Large Address Space Research Articles

Vulnerability Assessment of IPv6 Websites to SQL Injection and Other Application Level Attacks

Given the proliferation of internet connected devices, IPv6 has been proposed to replace IPv4. Aside from providing a larger address space which can be assigned to internet enabled devices, it has been suggested that the IPv6 protocol offers increased security due to the fact that with the large number of addresses available, standard IP scanning attacks will no longer become feasible. However, given the interest in attacking organizations rather than individual devices, most initial points of entry onto an organization's network and their attendant devices are visible and reachable through web crawling techniques, and, therefore, attacks on the visible application layer may offer ways to compromise the overall network. In this evaluation, we provide a straightforward implementation of a web crawler in conjunction with a benign black box penetration testing system and analyze the ease at which SQL injection attacks can be carried out.

Management of resource constrained devices in the internet of things

The embedded computing devices deployed within the Internet of Things are expected to be resource constrained. This resource constraint not only applies to memory and processing capabilities, but the low-power radio standards utilized further constrain the network interfaces. The IPv6 protocol provides a suitable basis for interoperability in the IoT, due to its large address space and a number of existing protocols that function over IP and its flexibility. We investigate how existing IP-based network management protocols can be implemented on resource-constrained devices. We present the resource requirements for SNMP and NETCONF on an 8-bit AVR based device.

IPv6 Deployment and Spam Challenges

Spam has posed a serious problem for users of email since its infancy. Today, automated strategies are required to deal with the massive amount of spam traffic. IPv4 networks offer a variety of solutions to reduce spam, but IPv6 networks' large address space and use of temporary addresses - both of which are particularly vulnerable to spam attacks - makes dealing with spam and the use of automated approaches much more difficult. IPv6 thus poses a unique security issue for ISPs because it's more difficult for them to differentiate between good IP addresses and those that are known to originate spam messages.

Scalable Tree-Based Architectures for IPv4/v6 Lookup Using Prefix Partitioning

Memory efficiency and dynamically updateable data structures for Internet Protocol (IP) lookup have regained much interest in the research community. In this paper, we revisit the classic tree-based approach for solving the longest prefix matching (LPM) problem used in IP lookup. In particular, we target our solutions for a class of large and sparsely distributed routing tables, such as those potentially arising in the next-generation IPv6 routing protocol. Due to longer prefix lengths and much larger address space, preprocessing such routing tables for tree-based LPM can significantly increase the number of prefixes and/or memory stages required for IP lookup. We propose a prefix partitioning algorithm (DPP) to divide a given routing table into k groups of disjoint prefixes (k is given). The algorithm employs dynamic programming to determine the optimal split lengths between the groups to minimize the total memory requirement. Our algorithm demonstrates a substantial reduction in the memory footprint compared with those of the state of the art in both IPv4 and IPv6 cases. Two proposed linear pipelined architectures, which achieve high throughput and support incremental updates, are also presented. The proposed algorithm and architectures achieve a memory efficiency of 1 byte of memory for each byte of prefix for both IPv4 and IPv6. As a result, our design scales well to support either larger routing tables, longer prefix lengths, or both. The total memory requirement depends solely on the number of prefixes. Implementations on 45 nm ASIC and a state-of-the-art FPGA device (for a routing table consisting of 330K prefixes) show that our algorithm achieves 980 and 410 million lookups per second, respectively. These results are well suited for 100 Gbps lookup. The implementations also scale to support larger routing tables and longer prefix length when we go from IPv4 to IPv6. Additionally, the proposed architectures can easily interface with external SRAMs to ease the limitation of on-chip memory of the target devices.

