Abstract
The Internet is driven by a common internetworking protocol suite called TCP/IP. Within the suite,
a network layer protocol named Internet Protocol version 4 (IPv4) exists. IPv4, with 32-bit address
fields, was designed without anticipating the forthcoming flood of global community. At the time, the
232 address space was sufficient to support the few users. As the Internet grew with diverse networking
demands and technologies, IPv4’s ability to support the size and the demands thereof was surpassed.
The latest IANA’s address exhaustion reports project that the end days of unallocated IPv4 address space
is a matter of months. Furthermore, the original design assumed trusted users; security was thus hardly
an issue. The design favored interoperability over security and did not contain features that protected
the confidentiality, integrity or availability of communications. Such incidents as the outbreak of the
Morris worm that marked the dawn of a new era of Internet security are prime witnesses. Therefore,
addressing these plagues was necessitated.
For these nuisances, both short-term and long-term solutions have been put forward. Short-term
’solutions’ such as Classless Inter-Domain Routing (CIDR) and Network Address Translation (NAT)
have prolonged the lifetime of IPv4 to some extent. As expected, these are time-bounded and ’patch-
and-prolong’ solutions. To address the security issues, a protocol suite named Internet Protocol Security
(IPsec) was then introduced to be used optionally,and not as a mandatory feature. On the other hand,
IETF’s quest for a long-term solution gave birth to a new and backward-incompatible network layer
successor protocol, Internet Protocol version 6 (IPv6). Put simply, IPv6 is the next generation Internet
protocol designed to handle the unprecedented growth of the Internet and cope up with the very current
networking requirements such as end-to-end security, Quality of Service (QoS), scalability and ubiquity.
IPv6 is already gaining global momentum, even in production and mission-critical environments.
Nations that did not benefit from the disproportionate IPv4 address allocation (e.g. Asia, Europe) have
shifted their gears and efforts towards embracing it to the fullest. Even in parts where IPv4 relatively
has a higher life expectancy (e.g. US), the effort is towards catalyzing the transition. For instance, the
US federal agencies are mandated to be IPv6-ready from 2008 onwards. The bottom line is that a global
migration to the IPv6 Internet is inevitable.
IPv6 being on the horizon, studying its security notions is critically important. With increased addi-
tion of unimaginable morphs of nodes (e.g. smart home appliances, cars, sensors, body-worn miniature
devices, etc) to the Internet and the attacks thereof, the worth of this study can not be emphasized further.
In this thesis, we have taken the initial stride of studying the security ramifications of IPv6’s key
features, in the hope of laying a foundation for security of the next generation Internet. Generally, the
research is centered around the following key objectives:
1. To identify vulnerability points of the protocol as early as possible.
2. To assess some of the proposed solutions in view of the threats identified.
3. To show the road map towards a more secure IPv6 world from the perspective of network protec-
tion devices (NPDs) and existing as well as IPv6-specific [projected] security practices.
To meet the first two objectives, in part I of the thesis, we have done an extensive threat analysis on
prominent features such as Neighbor Discovery, Autoconfiguration, Extension Headers, Mobile IPv6
(MIPv6) as well as on deployment-related aspects like transition mechanisms. For a so-obvious reason,
the analysis could not be exhaustive. In addition, we have done a comparative analysis of well-known
existing attacks in the light of IPv6. The viability as well as the resistance to potential attacks of some of
the proposed solutions such as Secure Neighbor Discovery (SEND), authentication solutions of MIPv6
and automatic IPv6-in-IPv4 tunneling protocols have also been analyzed.
In part II of the thesis, we show the road map towards the detection and prevention strategies, in
view of the threats analyzed in the preceding part. In this part, the inter IPv6-NPD issues and chal-
lenges are explored and assessed in a reasonable detail from the perspective of veteran security devices:
packet filters and deep packet inspection devices. Moreover, we present potential futuristic security
architectures of the IPv6 world. We also forward recommendations and Best Security Practices (BSPs)
based on the threat analysis done. These practices would pretty much serve as a stepping stone for more
comprehensive next generational security practices.