Impact of IPv6 on Smart Home Technology

Transcription

1 Impact of IPv6 on Smart Home Technology April 5, 2016 Copyright Icontrol Networks.

2 Introduction Corey Gates CTO Icontrol Networks, Inc. Copyright Icontrol Networks. 2

3 Connected Home Solutions Powered by Icontrol TOP NORTH AMERICAN CABLE PROVIDERS WORLD S LARGEST HOME SECURITY PROVIDERS LEADING INTERNATIONAL SERVICE PROVIDERS RETAIL SOLUTIONS Copyright Icontrol Networks. 3

4 Doesn t IPv4 Just Work? For Sale iphone 6 16g cracked screen works fine for sprint willing to trade for another sprint phone also Source: varagesale.com, March 2016 Copyright Icontrol Networks. 4

5 IPv6 In Context IPv4 address availability is in decline Source: APNIC Labs, March 2016 Copyright Icontrol Networks. 5

6 IPv6 In Context Number of devices dramatically increasing Smart Home Devices Included Here Source: Business Insider Intelligence, 2015 Copyright Icontrol Networks. 6

7 IPv6 In Context Number of services increasing Services Requiring Internet Connectivity Source: Forrester Research Inc., June 2015 Copyright Icontrol Networks. 7

8 IPv6 In Context IPv6 is needed to ensure pervasive Internet connectivity Source: Image from blog.apnic.net Copyright Icontrol Networks. 8

9 Device Development and IPv6: Top Four Considerations Copyright Icontrol Networks. 9

10 Device Development and IPv6: Top Four Considerations Education Copyright Icontrol Networks. 10

11 Device Development and IPv6: Top Four Considerations Education Standards Copyright Icontrol Networks. 11

12 Device Development and IPv6: Top Four Considerations Education Standards Security Copyright Icontrol Networks. 12

13 Device Development and IPv6: Top Four Considerations Education Standards Security Fallback Plan Copyright Icontrol Networks. 13

14 Education Education Plan Copyright Icontrol Networks. 14

15 Education Education Plan IPv6 Protocol Copyright Icontrol Networks. 15

16 Education Education Plan struct in6_addr addr; s = socket(af_inet6, SOCK_STREAM, 0); IPv6 Protocol IPv6 APIs Copyright Icontrol Networks. 16

17 IPv6 Protocol: Comparing IPv4 with IPv6 IPv6 headers are focused on data needed for routing Source: cisco.com CC- BY- SA- 3.0, via Wikimedia Commons Copyright Icontrol Networks. 17

18 IPv6 Protocol: Comparing IPv4 with IPv6 IPv6 extension headers add flexibility, but also complexity Next Header Next Header IPv6 Header Ext Header TCP Header Data Zero or more extension headers: Fragments Routing Security Mobility Copyright Icontrol Networks. 18

19 IPv6 Protocol: IPv6 vs. IPv4 Address Space Different address space means a different network IPv4 Network DNS: A record Device example.com IPv6 Network DNS: AAAA record Source: cisco.com CC- BY- SA- 3.0, via Wikimedia Commons Copyright Icontrol Networks. 19

20 IPv6 Protocol: Address Assignment Stateless Address Auto Configuration (SLAAC) vs. DHCPv6 Network prefix Interface Id Global prefix Link- local prefix MAC- based Pseudo- random SLAAC enables a node to obtain an IPv6 address in a decentralized manner DHCPv6 enables a centralized address assignments What about Default Router, DNS, NTP, etc.? Available through DHCPv6 or ICMPv6 Router Announcements Copyright Icontrol Networks. 20

21 IPv6 Protocol: ICMPv6 ICMPv6 Control protocol for IPv6 Must be supported Replaces ARP with ND over multicast Assists with configuration, routing - more than ICMP did Reducing fragmentation - Path MTU = error message = informational type code checksum message body Source: cisco.com CC- BY- SA- 3.0, via Wikimedia Commons Copyright Icontrol Networks. 21

22 IPv6 Protocol: Multicast Multicast Must be supported How to Broadcast? => Link- local multicast group Multicast address format allows multiple scopes: flags scope flgs2 rsvd plen net prefix group id temporary or permanent 1=node- local 2=link- local 5=site- local 8=organization- local 14=global 0:0:0:0:0:1 = all nodes 0:0:0:0:0:2 = all routers Source: RFC 7371, September 2014 Copyright Icontrol Networks. 22

23 IPv6 Protocol Education Summary New addressing scheme means a new network DNS records are different Decentralized way to obtain addresses Changes to well known protocols: ICMPv6 now critical DHCPv6 less important and often not needed ARP is not used Copyright Icontrol Networks. 23

