February 8, 2024
Network Security Issues in IPV6
I. What is IPV6
By jasim uddin
15 min read
Cisco states that "the number of network address bits increases from 32 bits in IPv4 to 128 bits in Internet Protocol version 6 (IPv6), which is the latest version of the Internet Protocol (IP) that uses packets to exchange data, voice, and video traffic over digital networks" [1]. The Internet Engineering Task Force is an organization that creates and implements Internet technology, and they are the ones who produced the IPv6 standard. The design of IPv6 was prompted by the IETF's prediction that there would be an increasing demand for IP addresses in the future due to the growing number of users and devices that are and will be accessing the Internet internationally.
II. IPV6 VS IPV4
Since IPv6 uses hexadecimal to assign IP addresses, more and more users and devices are able to connect to the Internet by utilizing progressively greater integers. Because an IPv6 address can have up to 314 trillion distinct IP addresses, its binary length of 128 bits is sufficient. The following is an example of an IPv6 address: ffaf: 1:201:02av:va07:0340 7009:db8.
Because IPv4's address space was smaller, NAT was necessary. Since IPv6 offers a larger address space and allows for address renumbering, this issue is resolved. The three components of an IPv6 address are the multicast address, unicast address, and any cast address. The IP header in IPv6 is 40 bytes long and fixed in length.
Due to the 32-bit length of each IPv4 address, there are approximately 4.3 billion distinct IP addresses available on the internet. Here is an example of an IPv4 address: 178.16.250.1, please. The three primary categories of IPv4 addresses are broadcast, multicast, and unicast addresses. Depending on the IP options that are provided, the IP header length in IPv4 might vary from 20 to 60 bytes [9].
III. Network Security with IPV6
In case IPv6 is protected by IP security, often known as IPsec. Prior to IPv4, IPsec was optional rather than integrated.
The IPsec protocol can flawlessly give IP access control, source identity, data integrity verification, confidentiality assurance, and resilience against replay attacks, among other security features.
In addition to providing all the necessary services, IPsec also offers the two primary services: the Authentication Header (A H) safeguards data consistency, while the Encapsulation Security Payload (ESP) header functions similarly to the AH header but further adds data confidentiality.
- **End-to-end security guarantee:**One of the many advantages of IPv6 is that Application Layer Gateways (ALGs) are no longer necessary. When IPv6 is widely used, hackers will have a harder time carrying out man-in-the-middle attacks and other similar exploits. Integrity checking and encryption, which are fixed elements of IPv6 that offer global security to all systems, devices, and connections, are present in all virtual private networks.
- Avoid unauthorised access: — IPv6 offers user authentication in addition to helping to improve data confidentiality and integrity (a task made possible by the Encapsulation Security Payload header), which raises the risk of unauthorized access. Therefore, we can conclude that it is more trustworthy for sensitive data as well as for programs and applications that need a high level of information security.
- **Traceability:**Even though IPv6 was introduced in 2011, many nations and businesses still do not use it. Each user can now have a unique IPv6 network address because to IPv6's enormous address space and its slow and steady development and acceptance. Every user has a distinct IPv6 network address, which allows for the binding of personal data to the address and, consequently, the user's traceability [8].
IV. Security Architecture of IPv6
All of the difficulties and problems that existed earlier with IPv4 have been examined and were a key consideration during the IPv6 design phase. It's also true that not everything, including potential security risks, can be taken into account during the design phase.
A. New pending issues of Public Key Infrastructure management in IPv6
The major difference in IPv6 and IPv4 is of the execution of IPsec as mandatory requirement. Hence on the network layer it will ensure the integrity and the confidentially of the data. Although. The public key infrastructure on which the whole deployment is dependent, does not occur in the IPv6 network.
B. IPv6 network is short of management approaches
Since IPv6 was launched in the year 2011, many countries and companies are trying to upgrade from IPv4 to IPv6. Majorly the security challenges are caused by the bad governance or the poor management. The IPv6 network deployment still needs to be take place on a global scale but due to the lack of the network management devices and management software for IPv6, it still has a long way to go.
C. IPv6 network requires network security devices as well
IPsec can provide shield against multiple attacks, but unfortunately it is unable to provide shield against the Dos attacks, defence sniffer, application layer attack and flood attack. Since IPsec is embedded in the network layer, therefore it provides network security to the next layer only but unable provide security to upper layers. Many of the security issues are analysed and monitored when the work takes place on the IPv6 network. Hence, IPv6 network also requires firewall [3], virtual private network, intrusion detection system, filtration of network etc.
