Cryptographically Generated Address Research Articles

One-key based cryptographically generated address for location update in next generation IP mobility

Mobile devices have risen due to internet growth in recent years. The next generation of internet protocol is evolving for mobile devices to generate their addresses and get continuous services across networks to support the enormous number of addresses in network-based mobility. The mobile device updates its current location to its home network and the correspondent users through a binding update scheme in the visited network. Numerous studies have investigated binding update schemes to verify the reachability of the mobile device at its home network. However, most schemes endure security threats due to the incompetence of authenticating user identity and concealing the temporary location of mobile devices. To address these issues, this paper proposes a secure and efficient binding update scheme (One-CLU) by incorporating a one-key-based cryptographically generated address (CGA) to validate and conceal the address ownership of mobile devices with minimal computations. The security correctness of the proposed One-CLU scheme is verified using AVISPA – a model checker. Finally, the simulation and the numerical results showthat the proposed scheme significantly reduces communication payloads and costs for the binding update, binding refresh, and packet delivery.

IPv6 Cryptographically Generated Address: Analysis, Optimization and Protection

In networking, one major difficulty that nodes suffer from is the need for their addresses to be generated and verified without relying on a third party or public authorized servers. To resolve this issue, the use of self-certifying addresses have become a highly popular and standardized method, of which Cryptographically Generated Addresses (CGA) is a prime example. CGA was primarily designed to deter the theft of IPv6 addresses by binding the generated address to a public key to prove address ownership. Even though the CGA technique is highly effective, this method is still subject to several vulnerabilities with respect to security, in addition to certain limitations in its performance. In this study, the authors present an intensive systematic review of the literature to explore the technical specifications of CGA, its challenges, and existing proposals to enhance the protocol. Given that CGA generation is a time-consuming process, this limitation has hampered the application of CGA in mobile environments where nodes have limited energy and storage. Fulfilling Hash2 conditions in CGA is the heaviest and most time-consuming part of SEND. To improve the performance of CGA, we replaced the Secure Hash Algorithm (SHA1) with the Message Digest (MD5) hash function. Furthermore, this study also analyzes the possible methods through which a CGA could be attacked. In conducting this analysis, Denial-of-Service (DoS) attacks were identified as the main method of attack toward the CGA verification process, which compromise and threaten the privacy of CGA. Therefore, we propose some modifications to the CGA standard verification algorithm to mitigate DoS attacks and to make CGA more security conscious.

A Lightweight Two-Way Authentication Scheme Between Communication Nodes for Software Defined Optical Access Network

For the rapid increase in the number of optical line terminals (OLTs) and optical network units (ONUs) connected to the control center in the software defined optical access network (SDOAN) environment, the security problems caused by the communication between devices and the high cost caused by the introduction of security schemes, we propose a lightweight identity two-way authentication scheme (LTWA) based on the cryptographically generated address (CGA) algorithm combined with the hash generated address (HGA) algorithm. The scheme introduces the CGA algorithm and the HGA algorithm without third party participation, so as to complete the first authentication binding and the non-first authentication binding between the communication nodes respectively, which effectively prevents an attacker from forging or tampering with authentication interaction messages, thereby establishing an end-to-end trusted connection in the access network. We experimentally verify the proposed LTWA scheme. The simulation results show that the scheme guarantees the security interaction between communication nodes, and reduces the average computational overhead and the blocking rate caused by malicious attacks.

Improving Cryptographically Generated Address Algorithm in IPv6 Secure Neighbor Discovery Protocol through Trust Management

Improving Cryptographically Generated Address Algorithm in IPv6 Secure Neighbor Discovery Protocol through Trust Management

A Distributed Cryptographically Generated Address Computing Algorithm for Secure Neighbor Discovery Protocol in IPv6

A Distributed Cryptographically Generated Address Computing Algorithm for Secure Neighbor Discovery Protocol in IPv6

Improving Cryptographically Generated Address Algorithm in IPv6 Secure Neighbor Discovery Protocol through Trust Management

Improving Cryptographically Generated Address Algorithm in IPv6 Secure Neighbor Discovery Protocol through Trust Management

Securing IPv6's Neighbour and Router Discovery, using Locally Authentication Process

Internet Protocol version six (IPv6), the next generation Internet Protocol (IP), exists sparsely in today's world.Internet Engineering Task Force (IETF), in IPv6, allowed nodes to Auto configure using neighbour discovery protocol. Neighbour Discovery (ND) and Address auto-configuration mechanisms may be protected with IPSec Authentication Header (AH). However, as it gains popularity now a day, it will grow into a vital role of the Internet and communications technology in general. IPv6, the latest revision of the Internet Protocol (IP), is intended to replace IPv4, which still carries the vast majority of Internet traffic as of 2014. Protecting all traffic will include Address Resolution Protocol. To protect this, IPSec will need agreed Key. For Key setup, UDP packet is sent, which requires IPSec for secure communication. So IPSec requires Agreed Key and for Key setup IPSec is needed, this creates a loop. To solve this problem Locally Authentication Process is presented in this paper and we provide a taxonomy for the IPv6 Neighbor and Router Discovery threats, describe two new cryptographic methods, Cryptographically Generated Addresses (CGA) and Address Based Keys (ABK), and discuss how these new methods can be used to secure the Neighbor and Router discovery mechanisms. In this process will provide a certificate of ownership of IP address on network Interface card and Public key to provide authorization. On the other hand, it will also reduce the network load. Keywords : Stateless Address Auto-configuration, Neighbour Discovery, Cryptographically Generated Address (CGA), MYSEA, IPsec, MLS, IP next generation, Multilevel security, Router Discovery, Secure Neighbour Discovery (SEND), Public Key Infrastructure (PKI), Digital Certificate, Security Attacks in IPv6.

