CLL: A Cryptographic Link Layer for Local Area Networks

Abstract. Ethernet and IP form the basis of the vast majority of LAN installations. But these protocols do not provide comprehensive security mechanisms, and thus give way for a plethora of attack scenarios. In this paper, we introduce a layer 2/3 security extension for LANs, the Cryptographic Link Layer (CLL). CLL provides authentication and confidentiality to the hosts in the LAN by safeguarding all layer 2 traffic including ARP and DHCP handshakes. It is transparent to existing protocol implementations, especially to the ARP module and to DHCP clients and servers. Beyond fending off external attackers, CLL also protects from malicious behavior of authenticated clients. We discuss the CLL protocol, motivate the underlying design decisions, and finally present implementations of CLL for both Windows and Linux. Their performance is demonstrated through realworld measurement results.

• Type: Journal
• Year: 2008
• Where: SCN
• Authors: Yves Igor Jerschow, Christian Lochert, Björn Scheuermann, Martin Mauve
• Keywords: CLL Protocol, Communications, Comprehensive Security Mechanisms, Cryptographic Link Layer, SCN 2008