Secure neighbor discovery (SEND) using pre-shared key
An extension is provided to the SEND protocol without requiring a CGA or third party trust anchor. A shared key is provided to both a sender and receiver of a neighbor discovery (ND) message. A digital signature option is contained in the ND message. A digital signature field is determined by the algorithm field in the option. When the ND message is received, the receiver may verify the digital signature field using the pre-shared key according to the algorithm field. If the ND message passes verification, the receiver may process the message.
1. A method for verifying a neighbor discovery message, the method comprising:
storing an algorithm table and a shared key at a memory at a first computing device, wherein the shared key is also stored at a memory at each of one or more other computing devices and the first computing device and the one or more other computing devices are communicatively coupled via one or more network interfaces;
generating a neighbor discovery message that includes an algorithm identifier associated with one of a plurality of different available encryption types, wherein the neighbor discovery message is generated by a processor executing instructions out of the memory at the first computing device and at least a portion of the neighbor discovery message is encrypted based on the shared key and encryption type identified by the included algorithm identifier; and
sending the neighbor discovery message to the one or more other computing devices via the one or more network interfaces of the first computing device, wherein a processor executing instructions out of the memory at each of the one or more other computing devices:
identifies the encryption type associated with the algorithm identifier,
decrypts the neighbor discovery message based on the shared key in accordance with the encryption type identified by the included algorithm identifier, and
verifies the decrypted neighbor discovery message after decrypting the neighbor discovery message.
2. The method of claim 1 , wherein at least one of the network interfaces of the first computing device is coupled to a communication network and at least another one of the network interfaces is coupled to at least one network interface of one of the other computing devices.
3. The method of claim 1 , wherein the first computing device is a router.
4. The method of claim 1 , wherein the neighbor discovery message is generated in accordance with a secure neighbor discovery (SEND) protocol.
5. The method of claim 1 , wherein the neighbor discovery message includes an option setting that indicates that the neighbor discovery message was not generated in accordance with a standard version of a secure neighbor discovery (SEND) protocol and the verification is further based on the option setting indicating that the neighbor discover message was not generated in accordance with the standard SEND protocol.
6. The method of claim 1 , wherein the shared key is provided to each of the other computing devices before the neighbor discovery message is sent.
7. The method of claim 1 , wherein at least one of the other computing devices accesses a computer network via the first computing device.
8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for performing a method for verifying a neighbor discovery message, the method comprising:
storing an algorithm table and a shared key at a memory at a first computing device that includes the processor that executes the program out of the memory, wherein the shared key is also stored at a memory at each of one or more other computing devices, and the first computing device and the one or more other computing devices are communicatively coupled via one or more network interfaces;
generating a neighbor discovery message that includes an algorithm identifier associated with one of a plurality of different available encryption types, wherein at least a portion of the neighbor discovery message is encrypted based on the shared key and encryption type identified by the included algorithm identifier; and
sending the neighbor discovery message to the one or more other computing devices via the one or more network interfaces of the first computing device, wherein a processor executing instructions out of the memory at each of the other computing devices:
identifies the encryption type associated with the algorithm identifier,
decrypts the neighbor discovery message based on the shared key in accordance with the encryption type identified by the included algorithm identifier, and
verifies the decrypted neighbor discovery message after decrypting the neighbor discovery message.
9. The non-transitory computer-readable storage medium of claim 8 , wherein at least one of the network interfaces of the first computing device is coupled to a communication network and at least another one of the network interfaces is coupled to at least one network interface of one of the other computing devices.
10. The non-transitory computer-readable storage medium of claim 8 , wherein the first computing device is a router.
11. The non-transitory computer-readable storage medium of claim 8 , wherein the neighbor discovery message is generated in accordance with a secure neighbor discovery (SEND) protocol.
12. The non-transitory computer-readable storage medium of claim 8 , wherein the neighbor discovery message includes an option setting that indicates that the neighbor discovery message was not generated in accordance with a standard version of a secure neighbor discovery (SEND) protocol and the verification is further based on the option setting indicating that the neighbor discover message was not generated in accordance with the standard SEND protocol.
13. The non-transitory computer-readable storage medium of claim 8 , wherein the shared key is provided to each of the other computing devices before the neighbor discovery message is sent.
14. The non-transitory computer readable storage medium of claim 8 , wherein at least one of the other computing devices accesses a computer network via the first computing device.
15. A system for verifying a neighbor discovery message, the system comprising:
a first computing device comprising:
a memory that stores an algorithm table and a shared key,
a processor that executes instructions stored in the memory of the first computing device, wherein the execution of the instructions by the processor of the first computing device generates a neighbor discovery message that includes an algorithm associated with one of a plurality of different available encryption types and at least a portion of the neighbor discovery message is encrypted based on the shared key and encryption type identified by the included algorithm identifier, and
one or more network interfaces; and
one or more other computing devices that are communicatively coupled to the first computing device via the one or more network interfaces, wherein each other computing device comprising:
a memory that stores the shared key,
at least one network interface that receives the neighbor discovery message sent from the first computing device, and
a processor that executes instructions stored in the memory, wherein execution of the instructions by the processor executing the instructions out of the memory of the one or more other computing devices:
identifies the encryption type associated with the algorithm identifier,
decrypts the neighbor discovery message based on the shared key in accordance with the encryption type identified by the included algorithm identifier, and
verifies the decrypted neighbor discovery message after decrypting the neighbor discovery message.
16. The system of claim 15 , wherein the first computing device further comprises at least one network interface coupled to a communication network and at least one other network interface coupled to the at least one network interface of each of the other computing devices.
17. The system of claim 15 , wherein the first computing device is a router.
18. The system of claim 15 , wherein the first computing device generates the neighbor discovery message in accordance with a secure neighbor discovery (SEND) protocol.
19. The system of claim 15 , wherein the neighbor discovery message includes an option setting that indicates that the neighbor discovery message was not generated in accordance with a standard version of a secure neighbor discovery (SEND) protocol and each of the other computing devices verifies the message based on the option setting indicating that the neighbor discover message was not generated in accordance with the standard SEND protocol.
20. The system of claim 15 , wherein the shared key is provided to each of the other computing devices before the neighbor discovery message is sent.
21. The system of claim 15 , wherein at least one of the other computing devices accesses a computer network via the first computing device.