## 2 State-of-the-Art and Related Work  
To be able to ensure reliable and trusted communication and use of services, we need to be able to control what happens both in the infrastructure and for the end points, services for example. Regarding the infrastructure, trust has been focused on security measures, e.g., dealing with securing individual channels via IPSEC or through end-to-end SSL encryption. Network Address Translation (NAT) has addressed network autonomy and security by decoupling the internal network from the Internet [3]. Approaches such as HIP (Host Identity Protocol) have separated identification and identities from the addresses (locators) that point to where a device is attached. HIP uses cryptographic host identifiers with a global name space between the IP and transport layers [4]. The EU FP6 Ambient Networks project is based on such a separation of locator, identifier and administrative domains [4, 5]. Related approaches are PONA [6] and MILSA [7]. Some have suggested completely eliminating layering [8] to overcome layering violations of the TCP/IP architecture. Others adopt a content- or information-centric approach [9, 10] connecting information consumers with information producers. Building on this work,our goal on the infrastructure side is to enable reliable Virtual Infrastructure Sessions (VIS) connecting two or more end-points of the communication, represented by virtual identities as defined in SWIFT and Daidalos, to support privacy, with an architecture that allows us to control and understand trust related to the infrastructure and the end-points. We have not specifically addressed solutions, such as U-Prove and IDMix from the EU projects ABC4 Trust or Prime/Primelife. These address privacy in the context of services and applications, not the network or the infrastructure. They may thus be seen as complementary or orthogonal approaches to the one described here, see Figure 1.  
Much work including in standards has been done on the identity side of things. ITU-T Recommendation (X.1250) on global identity management [11] defines identity as the \"Representation of an entity (or group of entities) in the form of one or more information elements, which allow the entity(s) to be uniquely recognized within a context to the extent that is necessary (for the relevant applications).\" For privacy, we need to handle (and restrict) Personally Identifiable Information (PII), which is \"the information pertaining to any living person which makes it possible to identify such individual (including the information capable of identifying a person when combined with other information even if the information does not clearly identify the person)\" [12]. More on the application and end-point side, federated identity management systems are based on the SAMLv2 [13] Liberty Alliance [14] and Shibboleth [15] models, that support identity management, authentication and authorization. We differentiate between an identifier and an identity that includes attributes of the entity to enable communication between endpoints based on identifiers, possibly pseudonyms, as well as attributes, such as connecting with any entity with the property representative of bank x (not necessarily human). The use of pseudonyms and attributes help making identification more difficult.