Enhancing IoT Server Security Using IPv6: The security problems brought by the IPv6 address space can be traced back to the early IPv6 protocols.
There are several methods for IPv6 address allocation, including IPv6 Stateless Address Autoconfiguration (SLAAC), DHCPv6, and manual configuration.
In RFC 4291, IETF divides an IPv6 address into two parts, a 64-bit prefix and a 64-bit interface identification (IID).
In SLAAC, the IID is calculated by the MAC address of the device through the EUI- 64 algorithm.
EUI-64 is a reversible transformation, which means that anyone can calculate the MAC address through the IPv6 address of the user, thereby obtaining the device information of the user.
This exacerbates the security and privacy problems. Some approaches have been proposed to solve this problem.
One of the most important methods is to generate semantically opaque IID with SLAAC or DHCPv6.
RELATED: Pv6 Best Practices, Benefits And Challenges
SLAAC uses temporary addresses that consist of a fixed prefix and a periodical IID generated by the previous IID via the MD5 hash algorithm.
However, it brings difficulties to network management and may be faced with certain threatens in some circumstances.
Some other methods are introduced in RFC 7707 and RFC 7721, such as reducing the predictability of addresses or changing the address if necessary.
RFC 7707 concludes some IPv6 scanning tools and hitlist generation methods. Just like those mentioned in RFC 7707, IPv6 scanning is an important issue in IPv6 address security research.
Zmap greatly improves the scanning efficiency of IPv4, making it possible to scan the entire IPv4 address space within one hour. Similar to Zmap, Zmapv6 is introduced in IPv6 scanning.
However, IPv6 has a very large address space, so scanning the entire IPv6 address space is rather difficult.
Some recent IPv6 scanning algorithms are based on the comprehensive description of IPv6 address space.
A lot of works have been proposed to tell us how people use the IPv6 address in the past few years.
Plonka and Berger describe the temporal and spatial characteristics of active IPv6 addresses, and Li et al. show us the prefix distribution of IPv6 Internet.
There are two types of IPv6 scanning methods, one is to collect the active addresses on the Internet, and the other is to generate the hitlists by learning and predicting algorithms.
Fiebig et al. use DNS data to collect active IPv6 addresses, while DNSSEC reverse zone is used by Borgolte et al. and reverse DNS information is used by Fiebig et al.
Beverly et al. collect router addresses by some algorithms, such as random detection, and Rohrer et al. accomplish some other similar work. Gasser et al. summarize these methods and give a large hit list set. read full pdf here
