A Comprehensive Threat Model for Ipv6 Transition Technologies
Total Page：16
File Type：pdf, Size：1020Kb
The STRIDE Towards IPv6: A Comprehensive Threat Model for IPv6 Transition Technologies M. Georgescu, H. Hazeyama, T. Okuda, Y. Kadobayashi and S. Yamaguchi Nara Institute of Science and Technology, 891-6 Takayama, Ikoma, Nara, Japan Keywords: IPv6 Transition Technologies, Threat Model, STRIDE, Dual-stack, Single Translation, Double Translation, Encapsulation. Abstract: The IPv6 worldwide deployment rate is still a single figure. This is due to the many challenges introduced by the transition period through which both IPv4 and IPv6 will need to coexist. One of the biggest concerns related to the IPv6 transition is security, which is more difficult to ensure in a heterogeneous environment. To clarify the security threats introduced by IPv6 transition technologies, this article proposes a comprehensive threat model built around the established STRIDE approach. To verify the usefulness of the proposed model, a threat analysis of four generic categories of IPv6 transition technologies is performed. Existing and new threats are documented, classified and prioritized. To further validate some of the documented threats, preliminary penetration test data is presented. 1 INTRODUCTION headers, stateless autoconfiguration), or not-feasible (e.g. widespread deployment of IPv6 with IPsec). The IPv4 address space exhaustion is imminent and The IPv6 transition has further aggravated these chal- can affect the further expansion of the Internet. The lenges as transition technologies are generally ex- Internet Assigned Numbers Authority (IANA) has al- posed to the threats associated with both IP versions located on February 3rd 2011 the last blocks of IPv4 and hybrid blends, depending on the subcomponents. addresses (NRO, 2014). Four out of the five Regional When building an IPv6 transition plan, security Internet Registries (RIR) have entered the last stage is arguably the biggest concern for network opera- of IPv4 exhaustion. A detailed report is presented in tors, as a heterogeneous IPv4 and IPv6 environment (Huston, 2015) by APNIC’s G. Huston. IPv6 was in- greatly increases the attack surface. To that end, troduced in 1998. However, the IPv6 worldwide de- building a threat model for IPv6 transition technolo- ployment rate is still very low, approaching 5% as the gies can help clarify and categorize the associated se- APNIC Labs (APNIC, 2015) report. The root cause curity threats. In turn, this should facilitate the search for this low deployment status is the lack of back- for mitigation techniques and can lead to a security wards compatibility between IPv6 and IPv4. In other quantification method for IPv6 transition implemen- words, IPv4-only nodes and IPv6-only nodes cannot tations. Considering all of the above, this article pro- communicate directly. That means transition mecha- poses a threat model built around the well established nisms have to be used and also that the Internet has to STRIDE approach described in (Hernan et al., 2006). undergo a period through which both protocols have The STRIDE mnemonic is used to classify the doc- to coexist. This period can be simply referred as the umented threats. The correlations between elements IPv6 transition. of the Data Flow Diagrams (DFD) and the STRIDE Aside from the larger address space, IPv6 has, threat categories detailed in (Hernan et al., 2006) are in theory, a number of advantages over its predeces- used for the initial basic assessment of the threats for sor in terms of design: a more efficient and exten- each of the sub-elements. sible datagram, improved routing with easier route The generic STRIDE approach represents only the computation and aggregation, stateless autoconfigu- base of our proposal. The main contribution lies in ration and mandatory security. Over the years, how- identifying the threat modeling steps necessary for ever, some of these new features have proved to be ei- IPv6 transition technologies in particular. To prove ther challenges for enforcing security (e.g. extension the validity of the proposal, the model is used to de- 243 Georgescu, M., Hazeyama, H., Okuda, T., Kadobayashi, Y. and Yamaguchi, S. The STRIDE Towards IPv6: A Comprehensive Threat Model for IPv6 Transition Technologies. DOI: 10.5220/0005652402430254 In Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016), pages 243-254 ISBN: 978-989-758-167-0 Copyright c 2016 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved ICISSP 2016 - 2nd International Conference on Information Systems Security and Privacy fine and categorize existing and new threats for the 2.1 IPv6 Transition Technologies four generic types of IPv6 transition technologies. Generic Categories The resulting non-exhaustive threat analysis and pen- etration test data can be considered another important We can consider a basic production IP-based network part of the contribution of this work. as being constructed using the following components: The rest of the paper is organized as follows: Sec- tion 2 gives an overview of IPv6 transition technolo- Customer Edge (CE) segment: connects the cus- • gies, Section 3 presents related literature, in Section tomer network to the production network’s core. 4, we introduce the proposed threat model, section 5 Core network segment: the main part of the pro- discusses our approach and lastly section 6 states the • duction network, which connects the CE and PE conclusions. segments. Provider Edge (PE) segment: connects the core • network to the up-link provider. 