Improving Security of Duplicate Address Detection on IPv6 Local Network in Public Area

摘要

Internet Protocol Version six (IPv6) is an ultimate solution for the Internet address depletion problem. It is developed not only to solve the addressing problem but also introduce some improvements on networking infrastructure. One of the improvements is the availability of Neighbor Discovery Protocol (NDP). Duplicate address detection (DAD) is one of the functions of NDP to make sure a generated IPv6 address is unique. However, since the NDP is not supported by a security mechanism, the DAD is vulnerable to DoS attack. Attacker can fail the detection process that causes on failing of IPv6 address configuration. The NDP standard suggested using IPSec or SeND to protect the NDP. However, the two security mechanisms introduced high computation due to the usage of cryptography algorithm. Further, its implementation in IPv6 local network is not trivial. This paper proposes a lightweight security mechanism based on distributed trust management that integrates hard security and soft security to secure the DAD in IPv6 called Trust-ND. The experimental result showed it could save the processing time of SeND mechanism up to 65.44 ms in sender and 23.53 ms in receiver. It also saves the available bandwidth up to 21.504 Kbps from the SeND mechanism.