Improved Secure Neighbor Discovery Protocol (ISEND) for New Wireless Networks Generations

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

Tactical Wireless sensor networks (WSNs) provide a low-signature communications system that can be used for a wide variety of military applications. However, these networks are vulnerable to intrusion and must balance security with performance and longevity. The neighbor discovery process in a WSN is vital for nodes to maintain network connectivity, but it introduces security vulnerabilities. In addition, existing protocols for securing the neighbor discovery process use public key encryption (PKE), which is computationally expensive for low-powered, resource-constrained IEEE 802.15.4 enabled sensor devices. Therefore, a lightweight algorithm to secure the neighbor discovery process is necessary to prevent unauthorized nodes from accessing network data and resources. We develop a key management algorithm that modifies the commonly used Neighbor Discovery Protocol (NDP) and Secure Neighbor Discovery (SEND) protocol. We replace PKE in NPD and SEND with a symmetric encryption algorithm, AES, to allow for energy efficiency. In addition, we implement the Diffie-Hellman key exchange algorithm for symmetric key management. We simulate our algorithm in MATLAB to demonstrate its effectiveness in securing the neighbor discovery protocol while providing energy and message efficiency and key security.

The neighbor discovery protocol (NDP) is a stateless protocol facilitating link local communication in IPv6 networks. The nodes employ IPv6 NDP to locate other hosts/routers on the link, cover resolution of link layer addresses, duplicate address detections and track reachability status about paths to active nodes. However, link local communication using NDP is susceptible to some severe attacks, which if neglected leave the network vulnerable. Attackers can spoof source addresses of legitimate nodes by forging NDP messages and propel attacks like Denial of Service (DoS) and Man-in-the-Middle (MITM) leading to failure of IPv6 host initialization. To avert this, RFC 3971 advocates employing Secure Neighbor Discovery (SeND) to make the process inviolable. SeND fortifies message tampering, prevents IPv6 address theft, including protection against replay attacks and enable validation of routers on the link. Although SeND is a robust link layer security mechanism, its practical implementation is reported to have serious shortcomings like cryptographic algorithms which impact computational complexity including bandwidth utilization, as such negate their implementation and adoption. Moreover, the protocol itself fails to provide the confidentiality factor in the network. SeND also falls short of mature unabridged implementations in commercial operating systems and network devices. This paper revisits the protocol implementation and reviews its deployment challenges. This article also discusses some feasible proposals and recommendations for facilitating practical deployment of SeND in IPv6 networks including resource constrained devices like mobile phones.

Mobile devices apply neighbor discovery (ND) protocols to wirelessly initiate a first contact within the shortest possible amount of time and with minimal energy consumption. For this purpose, over the last decade, a vast number of ND protocols have been proposed, which have progressively reduced the relation between the time within which discovery is guaranteed and the energy consumption. In spite of the simplicity of the problem statement, even after more than 10 years of research on this specific topic, new solutions are still proposed even today. Despite the large number of known ND protocols, given an energy budget, what is the best achievable latency still remains unclear. This paper addresses this question and for the first time presents safe and tight, duty-cycle-dependent bounds on the worst-case discovery latency that no ND protocol can beat. Surprisingly, several existing protocols are indeed optimal, which has not been known until now. We conclude that there is no further potential to improve the relation between latency and duty-cycle, but future ND protocols can improve their robustness against beacon collisions.

The adoption of Internet Protocol version 6 (IPv6) has increased due to the requirements for a larger address space and better suitability for modern networks, such as Internet of Things (IoT) networks, but it also introduces new security challenges. The Neighbor Discovery Protocol (NDP) that supports features like the router discovery and address resolution, is not secured due to its stateless and trust-based feature. The most notable one is the NDP Table Exhaustion attack that consists of overwhelming the network with forged Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packets, inducing neighbor cache overload and denial-of-service (DoS). Current defenses, such as Secure Neighbor Discovery (SEND) or machine learning-based detection models, have significant computational overheads and cannot be adapted to resource-constrained networks, creating a gap in the overall security of IPv6. To address this problem, this research paper suggests a lightweight, flow-based detection framework that integrates an entropy-based analysis with rule-based thresholds to detect NS and NA flooding attacks. The system gathers traffic into flows, entropy checks on key fields such as source Internet Protocol (IP) and network prefix, and alerts on anomalies when the traffic moves out of the normal operation range. It had the average precision of 0.91, average recall of 0.88, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$F 1$</tex>-score of 0.87, but with minimal overhead and highly deployable in both enterprise and IoT networks.

