Secure neighbor discovery (SEND) using pre-shared key
View Patent ↗An extension is provided to the SEND protocol without requiring a CGA or third party trust anchor. A shared key is provided to both a sender and receiver of a neighbor discovery (ND) message. A digital signature option is contained in the ND message. A digital signature field is determined by the algorithm field in the option. When the ND message is received, the receiver may verify the digital signature field using the pre-shared key according to the algorithm field. If the ND message passes verification, the receiver may process the message.
1. A method for verifying a neighbor discovery message, comprising:
receiving a neighbor discovery message from a first computer by a second computer, the neighbor discovery message including an algorithm identifier, an algorithm, and an encryption type identifier;
detecting the algorithm identifier;
accessing the algorithm identifier and algorithm from the neighbor discovery message;
identifying that the algorithm identifier corresponds to a value in an algorithm table at the second computer, wherein the value is in a row and in an algorithm field column of the algorithm table;
identifying an encryption type based on an entry appearing in the same row as the value and in a digital signature field column of the algorithm table;
identifying that the received neighbor discovery message is according to a standard Secure Network Discovery (SEND) protocol;
performing a verification of the received neighbor discovery message by the second computer based on the algorithm identifier, the algorithm, and a key; and
discarding, by the second computer, the received neighbor discovery message based on identifying that the message is according to the standard SEND protocol.
2. The method of claim 1 , wherein the key at the second computer is shared with the first computer, the first computer generating the message based on the key and the algorithm.
3. The method of claim 1 , wherein the algorithm identifier includes a value associated with a type of algorithm, the algorithm identifier stored in an algorithm field.
4. The method of claim 1 , wherein the verification is performed by a module operating at the link layer as an extension to the SEND protocol.
5. The method of claim 1 , the method further comprising:
identifying the received neighbor discovery message passes the verification.
6. The method of claim 1 , further comprising:
identifying the received neighbor discovery message fails the verification.
7. The method of claim 1 , further comprising:
detecting an option defined in a SEND protocol in the received neighbor discovery message.
8. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for verifying a neighbor discovery message, the method comprising:
receiving a neighbor discovery message from a first computer by, the neighbor discovery message including an algorithm identifier, an algorithm, and an encryption type identifier;
detecting the algorithm identifier;
accessing the algorithm identifier and algorithm from the neighbor discovery message;
identifying that the algorithm identifier corresponds to a value in an algorithm table at the second computer, wherein the value is in a row and in an algorithm field column of the algorithm table;
identifying an encryption type based on an entry appearing in the same row as the value and in a digital signature field column of the algorithm table;
identifying that the received neighbor discovery message is according to a standard Secure Network Discovery (SEND) protocol;
performing a verification of the received neighbor discovery message based on the algorithm identifier, the algorithm, and a key; and
discarding, by the second computer, the received neighbor discovery message based on identifying that the message is according to the standard SEND protocol.
9. The non-transitory computer readable storage medium of claim 8 wherein the key is shared with the first computer, the first computer generating the message based on the key and the algorithm.
10. The non-transitory computer readable storage medium of claim 8 , wherein the algorithm identifier includes a value associated with a type of algorithm, the algorithm identifier stored in an algorithm field.
11. The non-transitory computer readable storage medium of claim 8 , wherein the verification is performed by a module operating at the link layer as an extension to the SEND protocol.
12. The non-transitory computer readable storage medium of claim 8 , the program further executable to:
identify that the received neighbor discovery message passes the verification.
13. The non-transitory computer readable storage medium of claim 8 , wherein the program is further executable to:
identify the received neighbor discovery message fails the verification.
14. The non-transitory computer readable storage medium of claim 8 , wherein the program is further executable to:
detect an option defined in a SEND protocol in the received neighbor discovery message.
15. A system for verifying a neighbor discovery message, the system comprising:
a server including a memory and a processor; and
one or more modules stored in the memory and executed by the processor to:
receive a neighbor discovery message from a first computer by a second computer, the neighbor discovery message including an algorithm identifier, an algorithm, and an encryption type identifier,
detect the algorithm identifier;
access the algorithm identifier and algorithm from the neighbor discovery message,
identify that the algorithm identifier corresponds to a value in an algorithm table at the second computer, wherein the value is in a row and in an algorithm field column of the algorithm table,
identify an encryption type based on an entry appearing in the same row as the value and in a digital signature field column of the algorithm table,
identify that the received neighbor discovery message is according to a standard Secure Network Discovery (SEND) protocol,
perform a verification of the received neighbor discovery message by the second computer based on the algorithm identifier, algorithm, and a key, and
discard, by the second computer, the received neighbor discovery message based on identifying that the message is according to the standard SEND protocol.
16. The system of claim 15 , wherein the key at the second computer is shared with the first computer, the first computer generating the message based on the key and the algorithm.
17. The system of claim 15 , wherein the algorithm identifier includes a value associated with a type of algorithm, the algorithm identifier stored in an algorithm field.
18. The system of claim 15 , wherein the verification is performed by a module operating at the link layer as an extension to the SEND protocol.
19. The system of claim 15 , the modules further executable to:
identify that the received neighbor discovery message passes the verification.
20. The system of claim 15 , the modules further executable to identify that the received neighbor discovery message fails the verification.
21. The system of claim 15 , the modules further executable to detect an option defined in a SEND protocol in the received neighbor discovery message.