An SDN-Based Authentication Mechanism for Securing Neighbor Discovery Protocol in IPv6

Abstract

The Neighbor Discovery Protocol (NDP) is one of the main protocols in the Internet Protocol version 6 (IPv6) suite, and it provides many basic functions for the normal operation of IPv6 in a local area network (LAN), such as address autoconfiguration and address resolution. However, it has many vulnerabilities that can be used by malicious nodes to launch attacks, because the NDP messages are easily spoofed without protection. Surrounding this problem, many solutions have been proposed for securing NDP, but these solutions either proposed new protocols that need to be supported by all nodes or built mechanisms that require the cooperation of all nodes, which is inevitable in the traditional distributed networks. Nevertheless, Software-Defined Networking (SDN) provides a new perspective to think about protecting NDP. In this paper, we proposed an SDN-based authentication mechanism to verify the identity of NDP packets transmitted in a LAN. Using the centralized control and programmability of SDN, it can effectively prevent the spoofing attacks and other derived attacks based on spoofing. In addition, this mechanism needs no additional protocol supporting or configuration at hosts and routers and does not introduce any dedicated devices.

Dual-Stack Network Management Through One-Time Authentication Mechanism

“…The authentication mechanism based on software-defined networking proposed by Lu et al [8] contains an authentication table module that maintains a sheet for storing the collected users' device information. The sheet is indexed by the MAC address to avoid duplicate entries.…”

Impacts Evaluation of DoS Attacks Over IPv6 Neighbor Discovery Protocol

“…In a word, SEND has many limitations including computation, deployment and security (Ahmed et al, 2017;Gelogo et al, 2011). Proposals to enhance SEND and make it applicable were introduced in (Sarma, 2014;Rafiee et al, 2011;Doja and Saggar, 2012;Kempf et al, 2006;Park et al, 2007;Cheneau and Laurent, 2011;Huang et al, 2009;Oh and Chae, 2007;Vasić et al, 2011;Lu et al, 2017). A small test bed consists of three computers; switch and router were used to implement DoS attacks against SeND.…”

Towards a New Algorithm to Optimize IPv6 Neighbor Discovery Security for Small Objects Networks

“…In [11], the authors have proposed a new method to secure Neighbor Discovery Protocol in IPv6. This mechanism is based on SDN controller to verify the source of NDP packets.…”

“…The attack is composed as follows: the attacker will deceive the DAD mechanism and make it succeed in one of the two cases where it fails so that the victim cannot claim an address. Since there is a finite number of tries to get an address, the DAD always ends up failing; it is a DoS attack [11]. For the attack to be feasible, the attacker must be able to listen on the network to any query necessary to perform the DAD procedure, e.g., the NS messages with the unspecified address as the source address is characteristics of the DAD procedure; this implies being able to join the multicast group "Solicited-Node".…”