Neighbor Discovery protocol can be used to communicate between neighboring nodes in the MobileIPv6 environment. For a secure Neighbor Discovery protocol, the IETF SEND working group standardized a Secure Neighbor Discovery protocol, and a Cryptographically Generated Address protocol. Neighbor Discovery protocol can be provided with secure functions by adding the RSA signature option and the CGA parameter option. But one drawback of SEND protocol is, it cannot provide the confidentiality of Neighbor Discovery messages. To provide the confidentiality of Secure Neighbor Discovery protocol message in Mobile IPv6 environment, we propose a mechanism that solve the problem by AES encryption algorithm using a symmetric key without a certification authority or any security infrastructure.

As an indispensable part of Internet of Things (IoT), wireless sensor networks (WSNs) are more and more widely used with the rapid development of IoT. The neighbor discovery protocols are the premise of communication between nodes and networking in energy-limited self-organizing wireless networks, and play an important role in WSNs. Because the node energy is limited, neighbor discovery must operate in an energy-efficient manner, that is, under the condition of a given energy budget, the neighbor discovery performance should be as good as possible, such that the discovery latency would be as small as possible and the discovered neighbor percentage as large as possible. The indirect neighbor discovery mainly uses the information of the neighbors that have been found by a pairwise discovery method to more efficiently make a re-planning of the discovery wake-up schedules of the original pairwise neighbor discovery, thereby improving the discovery energy efficiency. The current indirect neighbor discovery methods are mainly divided into two categories: one involves removing the inefficient active slots in the original discovery wake-up schedules, and the other involves adding some efficient active slots. However, the two categories of methods have their own limitations. The former does not consider that this removal operation destroys the integrity of the original discovery wake-up schedules and hence the possibility of discovering new neighbors is reduced, which adversely affects the discovered neighbor percentage. For the latter category, there are still inefficient active slots that were not removed in the re-planned wake-up schedules. The motivation of this paper is to combine the advantages of these two types of indirect neighbor discovery methods, that is, to combine the addition of efficient active slots and the removal of inefficient active slots. To achieve this goal, this paper proposes, for the first time, the concept of virtual nodes in neighbor discovery to maximize the integrity of the original wake-up schedules and achieve the goals of adding efficient active slots and removing inefficient active slots. Specifically, a virtual node is a collaborative group that is formed by nodes within a small range. The nodes in a collaborative group share responsibility for the activating task of one member node, and the combination of these nodes’ wake-up schedules forms the full wake-up schedule of a node that only uses a pairwise method. In addition, this paper proposes a set of efficient group management mechanisms, and the key steps affecting energy efficiency are analyzed theoretically to obtain the energy-optimal parameters. The extended simulation experiments in multiple scenarios show that, compared with other methods, our neighbor discovery protocol based on virtual nodes (VN-NDP) has a significant improvement in average discovery delay and discovered neighbor percentage performance at a given energy budget. Compared with the typical indirect neighbor discovery algorithm EQS, a neighbor discovery with extended quorum system, our proposed VN-NDP method reduces the average discovery delay by up to and increases the discovered neighbor percentage by up to .

