Stateless Address Autoconfiguration Research Articles

Optimized Duplicate Address Detection for the Prevention of Denial-of-Service Attacks in IPv6 Network

In constrained IoT networks, Stateless Address Autoconfiguration (SLAAC) utilizes the Duplicate Address Detection (DAD) protocol to ensure the uniqueness of IPv6 addresses. However, the DAD employed in SLAAC is susceptible to various security vulnerabilities, including issues related to confidentiality, conflicting addresses, and spoofing attacks. Malicious nodes can exploit these weaknesses to perform Denial of Service (DoS) attacks by consistently claiming a tentative address, joining with conflicting address, or disclosing assigned address. Existing measures against DAD attacks have limitations, e.g. high computation, communication overhead, energy consumption, and major protocol modification. To address these challenges, this paper presents an innovative Optimized DAD (O-DAD) that is robust, scalable, and compliant with standard specifications. In O-DAD, the uniqueness of tentative IPv6 addresses is ensured in a way that neither new nor existing nodes have knowledge of each other's exact assigned addresses. O-DAD also hampers the ability of malicious nodes to spoof new/existing nodes. Experimental results demonstrate that the proposed solution effectively mitigates these attacks and exhibits superior performance in terms of Address Success Ratio (ASR), computational complexity, overhead, and energy consumption. When compared to Secure, Improved, and Standard DAD, the proposed scheme reduces overhead and energy by approximately 6%, 8%, and 15%, respectively.

SADetection: Security Mechanisms to Detect SLAAC Attack in IPv6 Link-Local Network

Neighbour Discovery Protocol (NDP) attacks are a serious security concern for IPv6. Attackers utilise the Stateless Address Auto-configuration (SLAAC) NDP attack type to target the SLAAC process. SLAAC attacks can compromise an IPv6 link-local network and expose private data. Attack detection mechanisms including RA-Guard, Snort IPv6 Plugin, SLAAC detection method by Buenaventura et al., and SLAAC Security Method by Massamba et al. have been proposed by researchers to address this issue. However, the detection algorithms have a number of shortcomings, including a complete reliance on preconfigured router databases. Additionally, fragment packets and packets with Hop-by-Hop Options and Destination Options extension headers are not detectable by the detection techniques for hidden RA messages. In this study, a rule-based detection method called SADetection is proposed for use in IPv6 link-local networks to identify SLAAC attacks. Both an illegal Router Advertisement (RA) message and a concealed RA message in a packet with an extension header have been found by SADetection. SADetection has demonstrated a detection accuracy of 98\% percent and the capacity to defend an IPv6 link-local network from SLAAC attacks.

Neighbor Discovery ++− a Scalable and Robust Address Auto-Configuration for Future Internet of Things Networks

The growing complexity of the Internet of Things (IoT) solutions along with highly increased application needs call for more complex and robust networking solutions. Especially the importance of autonomic, self-configuration capabilities becomes particularly significant. The IPv6-based mobile ad hoc networks are envisioned to be a good candidate technology for the IoT networks. However, they lack efficient address auto-configuration mechanisms, which could extend the IPv6 to cover the requirements of such a demanding networking environment. To address this challenge, we have proposed the Neighbor Discovery ++ (ND++) solution for the enhanced stateless address auto-configuration. The ND++ incorporates a well-performing flooding control mechanism to the basic IPv6 ND design, which results in a very low protocol overhead in the order of few messages per node. The presented simulation-based evaluation, performed under diversified mobile scenarios, confirms the scalability and robustness of this approach with regard to the key identified metrics-reliability, overhead, and latency.

Securisation of an IPv6 Address Obtaining with SLAAC in Home Networks

In this article, we present a new method based on the securisation of an IPv6 (Internet Protocol version 6) address obtaining with the SLAAC (Stateless Address Autoconfiguration) method in the domestic network. The particularity of our domestic network is the presence of several Multihoming Internet service providers. The peripherals of the Home Network domain, especially routers are in charge of the relay of auto configuration messages coming from various routers of internet access providers. Our method allows the routers of the Home Network domain to filter the announcements of autoconfigurations called RA (Router Advertisements) according to the IPv6 addresses sources contained in the messages of autoconfiguration. The decision to relay or reject these announcements is based on a trusted table built from the addressing information obtained from the NDP protocol. Our method also aims to optimize the traffic in the Home Network domain by organizing routers to give them specific roles for the relay of information for autoconfiguration.

