Along with the deployment of IPv6 is becoming more and more widely, IPv4 networks will coexist with IPv6 networks for a relatively long time. The tunnel mechanisms are the best choice for a smooth transition to IPv6. With the wild deployment of the tunnel mechanisms, more and more security issues have been noticed. The security problems faced by tunnel mechanisms such as injection, address spoofing and reflector attack are analyzed, and corresponding countermeasures are concluded into three directions: filter, deep packet inspection (DPI) and IPsec. Some questions are pointed out for research in next steps.

Comparative studies of IPv6 tunnel security

IPv6 communication protocol vulnerabilities are common security threats in Next Generation Networks. Distributed Denial of Service (DDoS) attacks generated by exploiting these vulnerabilities have performance impact on both victim as well as on other hosts sharing the communication path. Hence in order to protect the computational and bandwidth resources of the shared path, the anomalies caused by these attacks are to be detected and the attack traffic should be filtered out from the network elements. Under the context of flow state maintenance not deployed in the network elements, the bandwidth characterization of the attack traffic is essential to deploy the filtering rules in the equipments. In this work we have considered the network bandwidth characterization of a highly critical DDoS attack in the network: the distributed reflector attack through spoofed IPv6 flows. The generated spoofed IPv6 traffic from the attacker (slaves), the reflector attack traffic caused by the responses from the reflector and the victim, and the end-to-end path bandwidth characteristics of these flows over a 6to4 tunnel are reported in terms of flow rates and per flow packet count. The flow rate pattern of the spoofed flows is modeled at the attacker side using inter departure time and packet size. The impact of network scale factor on the flow rate pattern over the path is studied and reported. We also have quantified the reflector attack flow rate in the presence of the scale factor and multiple spoofed flow sources.

A study on path behavior characteristics of IPv6 based reflector attacks

IPv6 networks are at present under vast deployment in production networks as well as in the Internet. Tasks such as resource reservation, capacity planning, and effective security deployments necessitate the understanding of IPv6 flow behavior in the nodes as well as in the network. To accomplish the understanding of IPv6 flow behavior, a tool that generates application and attack flows based on sound mathematical models is essential. Since different flows have different characteristics, the model parameters for a particular flow feature are to be assigned with appropriate values. In our tool, we have identified five flow features for characterizing the flows. They are, namely, inter departure time (IDT), packet size (PS), flow count (FC), flow volume (FV), and flow duration (FD). Random sampling from distributions such as Exponential, Pareto, Poisson, Cauchy, Gamma, Student, Wei-bull, and Log Normal are considered. IPv6 TCP and UDP packets are constructed and transmitted for the flows according to the feature values received from the assumed distribution model. The direct model parameter specification and trace-based model parameter learning are incorporated in our tool. Using our tool, we have analyzed the node behavior for IDT feature over different hardware platforms to IPv6 flows. We have presented the IDT analysis and modeled the bit rate using a three parameter function from the experimental measurements. The parameters estimated for different platforms to this model are also reported.

S. M. Bhaskar

Papers

A study on path behavior characteristics of IPv6 based reflector attacks

Inter Departure Time Analysis Over Heterogeneous Platforms Using Distributed IPv6 Traffic Generator Tool