Multi-Key Cryptographically Generated Address Secure Proxying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure claim and defense of network addresses in computer networks, such as those using Mobile IPv6 and DHCP, lack secure proxying capabilities, particularly for multi-host authorization and address delegation, leading to vulnerabilities in address ownership verification and defense.
Innovation Solution
The implementation of a multi-key cryptographically generated address (MCGA) system, where a DHCP server generates a network address using both the client's and its own public keys, allowing secure proxying and verification through the Secure Neighbor Discovery (SEND) protocol, enabling nodes to securely claim and defend addresses themselves or through proxies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single-key cryptographically generated address is used, then address generation and verification are simple, but secure proxying and multi-host authorization are not supported
Solution Approach 1:
The patent combines multiple public keys (client's public key and DHCP server's public key) into a single cryptographically generated address. This merging of key materials enables the address to serve dual purposes: it can be verified by either the client or the DHCP server, thus enabling secure proxying where either party can defend the address on behalf of the other.
Solution Approach 2:
The multi-key cryptographically generated address serves multiple functions simultaneously: it acts as a unique network identifier, provides authentication for both the client and DHCP server, enables secure proxying capabilities, and supports multi-host authorization. This universal address structure eliminates the need for separate mechanisms for these different security functions.
2Adaptability or versatility
If address delegation is implemented, then multi-host authorization is enabled, but address ownership verification becomes vulnerable
Solution Approach 1:
The DHCP server's public key acts as an intermediary trust anchor in the address delegation process. By incorporating the DHCP server's public key into the cryptographically generated address, the system creates a chain of trust where the DHCP server can verify and defend delegated addresses on behalf of clients, ensuring reliable address ownership verification even when delegation occurs.
Solution Approach 2:
The system performs preliminary cryptographic binding between the client's public key and the DHCP server's public key during address generation. This preliminary action establishes the trust relationship before address delegation occurs, ensuring that subsequent address verification and defense operations are secure and reliable.
3Ease of operation
If cryptographic hash of single public key is used for address generation, then verification is straightforward, but proxying security is compromised
Solution Approach 1:
The patent merges multiple public keys into the address generation process, creating a cryptographic hash that incorporates both the client's public key and the DHCP server's public key. This combined hashing approach maintains verification simplicity (the address is still generated by hashing public key materials) while simultaneously enabling secure proxying (either party with the corresponding private key can defend the address).
Data Source
AI summary
A method allows Internet Protocol version 6 (IPv6) nodes that use Mobile IPv6 for mobility management, or DHCP for address provisioning, to securely claim and defend their network addresses themselves or through proxies using the SEND protocol. The network node may also sign and verify a message that claims and defends a network address. The network address to be claimed and defended may be either autoconfigured or obtained from a server using the DHCPv6 protocol. If the MCGA is generated by a mobile IPv6 node as a mobile IPv6 home address, the MCGA can be securely proxied by the mobile IPv6 home agent after the mobile node has left the home link. However, if the MCGA is generated as a mobile IPv6 care-of address by a mobile IPv6 node while on a foreign subnet, the MCGA can be securely proxied by the current or new access router, before the mobile node arrives on the link and after it has left the link, respectively.