Light weight cryptographic address generation (LW-CGA) using system state entropy gathering for IPv6 based MANETs

In IPv6 based MANETs, the neighbor discovery enables nodes to self-configure and communicate with neighbor nodes through autoconfiguration. The Stateless address autoconfiguration (SLAAC) has proven to face several security issues. Even though the Secure Neighbor Discovery (SeND) uses Cryptographically Generated Addresses (CGA) to address these issues, it creates other concerns such as need for CA to authenticate hosts, exposure to CPU exhaustion attacks and high computational intensity. These issues are major concern for MANETs as it possesses limited bandwidth and processing power. The paper proposes empirically strong Light Weight Cryptographic Address Generation (LW-CGA) using entropy gathered from system states. Even the system users cannot monitor these system states; hence LW-CGA provides high security with minimal computational complexity and proves to be more suitable for MANETs. The LW-CGA and SeND are implemented and tested to study the performances. The evaluation shows that LW-CGA with good runtime throughput takes minimal address generation latency.

A closer look into DHCP starvation attack in wireless networks

Dynamic Host Configuration Protocol (DHCP) is used by clients in a network to configure their interface with IP address and other network configuration parameters such as Default Gateway and DNS server IP addresses. This protocol is vulnerable to a Denial of Service (DoS) attack popularly known as classic DHCP starvation attack. In this paper, we make threefold contribution. First, we highlight the practical difficulty in generating classic DHCP starvation attack in wireless networks. Secondly, we propose a stealth starvation attack which is effective in wireless networks, easier to launch, requires fewer number of messages to be transmitted and difficult to detect by known detection methods. We also show a structurally similar attack in IPv6 networks which can affect address configuration protocols such as DHCPv6 and StateLess Address Autoconfiguration (SLAAC). Subsequently, we also describe an anomaly detection method to detect the proposed attack. We design and generate the attacks in a real network setup and report the results. The proposed detection method uses the Hellinger distance between two probability distributions generated from training and testing data to detect starvation.

A novel approach for securing IPv6 link local communication

ABSTRACTLink local communication is one of the predominant components and intrinsic features of Internet Protocol Version 6 (IPv6) networks. IPv6 nodes utilize link local communication for ascertaining the presence of other nodes on the link, for resolving their link local addresses, and for determining the reachability information of the other nodes. To achieve link local communication, IPv6 nodes employ the services of Neighbor Discovery Protocol (NDP). The protocol also suffices and forms the fundamental core in IPv6 mobile communication, enabling multihop communication. The NDP presumes that the network consists of trusted nodes; however, with the genesis of public unsecured wireless networks, any random node with minimum authentication can affix itself to the link and launch various attacks. As in the case of NDP Stateless Address Auto Configuration (SLAAC), there is no inclusion of central address configuration servers, thereby making the process vulnerable to denial-of-service (DoS) attacks on duplicate address detection (DAD). Also, in the case of the NDP address resolution process, man-in-the-middle attacks (MITM) can be launched, whereby the attackers impersonate the legitimate nodes address. Thus access to the link can be obstructed and network traffic can be redirected without the knowledge of users. To vanquish these problems, the Internet Engineering Task Force (IETF) proposed the use of cryptographically generated addresses (CGAs), which are an intrinsic element of the Secure Neighbor Discovery (SEND) protocol. The use of CGAs ensures message integrity, authentication, and address impersonation mitigation, but at the cost of higher computation and resource utilization. This article proposes some novel approaches for securing IPv6 link layer communication operations. These techniques are implemented programmatically for securing DoS on IPv6 DAD and MITM attacks and used as an alternate approach for CGAs and the SEND protocol.

Lightweight Handover Control Function (L-HCF) for Mobile Internet Protocol version Six (IPv6)

While shifting from one specific single access point to another point, the Mobile IP address permits a single mobile node for keeping an uninterrupted connection with the internet. Nevertheless, when handover occurs, the packets designed for the mobile nodes may have some delay or the risk of getting lost, because of the operations such as Mobile IP handover and link switching delay. This paper presented a novel control function that is called Lightweight Handover Control Function (L-HCF). The purpose of this control function is to improve of the handover performance in the perspective of Mobile IPv6 over wireless networks. The L-HCF functionality allows a router to choose which Access Router(AR)/Access Point (AP)/ address that the mobile node is associated with when movement is needed, by using available IP addresses in its database if the movement operation in side domain or by exchange messages between other routers if the movement alter domain. Thus the Mobile Nodes (MN) can use this address without engaging in the process of Stateless Address Auto-configuration or the procedure of Duplicate Address Detection. The function is implemented analytically then simulated in OPNET. The result shows that, the control function offer minimum latency, less packet loss compared with the standard function of the mobile IPv6.

