# Neighbor Discovery for IPv6 over BLE Mesh Networks
## 3 6 LoBLEmesh Neighbor Discovery
### IPv6 Address Auto-Configuration and Update Mechanism  
IPv6 address auto-configuration is an important technical feature of IPv6; it can allocate a unique IPv6 address for each node in the 6 LoBLEmesh, which is consistent with the design goals of 6 LoBLEmesh ND. According to the structure of IPv6 address, an IPv6 address includes two parts, a prefix and an Interface Identifier (IID). There are two types of IPv6 addresses used in 6 LoBLEmesh based on different prefixes. As shown in Table 2, a link-local address (LLA) is made of a prefix FE80. : and an IID, which can be used in link communications, and a global unicast address which is made of a global prefix and an IID, that can be used in end-to-end communications. In 6 LoBLEmesh networks, all nodes generate their IID following the configuration of EUI-64 using the 48-bit Bluetooth device address. Once the LLA is set up, the nodes are ready to perform address registration and update. For the relay nodes connecting to the mesh gateway directly in the \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Prefix** & **IID** \\ \hline Link-local address & FE80: & 64 bit IID \\ Global unicast address & Prefix & 64 bit IID \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Two types of IPv6 address. Figure 3: Neighbor discovery for IPv6 over Bluetooth Low Energy Mesh Network. 6 LoBLEmesh domain, address configuration is the same as the nodes in a star-topology BLE network; for the relay nodes having no direct connection to the mesh gateway, the address configuration is similar to the nodes in the 6 LoBLEmesh domain. Meanwhile, since friend nodes and regular nodes perform the same function in 6 LoBLEmesh ND, we do not make the distinction in the following section. In Figure 4, the new node sends a multicast Router Solicitation (RS) message to the mesh gateway through relay nodes. The RS message contains a source local link option (SLLAO), including the LLA of the node. When the mesh gateway receives the RS message, it records the SLLAO and responses a Router Advertisement (RA) message to the node through a designated relay node. The designated relay node will be the default router of the node. In the RA message, there is an Authoritative Border Router Option (ABRO), a 6 LoBLE Context Option (6 CO), a Prefix Information Option (PIO), and an SLLAO. In the following communications, the node will check the context and prefix information with these options. Meanwhile, the node generates the global unicast IPv6 address (GUA) using the prefix information. Once the node has the GUA, the node sends a unique neighbor solicitation (Uni-NS) message to the mesh gateway through the designated relay node for address registration. When the mesh gateway receives the NS message, it performs duplicate address detection (DAD)to ensure the uniqueness of the assigned address. Address registration is successful when the node receives the neighbor advertisement (NA) message with the address registration option (ARO). While during the DAD, the Registration Ownership Verifier (ROVR) field is used during address duplication detection, any registration for the same address but with a different ROVR will be rejected. Therefore, a possible attack during the neighbor discovery can be done by sending an NS and expecting the NA back to contain ROVR fields of the existing state. With that information, the attacker can easily increase the Transaction ID and take over the Binding. Furthermore, such a ROVR can be spoofed, and therefore, any node connected to the subnet and aware of a registered-address-to-ROVR mapping could perform address theft and impersonation attacks [8]. The proposed address configuration mechanism protects against misinterpreting a movement for a duplication, and enables to decide which mesh gateway has the freshest registration and thus most possibly the device attached to it [9]. During address registration, the mesh gateway maintains a context table for the registered nodes. The context table consists of the prefix, the context ID, and the valid lifetime of the prefix.