Network Impersonation Defense Using Cryptographic Neighbor Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security protocols, such as RFC 8505, do not adequately protect against rogue routing devices impersonating networks and do not ensure that host computing devices are authentic, leading to potential unauthorized network connections and data security risks.
Innovation Solution
Implementing Address Protected Neighbor Discovery (AP-ND) with cryptographic identifiers (crypto-IDs) and nonces to verify the ownership of network addresses, ensuring that both the host computing device and the network are authenticated through a challenge-response mechanism involving network and host crypto-IDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional Neighbor Discovery protocols are used for network joining, then network connectivity is established, but the host is vulnerable to rogue routing devices impersonating the network
Solution Approach 1:
The patent applies preliminary action by pre-provisioning the host with network cryptographic identifiers (crypto-IDs) before the host joins the network. This allows the host to verify the network's authenticity in advance through cryptographic verification, preventing impersonation attacks before they can succeed.
Solution Approach 2:
The patent introduces cryptographic identifiers (crypto-IDs) as an intermediary mechanism between the host and the network. These crypto-IDs serve as mediators that enable secure verification of the network's identity, allowing the host to authenticate the network without directly trusting the routing device.
2Reliability
If cryptographic verification mechanisms are implemented, then network authentication security is improved, but protocol complexity increases
Solution Approach 1:
The patent extracts the cryptographic verification functionality into a separate, standardized extension mechanism. By separating the security verification logic from the core Neighbor Discovery protocol, the implementation can adopt the cryptographic features without fundamentally redesigning the entire protocol stack.
Solution Approach 2:
The patent creates a universal cryptographic verification mechanism that can be applied across different Neighbor Discovery implementations. The crypto-ID verification extension provides multi-functional security that works with various network types and routing protocols, reducing overall system complexity through standardization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods may include sending, to a network registrar, an extended duplicate address request (EDAR) message including a first nonce generated by a host computing device, and receiving, from the network registrar, an extended duplicate address confirmation (ED AC) message including a second nonce, the second nonce being signed by the network registrar via a private key of a first public key infrastructure (PKI) key pair of the network registrar via a first signature. The method further includes sending a first neighbor advertisement (NA) message to the host computing device including the second nonce. The second nonce and the private key of the network registrar verifies the first signature from the network registrar, the verification of the first signature indicating that the router is not impersonating the network.