Optimizing Security and Address Configuration in IPv6 SLAAC

Abstract The Neighbor Discovery Protocol (NDP) is the predominant component in IPv6; the next generation internet protocol providing for stateless address auto configuration of nodes (SLAAC), resolution of link layer addresses and neighbor unreachability detection. The stateless address auto configuration is designed for self configuration of nodes and achieving plug and play support for network devices. The protocol is rooted on the assumption that network consists of trusted nodes, however with emergence of public wireless networks; any node can join the link with minimal authentication and the condition changes drastically. With no inclusion of central address configuration servers or trusted authorities, the process is vulnerable to malicious activities. The attacker can impersonate legitimate nodes and launch Man-in-the-Middle (MITM), Denial of Service (DoS), and other network related attacks. The access to the link can be blocked and the network traffic can be redirected without the knowledge of users. To overcome the above problem, RFC 3971 suggests the use of Cryptographically Generated Addresses (CGA) which is an innate component of Secure Neighbor Discovery (SEND). Although CGA provides for message integrity, authentication and mitigating address impersonation, the process is computation intensive with higher bandwidth consumption and harbors some other limitations. This paper presents a novel technique for address generation having a minimal computation cost as compared to CGA. The technique generates a highly randomized Interface Identifier that helps maintain nodes privacy and allows the nodes to ascertain the uniqueness on the link. It also provides robust security against DoS attacks during the DAD process of IPv6 SLAAC.

Securing IPv6's Neighbour and Router Discovery, using Locally Authentication Process

Internet Protocol version six (IPv6), the next generation Internet Protocol (IP), exists sparsely in today's world.Internet Engineering Task Force (IETF), in IPv6, allowed nodes to Auto configure using neighbour discovery protocol. Neighbour Discovery (ND) and Address auto-configuration mechanisms may be protected with IPSec Authentication Header (AH). However, as it gains popularity now a day, it will grow into a vital role of the Internet and communications technology in general. IPv6, the latest revision of the Internet Protocol (IP), is intended to replace IPv4, which still carries the vast majority of Internet traffic as of 2014. Protecting all traffic will include Address Resolution Protocol. To protect this, IPSec will need agreed Key. For Key setup, UDP packet is sent, which requires IPSec for secure communication. So IPSec requires Agreed Key and for Key setup IPSec is needed, this creates a loop. To solve this problem Locally Authentication Process is presented in this paper and we provide a taxonomy for the IPv6 Neighbor and Router Discovery threats, describe two new cryptographic methods, Cryptographically Generated Addresses (CGA) and Address Based Keys (ABK), and discuss how these new methods can be used to secure the Neighbor and Router discovery mechanisms. In this process will provide a certificate of ownership of IP address on network Interface card and Public key to provide authorization. On the other hand, it will also reduce the network load. Keywords : Stateless Address Auto-configuration, Neighbour Discovery, Cryptographically Generated Address (CGA), MYSEA, IPsec, MLS, IP next generation, Multilevel security, Router Discovery, Secure Neighbour Discovery (SEND), Public Key Infrastructure (PKI), Digital Certificate, Security Attacks in IPv6.

ND++ – an extended IPv6 Neighbor Discovery protocol for enhanced stateless address autoconfiguration in MANETs

SUMMARYRecent trends in information and communications technologies are oriented toward the design of the Future Internet and the Internet of Things. While IPv6‐based mobile ad hoc networks (MANETs) are emerging as an important building block of these new technologies, it is necessary to come up with adequate self‐configuration capabilities allowing for seamless and automated configuration of addresses in mobile environment. The mechanisms of stateless address autoconfiguration proposed for IPv6 networks are supposed to automate some configuration steps; however, they would need to be aligned with the requirements imposed by MANET networks. Therefore, in this article, we present Neighbor Discovery ++ – an extended IPv6 Neighbor Discovery protocol for enhanced duplicate address detection in MANETs, which provides increased coverage of network nodes, while minimizing protocol overhead. It exploits efficient flooding mechanism on the basis of the multipoint relay concept, which makes it an interesting approach also for large‐scale networks. Trials performed on the designated real‐world testbed platform indicate that ND++ is a promising solution to support efficient address autoconfiguration in MANETs. Copyright © 2012 John Wiley & Sons, Ltd.

Spectrum: Lightweight Hybrid Address Autoconfiguration Protocol Based on Virtual Coordinates for 6LoWPAN

Stateless address autoconfiguration protocols allow nodes to select addresses and validate the uniqueness of a selected address by duplicate address detection (DAD). The considerable cost of DAD results from the message complexity increase in multihop network topologies, such as wireless sensor networks. This paper proposes a lightweight, hybrid address autoconfiguration protocol, called Spectrum, that deploys IPv6-compatible addresses into 6LoWPAN networks in a distributed manner. Spectrum creates the virtual coordinate system on the network and deploys addresses based on the location of the nodes. The deployment policy based on the virtual locations of the nodes reduces the DAD cost in the initial configuration as well as the cost for additional configurations of newly arrived nodes. The authors implemented and tested the proposed scheme in a real environment. Simulations and experiments confirmed a reasonable message cost for both stateful and stateless autoconfigurations.

