DAD-match; Security technique to prevent denial of service attack on duplicate address detection process in IPv6 link-local network

Abstract

An efficiently unlimited address space is provided by Internet Protocol version 6 (IPv6). It aims to accommodate thousands of hundreds of unique devices on a similar link. This can be achieved through the Duplicate Address Detection (DAD) process. It is considered one of the core IPv6 network’s functions. It is implemented to make sure that IP addresses do not conflict with each other on the same link. However, IPv6 design’s functions are exposed to security threats like the DAD process, which is vulnerable to Denial of Service (DoS) attack. Such a threat prevents the host from configuring its IP address by responding to each Neighbor Solicitation (NS) through fake Neighbor Advertisement (NA). Various mechanisms have been proposed to secure the IPv6 DAD procedure. The proposed mechanisms, however, suffer from complexity, high processing time, and the consumption of more resources. The experiments-based findings revealed that all the existing mechanisms had failed to secure the IPv6 DAD process. Therefore, DAD-match security technique is proposed in this study to efficiently secure the DAD process consuming less processing time. DAD-match is built based on SHA-3 to hide the exchange tentative IP among hosts throughout the process of DAD in an IPv6 link-local network. The obtained experimental results demonstrated that the DAD-match security technique achieved less processing time compared with the existing mechanisms as it can resist a range of different threats like collision and brute-force attacks. The findings concluded that the DAD-match technique effectively prevents the DoS attack during the DAD process. The DAD-match technique is implemented on a small area IPv6 network; hence, the author future work is to implement and test the DAD-match technique on a large area IPv6 network.

A New Concept of Duplicate Address Detection Processes in IPv6 Link-Local Network

“…However, there hasn't been much discussion about how to apply diligent checking operations in actual applications. As a result, following the previous successful applications of the Match-prevention technique for preventing DAD by Al-Ani et al [7] and the DAD-match technique by Al-Ani et al [16] for securing DAD, and motivated by the works of [1][2][3][4][5], this paper presents an Initial Neighbor Inspection approach to DAD operation by establishing an initial round of verification of the nodes on the same link before a broadcast request on the existence.…”

IPv6 addressing with hidden duplicate address detection to mitigate denial of service attacks in the internet of drone

“…Still, they involve complex cryptographic techniques unsuitable for resource-constrained environments. Authentication-based schemes 52,61,62 require an additional authentication system to authorize the participation of various components in the DAD process, which is tedious and violates the SLAAC standard. Detection and defense mechanisms 46,55,58,60,[64][65][66][67] use intelligent techniques to identify and take defensive actions against malicious nodes, but they require additional development and implementation and cannot prevent all attacks.…”

Proposed security mechanism for preventing fake router advertisement attack in IPv6 link-local network

“…Al-Ani et al [22] proposed an alternative DAD method to address the DoS attack during the DAD process in the IPv6 network. DAD-match have introduced two new NDP message types known as NS-match and NA-match.…”

“…Song and Ji [21] DAD-h i) vulnerable to hash collision attack because using MD5, ii) suffers from Dos attack, and iii) only implemented for neighbor discovery, not for RD. Al-Ani et al [22] DAD-match i) suffers from pre-image attack; ii) has lower hash power, and iii) only implemented for neighbor discovery not for RD. Praptodiyono et al [23] Trust-ND i) the hash collision attack can be used against the SHA-1 hashing algorithm, ii) unreliable generation of trust value, iii) vulnerable to DoS attack, and iv) complex processing overhead.…”