Neighbor discovery for wireless networks via compressed sensing

This paper studies the problem of neighbor discovery in wireless networks, namely, each node wishes to discover and identify the network interface addresses (NIAs) of those nodes within a single hop. A novel paradigm, called compressed neighbor discovery is proposed, which enables all nodes to simultaneously discover their respective neighborhoods with a single frame of transmission, which is typically of a few thousand symbol epochs. The key technique is to assign each node a unique on–off signature and let all nodes simultaneously transmit their signatures. Despite that the radios are half-duplex, each node observes a superposition of its neighbors’ signatures (partially) through its own off-slots. To identify its neighbors out of a large network address space, each node solves a compressed sensing (or sparse recovery) problem.Two practical schemes are studied. The first employs random on–off signatures, and each node discovers its neighbors using a noncoherent detection algorithm based on group testing. The second scheme uses on–off signatures based on a deterministic second-order Reed–Muller code, and applies a chirp decoding algorithm. The second scheme needs much lower signal-to-noise ratio (SNR) to achieve the same error performance. The complexity of the chirp decoding algorithm is sub-linear, so that it is in principle scalable to networks with billions of nodes with 48-bit IEEE 802.11 MAC addresses. The compressed neighbor discovery schemes are much more efficient than conventional random-access discovery, where nodes have to retransmit over many frames with random delays to be successfully discovered.

Internet Protocols: IPv4 vis a vis IPv6

Next generation internet protocol IPv6 provides great solution to the problems associated with IPv4. large address space of IPv6 solves the problem of lack of IP addresses which was a major concern with the enormous growth of the internet. The new version of protocol provides innumerable benefits like auto configuration, simple header, multicasting, quality of service, etc. which improve the overall functionality of IPv6. In the present study, the benefits of IPv6 on IPv6 on IPv 4 have been discussed in detail including he lacuna of Ipv6 in present day scenaro. The future challenges have also been identified during the implemntation of IPv 6

Security Holes in Contrast to the New Features Emerging in the Next Generation Protocol

ABSTRACT The next generation protocol (Ipv6) also called Iping, which should replace the current generation of Internet protocol (Ipv4), brings many enhancements over Ipv4. Ipv4 has been a great success for more than 20 years, since its interception in 1980 but due to limited address space, complex configuration and very important lack of security it does not fulfil the requirement of the exponentially growing internet. Because of inadequate address and for other issues, Ipv6 was proposed by the network working group of the internet engineering taskforce (IETF) which provides many new features like quality of services, auto-address configuration, end to end connectivity, security, simple routing header and so on. This paper identifies security holes to the new features introduced in Ipv6 and security holes that are not altered by new futures of Ipv6. Keywords: Ipv4, Ipv6, Ipsec, NAT, TCP/IP, security holes, IP 1. INTRODUCTION The current generation of Internet protocol (IPv4) has been in use for more than 20 years and has not significantly changed since it was introduced in 1981. IPV4 has proven to be robust, interoperable and easily implemented. With Ipv4, options were integrated into the basic Ipv4 header whereas in Ipv6 they are handled as extension headeThe IPV4 specifies a 32 bit IP address field is a key component of the internet infrastructure and have many issues like complex configuration, limited address space, large routing tables, demand for real time data transfer and lack of security which does not fulfil the requirement of the exponential growth of the internet. To eliminate some of the mentioned imperfection, Network-working group of the Internet engineering task force (IETF) proposed a new suite of protocols called the Internet protocol version (IPv6) [1]. Industry stakeholder and Internet experts generally agree that IPv6-based network would be technically superior to the commonly installed base of IPv4-based networks [2]. The IPv6 with 128 bit address space provides large IP addresses and also with classless and auto address configuration features, IPv6 provides a new innovative communication services among the nodes and improved security by using IPsec as a part of packet header. IPv6 provides various improvements over IPv4 like simplicity, large address space, simple routing header format, extension for authentication and privacy, flow labelling capabilities, quality of services (Qos) and very important security at IP level. In addition, through auto configuration and mobility feature of IPv6 nodes on the Internet can communicate in simpler way. However, IPv6 with new features will likely generate newer protocol attacks and IPv4 related attack would morph into new form. Although the IPv6 protocol is still developing, it is fully functional and its implementation and usage in the real network is possible [3]. In section 2, we will discuss the new features introduced in IPv6. In section 3, these features are discussed along with security holes. Section 4 outlines security threats that are common to IPv4. Finally the conclusion will be given.

