{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T16:18:45Z","timestamp":1772813925710,"version":"3.50.1"},"reference-count":51,"publisher":"Wiley","license":[{"start":{"date-parts":[[2021,5,26]],"date-time":"2021-05-26T00:00:00Z","timestamp":1621987200000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2021,5,26]]},"abstract":"<jats:p>Internet benefits societies by constantly connecting devices and transmitting data across the world. However, due to the lack of architectural built-in security, the pervasive network attacks faced by the entire information technology are considered to be unending and inevitable. As Internet evolves, security issues are regularly fixed according to a patch-like strategy. Nevertheless, the patch-like strategy generally results in arms races and passive situations, leaving an endless lag in both existing and emerging attacking surface. In this paper, we present NAIS (Network Architecture with Intrinsic Security)\u2014a network architecture towards trustworthiness and security. By solving stubborn security issues like IP spoofing, MITM (man-in-the-middle) attacks, and DDoS (distributed denial of service) attacks at architectural level, NAIS is envisioned to provide the most secure end-to-end communication in the network layer. This paper first presents a comprehensive analysis of network security at Internet range. Then, the system design of NAIS is elaborated with particular design philosophies and four security techniques. Such philosophies and techniques intertwine internally and contribute to a communication environment with authenticity, privacy, accountability, confidentiality, integrity, and availability. Finally, we evaluate the security functionalities on the packet forwarding performance, demonstrating that NAIS can efficiently provide security and trustworthiness in Internet end-to-end communication.<\/jats:p>","DOI":"10.1155\/2021\/6694650","type":"journal-article","created":{"date-parts":[[2021,5,27]],"date-time":"2021-05-27T21:52:55Z","timestamp":1622152375000},"page":"1-16","source":"Crossref","is-referenced-by-count":4,"title":["Security-Oriented Network Architecture"],"prefix":"10.1155","volume":"2021","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3229-0498","authenticated-orcid":true,"given":"Weiyu","family":"Jiang","sequence":"first","affiliation":[{"name":"Huawei Technologies, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bingyang","family":"Liu","sequence":"additional","affiliation":[{"name":"Huawei Technologies, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chuang","family":"Wang","sequence":"additional","affiliation":[{"name":"Huawei Technologies, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xue","family":"Yang","sequence":"additional","affiliation":[{"name":"Huawei Technologies, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","reference":[{"key":"1"},{"key":"2","first-page":"1","article-title":"Preventing DRDoS attacks in 5G networks: a new source IP address validation approach","author":"X. Chen"},{"key":"3"},{"key":"4","unstructured":"AWS ShieldThreat landscape report -q1 20202020Seattle, WA, USAAmazonTechnical report"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1007\/s11235-019-00599-z"},{"key":"6","doi-asserted-by":"crossref","unstructured":"FergusonP.Network ingress filtering: defeating denial of service attacks which employ IP source address spoofingMay 2000Technical report, RFC 2827","DOI":"10.17487\/rfc2827"},{"key":"7","doi-asserted-by":"crossref","DOI":"10.17487\/rfc3704","article-title":"Ingress filtering for multihomed networks","author":"F. Baker","year":"2004"},{"key":"8","first-page":"536","article-title":"Spoofing prevention method","author":"A. Bremler-Barr"},{"key":"9","first-page":"30","article-title":"Hop-count filtering: an effective defense against spoofed DDOS traffic","author":"C. Jin"},{"key":"10","first-page":"86","article-title":"Detection, classification, and analysis of inter domain traffic with spoofed source IP addresses","author":"F. Lichtblau"},{"key":"11","unstructured":"WuJ.BiJ.BagnuloM.BakerF.VogtC.Source address validation improvement (savi) frameworkOctober 2013Technical report, RFC 7039"},{"key":"12","doi-asserted-by":"crossref","unstructured":"WuJ.BiJ.LiX.RenG.XuK.WilliamsM.A source address validation architecture (SAVA) testbed and deployment experienceJune 2008Technical report, RFC 5210","DOI":"10.17487\/rfc5210"},{"key":"13","doi-asserted-by":"publisher","DOI":"10.1145\/1516539.1516541"},{"key":"14","first-page":"1","article-title":"Enabling efficient source and path verification via probabilistic packet marking","author":"B. Wu"},{"key":"15","article-title":"Passport: secure and adoptable source authentication","author":"X. Liu"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03168-7_9"},{"key":"17","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/978-1-4615-0239-5_14","article-title":"Untraceable electronic mail, return addresses and digital pseudonyms","volume-title":"Secure Electronic Voting","author":"D. Chaum","year":"2003"},{"key":"18","first-page":"303","article-title":"Tor: the second generation onion router","author":"S. Paul"},{"key":"19","article-title":"Tor instead of IP","author":"V. Liu"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1016\/j.forsciint.2019.03.030"},{"key":"21","first-page":"1","article-title":"Tailoring