Network Impersonation Defense Using Cryptographic Neighbor Discovery

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing network security protocols, such as RFC 8505, do not adequately protect against rogue routing devices impersonating networks and do not ensure that host computing devices are authentic, leading to potential unauthorized network connections and data security risks.

Innovation Solution

Implementing Address Protected Neighbor Discovery (AP-ND) with cryptographic identifiers (crypto-IDs) and nonces to verify the ownership of network addresses, ensuring that both the host computing device and the network are authenticated through a challenge-response mechanism involving network and host crypto-IDs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional Neighbor Discovery protocols are used for network joining, then network connectivity is established, but the host is vulnerable to rogue routing devices impersonating the network

Engineering Contradiction:
Improvenetwork authentication reliabilityVSAvoidimpersonation attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by pre-provisioning the host with network cryptographic identifiers (crypto-IDs) before the host joins the network. This allows the host to verify the network's authenticity in advance through cryptographic verification, preventing impersonation attacks before they can succeed.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent introduces cryptographic identifiers (crypto-IDs) as an intermediary mechanism between the host and the network. These crypto-IDs serve as mediators that enable secure verification of the network's identity, allowing the host to authenticate the network without directly trusting the routing device.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If cryptographic verification mechanisms are implemented, then network authentication security is improved, but protocol complexity increases

Engineering Contradiction:
Improveauthentication securityVSAvoidprotocol complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the cryptographic verification functionality into a separate, standardized extension mechanism. By separating the security verification logic from the core Neighbor Discovery protocol, the implementation can adopt the cryptographic features without fundamentally redesigning the entire protocol stack.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent creates a universal cryptographic verification mechanism that can be applied across different Neighbor Discovery implementations. The crypto-ID verification extension provides multi-functional security that works with various network types and routing protocols, reducing overall system complexity through standardization.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP4229822B1Network security from host and network impersonation
Publication Date: 2025.08.27 CISCO TECHNOLOGY INC
  • EP4229822B1 patent drawingFigure 1
  • EP4229822B1 patent drawingFigure 2
  • EP4229822B1 patent drawingFigure 3

AI summary

Systems and methods may include sending, to a network registrar, an extended duplicate address request (EDAR) message including a first nonce generated by a host computing device, and receiving, from the network registrar, an extended duplicate address confirmation (ED AC) message including a second nonce, the second nonce being signed by the network registrar via a private key of a first public key infrastructure (PKI) key pair of the network registrar via a first signature. The method further includes sending a first neighbor advertisement (NA) message to the host computing device including the second nonce. The second nonce and the private key of the network registrar verifies the first signature from the network registrar, the verification of the first signature indicating that the router is not impersonating the network.