New IPv6 Identification Paradigm: Spreading of Addresses Over Time

Florent Fourcot (1, 2, 3) , Laurent Toutain (4, 1) , Frédéric Cuppens (5, 2) , Nora Cuppens-Bouhlahia (5, 2) , Stefan Köpsell (3)

1 RSM - Département Réseaux, Sécurité et Multimédia
2 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
3 TUD - TU Dresden, Faculty of Computer Science (TU Dresden)
4 OCIF - Objets communicants pour l'Internet du futur
5 Lab-STICC_TB_CID_SFIIS

The identification of packet flows is a very important feature to provide security on the Internet. This flow identification is traditionally done by the well-know five tuple source IP address, destination IP address, transport layer protocol number and the two source/destination identifiers of transport layer protocols (named ports on UDP and TCP). Unfortunately, the IP source address is not reliable at all. However, we can use new security paradigms based on new IPv6 properties. In particular, IPv6 introduces a large address space. Our solution takes the benefit of this space with a high frequency rotation of IP addresses, that we call spreading. This spreading improves the security since only the sender and the receiver are able to generate and follow this temporal sequence. An attacker will not be able to successfully insert malicious packets into a flow or to initialize a flow. It protects against session initialization flooding and against attacks on established connections. In this paper, we describe the architecture of our solution and the protocol to initiate a connection and also performance evaluation of our spreading.

Mots clés: IPv6; Security; Flow identification; Spoofing

Domaines: Réseaux et télécommunications [cs.NI]

Florent Fourcot, Laurent Toutain, Frédéric Cuppens, Nora Cuppens-Bouhlahia, Stefan Köpsell. New IPv6 Identification Paradigm: Spreading of Addresses Over Time. ICNS 2014 : the tenth International Conference on Networking and Services, Apr 2014, Chamonix, France. pp.74 - 83. ⟨hal-01060114⟩