Dissertation
Towards a secure and accessible internet over IPV6
University of Iowa
Doctor of Philosophy (PhD), University of Iowa
Spring 2025
DOI: 10.25820/etd.007969
Abstract
Internet protocol version 6 (IPv6) was introduced to curb a fundamental scalability issue facing the internet; the IP exhaustion problem. IPv6 tackled this by introducing a significantly larger address space (2^128 addresses) compared to that of its predecessor IPv4 (2^32 addresses). IPv6’s virtually unlimited address space has rendered tools/methods, developed for assessing the security and accessibility of IPv4 networks, obsolete. Specifically, methodologies for capturing Internet scanning traffic and probing state censorship architectures, developed in the context of IPv4’s limited address space, are ineffective when applied to IPv6 networks. A recent surge in threats incident on IPv6 networks coupled with increased adoption of the protocol mandates that we build IPv6-specific frameworks to characterize and mitigate these threats.
In this dissertation, we outline the tools and methods we built – tailor made for IPv6’s expansive address space – to close this gap. In particular, we (1) build a distributed, asynchronous and stateful internet censorship measurement tool called ProtoScan and leverage open IPv6 DNS resolvers to feasibly conduct a global comparative study of internet censorship in IPv4 and IPv6 networks, and (2) introduce a novel method for building IPv6 network telescopes that utilizesactive regions of address space to attract IPv6 scanning traffic and deploy it in a production ISP network.
Through these frameworks, we gather unprecedented insights into IPv6 scanning and censorship behaviors. Specifically, (1) we reveal significant coverage gaps in existing IPv6 censorship architectures, specifically highlighting substantial differences in DNS censorship between IPv4 and IPv6, revealing opportunities for new circumvention methods, and (2) collect ∼1 billion packets of unsolicited IPv6 scanning packets and identify novel IPv6-specific scanning techniques, uncover massive distributed IPv6 scanning campaigns and produce security postures to harden IPv6 networks against scanners.
Taken together, this dissertation accomplishes two goals. (1) It provides a comprehensive picture of internet scanning, censorship and their intersection in the context of IPv6’s expansive address space as it continues to grow and (2) equip researchers and network operators with ready to use tools, methods and actionable findings to improve their IPv6 network’s security and accessibility.
Details
- Title: Subtitle
- Towards a secure and accessible internet over IPV6
- Creators
- Hammas Bin Tanveer
- Contributors
- Rishab Nithyanand (Advisor)Rachee Singh (Committee Member)Ricky Mok (Committee Member)Steve Goddard (Committee Member)Octav Chipara (Committee Member)
- Resource Type
- Dissertation
- Degree Awarded
- Doctor of Philosophy (PhD), University of Iowa
- Degree in
- Computer Science
- Date degree season
- Spring 2025
- DOI
- 10.25820/etd.007969
- Publisher
- University of Iowa
- Number of pages
- xii, 141 pages
- Copyright
- Copyright 2025 Hammas Bin Tanveer
- Language
- English
- Date submitted
- 04/29/2025
- Description illustrations
- illustrations (some color)
- Description bibliographic
- Includes bibliographical references (page 119-141).
- Public Abstract (ETD)
The Internet is undergoing a major shift with the adoption of Internet Protocol version 6 (IPv6), a new protocol designed to mitigate the long-standing issue of IP address exhaustion. Unlike its predecessor, IPv4, which had a limited number of IP addresses, IPv6 offers a virtually unlimited address space. Although the expansive address space has its advantages, it has also introduced new challenges related to security and accessibility that remain poorly understood.
Most past research has largely focused on IPv4, as it was the dominant protocol for decades. However, the tools and techniques developed – to understand security/accessibility issues – for IPv4 are ineffective in IPv6 due to its vast address space. With the increasing adoption of IPv6, understanding its vulnerabilities has become more urgent. This thesis presents new, IPv6-specific methodologies to study two critical issues: Internet scanning and Internet censorship.
By investigating how malicious actors function in uncovering vulnerabilities in IPv6’s extensive address space, we produced security postures in order to harden our networks against potential compromises. Additionally, we examined how censorship mechanisms operate in IPv6 environments and how they differ from those in IPv4. These insights help us better understand both the risks and the opportunities introduced by IPv6 and how we can leverage them to circumvent censorship. As the internet continues its transition, ensuring a secure and open network requires adapting our approaches to match the scale and complexity of IPv6.
- Academic Unit
- Computer Science
- Record Identifier
- 9984830824602771
Metrics
1 File views/ downloads
103 Record Views