DFS

We present the design, implementation, and evaluation of Direct File System (DFS) for virtualized flash storage. Instead of using traditional layers of abstraction, our layers of abstraction are designed for directly accessing flash memory devices. DFS has two main novel features. First, it lays out its files directly in a very large virtual storage address space provided by FusionIO's virtual flash storage layer. Second, it leverages the virtual flash storage layer to perform block allocations and atomic updates. As a result, DFS performs better and is much simpler than a traditional Unix file system with similar functionalities. Our microbenchmark results show that DFS can deliver 94,000 I/O operations per second (IOPS) for direct reads and 71,000 IOPS for direct writes with the virtualized flash storage layer on FusionIO's ioDrive. For direct access performance, DFS is consistently better than ext3 on the same platform, sometimes by 20%. For buffered access performance, DFS is also consistently better than ext3, and sometimes by over 149%. Our application benchmarks show that DFS outperforms ext3 by 7% to 250% while requiring less CPU power.

Translation caching

This paper explores the design space of MMU caches that accelerate virtual-to-physical address translation in processor architectures, such as x86-64, that use a radix tree page table. In particular, these caches accelerate the page table walk that occurs after a miss in the Translation Lookaside Buffer. This paper shows that the most effective MMU caches are translation caches, which store partial translations and allow the page walk hardware to skip one or more levels of the page table. In recent years, both AMD and Intel processors have implemented MMU caches. However, their implementations are quite different and represent distinct points in the design space. This paper introduces three new MMU cache structures that round out the design space and directly compares the effectiveness of all five organizations. This comparison shows that two of the newly introduced structures, both of which are translation cache variants, are better than existing structures in many situations. Finally, this paper contributes to the age-old discourse concerning the relative effectiveness of different page table organizations. Generally speaking, earlier studies concluded that organizations based on hashing, such as the inverted page table, outperformed organizations based upon radix trees for supporting large virtual address spaces. However, these studies did not take into account the possibility of caching page table entries from the higher levels of the radix tree. This paper shows that any of the five MMU cache structures will reduce radix tree page table DRAM accesses far below an inverted page table.

IPv4 Address Trading Using Resource Certificate

Abstract —The Internet has been growing at unprecedented rates. The problem of an address shortage could act as a barrier on this growth. In principle, a new Internet standard, IPv6 solves the problem of the address shortage because it has a very large address space. But IPv6 is not yet compatible with the IPv4 and during the IPv4-to-IPv6 transition period IPv4 address will continue to be in demand. Thus for quite some time, the problem of IP address shortage will persist. To solve the problem, we propose the mechanism of secure IP address trading. This mechanism is based on the Resource PKI (RPKI). The RPKI is the working item of IETF. This proposed mechanism maximizes the trust of IP address trading using RPKI. Keywords —IP Address Trading, Resource PKI, Routing Security, IP Address Management 1. I NTRODUCTION The Internet has been growing at unprecedented rates. According to a prediction by the Or-ganization for Economic Cooperation and Development (OECD), it is reported that more than 85% of the available addresses on the Internet have been allocated and the remaining will run out by 2011 [1]. The problem of an address shortage could act as a barrier to the growth of the Internet [1]. Especially Internet business in Africa, Asia and Latin America are just beginning to fulfill their potential level of Internet development [1]. In principle, a new Internet standard, IPv6 solves the problem of address shortage because it has a very large address space (2128 addresses). But IPv6 is not yet compatible with the IPv4 and during the IPv4-to-IPv6 transition period IPv4 addresses will continue to be in demand [1]. Thus for quite some time, the problem of IP address shortage will persist. Another method to solve this IP address shortage problem is IPv4 address transactions. Ad-dress holders who no longer need their IPv4 address could sell or lend their address to someone who wants an IPv4 address. One important benefit of such a transaction is that it provides incen-tives for existing holders of addresses to release unused address resources. And it might rational-ize and make an underground economy in address resources more than transparent [1]. If an IPv4 address transfer market comes to exist, then it is important to consider the method

Honeynet games: a game theoretic approach to defending network monitors

A honeynet is a portion of routed but otherwise unused address space that is instrumented for network traffic monitoring. It is an invaluable tool for understanding unwanted Internet traffic and malicious attacks. We formalize the problem of defending honeynets from systematic mapping (a serious threat to their viability) as a simple two-person game. The objective of the Attacker is to identify a honeynet with a minimum number of probes. The objective of the Defender is to maintain a honeynet for as long as possible before moving it to a new location within a larger address space. Using this game theoretic framework, we describe and prove optimal or near-optimal strategies for both the Attacker and the Defender. This is the first mathematically rigorous study of this increasingly important problem on honeynet defense. Our theoretical ideas provide the first formalism of the honeynet monitoring problem, illustrate the viability of network address shuffling, and inform the design of next generation honeynet defense systems.