Authenticated route optimization scheme for network mobility (NEMO) support in heterogeneous networks

AbstractFor the efficient communications between mobile or fixed hosts in mobile networks, the route optimization and its security are indispensable. So, the Internet Engineering Task Force introduced a NEMO basic support protocol in 2005. However, this protocol does not provide a strong security between hosts and especially in nested‐mobile network it can incur a pinball routing problem. And the previous Proxy Binding Update (PUB) protocol has an advantage that can prove the ownership of address of a host using Multi‐key Cryptographically Generated Address (MCGA) which can alleviate a neighbor bombing attack. However, a Mobile Network Node (MNN) belonging to the mobile network which can have low power or limited computing capability may be require burdened costs such as signification and verification of messages. Also, the PUB protocol does not provide the secure message communication architecture between the MNN and its Mobile Router (MR). In this paper we propose a CGA‐based Authentication Route Optimization scheme (CARO) in mobile hotspots with heterogeneous networks. The proposed CARO protocol satisfies two problems using IPsec Encapsulating Security Payload (ESP) tunnel, a secret mobile group key, and the CGA. And we also do not require the considerable computing costs to the MNN or a Correspondent Node. In performance analysis, we prove more secure and efficient protocols than the previous protocols using the defense of various attacks and the result of computational cost, etc. Copyright © 2010 John Wiley & Sons, Ltd.

Security-Enhanced Fast Mobile IPv6 Handover

Motivated by the fact that the existing FMIPv6 security scheme has several weaknesses in terms of security and efficiency, we propose a security-enhanced fast mobile IPv6 in this letter. Based on the concept of a secret key-based CGA (Cryptographically Generated Address), we show how to establish a new security association between the MN and AR (Access Router) whenever a handover occurs. We also show that the proposed scheme is robust against several types of security attacks feasible with the existing scheme. Our scheme is more efficient in that it requires fewer public key operations.

Extended Ticket-Based Binding Update (ETBU) Protocol for Mobile IPv6 (MIPv6) Networks

Currently, Mobile IPv6 (MIPv6) working group of Internet Engineering Task Force (IETF) recommends to execute the Binding Update (BU) using Return Routability (RR) procedure. However, the RR procedure doesn't entirely satisfy the security requirements of MIPv6. The previous BU protocols are also likely to reduce the efficiency since they iterate entirely BU protocol courses in Pico/Micro cellular environment in which it occurs frequently handoff or handover and some protocols don't consider that the Correspondent Node (CN) is movable node and has the limited resources. In this paper we propose the ETBU protocol, which is based on Cryptographically Generated Address (CGA) to provide mutual authentication between nodes; it considers that the CN is a movable node. This protocol doesn't require a Mobile Node (MN) to create a signature each time it obtains a new Care-of Address (CoA) unlike the previous CGA-based BU protocol. An MN and its CN issue the ticket to minimize the computing costs that need to calculate CGA. Also, the ETBU protocol minimizes the loss of traffic using smooth handoff or handover. A performance analysis shows that the scheme provides the security as much as the previous BU protocols and more efficiency than them in case that each node obtains the ticket. Therefore, the proposed ETBU protocol can be applied easily to the mobile network environments.

IPv6 네트워크 환경에서 MCGA를 고려한 통합적인 보안관리 방안

32비트의 IPv4 주소고갈의 문제를 해결하고 보안과 QoS를 확실히 보장해 주기 위해 등장한 IPv6는 특성상 128비트로 증가된 주소공간과 네트워크를 효율적으로 관리하기 위한 주소체계, 이웃 탐색 및 주소 자동 설정 등 다양한 서비스 제공을 위해 노드와 라우터간의 주고받는 새로운 메시지들이 많이 추가되었다. 결과 IPv4에서 존재하던 공격은 물론 예측하지 못했던 새로운 공격들이 많이 등장하게 된다. IPv4에서 성공적으로 IPv6로 전환하기 위해 무엇보다 필요한 것은 안전하고 체계적인 보안 정책기반 아래 기존에 동작되고 있는 IPv4 호스트 및 라우터와 IPv6의 안전한 호환성이다. 따라서 관리자는 앞으로 도래 할 IPv6 네트워크 환경을 효율적으로 관리하기 위해서 다양한 측면에서 보안 문제를 도출하여 통합적인 보안 대응 방안을 설계해야 한다. 본 논문에서는 IPv4와 IPv6의 특성을 파악하고, IPv4/IPv6에서의 공격 측면에서 보안 취약성 분석 및 보안 문제를 도출하여 시스템 측면, IPv6 특성별 측면, 개선된 CGA인 MCGA (Modified Cryptographically Generated Address)의 제안을 통해 IPv6에서의 효율적인 보안 관리를 위한 통합적인 대응방안을 제시한다. IPv6 has appeared for solving the address exhaustion of IPv4 and for guaranteeing the problems of security and QoS. It occurs the unexpected new attacks of IPv6 as well as the existing attacks of IPv4 because of the increasing address space to 128bits and the address hierarchies for efficient network management and additions of the new messages between nodes and routers like neighbor discovery and auto address configuration for the various comfortable services. For the successful transition from IPv4 to IPv6, we should get the secure compatibility between IPv4 hosts or routers working based on secure and systematic policy and IPv6. Network manager should design security technologies for efficient management in IPv4/IPv6 co-existence network and IPv6 network and security management framework designation. In this paper, we inspected the characteristics of IPv4 and IPv6, study on security requirement for efficient security management of various attacks, protocol, service in IPv4/IPv6 co-existence and IPv6 network, and finally suggest integrated solution about security vulnerability of IPv6 network in considering of analysis of IPv6 system, host and application, IPv6 characteristics, modified CGA(MCGA).