Secure Neighbor Discovery Protocol

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

Neighbor Discovery (ND) protocol has been proposed to discover neighboring hosts and routers in IPv6 wired or wireless local networks. Even though ND protocol is very useful, it has a weakness to security because it allows a malicious user to impersonate a legitimate host or a router by forging ND protocol messages. To address the security problem, IETF (Internet Engineering Task Force) has proposed SEcure Neighbor Discovery (SEND) protocol. The key functions of SEND protocol include address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism. In this paper, we analyze SEND protocol in the view point of security through several experiments. For this, we implement SEND protocol in IPv6 real system and develop a simulation environment. Based on the experimental results, we also propose a monitoring-based ND message differentiation scheme which is able to make up for security vulnerability of SEND protocol effectively.

In charge of several critical functionalities, the Neighbor Discovery Protocol (NDP) is used by IPv6 nodes to find out nodes on the link, to learn their link-layer addresses to discover routers, and to preserve reachability information about the paths to active neighbors. Given its important and multifaceted role, security and efficiency must be ensured. However, NDP is vulnerable to critical attacks such as spoofing address, denial-of-service (DoS) and reply attack. Thus, in order to protect the NDP protocol, the Secure Neighbor Discovery (SEND) was designed. Nevertheless, SEND's protection still suffers from numerous threats and it is currently incompatible with the context of mobility and especially with the proxy Neighbor Discovery function used in Mobile IPv6. To overcome these limitations, this paper defines a new protocol named Improved Secure Neighbor Discovery (ISEND) which adapt SEND protocol to the context of mobility and extend it to new functionalities. The proposed protocol (ISEND) has been modeled and verified using the Security Protocol ANimator software (SPAN) for the Automated Validation of Internet Security Protocols and Applications (AVISPA) which have proved that authentication goals are achieved. Hence, the scheme is safe and efficient when an intruder is present.

Tactical Wireless sensor networks (WSNs) provide a low-signature communications system that can be used for a wide variety of military applications. However, these networks are vulnerable to intrusion and must balance security with performance and longevity. The neighbor discovery process in a WSN is vital for nodes to maintain network connectivity, but it introduces security vulnerabilities. In addition, existing protocols for securing the neighbor discovery process use public key encryption (PKE), which is computationally expensive for low-powered, resource-constrained IEEE 802.15.4 enabled sensor devices. Therefore, a lightweight algorithm to secure the neighbor discovery process is necessary to prevent unauthorized nodes from accessing network data and resources. We develop a key management algorithm that modifies the commonly used Neighbor Discovery Protocol (NDP) and Secure Neighbor Discovery (SEND) protocol. We replace PKE in NPD and SEND with a symmetric encryption algorithm, AES, to allow for energy efficiency. In addition, we implement the Diffie-Hellman key exchange algorithm for symmetric key management. We simulate our algorithm in MATLAB to demonstrate its effectiveness in securing the neighbor discovery protocol while providing energy and message efficiency and key security.

The adoption of Internet Protocol version 6 (IPv6) has increased due to the requirements for a larger address space and better suitability for modern networks, such as Internet of Things (IoT) networks, but it also introduces new security challenges. The Neighbor Discovery Protocol (NDP) that supports features like the router discovery and address resolution, is not secured due to its stateless and trust-based feature. The most notable one is the NDP Table Exhaustion attack that consists of overwhelming the network with forged Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packets, inducing neighbor cache overload and denial-of-service (DoS). Current defenses, such as Secure Neighbor Discovery (SEND) or machine learning-based detection models, have significant computational overheads and cannot be adapted to resource-constrained networks, creating a gap in the overall security of IPv6. To address this problem, this research paper suggests a lightweight, flow-based detection framework that integrates an entropy-based analysis with rule-based thresholds to detect NS and NA flooding attacks. The system gathers traffic into flows, entropy checks on key fields such as source Internet Protocol (IP) and network prefix, and alerts on anomalies when the traffic moves out of the normal operation range. It had the average precision of 0.91, average recall of 0.88, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$F 1$</tex>-score of 0.87, but with minimal overhead and highly deployable in both enterprise and IoT networks.

Mobile devices apply neighbor discovery (ND) protocols to wirelessly initiate a first contact within the shortest possible amount of time and with minimal energy consumption. For this purpose, over the last decade, a vast number of ND protocols have been proposed, which have progressively reduced the relation between the time within which discovery is guaranteed and the energy consumption. In spite of the simplicity of the problem statement, even after more than 10 years of research on this specific topic, new solutions are still proposed even today. Despite the large number of known ND protocols, given an energy budget, what is the best achievable latency still remains unclear. This paper addresses this question and for the first time presents safe and tight, duty-cycle-dependent bounds on the worst-case discovery latency that no ND protocol can beat. Surprisingly, several existing protocols are indeed optimal, which has not been known until now. We conclude that there is no further potential to improve the relation between latency and duty-cycle, but future ND protocols can improve their robustness against beacon collisions.

