IPv6 Has built in security via IPsec (Internet Protocol Security).◦ IPsec Operates at OSI layer 3 or internet layer of

the Internet Protocol Suite. IPsec

◦ Internet Engineering Task Force (IETF)◦ Encrypts the IP connection between computers◦ Data is encrypted at the packet level◦ The standard for IP encryption

IPSec provides four major functions: Confidentiality – The sender can encrypt the

packets before transmitting them across the network. If the communication is intercepted, it cannot be read by anybody.

Data Integrity – The receiver can verify whether the data was changed while travelling the internet.

Origin authentication – The receiver can authenticate the source of the packet.

Anti replay protection – The receiver can verify that each packet is unique and not duplicated.

◦ IPsec is a framework of open standards which uses the following three protocols: Security association Authentication Header Encapsulating Security Payload

Security Association: Handles protocols and algorithms used to generate the encryption and authentication keys used by Ipsec.

Authentication Header provides connectionless integrity and data origin authentication for IP datagrams.

Encapsulating Security Payload provides confidentiality, data origin authentication and connectionless integrity.

IPsec was developed in conjunction with IPv6 and it is required in all implementations of IPv6.

Although IPsec was designed for IPv6 it can be and has been used to secure IPv4 traffic for some time now.

Although IPv6 itself has built in security, the coming change to IPv6 and away from IPv4 has raised security concerns over how the change from one protocol to another may be exploited.

The main catalyst for IPv6 is the soon to be depleted number of IPv4 addresses. Some estimates say it may take more than a decade for IPv6 capabilities to spread throughout the network community.

During this transition time and even afterwards there will be servers available over IPv4 only, some will only be available to IPv6 and some available to both protocols.

Support and security for both of these protocols will be needed for an extended period.

The security concerns at this early stage deal with the minimal but growing amount of IPv6 traffic running across IPv4 networks that are not secure against threats arriving via this IPv6 traffic.

Most U.S. organizations have hidden IPv6 traffic running across their networks. They can have IPv6 running on their networks and not know it.

Windows 7, Vista, Windows Server 2008, MAC OS X, Linux And Solaris all ship with IPv6 enable by default.

The main concern lies with security meant to monitor IPv4 traffic. This security needs to be updated to include IPv6.

Firewalls need to be able to distinguish between IPv4 and IPv6. If you only have an IPv4 firewall you can have IPv6 running between you and the threat.

Tunneling is another area of concern. IPv6 traffic can be tunneled over IPv4 using programs such as Teredo, 6to4, or ISATAP.

Typical IPV4 security devices are not tuned to look for tunneled traffic. Tunneled traffic can be hard to discern and decipher in any case as the following example suggests >> you can tunnel IPv6 over HTTP over IPv4.

Rogue IPv6 traffic can include attacks such as botnet commands and controls.

One example of an botnet attack using IPv6 had the IPv6 protocol hiding itself as IPv4 through the router. It was then attacking and issuing command and controls to a botnet in the far east. Another type of threat has seen illegal file sharing that leverages IPv6 for peer to peer communications.

The type 0 routing header is another potential security problem with IPv6. This feature of IPv6 allows you to specify in the header what route is used to forward traffic. A hacker could use this to overwhelm a part of the network generating denial-of-service traffic.

RFC 5095 dated December 2007 called for measures to confront this problem. Implemented yet?

The number of attacks via IPv6 has been low but this can be attributed to the low amount of IPv6 traffic and the fact that the vast majority of the prime targets are still using IPv4.

Organizations will have to mirror what they have done for IPv4 security with IPv6. Until recently IPv4 was the only protocol used and the only one that network security needed to be concerned with. Now there is IPv4, IPv6 and IPv6 tunneled over IPv4.

Companies are now coming out with products to deal with these issues.

Command Information Assure 6 and McAfee Network Security Platform both provide full IPv6 and tunnel inspection.

Cisco and Juniper offer IPv6 enabled routers and firewalls.