Internet Protocol Version 8 (IPv8)

1.3. The IPv8 Management Philosophy

The central operational concept in IPv8 is the Zone Server —
a paired active/active platform that runs every service a
network segment requires: address assignment (DHCP8), name
resolution (DNS8), time synchronisation (NTP8), telemetry
collection (NetLog8), authentication caching (OAuth8), route
validation (WHOIS8 resolver), access control enforcement
(ACL8), and IPv4/IPv8 translation (XLATE8).¶

A device connecting to an IPv8 network sends one DHCP8
Discover and receives one response containing every service
endpoint it requires. No subsequent manual configuration is
needed for any service. The device is fully operational —
authenticated, logged, time-synchronised, zone-policy-enforced
— before its first user interaction.¶

Every manageable element in an IPv8 network is authorised via
OAuth2 JWT tokens [RFC7519]. Tokens are validated locally by
the OAuth8 cache on the Zone Server without round trips to
external identity providers. A device in a remote location
with a temporarily unreachable cloud identity provider
continues to authenticate normally — the OAuth8 cache holds
all public keys and validates signatures locally in sub-
millisecond time. JWT tokens may be served by a local OAuth2
authority (home router operating in local authority mode) or
by a cached enterprise OAuth2 provider. Authentication is
universal, consistent, and requires no per-service credential
management.¶

Firmware and software updates for L1-L4 stack components are
managed via the Update8 protocol [UPDATE8]. Update8 defines
a standard vendor feed format, Zone Server validated proxy,
optional local caching, device criticality-based scheduling,
and rollback prevention enforced in NIC hardware. Devices
receive updates only from DNS-named sources validated by the
Zone Server. Connection to an update source identified by IP
address is blocked by default.¶

The 127.0.0.0/8 r.r.r.r range is permanently reserved as the
IPv8 internal zone prefix space. Organisations assign internal
zone prefixes (127.1.0.0, 127.2.0.0 etc) to network zones
and regions. Internal zone addresses are never routed
externally. No address conflict between zones is possible.
An organisation may build a network of arbitrary geographic
and organisational scale — with dozens of regional zones, each
containing thousands of devices — using familiar routing
protocols without any external address coordination.¶