6th European Conference - Academic Conferences

Stephen Groat et al.
Sections 4 and 5 analyze the different factors which affect the security of a dynamic address and how
these factors affect each other. Section 6 uses statistical simulation results to validate our security
analysis of dynamic addressing factors. In Section 7, we discuss specific security advantages offered
by dynamic addresses. Future work planned to demonstrate a dynamic addressing approach is
discussed in Section 8 and we conclude in Section 9.
2. Problem
Static addresses are necessary to allow users to repeatedly find resources. Without providing a
notification of an address change, users must have a single, static identifier to locate resources. For
example, IP addresses, whether static or dynamic, are often connected with Domain Name System
(DNS) names. DNS names are updated with the current IP address to facilitate location of resources
on the Internet with an easily recognizable value. Without a static value connected to networked
resources, whether DNS names or IP addresses, users would be unable to find the resources. Even
Dynamic Host Configuration Protocol (DHCP) leased addresses, which are widely assumed to be
dynamic, rarely change.
While static addressing is critical to assist users in finding resources, static addresses allow malicious
users to easily locate targets for attack. For example, DNS names and IP addresses are publically
available static addresses. These vectors allow attackers to easily conduct scans to locate target
hosts. Once a target is located, the attacker can focus on the target found and assume that the
target’s static identifier will not change. An attacker is able to make this assumption since identifier
changes would interrupt service for valid users. To ensure the reliability and security of service, critical
services must deploy some sort of moving target defense that changes static identifiers while allowing
continuity of service for trusted users.
3. Related work
The need for an anonymous network address to maintain security and privacy has been explored.
Reiter and Rubin (1999) developed a scheme, called Crowds, to maintain IP address anonymity from
web sites. The protocol uses other computers surfing the web to funnel web requests through. The
effect is to create a crowd of users browsing web servers to hide web requests. Johnson et al. (2007)
identified the need to anonymize addresses and built a trust model into Tor networks called Nymble.
Nymble hides clients' IP addresses from servers. Shields et al. (2000) created another anonymity
protocol named Hordes. Hordes’ focus is on creating a secure system that does not decrease network
performance. All of these approaches focus on hiding the publicly available addresses by using
complex support networks. We analyze the vectors that static address create for tracking and attack
and recommend anonymizing the host address, which none of these three protocols addresses.
Koukis et al. (2006) uses web site signatures and fingerprinting to determine host addresses in
anonymized IP logs. This method is ineffective for tracking dynamic hosts, further demonstrating the
potential security and privacy advantages of dynamic addresses.
A number of researchers have focused on the potential dangers resulting from network address
tracking in the Internet Protocol version 6 (IPv6). Dunlop et al. (2011) identified the dangers posed by
auto-configured addresses in IPv6 and presented a taxonomy of methods to obscure addresses.
Narten, Draves, and Krishnan (2007) also identified a privacy concern with IPv6 addresses and
proposed a potential solution called privacy extensions. Privacy extensions can create new addresses
for users each time they connect to a subnet. Bagnulo and Arkko (2006) also proposed a solution
aimed at protecting IPv6 addresses. Their approach, called Cryptographically Generated Addresses
(CGAs), uses a self-generated public key to obscure an address for each subnet. Neither privacy
extensions nor CGAs dynamically obscure addresses and addresses remain the same until the user
terminates the session. Even though the addresses are obscured, they typically remain static long
enough for a malicious third party to gather information about the user.
While we have discovered no other academic work considering the security and privacy effects of
addressing, two patents attempt to utilize dynamic addressing for security. A technique by Sheymov
(2010) is designed with the goal of dynamic obscuration. Sheymov's objective behind dynamic
obscuration is to provide intrusion protection from certain classes of network attacks. While
Sheymov’s method uses dynamic addressing, it relies on an Intrusion Detection System to trigger
address changes. We analyze consistent dynamic address changes that require no additional
systems to support. Fink et al. (2006) also propose a technique for dynamically obscuring host
addresses called Adaptive Self-Synchronized Dynamic Address Translation (ASD). ASD uses
85