This document summarizes a survey on IPv6 security issues. It discusses how IPv6 provides larger address spaces and more features than IPv4, but also introduces new potential security risks. Some key risks discussed include network reconnaissance due to the large number of possible IPv6 addresses, bypassing access controls by using extension headers, and packet spoofing due to the way IPv6 addresses are allocated. The document recommends steps to help maintain secure networks during the IPv6 transition such as filtering internal addresses and unnecessary services.

1. Survey on IPv6 Security Issues
Neeha Bathini

2. INTRODUCTION
The accelerated growth of the internet based
applications and devices made the transition from
IPv4 to IPv6 mandatory.
IPv6 provides large address spaces, QoS,
extensibility, security, routing capabilities, mobility
and other features.
IPv6 features are likely to provide newer protocol
attacks.
This paper provides various security challenges with
Ipv6 and some of the possible solutions.

3. IPv4 Vs IPv6
Allows for 4 billion
internet addresses
Allows 34 trillion, trillion,
trillion internet addresses
32 bit address field 128 bit address field
IPv4 supports only 40-bytes of
options,
options in IPv6 can be as much
as the size of IPv6 packet itself.
No packet flow
identification.
Packet flow identification is
available within the IPv6
header using the Flow
Label field.

4. IPv6 Packet Format

5. IPv6 Header in detail :
1.Version (4 bits)
 4 bits are used to indicate the version of IP and is set to 6
2.Traffic Class (8 bits)
 same function as the Type of Service field in the IPv4 header.
3.Flow Label (20 bits)
 identifies a flow and it is intended to enable the router to identify
packets that should be treated in a similar way without the need for
deep lookups within those packets.
 set by the source and should not be changed by routers along the
path to destination.
 unique & powerful tool to IPv6

6. 6
……
4. Payload Length (16 bits)
 With the header length fixed at 40 bytes, Length of payload
determines the length of entire packet
 Next Header (8 bits)
 Indicates either the first extension header (if present) or the
protocol in the upper layer PDU (such as TCP, UDP, or
ICMPv6).
6. Hop Limit (8 bits)
 it is a variable that is decremented at each hop, and it does not
have a temporal dimension.

7. 7
……
7. Source IPv6 Address (128 bits)
 Stores the IPv6 address of the originating host.
8. Destination IPv6 Address (128 bits)
 Stores the IPv6 address of the current destination host.

8. Security Issues In IPv6
 The IPv6 characteristics can be utilized to accomplish attacks
to systems and networks
 IPv6 calls for deep comprehension of the protocol, its
prerequisites and security issues. Watchful arranging is
obliged to diminish the likelihood of exploitation.

9. IPv6 Security Characteristics
 Based on IPv4 experiences the new protocol
incorporates a number of features with already known
security issues.
 Support for some IPsec features:
Authentication headers
Encryption headers
These can be used to implement specific security
policies. Separate implementation allows for a degree
of flexibility when implementing a particular policy.

10. Network Reconnaissance
 Enormous number of conceivable IPs complicates the
undertaking of disclosure of working Operating systems and
administrations utilizing host and port scanning
Shortcomings:
Normally fundamental systems get appointed "simple to
recollect" addresses
DNS servers keep framework information
IPv6 neighbor-revelation information
Exceptional multicast addresses for different sorts of
system recourses (switches, DHCP servers and so forth.)

11. Access Control
 One Interface might have various addresses, worldwide
unicast
 The director may empower worldwide unicast addresses just
for gadgets that must get to the web. Augmentation Headers
in IPv6 may be utilized to sidestep the security strategy
E.g. steering headers must be acknowledged at particular
gadgets (IPv6 endpoints)
 In IPv6 some ICMP and (connection neighborhood) Multicast
messages are needed for the right operation of the
convention
 The firewalls ought to be suitably arranged just to permit the
right messages of these sorts
 The IPv4 ICMP security strategy must be fittingly adjusted for
ICMPv6 messages

12. Packet Spoofing
 The address allocation technique offers another trademark
for the control of bundles with spoofed source address
 All inclusive accumulated nature of location distribution
implies that addresses are appointed from greater to littler
gatherings. At diverse phases of the steering strategy
channels can be set up to check and piece wrong source
addresses.
 The huge number of accessible IPv6 locations permits an
aggressor to utilize parodied, yet from legitimate sources,
addresses

13. Amplification (DDoS) Attacks
 There are no broadcast addresses in IPv6
 This would stop any kind of intensification/"Smurf" assaults
that send ICMP packets to the broadcast address
 Worldwide multicast addresses fro uncommon gatherings of
gadgets, e.g. join residential areas, residential areas, site-
nearby switches, and so on.
 IPv6 determinations preclude the era of ICMPv6 parcels in
light of messages to worldwide multicast addresses.
 Numerous well known working frameworks take after the
detail
 Still questionable on the risk of ICMP bundles with worldwide
multicast source addresses

14. Security Issues With Transition
There are security issues with the transition from v4 tov6
 Tunnels are widely used to interconnect organizes over
ranges supporting the "wrong" form of convention
 Tunnel activity ordinarily has not been expected by the
security strategies. It may go through firewall frameworks
because of their failure weigh two conventions in the same
time
 Such checks additionally set levels of popularity for handling
power and figuring recourses
 The issue is disintegrated by the way that numerous
burrowing components are working consequently

15. In order to maintain secure networks……
 Use standard, non-obvious static addresses for critical systems;
 Ensure adequate filtering capabilities for IPv6;
 Filter internal-use IPv6 addresses at border routers;
 Block all IPv6 traffic on IPv4-only networks;
 Filter unnecessary services at the firewall;
 Maintain host and application security with a consistent security
policy for both IPv4

16. Thank you