AS Semantic Router: Router-Centric Architecture for Identity-Oriented Networking over Existing IPv4

This paper presents AS Semantic Router (Secure Application Protocol over Identity), a router-centric architecture that breaks the thirty-year deadlock of identifier-locator separation research. Unlike previous proposals (GSE 1994, HIP 2006, LISP 2013, NDN 2009, MobilityFirst 2011) that remained trapped in simulation environments, required endpoint cooperation, or demanded global Internet infrastructure changes, AS Semantic Router delivers production-validated identity separation at the edge router, operating entirely over existing IPv4 without modifying hosts, transit routers, or the IP protocol. The architecture introduces AeonNES (AEON Network Edge Semantics), a new semantic layer that nullifies traditional attack surfaces by shifting validation from IP/port/protocol tuples to cryptographic ID-KV marks. Each device receives an AEON Identity (AEON-ID) — cryptographic, rotating (monotonically increasing key_version), and managed entirely by the router. Applications address destinations by identity (aeon_connect(AEON-ID)); the router resolves identity to the current endpoint in real time. Authorization is granted by proof of identity (challenge/response with nonce and HMAC-SHA256), not by spoofable source addresses. Critical distinction from prior work: AS Semantic Router is agentless. Inert devices (smart TVs, printers, IoT appliances) receive identity and protection transparently to their firmware, solving the endpoint cooperation problem that prevented HIP and MobilityFirst from achieving mass deployment. Attack attribution occurs inside the router on both sides (attacker→target), turning every network event into an identity-identified pair. Production measurements on a real edge appliance (not simulation) demonstrate: complete AEON-ID-initiated chain in 0.15s end-to-end, zero AEON-ID leakage on the wire (pure IPv4/TCP headers), external visibility reduced to the ISP public IP alone (silent in Shodan), and L2.5 eBPF data plane sustaining ~176-182k pkt/s with 13/13 tests passed (performance, security, E2E, resilience). Conventional exploitation vectors (DoH, DoT, QUIC abuse, port scanning, IP spoofing) cease to exist as meaningful concepts — traffic that cannot speak AeonNES is not "blocked by a rule" but unrecognized and discarded as noise before it can register as a connection attempt. This is not a simulation-based proposal or incremental improvement to IP-based security. It is a production-validated deployment that renders the existing attack surface obsolete at the edge, delivering the identifier-locator separation that thirty years of academic research could not achieve in practice. Blockchain Temporal Proof AS Router sematic.pdfSHA-256: 562eef7fcb298a4d4599f410f9b4e4cf50699c5f275fd16d171be697b8ecfbd6Bitcoin Block: 965627 TESTES-DATA-PLANE-IDKV.mdSHA-256: 8b522943a8ce8157593fdfe7df59ba0d17d97bc9c0986e83449e6f52105fcd52Bitcoin Block: 965627 Attestation: 2026-09-05 14:58:03 GMTVerify: https://mempool.space/block/965627