Abstract:Traditional IP-based Internet offers an end-to-end data transport service and has developed rapidly in the past half-century.However,serious security incidents emerged from attacks based on traditional networks.Traditional security mechanisms(e.g.,firewalls,intrusion detection systems) enhance security.However,most of them only provide some remedial strategies rather than solve the address-security problem radically due to the lack of change in network design.The overall in-depth security of the networked system cannot be guaranteed without a fundamental change.In order to meet the development requirements of the next generation of an endogenous security network,one of the future networks,the multi-identifier network(MIN),is introduced as our research background.This paper proposes an efficient scheme in hieratical architecture that provides comprehensive protection by addressing the security aspects pertaining to the network and application layers.At the network layer,the proposed architecture develops a multi-identifier routing scheme with embedded identity-based authentication and packet signature mechanisms to provide data tamper-resistance and traceability.At the application layer,the proposed architecture designs a mimic defensive scheme combined with weighted network centrality measures.This scheme focuses on protecting the core components of the whole network to improve the service's robustness and efficiently resist potential attacks.This paper tests and evaluates the proposed scheme from a theoretical and practical perspective.An analytical model is built based on the random walk for theoretical evaluation.In experiments,the proposed scheme is developed in MIN as MIN-VPN.Then considering IP-VPN as a baseline,anti-attack tests are conducted on IP-VPN and MIN-VPN.The results of theoretical evaluations and experiments show that the proposed scheme provides excellent transmission performance and successful defense against various TCP/IP-based attacks with acceptable defensive cost,demonstrating this security mechanism's effectiveness.In addition,after long-period penetration testing in three international elite security contests,the proposed method is effectively immune to all TCP/IP-based attacks from thousands of professional teams,thus verifying its strong security.

The Design and Implementation of IPSec Conflict Avoiding and Recovering System

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Evolving Defense Mechanism for Future Network Security

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

Intrusion prevention with attack traceback and software-defined control plane for campus networks

A Design and Implementation Method of IPSec Security Chip for Power Distribution Network System Based on National Cryptographic Algorithms

SAIDE: Efficient application interference detection and elimination in SDN

Design and Evaluation of A Data Partitioning-Based Intrusion Management Architecture for Database Systems

Efficiently Secure Architecture for Future Network

Toward A Practical Scheme For Ipsec Management

Design and Evaluation of a Policy-Based Security Routing and Switching System for Data Interception Attacks

A Pragmatic Methodology for Testing Intrusion Prevention Systems

Design and implementation of computer network security detection and control system

Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Modeling on Policy Conflict for Managing Heterogeneous Security Systems in Distributed Network Environment

The Impact of Network Design Interventions on the Security of Interdependent Systems

Implementing Snort Intrusion Prevention System (IPS) for Network Forensic Analysis

Joint Resource Allocation and Intrusion Prevention System Deployment for Edge Computing

IPSadas: Identity‐privacy‐aware secure and anonymous data aggregation scheme

Security Protection Architecture for Power Enterprise Information Integration Based on Technology of Distributed Intrusion Tolerance with Multi-Level Defense Line