Authentication and Privacy Approach for DHCPv6

Al-Ani, Ayman; Anbar, Mohammed; Hasbullah, Iznan H.; Abdullah, Rosni

doi:10.1109/access.2019.2919966

Cited by 8 publications

(2 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, NDPsec is considered a better alternative than SeND Match-Prevention, and Trust-ND. Some potential future works include; making the proposed mechanism work with stateful mode (i.e DHCPv6) [37], [38] and proposing a mechanism to distribute the router's public key in the linklocal network.…”

Section: Discussionmentioning

confidence: 99%

NDPsec: Neighbor Discovery Protocol Security Mechanism

Al-Ani

Laghari

et al. 2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

Internet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP is an integral component of IPv6 since it resolves addresses, locates routers, and finds duplicated addresses in a local-link network. Because NDP is based on the premise that all nodes in the network are trustworthy, it is subject to a variety of attacks, including Denial of Service (DoS) on Duplicate Address Detection (DAD) attacks (aka. DoS-on-DAD), Address Resolution-based attacks, Router Advertisement (RA) based attacks, and Redirect attacks. This paper proposes an NDP security (NDPsec) mechanism based on the Ed25519 digital signature to authenticate IPv6 hosts to prevent unauthorized devices from joining the network. The proposed NDPsec mechanism is evaluated and compared to Secure NDP (SeND), Match-Prevention, and Trust-ND mechanisms. The performance is measured in terms of processing time, traffic overhead, and resilience against network-based attacks. The results obtained from the experiments showed that NDPsec successfully prevented cyberattacks, with approximately 144% less processing time and over 50% less traffic overhead compared to SeND (the default security mechanism for NDP protocol). The proposed NDPsec mechanism has remarkable superiority in terms of resilience against attacks compared to Match-Prevention and Trust-ND mechanisms.

show abstract

Section: Discussionmentioning

confidence: 99%

NDPsec: Neighbor Discovery Protocol Security Mechanism

Al-Ani

Laghari

et al. 2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…In an IPv6 link-local network, all nodes can automatically configure their addresses by using Stateless Address Autoconfiguration (SLAAC), which is one of the NDP functions, without the need for Dynamic Host Configuration Protocol version 6 (DHCPv6) [9], which is one of the NDP processes. SLAAC provides the IPv6 host with the power to generate a link-local network and a global address without the need for manual intervention.…”

Section: Neighbour Discovery Protocolmentioning

confidence: 99%

Match-Prevention Technique Against Denial-of-Service Attack on Address Resolution and Duplicate Address Detection Processes in IPv6 Link-Local Network

2020

Self Cite

View full text Add to dashboard Cite

Protocol version 6 (IPv6) host communicating with other neighbouring hosts. Two NDP messages are used during AR and DAD to communicate with one another in the same IPv6 link-local network, namely Neighbour Solicitation (NS) and Neighbour Advertisement (NA) messages. However, NDP messages have non-secure designs and lack verification mechanisms for authenticating whether incoming messages originate from a legitimate or illegitimate node. Therefore, any node in the same link can manipulate NS or NA messages and then launch a Denial-of-Service (DoS) attack. Techniques proposed to secure AR and DAD include Secure NDP (SeND) and Trust-NDP (Trust-ND); however, these techniques either entail high processing time and bandwidth consumption or are vulnerable to DoS attacks because of their designs. Therefore, to secure AR and DAD, this study aims to introduce a prevention technique called Match-Prevention, which secures target IP addresses and exchange messages (i.e. NS and NA). The processing time, bandwidth consumption and DoS prevention success rate of Match-Prevention in different scenarios are evaluated, and its performance is compared with those of existing techniques, including Standard-Process (i.e., Standard-AR and Standard-DAD), SeND and Trust-ND. Results show that Match-Prevention requires less processing time during AR and DAD processes and less bandwidth consumption compared with other existing techniques. In terms of DoS prevention success rate, the experiments show that Standard-Process and Trust-ND are unable to secure AR and DAD from DoS attacks, whilst SeND is vulnerable to flooding attacks. By contrast, Match-Prevention allows IPv6 nodes to verify the incoming message, discard the fake message before further processing and prevent a DoS attack during AR and DAD in an IPv6 link-local network.

show abstract