• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.537-538
• /
• 2009

IPv6 is newly introduced to solve limitations and problems of IPv4 and in IPv6 network, nodes use Neighbor Discovery protocol to discover the subnet prefix and configure its own address. However, Neighbor Discovery is vulnerable to various attacks as it does not have secure mechanism to protect itself. Thus, the Secure Neighbor Discovery has introduced and the main mechanism used in Secure Neighbor Discovery is Cryptographically Generated Address. In this paper, we provide a brief of Cryptographically Generated Address and its limitation in a case where a mobile node moves from one network to another frequently. The proposed scheme resolves this limitation by using the fixed interface identifier.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.41 no.12
• /
• pp.33-40
• /
• 2004

IPv6 defines relation between surrounding node using Neighbor Discovery protocol. Used Neighbor Discovery messages, grasp surrounding node, include important informations about network. These network information outcrops can give rise in network attack and also service that use network will paralysis. Various kinds of security limitation was found in Present Neighbor Discovery protocol therefore security function to supplement this problem was required. In this thesis, Secure Neighbor Discovery protocol that add with suity function was design and embody by CGA module and SEND module.

• Proceedings of the IEEK Conference
• /
• 2004.08c
• /
• pp.571-575
• /
• 2004

Having age of ubiquitous ahead, existing IPv4's address space insufficiency phenomenon appears because of increasing network usage as well as multimedia data transmission becomes much, necessity of new IP address system that guarantee QoS are needed. IPv6 was made to solve these problem. IPv6 solves address space insufficiency phenomenon offering by 128bit address space, and also offers hierarchical address layer that support improved QoS. IPv6 defines relation between surrounding node using Neighbor Discovery protocol. Used Neighbor Discovery messages, grasp surrounding node, include important informations about network. These network information outcrops can give rise in network attack and also service that use network will paralysis. Various kinds of security limitation was found in Present Neighbor Discovery protocol therefore security function to supplement tris problem was required. In this thesis, Secure Neighbor Discovery protocol that add with security function was design and embody by CGA module and SEND module.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.6A
• /
• pp.85-96
• /
• 2008

Neighbor Discovery(ND) protocol is used to exchange an information of the neighboring nodes on the same link in the IPv6 protocol environment. For protecting the ND protocol, firstly utilizing Authentication Header(AH) of the IPsec protocol was proposed. But the method has some problems-uses of key exchange protocol is not available and it is hard to distribute manual keys. And then secondly the SEcure Neighbor Discovery(SEND) protocol which protects all of the ND message with digital signature was proposed. However, the digital signature technology on the basis of public key cryptography system is commonly known as requiring high cost, therefore it is expected that there is performance degradation in terms of the availability. In the paper, to improve performance of the SEND protocol, we proposed a modified CGA(Cryptographically Generated Address) which is made by additionally adding MAC(Media Access Control) address to the input of the hash function. Also, we proposed cache mechanism. We compared performance of the methods by experimentation.

• Proceedings of the Korean Institute of Communication Sciences Conference
• /
• 2006.07a
• /
• pp.287-287
• /
• 2006

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.7B
• /
• pp.403-410
• /
• 2007

Neighbor Discovery (ND) protocol was proposed to discover neighboring hosts and routers in IPv6 wire/wireless local networks. ND protocol, however, has a problem that it is vulnerable to network attacks because ND protocol allows malicious users to impersonate other legitimate hosts or routers by forging ND protocol messages. To address the security problem, Secure Neighbor Discovery (SEND) protocol was proposed. SEND protocol provides address ownership proof mechanism, ND protocol message protection mechanism, reply attack prevention mechanism, and router authentication mechanism to protect ND protocol. In this paper, we design and implement SEND protocol in IPv6 local networks. And also, we evaluate and analyze the security vulnerability and performance of SEND protocol by experimenting the implemented SEND protocol on IPv6 networks.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• v.9 no.2
• /
• pp.82-85
• /
• 2005

In the MIPv6 network, when mobile nodes move into new newtwork, they need to find the new access router and points(AR/AP) for the newtwork. Unless they are not connected to authorized AR/APs, they can be exposed to a lot of attacks. In this paper we propose a protocol to authenticate AR/AR and MN each other. This protocol is based on the public key scheme which is used in the SEcure Neighbor Discovery(SEND) protocol.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.05a
• /
• pp.1104-1106
• /
• 2007

IPv6 환경에서 SEcure Neighbor Discovery(SEND) 프로토콜은 Neighbor Discovery 프로토콜의 위협 요소를 제거하고 단말 노드의 안전한 통신을 위한 환경을 제공함으로써 보다 안정적으로 인터넷 서비스를 제공할 수 있게 되었다. 하지만 SEND 프로토콜을 Mobile IPv6와 연동하는 과정에서 모바일 노드가 다른 네트워크로 이동하였을 경우 SEND 프로토콜 동작 과정에서의 취약점을 발견하고 기존의 방식과 차별화된 RSA기반의 위임 정보에 기반한 대리 서명 기법을 사용하여 문제를 해결하였다.

• 제어로봇시스템학회:학술대회논문집
• /
• 2005.06a
• /
• pp.1545-1549
• /
• 2005

According as computer is supplied in a lot of homes and offices and Internet use increases, various service based on the Internet. Including wireless PDA in the future, many devices such as Internet telephone, TV, refrigerator and oven will be connected on the Internet and Internet address exhaustion will be raised to serious problem gradually. Today, the IPv4 address exhaustion problem has been solved partially using NAT (Network Address Translation) however, the transition to next Generation Internet will be accelerated because of advantages such as mobility, security service, QoS, and abundant IP addresses. In IPv6, all hosts are designed to create and set their address automatically without manager's intervention using Neighbor Discovery Protocol. But, when an IPv6 host sets its address automatically, there are serious security vulnerabilities. In this paper, we analysis security vulnerabilities in auto-configuration and provide security requirements for secure auto-configuration.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.1266-1269
• /
• 2007

IPv6 환경에서는 NDP(Neighbor Discovery Protocol)를 이용한 주소 자동 설정 메커니즘을 지원한다. 그러나, NDP 는 메시지 내 중요 정보가 네트워크 상에 그대로 노출됨으로 인해 각종 공격에 취약하다. 이러한 취약성을 극복하기 위해, CGA(Cryptographically Generated Address)를 사용하여 주소의 소유권 증명이 가능한 SEND(SEcure Neighbor Discovery)가 도입되었다. 그러나 SEND 는 높은 비용 연산으로 인해 모바일 기기 등에 적용하는데 한계점을 가진다. SEND 의 한계점을 보완하고자 해쉬 함수를 이용해 주소 자동 설정에 사용되는 임시 주소를 감추는 기법이 제안되었다. 이 기법은 DAD(Duplicate Address Detection) 과정 중 SEND 수준의 보안을 제공하면서도 빠르게 동작할 수 있는 장점을 갖는다. 본 논문에서는 리눅스 환경에서 제안 기법을 구현해 보고, 주소 생성 시간 측정 및 DAD 과정에서 드러난 서비스 거부 공격에 대한 안전성을 검증한다.