Context-Aware IPv6 Address Hopping

Marx, Matthias; Schwarz, Monina; Blochberger, Maximilian; Wille, Frederik; Federrath, Hannes

doi:10.1007/978-3-030-41579-2_31

“…The per-connection address is not the end of the road either. Researchers extend this idea temporally to propose per-packet address [36,37], and spatially to propose prefix alteration [60][61][62]. The per-packet address means to use a unique address for each packet.…”

Section: Using Ipv6 Address Space To Enhance Security and Privacymentioning

confidence: 99%

“…Prefix alteration means not only the IID part but also the prefix part of a device's address can be varying. It can be achieved by prefix hopping, prefix bouquets, prefix sharing, and variable-length prefix [60,61], or by exploiting mobile IPv6 [62].…”

Section: Using Ipv6 Address Space To Enhance Security and Privacymentioning

confidence: 99%

Addressless: A new internet server model to prevent network scanning

Hao

¹

,

Liu

²

,

Zhe

³

et al. 2021

PLoS ONE

1

0

View full text Add to dashboard Cite

Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.

show abstract

“…By now, the researchers have put more emphasis on changing static parameters of the data flow on the fly [16,17,18,19,20]. The IP address [21], the port [22], and the routing path of a flow [11,19,20,23,24,25] are the main objects of dynamic configuration.…”

Section: Related Workmentioning

confidence: 99%

Polymorphic Path Transferring for Secure Flow Delivery

2021

KSII TIIS

1

0

View full text Add to dashboard Cite

In most cases, the routing policy of networks shows a preference for a static one-to-one mapping of communication pairs to routing paths, which offers adversaries a great advantage to conduct thorough reconnaissance and organize an effective attack in a stress-free manner. With the evolution of network intelligence, some flexible and adaptive routing policies have already proposed to intensify the network defender to turn the situation. Routing mutation is an effective strategy that can invalidate the unvarying nature of routing information that attackers have collected from exploiting the static configuration of the network. However, three constraints execute press on routing mutation deployment in practical: insufficient route mutation space, expensive control costs, and incompatibility. To enhance the availability of route mutation, we propose an OpenFlow-based route mutation technique called Polymorphic Path Transferring (PPT), which adopts a physical and virtual path segment mixed construction technique to enlarge the routing path space for elevating the security of communication. Based on the Markov Decision Process, with considering flows distribution in the network, the PPT adopts an evolution routing path scheduling algorithm with a segment path update strategy, which relieves the press on the overhead of control and incompatibility. Our analysis demonstrates that PPT can secure data delivery in the worst network environment while countering sophisticated attacks in an evasion-free manner (e.g., advanced persistent threat). Case study and experiment results show its effectiveness in proactively defending against targeted attacks and its advantage compared with previous route mutation methods.

show abstract

“…The per-connection address is not the end of the road either. Researchers extend this idea temporally to propose per-packet address [31,32], and spatially to propose prefix alteration [55][56][57]. The per-packet address means to use a unique address for each packet.…”

Section: Using Ipv6 Address Space To Enhance Security and Privacymentioning

confidence: 99%

“…Prefix alteration means not only the IID part but also the prefix part of a device's address can be varying. It can be achieved by prefix hopping, prefix bouquets, prefix sharing, and variable-length prefix [55,56], or by exploiting mobile IPv6 [57].…”

Section: Using Ipv6 Address Space To Enhance Security and Privacymentioning

confidence: 99%

Addressless: A New Internet Server Model to Prevent Network Scanning

Hao,

Liu,

Weng

et al. 2020

Preprint

0

View full text Add to dashboard Cite

Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.

show abstract

Context-Aware IPv6 Address Hopping

Cited by 5 publications

References 18 publications

Addressless: A new internet server model to prevent network scanning

Addressless: A new internet server model to prevent network scanning

Polymorphic Path Transferring for Secure Flow Delivery

Addressless: A New Internet Server Model to Prevent Network Scanning

Contact Info

Product

Resources

About