2 IPv6 TRANSITION According to the technology used for the core net- IPv6 was not designed to be backwards compatible. work traversal, the IPv6 transition technologies can be Consequently, in a heterogeneous environment coex- categorized as follows: istence and transition technologies need to be em- 1. Dual-stack: the core network devices implement ployed. Initially, three basic transition mechanisms both IP protocols were proposed: dual-stack, translation and tunnel- ing. The associated implementation standards are pre- 2. Single translation: either IPv4 or IPv6 is used to sented in RFC 4213 (Nordmark and Gilligan, 2005) traverse the core network, and translation is used and RFC 6144 (Baker et al., 2011). at one of the edges For dual-stack, IPv4 and IPv6 are implemented on 3. Double translation: a translation mechanism is the same node. This method is used mostly for host- employed for the traversal of the core network; side nodes and edge nodes. The biggest challenge CE nodes translate IPvX packets to IPvY packets introduced by dual-stack is overhead. Translation is and PE nodes translate the packets back to IPvX. the only method which ensures direct communication 4. Encapsulation: an encapsulation mechanism is between IPv4 and IPv6 by translating the message used to traverse the core network; CE nodes en- format and information between different versions of capsulate the IPvX packets in IPvY packets, while Internet Protocol. The complication introduced by PE nodes are responsible for the decapsulation translation is breaking the end-to-end characteristic process. of the Internet, something that IPv6 was supposed to bring back. Tunneling or encapsulation is used Table 1 shows how some of the existing IPv6 transi- to traverse heterogeneous network environments, by tion technologies can fit into the generic categories. encapsulating the IPvX packets into the payload of IPvY packets, where X,Y 4,6 . At the border of ∈ { } the IPvY and IPvX networks the packets are decap- 3 RELATED WORK sulated back into IPvX by an edge router. Tunneling mechanisms are mainly confronted with fragmenta- Threat models have been proposed and used for the tion problems because of encapsulation. security analysis of online applications for some time. In an attempt to compensate for the design sim- Probably the most popular is the one introduced in plicity of the two IP versions, IPv6 transition tech- (Hernan et al., 2006), more commonly known as nologies grew in complexity. Most of the modern the STRIDE approach. At the heart of the pro- transition technologies use one or more basic tran- posal is the STRIDE mnemonic, which stands for sition technologies. For instance, Dual-Stack Lite Spoofing, Tampering, Repudiation, Information dis- (DSLite)(Durand et al., 2011) used dual-stack and closure, Denial of service and Elevation of privilege, translation at the edge nodes and encapsulation in the a set of generic security threats. The mnemonic offers core. Considering all of the above, a generic classifi- a simple and comprehensible classification base. Us- cation of the transition technologies can prove useful. ing STRIDE in conjuncture with a good understand- ing of the system’s components, can result in a good overview of the threats and possible mitigation direc- tions. As a measure of its success, the STRIDE cate- gories are used as well in (OWASP, 2015), the threat 244 The STRIDE Towards IPv6: A Comprehensive Threat Model for IPv6 Transition Technologies Table 1: IPv6 transition technologies association. Generic category IPv6 Transition Technology 1 Dual-stack Dual IP Layer Operations(Nordmark and Gilligan, 2005) 2 Single translation NAT64(Bagnulo et al., 2011), SIIT-DC(Anderson, 2015), SA46T-AT(Matsuhira, 2015), IVI(Li et al., 2011b) 3 Double translation 464XLAT(Mawatari et al., 2013), MAP-T(Li et al., 2015), dIVI(Bao et al., 2014) 4 Encapsulation DSLite(Durand et al., 2011), Lightweight 4over6(Tsou et al., 2015), MAP-E(Troan et al., 2015) modeling process used by the Open Web Application This step will help build the data flow diagram (DFD) Security Project (OWASP). Furthermore, in (Gervais, used in the following steps. 2012), the STRIDE approach has been used to model (3) Decompose the Technology: build a data the threats of industrial control systems. flow diagram (DFD) and highlight the entry points, As for the security of IP-based systems, there are protected resources and trust boundaries. The entry many articles in current literature dedicated to the is- points should be assigned a level of trust consider- sues introduced by IPv4 and IPv6. In terms of IPv4 ing the trust boundaries.