![](bg3.png)
used to make sure that the sender of a
neighbor discovery message is the owner of
the claimed address. A public-private key
pair is generated by all nodes before they can
claim an address. The CGA option is used to
carry the public key and associated
parameters. The messages are signed with
the corresponding private key. Only if the
source address and the public key are known
can the verifier authenticate the message
from that corresponding sender.
RSA option: The RSA Signature option is
used to authenticate the identity of the sender
and to protect all messages relating to
Neighbor and Router Discovery. The
message which is sent from CGA address is
signed with the address owner private key
and the public key is used to verify the
signature.
Nonce Option: This option provides anti-
replay protection, and ensures that an
advertisement is a fresh response to a
solicitation which is sent earlier by the node.
Timestamp option: the Timestamp make sure
that redirects and unsolicited advertisements
have not been replayed.
Certificate Path Solicitation (CPS): is sent
by hosts during the Authorization Delegation
Discovery (ADD) process to request a
certification path between a router and one of
the host’s trust anchors.
Certificate Path Advertisement (CPA): the
CPA message contains the router certificate,
it is sent in reply to the CPS message.
Although, SEND was designed to enhance the
security of the NDP protocol, it still suffers from
numerous vulnerabilities. On one hand, there is an
incompatibility between Anycast addresses and
SEND. Indeed, in the case of NDP signaling SEND
authorizes only the owner of the address. On the
other hand, the procedure of the CGA verification
used in SEND can launch DoS attack (Gelogo et al.,
2011). Finally, SEND (Arkko et al., 2005) ensures
that only the owner of the address is enabled to send
message with its source address. Therefore, the
message’s integrity is valid through the CGA
verification and the RSA Signature option
protection.
As well, the proxy ND can intercept and modifies
messages on behalf of the mobile nodes. As such,
Proxy ND and SEND are incompatible. This context
presents our interest.
5 RELATED WORK
Although the literature carries a multitude of ND
security protocols addressing a number of problems
related to security and mobility, there are no
lightweight, robust solutions ND Proxy that can
operate autonomously in an open environment
without use an incompatibilities problems between
ND proxy and SEND. This section details some
related work focused to resolves incompatibilities
between SEND and Proxy ND. Among them,
Krishnan et al. present in (Krishnan et al., 2012) a
certificate based solution. The router’s certificate is
extended to support a new Extended Key Usage
(EKU) field that indicates whether the router assumes
a proxy role. Then, whenever it issues or modifies
ND messages and signs with its public key.
Neighboring nodes learn, during the Authorization
Delegation Discovery, that the router is also
authorized to act as a proxy for this subnet prefix or
not, therefore they will trust all messages coming
from this proxy.
In document (Combes et al., 2010) and
(Nikander et al., 2002), Nikander and Arkko,
propose a solution which empowers the nodes to
determine if a router is trusted enough to be a proxy
and to issue a certificate to authorize it to act as
such. But, this solution fails to identify the real
overhead due to the certificate exchange mechanism.
In (Cheneau et al., 2011), the author’s claim their
solution is especially important to resolve
incompatibilities between SEND and Proxy ND,
which is based on Signature Algorithm Agility. In
this paper, the author’s propose modifications to the
CGA addresses and the SEND protocol to support
Signature Algorithm Agility and present the MCGA
addresses. Then they extend the MCGA addresses to
store public keys of different nodes, therefore
enabling a secure address sharing and to solve
incompatibilities between the Proxy ND and the
SEND protocol. With the novel solution-based
certification mechanism, and the introduction of new
addresses, the proposed solution achieves defending
against many attacks successfully and efficient.
6 IMPROVED SECURE
NEIGHBOR DISCOVERY
PROTOCOL
The principle operation of NDP is the neighbor
discovery. Indeed, when a mobile sends an NS
requesting some information to another neighbor
ImprovedSecureNeighborDiscoveryProtocol(ISEND)forNewWirelessNetworksGenerations
73