Secure neighbor discovery (SEND) using pre-shared key
An extension is provided to the SEND protocol without requiring a CGA or third party trust anchor. A shared key is provided to both a sender and receiver of a neighbor discovery (ND) message. A digital signature option is contained in the ND message. A digital signature field is determined by the algorithm field in the option. When the ND message is received, the receiver may verify the digital signature field using the pre-shared key according to the algorithm field. If the ND message passes verification, the receiver may process the message.
1. A system for discovering neighboring computers, the system comprising:
a first computer comprising a first memory that:
stores algorithm information that includes a plurality of algorithm identifier values, wherein each algorithm identifier value is associated with a different encryption type, and the stored algorithm information cross-references each algorithm identifier value with the associated encryption type, and
stores a shared key corresponding to at least one of the plurality of algorithm identifier values;
a second computer comprising:
a second memory that:
stores a copy of the algorithm information, wherein the copy of the stored algorithm information also cross-references each of the algorithm identifier values with the associated encryption type, and
a network interface that:
receives the shared key over a computer network, wherein the shared key is stored in the second memory, and
sends a message to the first computer, wherein the message includes one of the algorithm identifier values;
wherein a processor at the first computer executes instructions stored in the first memory to:
identify that the received message was sent according to the secure neighbor discovery (SEND) protocol,
identify an encryption type associated with the algorithm identifier value in the message based on the stored algorithm information, and
verify the message after identifying that the received message was sent according to the SEND protocol, the verification based on the identified encryption algorithm type and the shared key.
2. The system of claim 1 , wherein the algorithm information stored at the first memory and at the second memory correspond to a same set of information that cross-references each of the algorithm identifiers to the associated encryption type.
3. The system of claim 1 , further comprising one or more other computers, each other computer storing a respective copy of the algorithm information for use in processing a neighbor discovery (ND) message.
4. The system of claim 3 , wherein at least one of the other computers is configured to verify the ND message when the ND message corresponds to a router advertisement (RA) message.
5. The system of claim 3 , wherein a corresponding shared key is stored at each of the other computers.
6. The system of claim 1 , wherein the verification is performed only on messages received according to the SEND protocol.
7. A method for discovering neighboring computers, the method comprising:
storing algorithm information at a first computer, wherein the stored algorithm information includes a plurality of algorithm identifier values, each algorithm identifier value is associated with a different encryption type, and the stored algorithm information cross-references each algorithm identifier value with the associated encryption type;
storing a shared key at the first computer, the shared key corresponding to at least one of the plurality of algorithm identifier values, wherein the shared key is sent over a computer network to a second computer, the second computer stores a copy of the algorithm information, and the copy of the algorithm information stored at the second computer also cross-references each of the algorithm identifier values with the associated encryption type;
receiving a message sent from the second computer to the first computer, wherein the message includes one of the algorithm identifier values;
identifying that the received message was sent according to the secure neighbor discovery (SEND) protocol;
identifying an encryption type associated with the algorithm identifier value in the message based on the stored algorithm information; and
verifying the message after identifying that the received message was sent according to the SEND protocol, wherein the verification is based on the identified encryption type and the shared key.
8. The method of claim 7 , wherein the algorithm information stored at the first computer and at the second computer correspond to a same set of information that cross-references each of the algorithm identifier values with the associated encryption type.
9. The method of claim 7 , wherein each of one or more other computers stores a respective copy of the algorithm information for use in processing a neighbor discovery (ND) message.
10. The method of claim 9 , wherein at least one of the other computers is configured to verify the ND message when the ND message corresponds to a router advertisement (RA) message.
11. The method of claim 9 , wherein a corresponding shared key is stored at each of the other computers.
12. The method of claim 7 , wherein the verification is performed only on messages received according to the SEND protocol.
13. The method of claim 7 , wherein verifying the message includes:
identifying an encryption type associated with the message based on the algorithm information associating the algorithm identifier value in the message with the associated encryption type;
decrypting at least part of the message based on the encryption type and the shard key; and
identifying that the message is verified based on the decrypting part of the message.
14. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for discovering neighboring computers, the method comprising:
storing algorithm information at a first computer, wherein the stored algorithm information includes a plurality of algorithm identifier values, each algorithm identifier value is associated with a different encryption type, and the stored algorithm information cross-references each algorithm identifier value with the associated encryption type;
storing a shared key at the first computer, the shared key corresponding to at least one of the plurality of algorithm identifier values, wherein the shared key is sent over a computer network to a second computer, the second computer stores a copy of the algorithm information, and the copy of the algorithm information stored at the second computer also cross-references each of the algorithm identifier values with the associated encryption type;
receiving a message sent from the second computer to the first computer, wherein the message includes one of the algorithm identifier values;
identifying that the received message was sent according to the secure neighbor discovery (SEND) protocol;
identifying an encryption algorithm type associated with the algorithm identifier value in the message based on the stored algorithm information; and
verifying the message after identifying that the received message was sent according to the SEND protocol, wherein the verification is based on the identified encryption type and the shared key.
15. The non-transitory computer readable storage medium of claim 14 , wherein the algorithm information stored at the first computer and at the second computer correspond to a same set of information that cross-references each of the algorithm identifier values with the associated encryption type.
16. The non-transitory computer-readable storage medium of claim 14 , wherein each of one or more other computers stores the algorithm information for use in processing a neighbor discovery (ND) message.
17. The non-transitory computer-readable storage medium of claim 16 , wherein at least one of the other computers is configured to verify the ND message when the ND message corresponds to a router advertisement (RA) message.
18. The non-transitory computer-readable storage medium of claim 16 , wherein a corresponding shared key is stored at each of the other computers.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the verification is performed only on messages received according to the SEND protocol.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the program is also executable to verify the message includes instructions for:
identifying an encryption type associated with the message based on the algorithm information associating the algorithm identifier value in the message with the associated encryption type;
decrypting at least part of the message based on the encryption type and the shard key; and
identifying that the message is verified based on the decrypting part of the message.