Secure neighbor discovery router for defending host nodes from rogue routers

A router comprising:

• an Internet Protocol (IP) interface circuit configured for receiving a router advertisement message on a network link in a network;
• a routing circuit configured for detecting within the router advertisement message an advertised address prefix and an identified router having transmitted the router advertisement message within the network, the routing circuit further configured for determining at least one of whether the identified router is authorized to advertise itself as a router or advertise the advertised address prefix on the network link, the routing circuit further configured for selectively initiating a defensive operation against the identified router based on determining the identified router is not authorized to advertise itself as a router or advertise the advertised address prefix on the network link.

An apparatus comprising:

• means for receiving a router advertisement message on a network link in a network;
• and
• means for detecting within the router advertisement message an advertised address prefix and an identified router having transmitted the router advertisement message within the network, the means for detecting further configured for determining whether the identified router is authorized to at least one of advertise itself as a router, or advertise the advertised address prefix on the network link, the means for detecting further configured for selectively initiating a defensive operation against the identified router based on determining the identified router is not authorized to advertise itself as a router, or advertise the advertised address prefix on the network link.