Privacy and Security of DHCP Unique Identifiers

As protection against the current privacy weaknesses of StateLess Address AutoConfiguration (SLAAC) in the Internet Protocol version 6 (IPv6), network administrators may choose to deploy the new Dynamic Host Configuration Protocol for IPv6 (DHCPv6). Similar to the Dynamic Host Configuration Protocol (DHCP) for the Internet Protocol version 4 (IPv4), DHCPv6 uses a clientserver model to manage addresses in networks, providing stateful address assignment. While DHCPv6 can be configured to assign randomly distributed addresses to clients, the DHCP Unique Identifier (DUID) was designed to identify uniquely identify clients to servers and remains static to clients as they move between different subnets and networks. Since the DUID is globally unique and exposed in the clear, attackers can geotemporally track clients by sniffing DHCPv6 messages on the local network or by using unauthenticated protocol-valid queries that request systems’ DUIDs or leased addresses. DUIDs can also be formed with systemspecific information, further compromising the privacy and security of the host. To combat the threat of the static DUID, a dynamic DUID was implemented and analyzed for its effect on privacy and security as well as its computational overhead. The privacy implications of DHCPv6 must be addressed before large-scale IPv6 deployment.

A Scalable Network Architecture for a Large-scale Uni-directional Link

Effective bandwidth utilization and scalability are vital issues for IP networking over a large-scale uni-directional link (UDL), such as a wide-area wireless broadcast over satellite or terrestrial digital broadcasting. On a large-scale UDL, the current network architecture is not scalable to cover an extraordinary number of receivers that communicate using a Link-layer Tunneling Mechanism (LLTM). This paper proposes a network architecture for a large-scale UDL that: (1) decreases the traffic load of LLTM at the upstream network of the UDL, (2) coordinates the data link layer and network layer of receivers without communications via UDL, and (3) enables neighbor discovery for direct communication between receivers via a bi-directional link that is used as a return path for LLTM. Simulation results showed that our approach reduces by more than 90% the control messages to be sent via UDL compared with IPv6 stateless address autoconfiguration on the existing network architecture. Our proposal improves the UDL bandwidth consumption from O(N) to O(1), so that the bulk of the bandwidth can be utilized for delivering services, not for network configuration of receivers.

SIP-based MIP6-MANET: Design and implementation of mobile IPv6 and SIP-based mobile ad hoc networks *,†

In this paper, we designed and implemented an integrated wireless system, namely a SIP-based MIP6-MANET system. This SIP-based MIP6-MANET system is an integration and implementation of Mobile IPv6 and SIP-based mobile ad hoc networks (MANETs). To support mobile multimedia services, this work is the first result to combine session initiation protocol (SIP) into the integrated MIP6-MANET system. Our actual system implementation was built on the Linux OS (2.4.22 Kernel), the Orinoco IEEE 802.11b wireless card, and MIPL (mobile IPv6 for Linux), where the router advertisement and solicitation and binding update packets were adaptively modified and redefined to achieve the real implementation of the SIP-based MIP6-MANET integrated system. Our SIP-based MIP6-MANET system utilizes the IPv6 stateless address auto-configuration (SAA) mechanism to automatically get a care-of-address (CoA) without CoA address management from the IPv4-based DHCP server. The SIP-based MIP6-MANET system supports the IP mobility mechanism which maintains a session connection when a mobile host roams from one MANET subnet to another. The key contributions of the SIP-based MIP6-MANET system are stated as follows: (1) This system provides an efficient handoff mechanism to reduce the handoff time when a mobile node (MN) roams between different MANETs; (2) Our system can efficiently reduce the triangle routing delay when an MN roams to a foreign MANET; (3) It obviously improves the throughput and arrival rate between an MN and a corresponding node; (4) The response time of our system is decreased when an MN roams to a foreign MANET. Performance analysis also illustrated the performance, which showed that the integrated system is more efficient in terms of handoff probability, triangle routing delay, throughput, and response time than traditional MIPv4-based wireless infrastructure systems.

An address autoconfiguration protocol for IPv6 hosts in a mobile ad hoc network

A mobile ad hoc network is an infrastructure-free wireless network that is built on the fly. Since central administration or configuration by the users is impractical in such networks, autoconfiguration of network nodes is highly desirable. In this paper, we propose an approach to IPv6 address autoconfiguration in ad hoc networks, where we apply the IPv6 Stateless Address Autoconfiguration Protocol and Neighbour Discovery Protocol to the context of ad hoc networks. It overcomes some of the limitations of existing protocols. In particular, we consider the scenarios of network partitioning and merging. A distributed scheme for duplicate address detection is also discussed. We evaluate the performance of our solution through simulation experiments.