Neighbor discovery is the cornerstone of the mobile social applications over mobile ad hoc networks. Most current neighbor discovery protocols adopt a carefully designed wake-up/sleep schedule. However, a well-designed wake-up/sleep neighbor discovery schedule still might miss those neighbor nodes in the sleep state or discover undesirable neighbors with different purposes. Either results in inevitable discovery latency and unnecessary energy consumption. In this paper, we propose a flexible neighbor discovery protocol with social recognition under a passive discovery framework. In this framework, each mobile device is equipped with a wake-up radio. When a mobile node, called sponsor node, launches a neighbor detection, it will broadcast a wake-up radio signal before the hello message. Within a certain distance, the node will be triggered by its wake-up radio for a hello message, which is integrated with the social information. Furthermore, a flexible self-adjustment strategy is designed for the sponsor node to improve discovery-efficiency. Our protocol shows higher efficiency in both discovery latency and energy consumption than the traditional deterministic neighbor discovery protocols in the simulation.

On multipacket reception based neighbor discovery in low-duty-cycle wireless sensor networks

The majority of local IPv6 networks continue to remain insecure and vulnerable to neighbor spoofing attacks. The Secure Neighbor Discovery (SEND) standard and its concomitant Cryptographically Generated Addressing (CGA) scheme were accepted by large standard bodies to codify practical mitigations. SEND and CGA have never seen widespread adoption due to their complexities, obscurity, costs, compatibility issues, and continued lack of mature implementations. In light of their poor adoption, research since their standardization has continued to find new perspectives and proffer new ideas. The orthodox solutions for securing Neighbor Discovery have historically struggled to successfully harmonize three core ideals: simplicity, flexibility, and privacy preservation. This research introduces Voucher-Based Addressing, a low-configuration, low-cost, and high-impact alternative to IPv6 address generation methods. It secures the Neighbor Discovery address resolution process while remaining simple, highly adaptable, indistinguishable, and privacy-focused. Applying a unique concoction of cryptographic key derivation functions, link-layer address binding, and neighbor consensus on the parameters of address generation, the resolved address bindings are verifiable without the need for complex techniques that have hindered the adoption of canonical specifications.

From the perspective of media protocol control and routing of directional wireless ad hoc sensors networks, neighbor discovery protocol is an important problem to be solved first. In the past period of time, some methods have been studied on neighbor discovery protocol, but they have a common defect of link collision. The collision is caused by mutual interference of multiple transmitting nodes which are in one reception beam of the receiving node. To solve this problem, we propose a neighbor discovery algorithm using a bi-directional carrier sense collision avoidance and multi subchannels based on a scan-based algorithm (BD-SBA). Based on a scan-based algorithm (SBA), bi-directional carrier sense of the BD-SBA algorithm is performed in the first broadcast step which can reduce the collision of broadcasting the scanning request (SREQ) frames. In the second step (the reply step), the mechanism of multiple subchannels and multiple slots is applied to reduce the collision of the scanning response (SRES) frames. From the analysis and simulation, we can see that nodes using proposed algorithm can discover their neighbor nodes in fewer time. Moreover, the proposed algorithm has better performance for different beamwidths and densely distributed scenes. So it has great significance in engineering application.

Homes, offices and vehicles are getting networked. This will enable context aware, autonomous operation of many support systems that could be controlled remotely. To achieve this there would be a large number of tiny devices - sensors and actuators - which are networked and they are termed generally as Internet of Things (IoT) devices. In future, they will be powered through harvested energy from the ambience to enable perennial lifetime and minimal manual maintenance. Some examples of energy sources are photovoltaic panels and piezoelectric crystals. Several challenges arise due to the nature of sources of energy. One of these challenges is that the devices (nodes) leave and re-enter networks due to fluctuating availability of harvested energy. As a result, the neighbor table maintained at each node changes quite often leading to complications in forming and maintaining routes. In fact initial neighbor discovery (ND) itself is a difficult task. Further, usage of directional antennas would increase the time taken to complete ND. We study such a network through exhaustive simulation study considering various parameters. We demonstrate the benefits and challenges of using directional antennas for ND. We present a scheme that nodes could use to discover their neighbor during initial deployment and another scheme that could be used for subsequent discovery on re-entry into the network. We show that a dedicated ND protocol is necessary for energy harvesting networks and that directional ND is beneficial in these networks under some circumstances.

Neighbor discovery in wireless networks with sectored antennas