nation is actually on-link, and hence the node can send packets directly to its peer. With the ICMPv6 Redirect the router can help the sending node by directly including the link-layer address of the better next-hop destination in the Redirect message. A node that receives an ICMPv6 Redirect message will update its Destination Cache accordingly. The following packets to the same IPv6 address will be sent to the redi- rected link-layer and destination address (see more about next-hop determination in Section 3.4.6). 3.4.9 Secure Neighbor Discovery The NDP is an attractive target for on-link attacks, as it is essential for IPv6 node setup and function. The IETF has attempted to mitigate attacks against NDP by defining 'SEcure Neighbor Discovery (SEND)' [12]. The SEND uses public-private key cryptography and certification paths to provide integrity protection and to certify the authority of message senders, essentially the authority of routers. However, the requirement to have global or local trust anchors, routers provisioned with certificates from trust anchors, and hosts being configured with pointers to these trust anchors, has caused significant deployment challenges. Due to these deployments challenges, the SEND has not been able to really take off. Another reason for the lack of deployment is that enough security may also be provided by a link layer (such as is the case in 3GPP networks) and/or by higher layers, such as by Transport Layer Security (TLS), thus diminishing the need to secure NDP messages at layer 3. The SEND defines four Neighbor Discovery options that are used to protect NDP messages: Cryptographically Generated Address (CGA), RSA Signature, Timestamp, and Nonce options. Furthermore, the SEND uses CGAs as nodes' addresses [75]. The CGAs Deploying IPv6 in 3GPP Networks are used to provide proof that the sender of the message is actually who it claims to be. Two ICMPv6 messages are also defined: Certification Path Solicitation (CPS) and Certification Path Advertisement (CPA). The CGA option is u