onion routing to the internet of things: security and privacy in untrusted environments","author":"J. Hiller"},{"key":"22","first-page":"17","article-title":"Claps: client-location-aware path selection in tor","author":"F. Rochet"},{"key":"23","doi-asserted-by":"crossref","unstructured":"MeyerD.ZhangL.FallK.Report from the IAB workshop on routing and addressingSeptember 2007Technical report, RFC 4984","DOI":"10.17487\/rfc4984"},{"key":"24","doi-asserted-by":"crossref","unstructured":"GontF.A method for generating semantically opaque interface identifiers with ipv6 stateless address autoconfiguration (SLAAC)April 2014Technical report, RFC 7217","DOI":"10.17487\/rfc7217"},{"key":"25","doi-asserted-by":"crossref","unstructured":"DromsR.BoundJ.VolzB.LemonT.PerkinsC.CarneyM.Dynamic host configuration protocol for ipv6 (dhcpv6)July 2003Technical report, RFC 3315","DOI":"10.17487\/rfc3646"},{"key":"26","article-title":"Accountable internet protocol. Innovative internet technologies and mobile communication (IITM)","author":"O. von Wesendonk","year":"2010"},{"key":"27","first-page":"75","article-title":"Balancing accountability and privacy in the network","volume-title":"ACM SIGCOMM Computer Communication Review","author":"D. Naylor","year":"2014"},{"key":"28","first-page":"345","article-title":"Source accountability with domain-brokered privacy","author":"T. Lee"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1109\/tit.1976.1055638"},{"key":"30","doi-asserted-by":"publisher","DOI":"10.1145\/359460.359473"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2016.2548426"},{"key":"32","first-page":"5","article-title":"Imperfect forward secrecy: how diffie-hellman fails in practice","author":"D. Adrian"},{"key":"33","first-page":"634","article-title":"Research on Diffie-Hellman key exchange protocol","author":"N. Li"},{"key":"34","first-page":"105","article-title":"Blockpki: an automated, resilient, and transparent public-key infrastructure","author":"L. Dykcik"},{"key":"35","first-page":"1093","article-title":"Understanding the mirai botnet","author":"M. Antonakakis"},{"key":"36","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/978-3-319-34208-5_1","article-title":"An overview of 5g requirements","volume-title":"5G Mobile Communications","author":"D. Jiang","year":"2017"},{"issue":"10","key":"37","doi-asserted-by":"crossref","first-page":"1853","DOI":"10.1109\/JSAC.2006.877138","article-title":"Stackpi: new packet marking and filtering mechanisms for DDOS and IP spoofing defense","volume":"24","author":"Y. Abraham","year":"2006","journal-title":"IEEE Journal on Selected Areas in Communications"},{"key":"38","doi-asserted-by":"publisher","DOI":"10.1177\/1550147717741463"},{"issue":"10","key":"39","first-page":"390","article-title":"Preventing DDOS attack using data mining algorithms","volume":"6","author":"K. R. W. V. Bandara","year":"2016","journal-title":"International Journal of Scientific and Research Publications"},{"key":"40","first-page":"1","article-title":"Machine learning based DDOS attack detection","author":"G. Ajeetha"},{"key":"41","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2020.2988293"},{"key":"42","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2015.04.101"},{"key":"43","first-page":"599","article-title":"Routing around congestion: defeating ddos attacks and adverse network conditions via reactive BGP routing","author":"M. Jared"},{"key":"44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-30505-9_24"},{"key":"45","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2015.02.026"},{"key":"46","first-page":"817","article-title":"Bohatei: flexible and elastic DDOS defense","author":"K. Seyed"},{"key":"47","article-title":"Distributed denial-of-service open threat signaling (DOTS) signal channel specification: internet-draft","author":"T. Reddy","year":"2018"},{"key":"48","unstructured":"BernardA.BlunkL.VollbrechtJ.CarlsonJ.LevkowetzH.Extensible authentication protocol (EAP)2004Technical report"},{"key":"49","article-title":"802.1x-2020-IEEE standard for local and metropolitan area networks\u2013port-based network access control","author":"IEEE Standards Association","year":"2020"},{"key":"50","first-page":"539","article-title":"Crlite: a scalable system for pushing all TLS revocations to all browsers","author":"J. Larisch"},{"key":"51","first-page":"183","article-title":"An end-to-end measurement of certificate revocation in the web\u2019s PKI","author":"Y. Liu"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/6694650.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/6694650.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/6694650.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,27]],"date-time":"2021-05-27T21:53:03Z","timestamp":1622152383000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2021\/6694650\/"}},"subtitle":[],"editor":[{"given":"Salvatore","family":"D'Antonio","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2021,5,26]]},"references-count":51,"alternative-id":["6694650","6694650"],"URL":"https:\/\/doi.org\/10.1155\/2021\/6694650","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"value":"1939-0122","type":"electronic"},{"value":"1939-0114","type":"print"}],"subject":[],"published":{"date-parts":[[2021,5,26]]}}}