Abstract
Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.
Highlights
Exhaustion of IPv4 addresses has long been recognized and is a reality
We make a detailed analysis of previous work in using IPv6 address space to enhance security, and compare our model to the most related ones
Addressless: A new internet server model to prevent network scanning proposed to allow a DHCP server to assign a prefix to a DHCP client, so that this DHCP client can further allocate the addresses under the prefix to other devices
Summary
Exhaustion of IPv4 addresses has long been recognized and is a reality. IPv6 [1] was proposed in 1995 to solve this problem. Various approaches have been proposed to scan the IPv6 Internet more efficiently mainly in two ways: collecting active IPv6 address records [8,9,10,11,12,13,14,15], and using statistical and machine learning methods to generate hitlists [16,17,18,19,20,21]. Our model provides a novel perspective on various problems faced by public servers
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have