Methodology for the security analysis of IPv4-as-a-Service IPv6 transition technologies

Abstract As the depletion of IPv4 addresses accelerates, the urgency of transitioning to IPv6 has intensified. To address this imperative, numerous IPv6 transition technologies have emerged to facilitate this migration process. While existing methodologies offer insights into the security implications of these technologies, this paper presents a novel approach to security analysis that surpasses conventional methods. By leveraging the STRIDE threat modeling technique, which stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, we conduct a comprehensive security analysis of prominent IPv6 transition technologies, including Combination of Stateful and Stateless Translation (464XLAT), Dual-Stack Lite (DS-Lite), Lightweight 4over6 (Lw4o6), and Mapping of Address and Port using Translation (MAP-T)/Mapping of Address and Port with Encapsulation (MAP-E). Our methodology not only evaluates the categorization of transition technologies but also considers the location and the statefulness of the attacked router, whether it is a customer edge router or a provider edge device. Additionally, we introduce an abstraction method to derive potential vulnerabilities at a more general level from those discovered at a more specific level. Through synthesizing previous research endeavors and rigorously examining these technologies for vulnerabilities, our approach offers valuable insights into the security landscape of IPv4-as-a-Service IPv6 transition technologies. By addressing the limitations of existing methodologies and providing a more holistic framework for security analysis, this paper contributes to the ongoing discourse on IPv6 transition strategies. It enhances the resilience of network infrastructures against evolving security threats.