or PDA. However, for these environments to achieve the expected success they must probe to be secure and reliable. The security algorithms and mechanisms used to date are meant for powerful workstations and not suitable for small devices with specific constraints regarding energy and processing power. Therefore, in this paper we present a lightweight authentication and authorization solution based on the Kerberos symmetric key protocol, and we propose an extension of its functionalities in order to add authorization support.

Together with the IMO’s future navigation system implementation strategy, the e-navigation, wireless access technologies are proliferating on the maritime scenario, covering last mile communications. In the near future, we foresee that communication technologies will coexist and will be available in overlapping areas through the maritime last mile. Therefore, in order to enhace ship-shore communications, always best-connected procedures and an efficient mobility management protocol is required to satisfy maritime context peculiarities such as safety and security. In this article we analyze the most suitable mobility management protocol in terms of security and handover efficiency and propose a novel architecture that integrates the HIP protocol and always-best-connected procedures to best achieve maritime context specifications.

Today, collaboration is considered a way to improve efficiency and quality of work and this concept is spreading quickly over the technological world, giving place to the creation of ubiquitous and distributed collaborative environments where the different high level services are composed from more basic modules. A typical example of this kind of environments are the NGCWEs (Next Generation Collaborative Working Environments), which are mainly characterized by the utilization of heterogeneous and low capacity mobile devices. In this paper we take into account all the special features that characterize NGCWEs in order to propose a security model which best fits their requirements. With this aim, we have developed a solution based on symmetric cryptography, and we have introduced the concept of a centralized authorization server, in order to minimize the load that the security solution imposes over the final systems.

Today, collaboration is considered a way of improving efficiency and quality of work. This concept is spreading quickly over the technological world, resulting in the organisation of ubiquitous and distributed collaborative environments, which try to provide high-level services based on the interaction among different basic modules. A typical example of this kind of environments are the NGCWEs (Next Generation Collaborative Working Environments). Such working environments try to integrate the experiences of the workers into the system, for which they make use of sensors and low capacity mobile devices. In this paper we take into account all the special features that characterize NGCWEs in order to propose a security model which best fits their requirements. Therefore, we have developed a solution based on symmetric cryptography, and we have introduced the concept of a centralized authorization server, minimizing the load the security solution imposes over the final systems.

Since the appearance of Next Generation Networks (NGN), access and aggregation networks (even core networks) have suffered significant improvements and architectural evolutions. The idea of network convergence, something in which providers are very interested, is closely related with these deployments, as the same network must be capable of transporting all the existent telecommunication services (voice, video and data). This paper introduces an architectural model which is based on Broadband Forum technical recommendations for Multi-Service (TR-058), and makes use bridging technology in all the nodes. In this model, Carrier-Class Ethernet has been selected as transport technology in order to achieve convergence in provider networks. Then, a radically new approach for network convergence is presented, Bridging Virtualization. This approach introduces the concept of instances to differentiate service requests. Finally, a secure alternative to the instantiation of multiple services is presented (EAPOL-in-EAPOL).

Network convergence is one of the main challenges of NGN, and Carrier-Grade Ethernet is a very promising choice to achieve this as the transport technology of future network architectures. CGE consists of a group of technologies standardized by the IEEE, such as PB (802.1ad), PBB (802.1ah) or PBB-TE (802.1Qay). Commercial products sometimes take a long time to be available and are close platforms. Moreover, research entities have founding limitations to obtain those resources. Therefore, a new set of tools are proposed to overcome these restrictions and achieve a complete network scheme based on CGE technologies. The Click Project has been used as the basic element for this development. Firstly, new basic elements have been defined as Click modules to emulate CGE behaviours. Then, tap devices (Layer 2 virtual network devices) have been used to virtualize the network connections between elements. Finally, the virtual bridges are built with both resources. A new GUI has also been developed to make scenario composition lighter. Network definition is carried out on a graphical basis, and then the elements run as Click processes. The network can be split up in several machines, since taps can be changed by real interfaces. Input/output traffic can be from/to real devices (merging both real and virtual worlds), and traffic can be sniffed from every virtual device. As a final contribution, a new approach for network convergence based on Bridging Virtualization is presented, in which every network element can act simultaneously as PB, PBB or PBB-TE (or any new definition).