24 IPv6 APIs IPv6 impacts various APIs C,C++,C#,Go,Java,JS,Python,Ruby,Swift etc. are affected New data structures or new interfaces introduced Error handling may change IPv6 impacts DNS lookup and processing Service discovery Fallback process (more on this later) Copyright Icontrol Networks. 24

25 IPV4 to IPv6 Porting Example IPv4: struct sockaddr_in server;... server.sin_len = sizeof(server); server.sin_family = AF_INET; server.sin_addr.s_addr = INADDR_ANY; server.sin_port = 0; if (bind(sock, (struct sockaddr *) &server, sizeof(server)) <0) {... IPv6: struct sockaddr_in6 server;... server.sin6_len = sizeof(server); server.sin6_family = AF_INET6; server.sin6_addr = in6addr_any; server.sin6_port = 0; if (bind(sock, (struct sockaddr *) &server, sizeof(server)) <0) {... Copyright Icontrol Networks. 25

26 IPv6: Further Education Learn about IPv6 Tutorials and primers Free tutorials on the web Lots of primers and slideware available Technical training Involve both managers and developers Copyright Icontrol Networks. 26

27 Standards Relevant IPv6 standards exist in multiple domains IPv6 related standards Copyright Icontrol Networks. 27

28 Standards Relevant IPv6 standards exist in multiple domains IPv6 related standards IPv4 transition standards Copyright Icontrol Networks. 28

29 Standards Relevant IPv6 standards exist in multiple domains IPv6 related standards IPv4 transition standards Various communication standards related to IPv6 Example: HTTPS (over TCP over TLS over IPv6) Example: Thread (mapping IPv6 onto ) Copyright Icontrol Networks. 29

30 Security Security must be considered from the start New network layer - > time to re- examine security Copyright Icontrol Networks. 30

31 Security Security must be considered from the start New network layer - > time to re- examine security ICMPv6 and multicast IPv6 depends on ICMPv6 and multicast Cannot just shut this down (no ARP!) Copyright Icontrol Networks. 31

32 Security Security must be considered from the start New network layer - > time to re- examine security ICMPv6 and multicast IPv6 depends on ICMPv6 and multicast Cannot just shut this down (no ARP!) Dual stacks Do not presume IPv6 is off Need to audit and test both connectivity modes Copyright Icontrol Networks. 32

33 Security Security must be considered from the start New network layer - > time to re- examine security ICMPv6 and multicast IPv6 depends on ICMPv6 and multicast Cannot just shut this down (no ARP!) Dual stacks Do not presume IPv6 is off Need to audit and test both connectivity modes Auto- configuration May expose MAC address Privacy addresses using pseudo- random ids Copyright Icontrol Networks. 33

34 Security Multiple addresses Very common in IPv6 Copyright Icontrol Networks. 34

35 Security Multiple addresses Very common in IPv6 Some things to watch out for Buffer overflow issues Larger IP addresses DNS results (glibc had getaddrinfo buffer overflow!) Packet Filtering Fake RA and ND multicasts Fallback attacks Downgrading of security protocols Forcing IPv4 addresses Copyright Icontrol Networks. 35

36 Fallback Plan Is IPv4 alive and well? By Dhatfield - Own work, CC BY- SA 3.0, ex.php?cur id= Copyright Icontrol Networks. 36

37 Fallback Plan Is IPv4 alive and well? IPv4 By Dhatfield - Own work, CC BY- SA 3.0, ex.php?cur id= Copyright Icontrol Networks. 37

38 Fallback Plan Top ten networks by volume only average 39% IPv6 IPv6/Adoption 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Source: Internet Society, March 2016 Copyright Icontrol Networks. 38

39 Fallback Plan Dual Stack IPv4/IPv6 Service discovery Can IPv6 be used? Or only IPv4? Copyright Icontrol Networks. 39

40 Fallback Plan Dual Stack IPv4/IPv6 Service discovery Can IPv6 be used? Or only IPv4? Network discovery Can IPv6 route to Internet services? Copyright Icontrol Networks. 40

41 Fallback Plan Dual Stack IPv4/IPv6 Service discovery Can IPv6 be used? Or only IPv4? Network discovery Can IPv6 route to Internet services? Security issues How to protect a system with multiple interfaces? Copyright Icontrol Networks. 41

42 Fallback Plan Dual Stack IPv4/IPv6 Service discovery Can IPv6 be used? Or only IPv4? Network discovery Can IPv6 route to Internet services? Security issues How to protect a system with multiple interfaces? Usability issues Does the user need to know which network? How will the UI expose this duality? Copyright Icontrol Networks. 42

43 Four Considerations Education Standards Security Fallback Plan Copyright Icontrol Networks. 43

44 Thanks Questions? Copyright Icontrol Networks. 44

45 Copyright Icontrol Networks.