Rethinking IPv6 Defense: A Unified Edge-Centric Zero-Trust Data-Plane Architecture

IPv6 dependability is increasingly inseparable from IPv6 security: the control plane relies on ICMPv6's Neighbor Discovery (ND) suite for router discovery, address resolution, and stateless address autoconfiguration (SLAAC), yet these trust-implicit mechanisms expose a broad attack surface for spoofing and flooding. IPv6's massive address space further defeats per-IP reputation, making many defenses either non-scalable or narrowly scoped. We propose a zero-trust edge architecture implemented in a single programmable data-plane pipeline that unifies four defense modules: external and internal spoofing, and external and internal flooding. A key architectural principle is identity plausibility before rate plausibility: stateless per-packet validation eliminates spoofed traffic early, ensuring that windowed flooding statistics operate only on credible identities. We realize this design in P4 using prefix Hop-Limit bands, DAD-anchored address-port bindings, and Count-Min Sketch windowed counting, and evaluate it across a systematic 15-scenario suite spanning single-, dual-, and multi-vector attack compositions. Validation on both a BMv2 prototype and a Netronome NFP-4000 SmartNIC yields near-perfect precision (100%), recall up to 100%, and sub-millisecond latency overhead, confirming practical deployability at the network edge.