IPv6 address obfuscation by intermediate middlebox in coordination with connected devices

Florent Fourcot (1, 2, 3) , Laurent Toutain (4, 5) , Frédéric Cuppens (1, 2) , Nora Cuppens-Bouhlahia (1, 2) , Stefan Köpsell (3)

1 Lab-STICC_TB_CID_SFIIS
2 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
3 TUD - TU Dresden, Faculty of Computer Science (TU Dresden)
4 OCIF - Objets communicants pour l'Internet du futur
5 RSM - Département Réseaux, Sécurité et Multimédia

Privacy is a major concern on the current Internet, but transport mechanisms like IPv4 and more specifically IPv6 do not offer the necessary protection to users. However, the IPv6 address size allows designing privacy mechanisms impossible in IPv4. Nevertheless existing solutions like Privacy Extensions are not optimal, still only one address is in use for several communications over time. And it does not offer control of the network by the administrator (end devices use randomly generated addresses). Our IPv6 privacy proposal uses ephemeral addresses outside the trusted network but stable addresses inside the local network, allowing the control of the local network security by the administrator. Our solution is based on new opportunities of IPv6: a large address space and a new flow label field. In combination with Cryptographically Generated Addresses, we can provide protection against spoofing on the local network and enhanced privacy for Internet communication.

Mots clés: IPv6; Privacy; Security; Address Management

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Florent Fourcot, Laurent Toutain, Frédéric Cuppens, Nora Cuppens-Bouhlahia, Stefan Köpsell. IPv6 address obfuscation by intermediate middlebox in coordination with connected devices. EUNICE 2013 : 19th EUNICE/IFIP WG 6.6 International Workshop, Aug 2013, Chemnitz, Germany. pp.148 - 160. ⟨hal-00861078⟩