Research on IPv6 Neighbor Discovery Protocol (NDP) security

摘要

With the benefit of large address space, flexible header extension, high security and mobility, IPv6 is introduced as the next generation Internet protocol. NDP is a necessary part of IPv6 and provides nodes with a method to get the link-local addresses of nodes on the link. NDP has the functions of address resolution, router discovery and duplicate address detection. However, NDP is designed with the assumption that nodes in the network are trusted. So it is vulnerable to various attacks such as DoS, DDoS, replay and redirect. SEND is proposed to come across the threats against NDP, but it does not work well as expected. Security considerations are the main reasons for the application of IPv6. NDP security is an important part of IPv6 security. We analyze the security of NDP and SEND, and summarize the latest advances on how to protect NDP against attacks and enhance NDP security.