![](bg6.png)
6 CONCLUSIONS AND FUTURE
WORK
Providing the proper security application-layer can
increase the ability of applications to use secure com-
munication efficiently. In the same time, it will make
it more convenient and applicable for protecting the
application communications.
In this paper, we implement new APIs which give
any application the ability to control its security pol-
icy by providing sufficient configurations to the se-
curity layer. Moreover, it enables an application to
get the relevant information about the applied secu-
rity mechanisms and all the parameters of the secure
channel. We also provide APIs which allow any ap-
plication to authenticate the requester’s identity and
indicate whether this request is authorized or not,
based on the security policy of the receiving appli-
cation. The authorization decisions are not based on
packet-filter and ACLs mechanisms.
Adoption of our secure APIs by applications
caused a performance overhead. However, our im-
plementation is still in a proof-of-concept stage; dif-
ferent optimization methods could be used to reduce
this overhead. Hence, as future work, we intend to
implement some of the optimization methods such as
cashing the verified credentials and check its effects
on the performance. On the other hand, we plan to
do more measurement studies and compare the per-
formance of our APIs against existing protocols such
as TLS.
ACKNOWLEDGEMENT
This work was supported by the DFG Research Unit
Controlling Concurrent Change (CCC), funding num-
ber FOR 1800. We thank the members of CCC for
their support.
REFERENCES
Arkko, J. and Nikander, P. (2003). Limitations of ipsec pol-
icy mechanisms. In Security Protocols, 11th Inter-
national Workshop, Cambridge, UK, April 2-4, 2003,
Revised Selected Papers, pages 241–251.
Bellovin, S. (2009). Guidelines for specifying the use of
ipsec version 2. BCP 146, RFC Editor.
Blaze, M., Feigenbaum, J., Ioannidis, J., and Keromytis,
A. D. (1999). The keynote trust-management system
version 2. RFC 2704, RFC Editor.
Dierks, T. and Rescorla, E. (2008). The Transport Layer
Security (TLS) Protocol Version 1.2. RFC 5246 (Pro-
posed Standard).
Genode Labs GmbH. Genode OS Framework.
https://genode.org/ [last access on Jan 2017].
Hamad, M. and Prevelakis, V. (2015). Implementation and
performance evaluation of embedded ipsec in micro-
kernel os. In Computer Networks and Information Se-
curity (WSCNIS), 2015 World Symposium on, pages
1–7. IEEE.
Hiltgen, A., Kramp, T., and Weigold, T. (2006). Secure
internet banking authentication. IEEE Security & Pri-
vacy, 4(2):21–29.
Ioannidis, J. (2003). Why don’t we still have ipsec, dammit?
In NDSS 2003.
Ioannidis, S., Keromytis, A. D., Bellovin, S. M., and Smith,
J. M. (2000). Implementing a distributed firewall. In
Proceedings of the 7th ACM conference on Computer
and communications security, pages 190–199. ACM.
Kent, S. and Atkinson, R. (1998a). Ip authentication header.
RFC 2402, RFC Editor.
Kent, S. and Atkinson, R. (1998b). Ip encapsulating secu-
rity payload (esp). RFC 2406, RFC Editor.
Kent, S. and Seo, K. (2005). Security Architecture for the
Internet Protocol.
Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno,
T., Checkoway, S., McCoy, D., Kantor, B., Anderson,
D., Shacham, H., et al. (2010). Experimental secu-
rity analysis of a modern automobile. In 2010 IEEE
Symposium on Security and Privacy, pages 447–462.
IEEE.
McDonald, D. L. (1997). A Simple IP Security API Exten-
sion to BSD Sockets. Internet-Draft draft-mcdonald-
simple-ipsec-api-02, Internet Engineering Task Force.
Niederberger, R., Allcock, W., Gommans, L., Gr
¨
unter, E.,
Metsch, T., Monga, I., Valpato, G. L., and Grimm, C.
(2006). Firewall issues overview.
Pereira, R. and Beaulieu, S. (1999). Extended Authenti-
cation Within ISAKMP/Oakley (XAUTH). Internet-
Draft draft-ietf-ipsec-isakmp-xauth-06, Internet Engi-
neering Task Force. Work in Progress.
Prevelakis, V. and Hamad, M. (2015). A policy-based com-
munications architecture for vehicles. In International
Conference on Information Systems Security and Pri-
vacy, France.
Richardson, M. and Sommerfeld, B. E. (2006). Require-
ments for an IPsec API. Internet-Draft draft-ietf-btns-
ipsec-apireq-00, Internet Engineering Task Force.
Wu, C.-L., Wu, S. F., and Narayan, R. (2001). Ipsec/phil
(packet header information list): design, implementa-
tion, and evaluation. In Li, J. J., Luijten, R. P., and
Park, E. K., editors, ICCCN, pages 206–211. IEEE.
Yin, H. and Wang, H. (2007). Building an application-
aware ipsec policy system. IEEE/ACM Transactions
on Networking, 15(6):1502–1513.
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
558