Secure Neighbor Discovery Proxy Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Secure Neighbor Discovery (SEND) protocol and Neighbor Discovery Proxy (ND Proxy) are incompatible, as ND Proxy modifies the MAC address in ND messages, breaking the originating host's signature, leading to invalidation of RSA signatures and causing legitimate proxy operations to be misinterpreted as malicious by SEND-capable nodes.
Innovation Solution
A method and proxy that modify ND messages by replacing the link layer address with the proxy's address, adding a proxy signature, and preserving the original content in new message fields, allowing verification of the legitimacy of modified messages by receiving hosts using a certificate issued to the proxy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the ND Proxy modifies the MAC address in ND messages to bridge multiple links, then the proxying function is achieved, but the originating host's RSA signature becomes invalid
Solution Approach 1:
The patent introduces a proxy signature as an intermediary authentication mechanism. The proxy signs the modified ND message with its own private key, creating a new signature that validates the modified message. This intermediary signature bridges the gap between the original message and the modified message, allowing the receiving host to verify the proxy's authorization to modify the message while preserving the original signature for reference.
2Ease of operation
If the proxy replaces the link layer address with its own address, then the neighbor discovery routing is enabled, but the receiving host misinterprets the legitimate operation as malicious
Solution Approach 1:
The patent implements a feedback mechanism where the proxy includes its signature in the modified ND message, providing authentication feedback to the receiving host. The receiving host uses this signature to verify that the modification was performed by an authorized proxy rather than a malicious entity. This feedback loop prevents misinterpretation of legitimate proxy operations.
3Reliability
If the proxy preserves the original content in new message fields, then the original signature can be verified, but the message structure becomes more complex
Solution Approach 1:
The patent segments the authentication information into distinct components: the original signature from the sending host and a new proxy signature from the proxy. Each signature serves a specific verification purpose. This segmentation allows the receiving host to independently verify both the original message integrity and the proxy's authorization, managing complexity through structured separation of authentication functions.
Data Source
AI summary
A method, a proxy and a host are provided for securing neighbor discovery (ND) signaling between hosts when the hosts are connected through the proxy. A first host sends an original ND message comprising a first signature based on an address of the first host. The proxy removes the address of the first host and substitutes its own address in a modified ND message. The proxy then places a copy of the address of the first host in a new field and builds a proxy signature based on the own address of the proxy and on the new field. The new field and the proxy signature are added to the modified ND message. A second host receives the modified ND message from the proxy and verifies the proxy signature. The second host reconstructs the original ND message content and then verifies the first signature.