IPv6 Neighbor Discovery Protocol Specifications, Threats and Countermeasures: A Survey

Ahmed, Amjed Sid; Hassan, Rosilah; Othman, Nor Effendy

doi:10.1109/access.2017.2737524

Cited by 48 publications

(14 citation statements)

References 82 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Countermeasures include the use of compressed transport protocols, for instance datagrams transport layer security (DTLS) [72]. The threats against the neighbor discovery protocol (NDP) are presented in [75]. In this work, a detailed description of the operation and the most common attacks towards NDP is performed.…”

Section: Protocols Attacksmentioning

confidence: 99%

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Τσίκνας¹,

Taketzis²,

Demertzis³

et al. 2021

Preprint

View full text Add to dashboard Cite

In today’s Industrial IoT (IIoT) environment, where different systems interact with the physical world, the state proposed by the Industry 4.0 standards can lead to escalating vulnerabilities, especially when these systems receive data streams from multiple intermediaries, requiring multilevel security approaches, in addition to link encryption. At the same time taking into account the heterogeneity of the systems included in the IIoT ecosystem and the non-institutionalized interoperability in terms of hardware and software, serious issues arise as to how to secure these systems. In this framework, given that the protection of industrial equipment is a requirement inextricably linked to technological developments and the use of the IoT, it is important to identify the major vulnerabilities, the associated risks and threats and to suggest the most appropriate countermeasures. In this context, this study provides a description of the attacks against IIoT systems, as well as a thorough analysis of the solutions against these attacks, as they have been proposed in the most recent literature.

show abstract

Section: Protocols Attacksmentioning

confidence: 99%

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Τσίκνας¹,

Taketzis²,

Demertzis³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…AR, DAD, etc.) and disturb this process by manipulating the messages and carrying out a DoS attack [10]. The section below discusses the vulnerabilities to a DoS attack of two common NDP processes performed frequently from each of the IPv6 hosts in the network.…”

Section: Neighbour Discovery Protocolmentioning

confidence: 99%

“…The IP address of a host is just an abstract network layer address. If a host wants to transmit the network layer's packet to the target host, then the packet needs to be converted into a MAC frame that can be sent to the actual network [10]. Therefore, regardless of whatever protocols the network layer used, the physical address of the target in the data-link layer must be known to achieve transmission.…”

Section: Address Resolution Process and Its Security Challengesmentioning

confidence: 99%

“…Therefore, INDPmon can also warn the network of NDP attacks because the majority of these attacks violate the protocol rules. Previous studies [10], [15] show that INDPmon can only identify NDP attacks that violate the fundamental protocols (i.e. protocol-rule-related violations).…”

Section: A Network Monitoring Techniquesmentioning

confidence: 99%

“…SeND aims to prevent NS and NA spoofing, NUD failure, DoS-on-AR and NDP DoS attacks [24]. However, previous studies [7], [10], [15] reveal that the security options of SeND, including CGA and RSA, hinder the implementation of this mechanism as an NDP extension in an IPv6 link-local network. Moreover, CGA cannot establish the identity of a legitimate host, thereby allowing attackers to capture the NDP messages, modify the CGA parameters and, eventually, exploit the target hosts.…”

Section: B Extend Ndp-header Techniquesmentioning

confidence: 99%

See 2 more Smart Citations

Match-Prevention Technique Against Denial-of-Service Attack on Address Resolution and Duplicate Address Detection Processes in IPv6 Link-Local Network

2020

View full text Add to dashboard Cite

Protocol version 6 (IPv6) host communicating with other neighbouring hosts. Two NDP messages are used during AR and DAD to communicate with one another in the same IPv6 link-local network, namely Neighbour Solicitation (NS) and Neighbour Advertisement (NA) messages. However, NDP messages have non-secure designs and lack verification mechanisms for authenticating whether incoming messages originate from a legitimate or illegitimate node. Therefore, any node in the same link can manipulate NS or NA messages and then launch a Denial-of-Service (DoS) attack. Techniques proposed to secure AR and DAD include Secure NDP (SeND) and Trust-NDP (Trust-ND); however, these techniques either entail high processing time and bandwidth consumption or are vulnerable to DoS attacks because of their designs. Therefore, to secure AR and DAD, this study aims to introduce a prevention technique called Match-Prevention, which secures target IP addresses and exchange messages (i.e. NS and NA). The processing time, bandwidth consumption and DoS prevention success rate of Match-Prevention in different scenarios are evaluated, and its performance is compared with those of existing techniques, including Standard-Process (i.e., Standard-AR and Standard-DAD), SeND and Trust-ND. Results show that Match-Prevention requires less processing time during AR and DAD processes and less bandwidth consumption compared with other existing techniques. In terms of DoS prevention success rate, the experiments show that Standard-Process and Trust-ND are unable to secure AR and DAD from DoS attacks, whilst SeND is vulnerable to flooding attacks. By contrast, Match-Prevention allows IPv6 nodes to verify the incoming message, discard the fake message before further processing and prevent a DoS attack during AR and DAD in an IPv6 link-local network.

show abstract

IPv6 addressing with hidden duplicate address detection to mitigate denial of service attacks in the internet of drone

Kumar,

Pragya

2024

Concurrency and Computation

View full text Add to dashboard Cite

SummaryThe fusion of drones with the Internet, termed the Internet of Drones (IoD), resembles the Internet of Things (IoT) paradigm. In IoD, drones necessitate unique identifiers similar to IPv6 addresses. This paper presents a novel approach for securing the duplicate address detection (DAD) process in the IoD environment. This paper focuses on addressing the security challenges posed by malicious drones in the DAD process. The proposed solution introduces a hidden DAD (H‐DAD) process, to mitigate attacks on the DAD process. In this scheme, drones transmit a transformed portion of their interface identifier (IID) while concealing the full IID, thus thwarting potential disruptions by malicious entities. We evaluated the effectiveness of the H‐DAD scheme through experimental analysis using Python with SimPy, comparing it with the Improved DAD, Secure DAD, and Standard DAD schemes. Our results demonstrate a notable improvement, with the Hidden DAD scheme achieving a 100% address success rate under attack. Moreover, it exhibits approximately 5% and 12% lower overhead and energy consumption, respectively, compared to the other schemes.

show abstract

IPv6 Neighbor Discovery Protocol Specifications, Threats and Countermeasures: A Survey

Cited by 48 publications

References 82 publications

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Match-Prevention Technique Against Denial-of-Service Attack on Address Resolution and Duplicate Address Detection Processes in IPv6 Link-Local Network

IPv6 addressing with hidden duplicate address detection to mitigate denial of service attacks in the internet of drone

Contact Info

Product

Resources

About