The majority of local IPv6 networks continue to remain insecure and vulnerable to neighbor spoofing attacks. The Secure Neighbor Discovery (SEND) standard and its concomitant Cryptographically Generated Addressing (CGA) scheme were accepted by large standard bodies to codify practical mitigations. SEND and CGA have never seen widespread adoption due to their complexities, obscurity, costs, compatibility issues, and continued lack of mature implementations. In light of their poor adoption, research since their standardization has continued to find new perspectives and proffer new ideas. The orthodox solutions for securing Neighbor Discovery have historically struggled to successfully harmonize three core ideals: simplicity, flexibility, and privacy preservation. This research introduces Voucher-Based Addressing, a low-configuration, low-cost, and high-impact alternative to IPv6 address generation methods. It secures the Neighbor Discovery address resolution process while remaining simple, highly adaptable, indistinguishable, and privacy-focused. Applying a unique concoction of cryptographic key derivation functions, link-layer address binding, and neighbor consensus on the parameters of address generation, the resolved address bindings are verifiable without the need for complex techniques that have hindered the adoption of canonical specifications.

Neighbor Discovery protocol can be used to communicate between neighboring nodes in the MobileIPv6 environment. For a secure Neighbor Discovery protocol, the IETF SEND working group standardized a Secure Neighbor Discovery protocol, and a Cryptographically Generated Address protocol. Neighbor Discovery protocol can be provided with secure functions by adding the RSA signature option and the CGA parameter option. But one drawback of SEND protocol is, it cannot provide the confidentiality of Neighbor Discovery messages. To provide the confidentiality of Secure Neighbor Discovery protocol message in Mobile IPv6 environment, we propose a mechanism that solve the problem by AES encryption algorithm using a symmetric key without a certification authority or any security infrastructure.

Neighbor discovery is the cornerstone of the mobile social applications over mobile ad hoc networks. Most current neighbor discovery protocols adopt a carefully designed wake-up/sleep schedule. However, a well-designed wake-up/sleep neighbor discovery schedule still might miss those neighbor nodes in the sleep state or discover undesirable neighbors with different purposes. Either results in inevitable discovery latency and unnecessary energy consumption. In this paper, we propose a flexible neighbor discovery protocol with social recognition under a passive discovery framework. In this framework, each mobile device is equipped with a wake-up radio. When a mobile node, called sponsor node, launches a neighbor detection, it will broadcast a wake-up radio signal before the hello message. Within a certain distance, the node will be triggered by its wake-up radio for a hello message, which is integrated with the social information. Furthermore, a flexible self-adjustment strategy is designed for the sponsor node to improve discovery-efficiency. Our protocol shows higher efficiency in both discovery latency and energy consumption than the traditional deterministic neighbor discovery protocols in the simulation.

The fast growth of the Internet usage has caused problem on Internet protocol address space. To solve this problem, Internet Protocol version 6 (IPv6) was created to expand the availability of address spaces. An important part of the IPv6 suites is the Neighbour Discovery Protocol (NDP), which is geared towards substitution of Address Resolution Protocol in router discovery, and function redirection in Internet Protocol version 4 (IPv4). NDP includes the routing function which is determines which route a data packet will follow to arrive at its intended destination, and the address function which assigns unique addresses to each and every device connected to a network for identification purposes. NDP messages are broadly categorized into five types and each message type carries out distinct tasks, these messages are: Router Solicitation (RS), Neighbour Solicitation (NS), Router Advertisement (RA), Neighbour Advertisement (NA), and Redirect. NDP security vulnerabilities is openness of a network of computer, wherein there exists a lack of trust among users. Typically, huge numbers of NDP messages can be used to flood a network, resulting in disconnecting of the connected devices. Due to the limitations of existing defence mechanisms, NDP are still prone to network-based attacks and these vulnerabilities must be considered while creating an IPv6 network. In this thesis, we present a novel detection method for DDoS and Replayed attacks that are launched using NDP in IPv6. This detection method is a stream-based network representation, instead of packet-based representation. The proposed detection method makes use of Locally Weighted Learning machine learning techniques, with three different algorithms as its based learner Bayesian network, Decision tree and Naïve Bayes. LWL-Bayesian Network model achieved the highest detection rate of 96.48%. LWL-Naïve Bayes model is the next best model, with an accuracy rate of 96.024%, while the LWL-Decision Tree model had the lowest overall detection rate of 93%. Comparatively, all developed IDSs are capable of detecting DDoS and Replayed attacks based on NDP-based network traffic as well as the detection of anomalies. They all demonstrated strong predictive ability, however, the LWL-Bayesian Network model proved to have the best overall performance to develop a locally weighted IDS model among the three models. In short, the development of the detection models, has strong predictive capabilities, with high accuracy rate, does not overfit, has low computational costs, and uses less time for model development and attack detection.

