NDPsec: Neighbor Discovery Protocol Security Mechanism
Internet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9848803/ |
| _version_ | 1818483660567871488 |
|---|---|
| author | Ayman Al-Ani Ahmed K. Al-Ani Shams A. Laghari Selvakumar Manickam Khin Wee Lai Khairunnisa Hasikin |
| author_facet | Ayman Al-Ani Ahmed K. Al-Ani Shams A. Laghari Selvakumar Manickam Khin Wee Lai Khairunnisa Hasikin |
| author_sort | Ayman Al-Ani |
| collection | DOAJ |
| description | Internet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP is an integral component of IPv6 since it resolves addresses, locates routers, and finds duplicated addresses in a local-link network. Because NDP is based on the premise that all nodes in the network are trustworthy, it is subject to a variety of attacks, including Denial of Service (DoS) on Duplicate Address Detection (DAD) attacks (aka. DoS-on-DAD), Address Resolution-based attacks, Router Advertisement (RA) based attacks, and Redirect attacks. This paper proposes an NDP security (NDPsec) mechanism based on the Ed25519 digital signature to authenticate IPv6 hosts to prevent unauthorized devices from joining the network. The proposed NDPsec mechanism is evaluated and compared to Secure NDP (SeND), Match-Prevention, and Trust-ND mechanisms. The performance is measured in terms of processing time, traffic overhead, and resilience against network-based attacks. The results obtained from the experiments showed that NDPsec successfully prevented cyberattacks, with approximately 144% less processing time and over 50% less traffic overhead compared to SeND (the default security mechanism for NDP protocol). The proposed NDPsec mechanism has remarkable superiority in terms of resilience against attacks compared to Match-Prevention and Trust-ND mechanisms. |
| first_indexed | 2024-12-10T15:44:50Z |
| format | Article |
| id | doaj.art-4d16cce6bef3403bb39d99f7526042ce |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-10T15:44:50Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-4d16cce6bef3403bb39d99f7526042ce2022-12-22T01:42:59ZengIEEEIEEE Access2169-35362022-01-0110836508366310.1109/ACCESS.2022.31960289848803NDPsec: Neighbor Discovery Protocol Security MechanismAyman Al-Ani0https://orcid.org/0000-0001-8391-5887Ahmed K. Al-Ani1https://orcid.org/0000-0002-1411-5330Shams A. Laghari2https://orcid.org/0000-0002-6036-395XSelvakumar Manickam3https://orcid.org/0000-0003-4378-1954Khin Wee Lai4https://orcid.org/0000-0002-8602-0533Khairunnisa Hasikin5https://orcid.org/0000-0002-0471-3820Faculty of Computing and Informatics, Universiti Malaysia Sabah, Kota Kinabalu, Sabah, MalaysiaSchool of Computing and Data Science, Xiamen University Malaysia, Sepang, Selangor, MalaysiaNational Advanced IPv6 Centre (NAv6), Universiti Sains Malaysia (USM), Gelugor, Penang, MalaysiaNational Advanced IPv6 Centre (NAv6), Universiti Sains Malaysia (USM), Gelugor, Penang, MalaysiaDepartment of Biomedical Engineering, Faculty of Engineering, University of Malaya, Kuala Lumpur, MalaysiaDepartment of Biomedical Engineering, Faculty of Engineering, University of Malaya, Kuala Lumpur, MalaysiaInternet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP is an integral component of IPv6 since it resolves addresses, locates routers, and finds duplicated addresses in a local-link network. Because NDP is based on the premise that all nodes in the network are trustworthy, it is subject to a variety of attacks, including Denial of Service (DoS) on Duplicate Address Detection (DAD) attacks (aka. DoS-on-DAD), Address Resolution-based attacks, Router Advertisement (RA) based attacks, and Redirect attacks. This paper proposes an NDP security (NDPsec) mechanism based on the Ed25519 digital signature to authenticate IPv6 hosts to prevent unauthorized devices from joining the network. The proposed NDPsec mechanism is evaluated and compared to Secure NDP (SeND), Match-Prevention, and Trust-ND mechanisms. The performance is measured in terms of processing time, traffic overhead, and resilience against network-based attacks. The results obtained from the experiments showed that NDPsec successfully prevented cyberattacks, with approximately 144% less processing time and over 50% less traffic overhead compared to SeND (the default security mechanism for NDP protocol). The proposed NDPsec mechanism has remarkable superiority in terms of resilience against attacks compared to Match-Prevention and Trust-ND mechanisms.https://ieeexplore.ieee.org/document/9848803/IPv6NDPdenial of serviceRA floodingsecurityauthentication |
| spellingShingle | Ayman Al-Ani Ahmed K. Al-Ani Shams A. Laghari Selvakumar Manickam Khin Wee Lai Khairunnisa Hasikin NDPsec: Neighbor Discovery Protocol Security Mechanism IEEE Access IPv6 NDP denial of service RA flooding security authentication |
| title | NDPsec: Neighbor Discovery Protocol Security Mechanism |
| title_full | NDPsec: Neighbor Discovery Protocol Security Mechanism |
| title_fullStr | NDPsec: Neighbor Discovery Protocol Security Mechanism |
| title_full_unstemmed | NDPsec: Neighbor Discovery Protocol Security Mechanism |
| title_short | NDPsec: Neighbor Discovery Protocol Security Mechanism |
| title_sort | ndpsec neighbor discovery protocol security mechanism |
| topic | IPv6 NDP denial of service RA flooding security authentication |
| url | https://ieeexplore.ieee.org/document/9848803/ |
| work_keys_str_mv | AT aymanalani ndpsecneighbordiscoveryprotocolsecuritymechanism AT ahmedkalani ndpsecneighbordiscoveryprotocolsecuritymechanism AT shamsalaghari ndpsecneighbordiscoveryprotocolsecuritymechanism AT selvakumarmanickam ndpsecneighbordiscoveryprotocolsecuritymechanism AT khinweelai ndpsecneighbordiscoveryprotocolsecuritymechanism AT khairunnisahasikin ndpsecneighbordiscoveryprotocolsecuritymechanism |