While comparing to IPv6 to IPV4, IPv6 has some improvement have been there in relation to the data integrity and the data confidentially. But IPv6 is incompetent to fully the security challenges and issues which they face. There are several network security risks which are unavoidable; therefore they can be improved during the practice [8, 10].
V. Specific Vulnerabilities for IPV6
The security challenges, issues and vulnerabilities still apply to IPv6 from IPv4. They are categorised into three parts i.e.
1. IPv6 Basic Protocol Vulnerabilities The upgradation from IPv4 to IPv6 header probably caused few security issues. Some of them features that caused major security flaws are as follows
1.1 Extension Headers
Extension headers in IPv6 can be chained (just like link list in data structures), meaning one extension header will be pointing to another header, therefore it will be forming a series of extension header which provides a link between the transport header and IPv6 header. The above long chain of extension headers can be because of the multiple reasons. Among millions of reason, one of them is ambiguity. Currently, there are only known 6 extension headers. If an attacker wants to attack, it can easily attack the chain of extension headers which is quite long and get through the header of the transport layer for Deep Packet Inspection (DPI). The situation will get worse if the hostile code use packet fragmentation, thus driving all the security devices to reassemble the packets before security signature analysis, anomaly analysis and deep packet inspection are executed [5].
In order to avoid the attacks, following mitigation measures should be applied: (a) unusual headers order, (b) unusual header repetition, c)fragmented packets, (d) small packet sizes (especially smaller than 1280 bytes), (e) IPv6 in IPv6 encapsulation, (f) excessively large number of options in a hop- by-hop option header, (g) invalid options, and (h) monitoring non zero-filled padding bytes.
1.2 Packet reassembly by security devices
The fragmented packets should be resembled by the security devices and it should be able to parse the extension header, in order to execute deep packet inspection (DPI). To apply the port numbering filter rule and transport layer protocol, therefore a firewall should be able to traverse the transport layer header. Unfortunately, the functions listed above are not compatible with the specification of IPv6. The condition states that the packet re-assembly should not be done by the intermediate node and the extension headers should not be processed by the intermediate nodes except the hop-hop extension header. Furthermore, if the security devices reassemble the fragmented packets, then the probability is high that the similar types of security attacks can happen which were taking place in IPv4. 1.3 Auto configuration
One of the most differentiating feature of IPv6 is that stateless address auto configuration (SLAAC). Stateless address auto configuration also has many security consideration. One of the concern is that it is trust model linking to the trusting of the node within the network. Any node can acquire the local address of the link [7]. When the new node is getting the link local address, there is no need for the approval. Therefore, when the new node is given the address, it can have access to the link. The node can easily access the global prefix with the help of the node solicitation (NS) and router advertisement (RA) ICMPv6 messages for ND. The combination of the local link address with global prefix can develop a routable address which is global and can initiate it, since it will not require any approval. The above trust model poses some major challenges and issues for secure network [4, 6]. Below are the mentioned attack types which can possibly on the IPv6 auto configuration:-
1.3.1 Malicious router
It depends upon the node that whether it may or may not act as a hostile node on the router link. This means that the node will start posting the RA and start replying to NS. Any unsuspicious node will be able to select the hostile router as its on link router. It will be very easy now to perform a MITM, the attacker can also divert the traffic from router and also, now the messages can be redirected.
1.3.2 Attack on legitimate router
It is very easy to spoof the address of the authorised router and to publish a RA with 0-router lifetime. A malicious/hostile node can easily attack the authorised online router, therefore making it unreachable.
1.3.3 Bad prefixes
It is easy job for the hostile router to advertise the bad prefix that are not even present on the current link. Invalid address will be allotted to the host that auto configure themselves. One more possibility can be established by the hostile router that it can initiate an external address on link, therefore making the host unavailable. Now, the host will not transmit the packets to the router, since it will reflect that the address is on-link. Therefore it will attempt to execute the AR by transmitting NS, whose
response will not be given.
1.3.4 Failure of DAD and NUD processes
DAD request can be sent by a hostile node, therefore preventing a new node to connect to the link. This situation is the result because the hostile node can easily answer back to all the DAD requests which it receive. The hostile node asserts that it is utilising the desired address, therefore preventing it from obtaining a local address in the link. This is the same scenario, when a hostile node responds to NUD falsely, failing the process of NUD.
1.3.5 A non-existent address
It quite an easy job now for the external host to deliver the traffics to the authorised address. The traffic will be delivered to the address but the interface id will be invalid. The router will continuously try to rectify the address and will be unsuccessful. Sooner or later the router will be the victim of the denial of service attack as it will be using all of its resources to rectify the invalid address.