As an indispensable part of Internet of Things (IoT), wireless sensor networks (WSNs) are more and more widely used with the rapid development of IoT. The neighbor discovery protocols are the premise of communication between nodes and networking in energy-limited self-organizing wireless networks, and play an important role in WSNs. Because the node energy is limited, neighbor discovery must operate in an energy-efficient manner, that is, under the condition of a given energy budget, the neighbor discovery performance should be as good as possible, such that the discovery latency would be as small as possible and the discovered neighbor percentage as large as possible. The indirect neighbor discovery mainly uses the information of the neighbors that have been found by a pairwise discovery method to more efficiently make a re-planning of the discovery wake-up schedules of the original pairwise neighbor discovery, thereby improving the discovery energy efficiency. The current indirect neighbor discovery methods are mainly divided into two categories: one involves removing the inefficient active slots in the original discovery wake-up schedules, and the other involves adding some efficient active slots. However, the two categories of methods have their own limitations. The former does not consider that this removal operation destroys the integrity of the original discovery wake-up schedules and hence the possibility of discovering new neighbors is reduced, which adversely affects the discovered neighbor percentage. For the latter category, there are still inefficient active slots that were not removed in the re-planned wake-up schedules. The motivation of this paper is to combine the advantages of these two types of indirect neighbor discovery methods, that is, to combine the addition of efficient active slots and the removal of inefficient active slots. To achieve this goal, this paper proposes, for the first time, the concept of virtual nodes in neighbor discovery to maximize the integrity of the original wake-up schedules and achieve the goals of adding efficient active slots and removing inefficient active slots. Specifically, a virtual node is a collaborative group that is formed by nodes within a small range. The nodes in a collaborative group share responsibility for the activating task of one member node, and the combination of these nodes’ wake-up schedules forms the full wake-up schedule of a node that only uses a pairwise method. In addition, this paper proposes a set of efficient group management mechanisms, and the key steps affecting energy efficiency are analyzed theoretically to obtain the energy-optimal parameters. The extended simulation experiments in multiple scenarios show that, compared with other methods, our neighbor discovery protocol based on virtual nodes (VN-NDP) has a significant improvement in average discovery delay and discovered neighbor percentage performance at a given energy budget. Compared with the typical indirect neighbor discovery algorithm EQS, a neighbor discovery with extended quorum system, our proposed VN-NDP method reduces the average discovery delay by up to and increases the discovered neighbor percentage by up to .

From the perspective of media protocol control and routing of directional wireless ad hoc sensors networks, neighbor discovery protocol is an important problem to be solved first. In the past period of time, some methods have been studied on neighbor discovery protocol, but they have a common defect of link collision. The collision is caused by mutual interference of multiple transmitting nodes which are in one reception beam of the receiving node. To solve this problem, we propose a neighbor discovery algorithm using a bi-directional carrier sense collision avoidance and multi subchannels based on a scan-based algorithm (BD-SBA). Based on a scan-based algorithm (SBA), bi-directional carrier sense of the BD-SBA algorithm is performed in the first broadcast step which can reduce the collision of broadcasting the scanning request (SREQ) frames. In the second step (the reply step), the mechanism of multiple subchannels and multiple slots is applied to reduce the collision of the scanning response (SRES) frames. From the analysis and simulation, we can see that nodes using proposed algorithm can discover their neighbor nodes in fewer time. Moreover, the proposed algorithm has better performance for different beamwidths and densely distributed scenes. So it has great significance in engineering application.

On multipacket reception based neighbor discovery in low-duty-cycle wireless sensor networks

Internet Protocol Version six (IPv6) is an ultimate solution for the Internet address depletion problem. It is developed not only to solve the addressing problem but also introduce some improvements on networking infrastructure. One of the improvements is the availability of Neighbor Discovery Protocol (NDP). Duplicate address detection (DAD) is one of the functions of NDP to make sure a generated IPv6 address is unique. However, since the NDP is not supported by a security mechanism, the DAD is vulnerable to DoS attack. Attacker can fail the detection process that causes on failing of IPv6 address configuration. The NDP standard suggested using IPSec or SeND to protect the NDP. However, the two security mechanisms introduced high computation due to the usage of cryptography algorithm. Further, its implementation in IPv6 local network is not trivial. This paper proposes a lightweight security mechanism based on distributed trust management that integrates hard security and soft security to secure the DAD in IPv6 called Trust-ND. The experimental result showed it could save the processing time of SeND mechanism up to 65.44 ms in sender and 23.53 ms in receiver. It also saves the available bandwidth up to 21.504 Kbps from the SeND mechanism.