NDLI: Securing IPv6 network infrastructure: A new security model

Content Provider	IEEE Xplore Digital Library
Author	Choudhary, A.R. Sekelsky, A.
Copyright Year	2010
Description	Author affiliation: SEGMA Technologies Inc., 8070 Georgia Ave., Suite 402, Silver Spring, MD 20910, USA (Choudhary, A.R.) \|\| IT & Professional Services, Serco North America, 1818 Library Street, Suite 1000, Reston, VA 20190, USA (Sekelsky, A.)
Abstract	Nation's network infrastructure such as the Global Information Grid (GIG) for the Department of Defense (DoD) and the OneNet for the Homeland Security Department are tran-sitioning to the Internet Protocol version 6 (IPv6) per DoD CIO Memorandum of June 2003 and the Office of Management and Budget memorandum OMB-05–22. There exist IPv6 specific security vulnerabilities in these network infrastructures that need to be mitigated in order to achieve security parity with the existing IPv4 operations. From the perspective of the Homeland Security technologies, the existence of additional security vulnerabilities implies a possibility for two pronged threats. First, the IPv6 specific vulnerabilities reduce the security posture of the network infrastructure itself; second, other critical infrastructure sectors that depend on IPv6 need additional protection. For example, the future supervisory control and data acquisition (SCADA) industrial capabilities would increasingly use the IPv6 infrastructure, as would the voice communications, the voice and video collaboration, and sharing of data such as the image data and surveillance and reconnaissance data. This paper presents three contiguous results. First, it briefly presents the new IPv6 capabilities; second, it presents a brief analysis of the security vulnerabilities arising from these capabilities; and third, it presents a new security model for IPv6 network infrastructures that has the potential to mitigate these vulnerabilities. The new model is based on the end-to-end connectivity that is restored in IPv6, thus allowing the use of host based security (HBS) systems together with the perimeter security devices. However, the use of HBS complicates the security trust management. Therefore the third component of the model is introduced, namely a policy based security management (PBSM) approach. The PBSM approach allows the secure deployment of the host based security systems. It provides the capabilities needed to specify the trust zones via a set of security policy rules that together specify a trust zone. Hosts belong to one or more trust zones. Accordingly, the host based security policies are derived from the zone security policies for all the zones to which a host belongs. In addition, the PBSM approach has the potential to support more sophisticated security capabilities such as a risk adaptive access control and dynamic security response to a changing operational picture. The capabilities are needed to enable net-centric security operations.
Starting Page	500
Ending Page	506
File Size	212746
Page Count	7
File Format	PDF
ISBN	9781424460472
e-ISBN	9781424460489
DOI	10.1109/THS.2010.5654971
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2010-11-08
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Protocols Filtering Adaptation model Fires Security Vulnerabilities Security Model Trust zones IPv6 Security Internet Security Servers
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Mitigating IPv6 Security Vulnerabilities

Prevention Algorithm against the Vulnerability of Type 0 Routing Header in Ipv6

Securing tunnel endpoints for IPv6 transition in enterprise networks

Vulnerabilities in personal firewalls caused by poor security usability

A study of technology in firewall system

Securing anycast communications in IPv6 networks by means of IPSec

Ipv6 security vulnerabilities.

Securing Teredo Client from Nat Holes Vulnerability

On Reconnaissance with IPv6: A Pattern-Based Scanning Approach

Securing IPv6 network infrastructure: A new security model

Similar Documents

Mitigating IPv6 Security Vulnerabilities

Prevention Algorithm against the Vulnerability of Type 0 Routing Header in Ipv6

Securing tunnel endpoints for IPv6 transition in enterprise networks

Vulnerabilities in personal firewalls caused by poor security usability

A study of technology in firewall system

Securing anycast communications in IPv6 networks by means of IPSec

Ipv6 security vulnerabilities.

Securing Teredo Client from Nat Holes Vulnerability

On Reconnaissance with IPv6: A Pattern-Based Scanning Approach

Securing IPv6 network infrastructure: A new security model