Secured protection of advertisement parameters in a zero trust low power and lossy network

An apparatus implemented as a physical machine, the apparatus comprising:

• non-transitory machine readable media configured for storing executable machine readable code;
• a device interface circuit configured for receiving a destination advertisement object (DAO) message in a low power and lossy network, the apparatus implemented as a parent network device providing at least a portion of a directed acyclic graph (DAG) according to a prescribed routing protocol in the low power and lossy network;
• and
• a processor circuit configured for executing the machine readable code, and when executing the machine readable code operable for:
• determining the DAO message specifies a target Internet Protocol (IP) address claimed by an advertising network device in the DAG, and that the DAO message further specifies a secure token associated with the target IP address;
• and
• selectively issuing a cryptographic challenge in response to the DAO message to validate whether the advertising network device generated the secure token.