.jpg?la=en&h=320&w=720&hash=244C75B74F0F77521D56164450973BCD){kind=logo}
.jpg?la=en&h=310&w=720&hash=8D9823F26AA80B2B75C3E4B2E61770DC)
.jpg?la=en&h=320&w=719&hash=13CA7E4AA3E453809B6726B561F2F4DD)
.jpg?la=en&h=306&w=720&hash=F21A7CD3C49EFBF4D41F00691D09AEAC){kind=logo}
.png?la=en&h=320&w=720&hash=18CFCCD916C92D922F600511FABD775D){kind=logo}
A simpler, more secure approach to IP networking
Host Identity Protocol (HIP) is a standard-track network security protocol, approved by the leading standards organization in the Internet, the Internet Engineering Task Force (IETF), in 2015. That event crowned over 15 years of HIP development, testing and deployment in coordination with several large companies (such as Boeing, Ericsson, Nokia, Verizon, TeliaSonera) and standard bodies (Trusted Computing Group, IEEE 802).
Understanding the Host Identity Protocol: RFC 7401 and RFC 9063
The Host Identity Protocol (HIP) is formally defined through two foundational IETF documents that work in tandem to establish its design and implementation, together forming the essential foundation for understanding and deploying HIP across modern networks.
RFC 9063 – Host Identity Protocol Architecture
- Serves as the conceptual blueprint for HIP, updating and superseding the earlier RFC 4423 to reflect refined thinking on separating host identity from network location.
- Explains the architectural rationale behind HIP, detailing how a cryptographic Host Identity Namespace can solve longstanding Internet challenges around mobility, multihoming and end-to-end security.
RFC 7401 – Host Identity Protocol Version 2 (HIPv2)
- Provides the detailed technical specification for how HIP is implemented, defining the base exchange protocol, packet formats and cryptographic procedures.
- Establishes the concrete mechanisms needed to create secure, authenticated and mobile-friendly connections between hosts in real-world deployments.
Secure by design – fixing the inherent flaw in IP
HIP fundamentally provides a secure overlay fabric over existing network infrastructures and introduces a new cryptographic host identifier separate from the usual IP address. The fact that IP addresses include both route information and host IDs has complicated security policy management for decades. The new HIP ID allows for simplified, centralized management of end-point access control policies. The creation of a secure overlay network and the encrypted identifier renders hosts completely invisible to unauthorized users and potential attacks.
Rather than probing an IP device for vulnerabilities, attackers will never know of the existence of the host on the network. To them, the device is completely cloaked. This is the fundamental shift for Tempered Airwall compared to other zero trust and remote access solutions, reducing attack surfaces by upwards of 90% in most deployments.
Frequently asked questions
-
What is the OpenBlue Host Identity Protocol (HIP)?
OpenBlue Host Identity Protocol (HIP) is a secure networking technology that uses cryptographic identities instead of IP addresses to establish trusted communications between devices, applications and users.
-
How does OpenBlue HIP improve cybersecurity?
OpenBlue HIP verifies the identity of every authorized device before communication is established. This identity-based approach helps reduce attack surfaces, limit unauthorized access and support Zero Trust security strategies.
-
What is identity-based networking?
Identity-based networking uses verified cryptographic identities rather than network locations or IP addresses to determine which devices and users can communicate. This approach provides greater security and flexibility for modern connected environments.
-
How does OpenBlue HIP support Zero Trust architecture?
OpenBlue HIP follows Zero Trust principles by authenticating and authorizing devices before allowing communication. Only trusted and approved connections are permitted, helping organizations control access and reduce cyber risk.
-
Can OpenBlue HIP help secure building automation systems?
Yes. OpenBlue HIP helps secure building automation networks by establishing trusted connections between authorized devices, controllers, systems and users while preventing unnecessary network exposure.
-
What environments can benefit from OpenBlue HIP?
Organizations operating critical infrastructure, healthcare facilities, manufacturing plants, transportation systems, utilities, government facilities, and commercial buildings can benefit from identity-based security and secure connectivity.
-
How is OpenBlue HIP different from traditional IP-based networking?
Traditional networking relies on IP addresses to identify and connect devices. OpenBlue HIP uses cryptographic identities, making it more difficult for attackers to discover, impersonate or compromise networked assets.
-
Does OpenBlue HIP support remote access?
Yes. OpenBlue HIP enables secure remote connectivity by validating device identities before access is granted, helping organizations support remote operations while maintaining strong security controls.
-
Can OpenBlue HIP help reduce lateral movement within a network?
Yes. By restricting communications to only authorized identities, OpenBlue HIP limits unnecessary connectivity and helps prevent attackers from moving freely between systems if a device becomes compromised.
-
Does OpenBlue HIP require changes to existing applications?
OpenBlue HIP is designed to help organizations secure communications while minimizing disruption to existing operations and applications, supporting modernization efforts without requiring extensive infrastructure changes.
-
How does OpenBlue HIP support operational technology (OT) environments?
OpenBlue HIP helps establish trusted communications between OT assets, industrial control systems and connected devices, supporting cybersecurity initiatives while maintaining operational continuity.
-
Who should consider OpenBlue HIP?
Facility operators, cybersecurity teams, IT professionals, OT security teams, critical infrastructure operators and building owners should consider OpenBlue HIP when looking to strengthen Zero Trust, secure remote access and protect connected systems.