•  
  •  
 

Corresponding Author ORCID Identifer

Lokman Mohd Fadzil https://orcid.org/0000-0002-0398-0433
Mohamad Khairi Ishak https://orcid.org/0000-0002-3554-0061

Section

Regular Issue

Abstract

Many computer networks in operation today currently use both IPv4 and IPv6 stacks. On the other hand, there is a transition towards IPv6-only networks as a result of the limited availability of IPv4 addresses. The primary protocol for link-local IPv6 communication is the Neighbor Discovery Protocol (NDP). Regrettably, its insecure design and basic scope-based security mechanisms make the local network susceptible to insider threats. The Internet Engineering Task Force’s recommended security mechanism for NDP, which is Secure Neighbor Discovery (SEND), is well documented but complex and unsuitable for resource-constrained devices and networks. Trust-ND was positioned as an alternative to SEND as a lightweight trust-based distributed approach using the NDP extension headers. However, its timestamp design and utilization render it susceptible to temporal DoS vulnerabilities. Therefore, this research proposes eTrustND to improve the Trust-ND mechanism for securing IPv6 link-local networks from insider attacks by addressing the existing vulnerabilities by modifying the timestamp reference, format, precision, and validation rules. This paper documents the methodology, the experimentation, and the resulting outcome that show eTrustND eliminates Trust-ND’s temporal DoS vulnerabilities without adding computational and protocol overhead. It also highlights the challenges and best practices of timestamp design and usage in security mechanisms and protocols.

Download

Share

COinS