Contiguous IP Address Assignment Strategy for Small-Scale MANET

Most routing protocols in MANET use IP addresses as one of the most important routing information. To implement the routing protocol of MANET, the IP assignment in MANET should be solved. Allocating IP addresses is one of current key issues in the MANET, due to the absence of a centralized agent server. Previous methods require a large address space or can not use all the IP addresses of the given IP address space. For that reason, many IP addresses remain unused. To resolve this, we propose an IP address assignment protocol that uses the contiguous IP address assignment strategy without unused IP addresses. Simulations perform on ns-2 and confirm the viability of our protocol.

Anticipatory I/O Management for Clustered Flash Translation Layer in NAND Flash Memory

Recently, NAND flash memory has emerged as a next generation storage device because it has several advantages, such as low power consumption, shock resistance, and so on. However, it is necessary to use a flash translation layer (FTL) to intermediate between NAND flash memory and conventional file systems because of the unique hardware characteristics of flash memory. This paper proposes a new clustered FTL (CFTL) that uses clustered hash tables and a two-level software cache technique. The CFTL can anticipate consecutive addresses from the host because the clustered hash table uses the locality of reference in a large address space. It also adaptively switches logical addresses to physical addresses in the flash memory by using block mapping, page mapping, and a two-level software cache technique. Furthermore, anticipatory I/O management using continuity counters and a prefetch scheme enables fast address translation. Experimental results show that the proposed address translation mechanism for CFTL provides better performance in address translation and memory space usage than the well-known NAND FTL (NFTL) and adaptive FTL (AFTL).

A look at native IPv6 multicast

IP multicast offers a bandwidth-efficient means for transmitting packets to multiple hosts for applications that require multiparty communications. Coupled with IPv6's larger address space, its inherent multicast support enables current and future Internet-ready devices to support multiparty applications such as videoconferencing, P2P gaming, and data feeds. IP multicast is applicable to IPv4 and IPv6, but we focus on the IPv6 implementation, looking at the protocols and how they stack up against the IPv4 implementation. In particular, we describe how IPv6 multicast can be supported in an interdomain environment.

Value-based clock gating and operation packing

The large address space needs of many current applications have pushed processor designs toward 64-bit word widths. Although full 64-bit addresses and operations are indeed sometimes needed, arithmetic operations on much smaller quantities are still more common. In fact, another instruction set trend has been the introduction of instructions geared toward subword operations on 16-bit quantities. For examples, most major processors now include instruction set support for multimedia operations allowing parallel execution of several subword operations in the same ALU. This article presents our observations demonstrating that operations on “narrow-width” quantities are common not only in multimedia codes, but also in more general workloads. In fact, across the SPECint95 benchmarks, over half the integer operation executions require 16 bits or less. Based on this data, we propose two hardware mechanisms that dynamically recognize and capitalize on these narrow-width operations. The first, power-oriented optimization reduces processor power consumption by using operand-value-based clock gating to turn off portions of arithmetic units that will be unused by narrow-width operations. This optimization results in a 45%-60% reduction in the integer unit's power consumption for the SPECint95 and MediaBench benchmark suites. Applying this optimization to SPECfp95 benchmarks results in slightly smaller power reductions, but still seems warranted. These reductions in integer unit power consumption equate to a 5%-10% full-chip power savings. Our second, performance-oriented optimization improves processor performance by packing together narrow-width operations so that they share a single arithmetic unit. Conceptually similar to a dynamic form of MMX, this optimization offers speedups of 4.3%-6.2% for SPECint95 and 8.0%-10.4% for MediaBench.Overall, these optimizations highlight an increasing opportunity for value-based optimizations to improve both power and performance in current microprocessors.