There are many ways in which these risks can be reduced. Filtering of the layer should be done. The secure neighbour discovery protocol (SEND) should be used in order to evade the network attacks which uses the technique of spoofing of the address. Also, ND on link transmission should be filtered [10]. The SEND protocol uses CGA (Crypto-graphically Generated Address) which doesn't provide the facility of the user authentication. Nevertheless, in ad hoc mobile network which is the application of auto discovery in IPv6 [2].
Since the nodes in the ad hoc mobile network consume an enormous amount of battery, therefore the large calculations may not be practical. This security issue remains undiminished [4].
VI. THREATS, CHALLENGES AND RISKS IN IPV6 NETWORK
A. Analysis concerns password Attack
Attacks which are related to passwords are always robust, which is similar in IPv6 also. The attacker can easily acquire the valid user name and password by social engineering from the user whom has permission to access the system. Therefore, now the attacker has the privilege to enter into the machine and can perform the activities which he wants to damage the system.
B. Analysis Concerns Secret Key Attack.
In IPv6 also, the attacker can catch-hold of the secret key which is used for exchange of data between the sender and the receiver in the two modes of IPsec that is transport mode and tunnel mode. If the attacker manages to get the secret key then he can access the secure transmission. Both the sender and receiver does not know anything about the attack and that it is taking place. With the help of the key, the attacker can decipher the data, and now can remould it according to him. Moreover, the attacker can create many other secret key and with the help of that keys the attacker can acquire the different secure transmission.
C. Analysis Concerns Application Layer Attack When the attacker attacks on application layer, the attacker directly targets to the application program, therefore resulting in the error in operation system/application program of the server. This type of attack can provide the access to the attacker to bypass from the visit control. In such an occasion, the attacker will have all the privilege rights such as add, read, modify or delete the data; the attacker can also instigate the virus which can create copy of itself. IPsec provides encryption to the data on the network layer, while the data is transmitting, the firewall [3] cannot investigate the attack if it is being done by the attacker [5].
VII. NETWORK SECURITY CONCERNS AND ISSUES IN IPV6
IPv6 is superior to IPv4 in terms of simplicity and upgradation technology, but it also causes different types of security issues. The use of IPsec in IPv6 is mandatory, but somehow the network is prone to the old IP related attacks and these attacks are connected to specific features of IPv6. When IPsec infrastructure is in deployment phase, it is difficult to manage it; therefore reducing the use of IPsec. When the upgradation takes place from IPv4 to IPv6, there is high probability that the networks of IPv4 and IPv6 both exist at the same time. If this is the scenario, the likelihood of the attacks which are network based will go up and it would be more tedious job to secure the network. The previous security flaws will still haunt and affect the networks, example can be rouge devices, packet flooding, application layer attacks etc. Since IPv6 is still new technology to us, therefore upcoming threats can also affect the IPv6 network [11].
A. Reconnaissance attacks
When the attacker wants to exploit the network then initially, the attacker will want to spot the weak point of the system. This is done by the techniques called port scanning and host probing. In case of host probing, the attacker will try to find that how many hosts are connected to the network. When the attacker is able to identify the host, then while scanning the port, attacker will try to exploit the vulnerability. Since IPv6 uses 128 bit address, therefore its subnet will make more tedious job to make reconnaissance attacks, but sill there are million ways to discover the target system. The attacker can find the routers, DHCP server since IPv6 uses multicast address structure. With help of IPsec, the administrator can minimise the risk of sniffing of the packets. Since IPv6 header is humongous, therefore it is also difficult for the administrator to identify the attacker or any hostile code.
B. Host initialisation and associated attacks
One of the feature of IPv6 is auto configuration, i.e. it helps a node to generate an address for the interfaces of the network. Therefore, it will diminish the hectic job of network administrators of manually configuring host addresses/maintaining servers of DHCP. In auto configuration, an IPv6 node can manipulate its network address with the help of state full auto configuration or stateless auto configuration. Network prefix and media access control address are the two parts of stateless auto configuration which helps in the generation of the address. The network prefix is situated in the routers which are residing inside the network segment assigned to the host whereas the media access control address is located in the network interface of the node. To catch hold the necessary network and address information, the state full auto configuration communicates with a DHCP server. The stateless auto configuration process is supported by the neighbour discovery protocol (NDP). When the address has been located, therefore NDP is used by the node to determine the other node. When the transmission is not secured through IPsec, the Internet Control Message Protocol version 6 (ICMPv6), unlocks the portal for several attacks such as denial of service attack (DoS), flooding etc. There are several possibilities that a malicious node which will generate an ICMPv6 packet can easily subdue other network segment's node, therefore developing an attack according the attacker's desire. The attacker can also generate millions of ICMPv6 message, in order to decrease the performance of the network. Mostly the attacks can be accomplished in a network segment by a node where the victim's node is attached.
