Intelligent DAD System Using SRIID Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Duplicate Address Detection (DAD) methods in IPv6 are susceptible to attacks, particularly in Wi-Fi networks and multi-link subnets, where malicious hosts can prevent other devices from obtaining IP addresses by falsely claiming addresses, leading to inefficiencies and increased power usage.
Innovation Solution
Implementing intelligent DAD using secret Random Interface Identifiers (SRIIDs) and allocated MAC addresses, which randomize the use of SRIIDs and MAC addresses in address conflict check messages to detect and prevent duplicate address detection attacks, ensuring legitimate hosts can obtain IP addresses while blocking malicious responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DAD protocol is used for address verification, then address uniqueness can be confirmed, but the system becomes vulnerable to DoS attacks where malicious hosts can falsely claim addresses and prevent legitimate hosts from obtaining IP addresses
Solution Approach 1:
The patent changes the parameter of address verification by introducing a challenge-response mechanism with timestamps. Instead of simple DAD probes, the system uses ICV (Integrity Check Value) calculations based on cryptographic functions of source and destination addresses combined with timestamp parameters. This transformation makes the verification process resistant to spoofing while maintaining compatibility with existing IPv6 infrastructure.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where a challenge message is sent from the requesting host to the responding host, and the response must contain a valid ICV calculated by the responding host. This intermediary challenge-response process prevents malicious hosts from falsely claiming addresses without the actual host's cooperation, thereby blocking DoS attacks while preserving address verification functionality.
2Object-affected harmful factors
If DAD attacks are prevented using secure NS messages with authentication, then security is improved, but the implementation complexity increases significantly
Solution Approach 1:
The patent extracts the authentication functionality from the complex secure NS message framework and implements it as a separate challenge-response mechanism using existing ICMPv6 messages. By taking out the essential security requirement (verification of address ownership) and implementing it independently through ICV calculations, the solution achieves security without the full complexity of authenticated NS messages.
Solution Approach 2:
The patent uses disposable timestamp values and single-use ICV calculations that are valid only for the specific challenge-response exchange. These temporary cryptographic parameters are generated and discarded after use, providing strong security without requiring persistent cryptographic credentials or complex key management infrastructure, thereby reducing implementation complexity.
3Productivity
If multiple DAD attempts are made to overcome false claims, then address acquisition may succeed, but power consumption increases and network efficiency decreases
Solution Approach 1:
The patent performs preliminary verification by requiring the responding host to calculate and return an ICV in the first challenge-response exchange. This preliminary authentication action verifies that the responding host actually owns the claimed address before the requesting host commits to using it, eliminating the need for multiple retry attempts and thereby reducing power consumption and improving network efficiency.
Data Source
AI summary
A system and method for intelligently detecting a duplicate address attack is described. The system and method comprise transferring a first address conflict check message; receiving a first address conflict check response message; performing intelligent Duplicate Address Detection (DAD) to determine if the duplicate address attack is valid; and if the duplicate address attack is valid, then reporting the duplicate address attack to a monitoring server. An intelligent switch that detects the DAD attack blocks further address conflict check response messages from the attacker's MAC address.