Virtual memory in contemporary microprocessors

Here, we consider the memory management designs of a sampling of six recent processors, focusing primarily on their architectural differences, and hint at optimizations that someone designing or porting system software might want to consider. We selected examples from the most popular commercial microarchitectures: the MIPS R10000, Alpha 21164, PowerPC 604, PA-8000, UltraSPARC-I, and Pentium II. This survey describes how each processor architecture supports the common features of virtual memory: address space protection, shared memory, and large address spaces.

A new memory allocation method for shared memory multiprocessors with large virtual address space

This paper proposes a new memory allocation method for shared memory multiprocessors with large virtual address spaces. An evaluation of its performance is also presented. For effective use of shared memory multiprocessors, it is important that no processor's execution is blocked. If several processors simultaneously access a shared variable, their processes are blocked and access to the variable is serialized. Thus, frequent access to shared variables reduces the parallelism. In particular, the parallelism is significantly reduced when a special shared variable – the ‘allocation pointer’ – is frequently accessed in the dynamic object allocation by an application program. In this paper, we propose a new method for allocating physical memory pages where the allocation pointer is monotonically increased in the virtual address space in contrast to the conventional method. This allows the critical sections for access to the allocation pointer to be executed effectively and atomically by using the fetch-and-add primitive. Our method improves the application program's parallelism by access to the allocation pointer with considerably short blocking time to the process. © 1997 John Wiley & Sons, Ltd.

Virtual address translation for wide-address architectures

Operating systems employ virtual memory mechanism to provide large address space for programs. The efficiency of the virtual address translation plays an important role in determining system performance. In conventional virtual memory management systems, both the forward-mapped page table scheme and inverted page table scheme are widely used to organize the page tables that record translation data. These two schemes work well for 32-bit architectures, but not for wide address (64-bit) architectures. These two schemes either needs long translation time or incurs large memory overhead when translating wide virtual address. To cope with this problem, we propose a hybrid scheme to accelerate wide virtual address translation.

SYSTOLIC MERGING AND RANKING OF VOTES FOR THE GENERALIZED HOUGH TRANSFORM

In this paper we present and analyze a systolic structure to support the Generalized Hough Transform. Among the structural methods for object recognition, this transform is well established for its flexibility and noise immunity. Its use in actual systems has been however limited by the computational cost associated with the management of votes. Previous work has shown that a limited amount of memory can substitute the large address space required for building the histogram of votes. The systolic queue here introduced substitutes the address space required in a M- dimensional voting process, where the quantization of each dimension into Q bins yields a space complexity O(QM). An N-stage queue uses 3 M log(Q) memory bits at each stage and is capable of accumulating the incoming votes on the fly. The flow of data within the queue is designed to minimize the probability that new votes are lost because of overflow. We derive analytic expressions for the growth of the queue during the set-up period and for the time each new vote spends within the queue if it is not accumulated; furthermore, we show the conditions for the arrival times of a couple of coincident addresses to be detected and merged. The analysis of the time behaviour of the queue supports the experimental evidence that such a structure performs the accumulating process very reliably. A VLSI integrated circuit embedding a 50-stage queue is the third in a chip-set for the real time implementation of the Generalized Hough Transform.

Address space sparsity and fine granularity

To fully exploit the potential of large address spaces, e.g. 2 64 -byte, the sparsity problem has to be solved in an efficient manner. Current address translation schemes either cause enormous space overhead (page table trees) or do not support address space structuring, object grouping and mixed page sizes (inverted page tables). Furthermore, an essential handicap of current virtual address spaces is their coarse granularity. It restricts the concept's relevance to low level OS technology. Without this constraint, mapping could be a vertically integrating paradigm, useful on all levels from hardware up to application programming.Guarded page tables help solving both problems. They permit significant extensions of the current programming model without performance degradation: sparse occupation and coarse-grain (4K) pages can be handled by purely conventional hardware; fine-grain (down to 16-byte) pages without fine-grain aliasing become also possible using conventional cache and TLB technology combined with stochastically colored allocation. Unrestricted aliasing and unlimited user level mapping without performance degradation may become possible by hardware innovation.