Search

ABSTRACTStateless Address Autoconfiguration (SLAAC) is one of the novel features introduced in IPv6 Neighbor Discovery Protocol (NDP) providing for self-configuration of nodes and supplementing the reduction of operational and deployment cost of networks. Although self-configuration elevates the idea of autonomy for network, it has also introduced vulnerabilities that require substantial solutions. The SLAAC is pivoted on the presumption that network consists of authentic and entrusted nodes, however with inception of public sector wireless networks; any node can affix to the link with trivial authentication and situation changes radically. Although some security extensions like IPsec or SeND have been proposed, but these security protocols have been reported to have serious limitations like complex cryptographic algorithms which negate their adoption. This paper revisits the stateless auto configuration process and discusses its inherent vulnerabilities. The paper surveys existing research and available defense mechanisms available to protect SLAAC. The paper also suggests some guidelines from existing literature which can further promote and supplement the research to secure the auto configuration process. Finally, a novel technique is proposed for securing IPv6 link layer communication against DoS and Man-in-the-Middle attack which can be used as an alternate approach for CGA and SeND protocol.

ABSTRACTLink local communication is one of the predominant components and intrinsic features of Internet Protocol Version 6 (IPv6) networks. IPv6 nodes utilize link local communication for ascertaining the presence of other nodes on the link, for resolving their link local addresses, and for determining the reachability information of the other nodes. To achieve link local communication, IPv6 nodes employ the services of Neighbor Discovery Protocol (NDP). The protocol also suffices and forms the fundamental core in IPv6 mobile communication, enabling multihop communication. The NDP presumes that the network consists of trusted nodes; however, with the genesis of public unsecured wireless networks, any random node with minimum authentication can affix itself to the link and launch various attacks. As in the case of NDP Stateless Address Auto Configuration (SLAAC), there is no inclusion of central address configuration servers, thereby making the process vulnerable to denial-of-service (DoS) attacks on duplicate address detection (DAD). Also, in the case of the NDP address resolution process, man-in-the-middle attacks (MITM) can be launched, whereby the attackers impersonate the legitimate nodes address. Thus access to the link can be obstructed and network traffic can be redirected without the knowledge of users. To vanquish these problems, the Internet Engineering Task Force (IETF) proposed the use of cryptographically generated addresses (CGAs), which are an intrinsic element of the Secure Neighbor Discovery (SEND) protocol. The use of CGAs ensures message integrity, authentication, and address impersonation mitigation, but at the cost of higher computation and resource utilization. This article proposes some novel approaches for securing IPv6 link layer communication operations. These techniques are implemented programmatically for securing DoS on IPv6 DAD and MITM attacks and used as an alternate approach for CGAs and the SEND protocol.