|
|
|
|
| IPv6, An Enhanced Security Network
Protocol
Looking back, security precautions were not thought about in the development of IPv4 and have continued to be a challenge for application developers since then: IPsec was an afterthought, and Network Address Translation (NAT) - which has been widely deployed to solve the address depletion problem and for perceived security benefits - makes true end-to-end, secure applications extremely difficult to deploy. The integration of secure point-to-point networking is one area that today holds great promise for the IPv6 "killer app" and is expected to help drive wide spread consumer adoption. IPv6 solves the IPsec and NAT dilemmas. Since IPsec is designed into the v6 protocol, the need for NAT is eliminated, opening up a new networking paradigm currently not on the radar screen in the v4 world. NAT was first defined in RFC 1918 to reduce the consumption of IPv4 address space, a task that it fulfilled well. However, NAT was not designed to and does not provide security. NAT functions more like pseudo-privacy in hiding the number of nodes behind a NATed network, either behind a firewall or a router that maps the private address to a publicly routeable address. NAT breaks end-to-end connectivity by introducing additional hop(s) or node(s) (i.e. gateways) in the data path. NAT violates the IP architecture that states that every IP address uniquely identifies a computer/node. These NAT gateways typically rewrite the IP headers to masquerade systems on the internal network. If a NAT device (e.g. typically a firewall) breaks, all connections are lost. If one desires to have address privacy in the sense that one doesn't want the host, with a unique built-in MAC identifier, to be traced, then IPv6 Privacy Extensions for Stateless Address Autoconfiguration (RFC 3041) can be used. This IPv6 address contains a random number in place of the factory assigned serial number used for the MAC. Not only is this address a randomly generated number, it can also change over time. This works well for clients who wish to maintain their privacy while using FTP or HTTP. However, this is not a viable option for servers that need a well known, fixed address. This mechanism achieves the same address privacy results as Nat does in IPv4. NAT is not needed in IPv6, but can be used if desired. IPv6 NAT has a different meaning than in IPv4, as in routing between an IPv6 network and an IPv4 network. RFC 2765 and RFC 2766 describe address and protocol translation techniques as another transition mechanism in addition to dual stack and tunneling techniques. However, this translation mechanism should not be used if dual stack or tunneling is available. While NAT in IPv4, and the address privacy, protocol and port translation functions in IPv6 are good, neither provides authentication or encryption services. Though the Internet was originated with DARPA, the academic community developed the original protocol design. Security in IPv4 was not part of the original specification but rather an add-on after the Internet became more popular in the early 1990s. RFCs 2401-2411 define the Internet security architecture in which the three basic security requirements [1] of authenticity, confidentiality, and integrity are satisfied. Internet Protocol Security (IPsec) and Internet Key Exchange (IKE) are support protocols to IPv4. IKE provides a method to exchange cryptographic data (common security policy, agreed upon algorithms for authentication and encryption, and shared secret keys) in an authenticated, secure fashion, in order to key and manage the Security Associations in IPsec. IKE and IPsec have been designed into the IPv6 protocol as mandatory extension headers to the IPv6 protocol as defined in RFC 2460, Internet Protocol Version 6 (IPv6) Specification. This allows IPv6 the option to "turn on" the security features where in IPv4 an IPsec transport or tunnel would need to be constructed in order to transmit the data in a secure fashion. Despite which protocol (v4 or v6) is supported, the management of the security credentials in a Public Key Infrastructure (PKI) framework is a major issue to consider, especially if it is to scale. The corresponding standards comprising components of PKI have been available for some time, but there is no generally available comprehensive PKI. Both the Department of Commerce (DoC) and the Office of the Secretary of Defense (OSD) have indicated that the single issue of certificate revocation is the biggest issue they face with PKI. Additionally, the issue of vendor interoperability between various PKI components present challenges. m2m-x, or machine to machine, anything, anyplace, anytime connectivity, undertakes the management of secure IPv6 connections between client devices and the server. m2m-x enables secure peer-to-peer connectivity between applications, hosts or mobile devices using IPv6. The connection management server functions as a clearing house for peers desiring a secure connection. The central management server completes its task of negotiating the Security Association (SA) parameters after the connection is established between the peers. IPv6 by itself gives cable modem, DSL subscribers, and mobile devices
public address space so that true peer-to-peer connectivity can again
be realized. IPv6, coupled with the integrated security features of IPsec,
will allow the realization of secure end-to-end connectivity, allowing
multimedia and interactive-transaction oriented network applications to
grow and flourish in the IPv6 environment. These applications can then
deliver content to devices such as mobile phones, Personal Digital Assistants
(PDAs), and home appliances including refrigerators, coffee machines,
microwaves and other appliances. An MP3 player installed in an automobile,
can communicate with the home theater system to synchronize movies and
music for road trips while parked at home. The future holds an unforeseeable
number of new applications and devices that can be networked in a secure
fashion. http://niap.nist.gov/cc-scheme/index.html Additional References: |
|
|
