Improved Mechanism to Prevent Denial of Service Attack in IPv6 Duplicate Address Detection Process

Abstract

Abstract-From the days of ARPANET, with slightly over two hundred connected hosts involving five organizations to a massive global, always-on network connecting hosts in the billions, the Internet has become as important as the need for electricity and water. Internet Protocol version 4 (IPv4) could not sustain the growth of the Internet. In ensuring the growth is not stunted, a new protocol, i.e. Internet Protocol version 6 (IPv6) was introduced that resolves the addressing issue IPv4 had. In addition, IPv6 was also laden with new features and capabilities. One of them being address auto-configuration. This feature allows hosts to self-configure without the need for additional services. Nevertheless, the design of IPv6 has led to several security shortcomings. Duplicate Address Detection (DAD) process required for auto-configuration is prone to Denial of Service (DoS) attack in which hosts are unable to configure themselves to join the network. Various mechanisms, SeND, SSAS, and the most recent being Trust-ND, have been introduced to address this issue. Although these mechanisms were able to circumvent DoS attack on DAD process, they have introduced various side effects, i.e. complexities and degradation of performance. This paper reviews the shortcomings of these mechanism and proposes a new mechanism, Secure-DAD, that addresses them. The performance comparison between Trust-ND and Secure-ND also showed that Secure-DAD is more promising with improvement in terms of processing time reduction of 45.1% compared to Trust-ND while preventing DoS attack in IPv6 DAD process.

Address Autoconfiguration in IPv6 Networks: Challenges and Countermeasures

“…Duplicate Address Detection (DAD) procedure is considered to be one of the crucial steps in the autoconfiguration process, as autoconfiguration of a node solely lies on the success of DAD process. Unfortunately, DAD is subjected to several attacks and [5], [10], [11] has emphasized that DAD to a greater extent is exposed to Denial of Service (DoS) attacks. In [6], DoS-on-DAD can prevent a node from obtaining the target address by continuously replying NA messages indicating that the address is not unique.…”

“…Secure -Duplicate Address Detection (Secure-DAD) [10] was constructed to counter DoS attacks in DAD by overcoming the complexities of SeND, SSAS and Trust-ND. Secure-DAD is constructed on Universal hashing (UMAC) algorithm and recommends the addition of a secure tag option in NS and NA reciprocated during DAD.…”