Establishing trust relationships of IPv6 neighbors using attestation-based methods in IPv6 neighbor discovery
Systems, methods, and computer-readable media for assessing reliability and trustworthiness of devices operating within a network. A recipient node in a network environment can receive a neighbor discovery (ND) message from an originating node in the network environment that are both implementing a neighbor discovery protocol. Trustworthiness of the originating node can be verified by identifying a level of trust of the originating node based on attestation information for the originating node included in the ND message received at the recipient node. Connectivity with the recipient node through the network environment can be managed based on the level of trust of the originating node identified from the attestation information included in the ND message.
1. A method comprising:
receiving a Neighbor Discovery (ND) message at a recipient node in a network environment from an originating node in the network environment that are both implementing a Neighbor Discovery Protocol;
verifying trustworthiness of the originating node by identifying a level of trust of the originating node based on attestation information for the originating node included in the ND message received at the recipient node, wherein the attestation information includes one or more security measurements as part of metadata signed by the originating node and at least a signature of the metadata signed by the originating node is validated as part of verifying the trustworthiness of the originating node; and
managing connectivity between the recipient node and the originating node through the network environment based on the level of trust of the originating node identified from the metadata signed by the originating node in the attestation information included in the ND message.
2. The method of claim 1 , wherein managing the connectivity with the recipient node through the network environment incudes managing connectivity between the recipient node and the originating node in the network environment based on the level of trust of the originating node.
3. The method of claim 1 , wherein the recipient node, as part of managing the connectivity with the recipient node, is configured to disregard the ND message if the originating node is verified as untrustworthy based on the identified level of trust of the originating node.
4. The method of claim 1 , wherein the recipient node, as part of managing the connectivity with the recipient node, is configured to either or both establish and maintain a connection in the network environment between the recipient node and the originating node based on the ND message if the originating node is verified as trustworthy based on the identified level of trust of the originating node.
5. The method of claim 4 , further comprising adding a link layer address of the originating node included in the ND message to a neighbor discovery cache associated with the recipient node if the originating node is verified as trustworthy based on the identified level of trust of the originating node.
6. The method of claim 1 , wherein the ND message is either a router advertisement message or a neighbor advertisement message transmitted according to the Neighbor Discovery Protocol.
7. The method of claim 1 , wherein the ND message is transmitted by the originating node in response to either a router solicitation message or a neighbor solicitation message transmitted from the recipient node to the originating node according to the Neighbor Discovery Protocol.
8. The method of claim 1 , wherein the recipient node is a host in the network environment and the originating node is a router in the network environment.
9. The method of claim 1 , wherein the recipient node is a router in the network environment and the originating node is a host in the network environment.
10. The method of claim 1 , further comprising performing Neighbor Discovery Protocol-based attack mitigation if the originating node is verified as untrustworthy based on the identified level of trust of the originating node.
11. The method of claim 1 , further comprising sending the attestation information of the originating node included in the ND message from the recipient node to a verifier, wherein the verifier is configured to remotely verify the originating node using the attestation information.
12. The method of claim 1 , further comprising:
stapling, by the originating node, the attestation information included in the ND message with a verifier signed key, wherein the verifier signed key is generated based on a verifier validating the attestation information; and
sending the ND message including the attestation information with the verifier signed key from the originating node to the recipient node, wherein the recipient node is configured to locally verify the originating node using the attestation information and the verifier signed key received in the ND message.
13. The method of claim 12 , wherein the verifier is configured to validate the attestation information to generate the verifier signed key before the ND message is generated by the originating node.
14. The method of claim 12 , wherein the verifier signed key is associated with a validity time frame and the recipient node is configured to verify the originating node using the verifier signed key if the validity time frame is active.
15. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a Neighbor Discovery (ND) message at a recipient node in a network environment from an originating node in the network environment that are both implementing a Neighbor Discovery Protocol;
verifying trustworthiness of the originating node by identifying a level of trust of the originating node based on attestation information for the originating node included in the ND message received at the recipient node, wherein the attestation information includes one or more security measurements as part of metadata signed by the originating node and at least a signature of the metadata signed by the originating node is validated as part of verifying the trustworthiness of the originating node;
managing connectivity between the recipient node and the originating node through the network environment based on the level of trust of the originating node identified from the metadata signed by the originating node in the attestation information included in the ND message; and
disregarding, by the recipient node, the ND message if the originating node is verified as untrustworthy based on the identified level of trust of the originating node.
16. The system of claim 15 , wherein the recipient node, as part of managing the connectivity with the recipient node, is configured to either or both establish and maintain a connection in the network environment between the recipient node and the originating node based on the ND message if the originating node is verified as trustworthy based on the identified level of trust of the originating node.
17. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising performing Neighbor Discovery Protocol-based attack mitigation if the originating node is verified as untrustworthy based on the identified level of trust of the originating node.
18. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising sending the attestation information of the originating node included in the ND message from the recipient node to a verifier, wherein the verifier is configured to remotely verify the originating node using the attestation information.
19. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
stapling, by the originating node, the attestation information included in the ND message with a verifier signed key, wherein the verifier signed key is generated based on a verifier validating the attestation information; and
sending the ND message including the attestation information with the verifier signed key from the originating node to the recipient node, wherein the recipient node is configured to locally verify the originating node using the attestation information and the verifier signed key received in the ND message.
20. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising:
receiving a Neighbor Discovery (ND) message at a recipient node in a network environment from an originating node in the network environment that are both implementing a Neighbor Discovery Protocol;
verifying trustworthiness of the originating node by identifying a level of trust of the originating node based on attestation information for the originating node included in the ND message received at the recipient node, wherein the attestation information includes one or more security measurements as part of metadata signed by the originating node and at least a signature of the metadata signed by the originating node is validated as part of verifying the trustworthiness of the originating node; and
managing connectivity between the recipient node and the originating node through the network environment based on the level of trust of the originating node identified from the metadata signed by the originating node in the attestation information included in the ND message.