Sheng Jiang (Speaker) Xu Chen Xuan Song Huawei Neighbor Cache Protection in Neighbor Discover Protocol draft-jiang-v6ops-nc-prtection-01 IETF 77 V6OPS WG March 26, 2010

Threats to Neighbor Cache In the Neighbor Discover Protocol (RFC 4861) The neighbors' information, such as the paired mapping of link-layer addresses and IPv6 addresses, is recorded in a local Neighbor Cache database. NC is vulnerable to malicious attacks. A DoS attack against the NC of an IPv6 router can fill up with faked entries and exhaust the cache's resources.

A DoS Attack Example against NC NS (faked address) Hacker ARouter B NS (faked address) Example Neighbor Cache IPv6 AddressStatMac FE80::21D:A1FF:FE79:A437STALExxxx FE80::21D:A1FF:FE79:A438STALExxxx FE80::21D:A1FF:FE79:A439STALExxxx An attacker sends minimally sized Neighbor Solicitation (NS) packets, which is 90 Bytes, to a target router on a 100 Mbps Ethernet link It can, in theory, build up and sustain perhaps 145k bogus entries in a second Note: the size of Neighbor Cache on most of access router devices are between 1k~50k Even the biggest Routers NC are fully filled in less than half second New host access requests are blocked out Recovery depends on the expire time of NC items. It takes minutes after the attack stops

A Lightweight Secure Mechanism is needed SeND [RFC3971] provides a feasible solution, but too heavy. A lightweight secure mechanism is needed  focus on NC protection only  Minimize the change requests for the existing ND protocol  NO change requests on the normal hosts (initiator side) In-Scope Requirements  anti DoS attack  anti replay attack  anti IP address spoofing Out-Scope Requirements  Privacy (or encryption)  Authentication  Message Integrity  Non-repudiation

IPv | Host A | | Router B | | (1) RS/NS/NA | + ===========================> + | | (2) Create NS record | (3) Reverse Detect NS | (Impl. in high speed memory) | | (record ) + <=========================== + | (4) RD-Reply NA | + ===========================> + | | (5) Create NC entry | (6) RA/NA | ((5a)verify ) + <=========================== + | | Reverse Detection for Neighbor Cache Protection By receive the first RS/NS/NA message, the router puts this message into a high speed NS record table (action (2)) It then sends a RD NS message to the initiated host (action (3)) The initiated host responds a NS-replied NA message (action (4)) When the router received the RD-replied NA message, it verifies whether the pair of the source IPv6 address and the source MAC address matches any entry in the NS records table (action (5a)) If verified, fetch the matched NS record and continue the normal CPU-based slow path NS procedure (action (5) and (6))

Questions, clarification, comment?