Re: [v4v6interim] [46translation] [BEHAVE] Proposal for new BEHAVE charter

[Iljitsch van Beijnum <[e-mail]>]

On 23 okt 2008, at 18:06, Cullen Jennings wrote:

> If you want to be able hide that two uncorrelated sessions are  
> actually coming from the same internal host, well, I'm not sure I  
> see how to do this with 1:1 mappings.

Here's how:

For every new session, the NAT66 box creates a new 1-to-1 maping. So  
for every new session it must choose a new address from a pool map  
that address to the internal source address of the host in question.  
As long as the external addresses checksum to the same value as the  
internal address, the transports that use the normal checksum over the  
pseudo header are happy and don't have to be modified by the  
translator. In IPv6 sessions can of course be identified by the flow  
label so this will work for transports that the translator doesn't  
know. Since the mappings are 1-to-1, incoming sessions can still work  
with help from STUN. The translator does need to keep and time out  
state for translation mappings, though.

This will burn through very many addresses, but even with the checksum  
restriction this shouldn't be much of a problem if the translator  
"owns" a reasonable size prefix, i.e. the prefix is routed to the  
translator so no neighbor discovery is necessary. This kind of  
obfuscation would work really well with a very large prefix and very  
many hosts, such as a /48 for a large site, although in that case the  
state maintenance could be an issue.

There is still the issue that hosts can be recognized by the value  
that the addresses checksum to, but this can be solved by aggressively  
using RFC 3041 or by assigning all hosts checksum-equivalent addresses  
using DHCPv6.
_______________________________________________
v4v6interim mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v4v6interim