Security mechanism for IPv6 stateless address autoconfiguration

Internet Protocol version six (IPv6) was designed and developed to solve the problem of exhaustion of current Internet address. IPv6 also introduces a number of benefits including address auto-configuration mechanism which allows host to self-generate its own IPv6 address without the presence of a DHCPv6 server. It is one mechanism, among others, provided by Neighbor Discovery Protocol (NDP). However, the protocol does not have a built-in security mechanism and its messages were exchanged without security verification thus leaving the mechanism vulnerable to exploitation by malicious nodes. A malicious node could disrupt or tamper with the IPv6 address auto-generation process that will leave the victim without an IP address needed for communication or having a wrongly formed address. The NDP standard suggests either IPSec or SeND to secure the mechanism. Unfortunately, both security mechanisms have been extensively studied and were reported to have serious drawbacks that limit their implementation and adoption. This research proposes Trust-ND to secure IPv6 address auto-configuration mechanism based on a distributed trust mechanism. Experiment result shows that this mechanism is more lightweight and uses less bandwidth while still able to fulfill the required security feature.