- DoS attack on DAD protocol
DoS attack happens on Duplication address detection (DAD) protocol. When the DoS attack happens, the main motive of the attacker is to deprive the organisation resources/network services to their authenticate users. When dos attack happens on IPv6 network, the attacker tries to exploit the vulnerabilities in the DAD.
To achieve this, the attacker holds back for the node to send a network solicitation (NS) packet. Following the next step in attack, the attacker will respond with a neighbour advertisement (NA) packet, to inform the new that it has been using that address only.
When the NA is received, the new node will produce different address and will repeat the DAD procedure. Then again the attacker will respond with NA packet. Thus, exploiting the vulnerabilities and decrypting the transmission.
- Man-in-the-middle attack
Suppose there are two nodes, node A and node V. When a node a tries to acquire the MAC address of the another node V, it will broadcast a NS message to the group address/multicast address of the nodes. While the attacker has also the opportunity to capture and see the NS message on the same link and also has the ability to reply to it. Thus, interfering between the traffic flow between node A and node V.
- Bogus router implantation attack The IPv6 routers are able to determine each and every one's presence with the help of the Network Discovery protocol (ND) and also are able to find out their prefix and address information. Nevertheless, the network segment can be impersonated by the hostile node. Router advertisements are not validated by the node which is receiving the transmission. In this case the problem is that the hostile node can easily copy fake address and its prefix information to divert the traffic from the genuine network and user. To avoid the following problem, the nodes should be managed and coded in such a way that it should not be able to accept all the RA messages.
They should solely accept the communication from the routers which were previously listed. There may be the scenario that a set of particular nodes can begin the Man in the middle attack or DoS attack. MITM can be accomplished by seeing at the packets and passing their upgraded/modified versions. DoS attack can be achieved by abandoning the packets which it will be receiving from the victim nodes [11].
VIII. CONCLUSION
This paper focuses on the network security issues faced by IPv6. The transition from IPv4 to IPv6 was is still in process since many of the counties/companies has still not opted for it.IPv6 protocol uses the extension header therefore making it more flexible the IPv4. The extension header also fulfils the needs demanded by the user. In IPv4 the use of IPsec was optional but in IPv6 the use of IPsec is mandatory. Authentication Header and Encapsulation Security Payload are used by the IPsec in the IPv6 to give Internet protocol packet security. Where ever the packet is transmitted, the information such as IPsec, IP header and upper layer protocol layer will also travel.
There are several vulnerabilities which can easily be exploited by the attacker/hacker in IPv6. Therefore, more and more devices with enhanced security patches should be provided by the vendor for such situations. The devices should be hardcoded with features such as intrusion detection system, packet filtering, intrusion management etc. To assess the reconnaissance attacks, the two pathways are suggested, the active mode and the passive mode [6].The active mode means that to perform a scan on the chosen subnet address and the passive mode means to listening the traffic and mining the information of the live hosts. One of the solution for the problem is that the network service should be replaced with the other network service, therefore making it less prone to attacks. For denial of service attacks (DoS), the simple techniques such as DAD (Duplicate Address Detection) can have different effects on the functionality of the network.
Many of the attacks were easily executed when the IPv4 were used, but now these attacks are not effective since IPv6 is more secure than IPv4. The examples of the attacks in IPv4 are DHCP starvation etc. Mitigation techniques are similar to those used for reconnaissance attacks.
More and more use of scapy algorithm can be put into use for the better and secure future of the IPv6 [6]. IPv6 will not be able to solve the problem which were consistent in IPv4. But constant upgradation to IPv6 and testing of it will improve its current state.
REFERENCES
[1] "IPv6 Security Brief," CISCO,"
[2] "IPv6 Security," The Government of the Hong Kong Special Administrative Region, May 2011,"
[3] SUZUKI, Shinsuke and KONDO, Satoshi, "Dynamic Network Separation for IPv6 Network Enhancement,"
[4] Abdur Rahim Choudhary, "In-depth Analysis of IPv6 Security-Posture,"
[5] Dequan Yang, Xu Song and Qiao Guo "Security on IPv6,"
[6] Alexandru Carp, Andreea Soare and Razvan Rughini"Practical Analysis of IPv6 Security Auditing Methods,"
[7] Abdur Rahim Choudhary and Alan Sekelsky "Securing IPv6 Network Infrastructure : A New Security Model,"
[8] Cheng Min "Research on Network Security Based on IPv6 Architecture,"
[9] Shibendu Debbarma and Pijush Debnath "Internet Protocol Version 6 (IPv6) Extension Headers: Issues, Challenges and Mitigation"
[10] Why_IPv6_Matters_for_Your_Security"