Preventing Denial of Service Attacks on Address Resolution in IPv6 Link-local Network: AR-match Security Technique

摘要

Address resolution (AR) process, one of the important neighbor discovery protocol (NDP) functions, aims to obtain the corresponding relationship between Internet protocol and media access control addresses. This process uses two NDP messages, neighbor solicitation (NS) and neighbor advertisement (NA) messages, which are unsecure by design. In addition, the target address is revealed in the traditional AR process. Thus, any malicious node on the same link can modify the message and launch denial of service (DoS) attacks. The current mechanisms suffer from high-complexity issue or other forms of security issues that can induce DoS attack on AR in IPv6 link-local network. To overcome these limitations, this work proposes AR-match technique to secure AR process by hiding the target address by using a hash function algorithm and adding a new option named AR-match, which is attached to each NS and NA message for them to become NS- and NA-match messages, respectively. AR-match technique can provide a high security with less complexity and will completely prevent DoS attacks during AR in the IPv6 link-local network.