The marking of World IPv6 Day yesterday has drawn fresh attention to the next generation Internet addressing protocol, as well as to the security considerations that enterprises will need to deal with as they migrate to it.
IPv6 is an IP address standard that is designed to replace the current IPv4 protocol, which has been in use since the 1980s for routing Internet traffic. The new protocol has been available for several years now and supports several magnitudes more address spaces than IPv4, while also enabling better security and reliability.
Even so, few companies have upgraded to it because of the perceived complexity in doing so. That is expected to start quickly changing though because the IPv4 protocol has almost run out of unique IP addresses for all the Web sites, computers and other devices that are connecting to the Internet on a daily basis.
Browse our selection of new, free, tablet-friendly digital editions
World IPv6 Day is an attempt by a group of major Internet brands, including Google , Facebook , Yahoo and about 200 other smaller companies to test it, and to get network vendors, ISPs, software makers and enterprises to start thinking about moving to it.
As of midday Wednesday, the testing appeared to be going without a hitch , with none of those participating in the effort reporting any significant problems, said John Curran, chief executive of the American Registry for Internet Numbers (ARIN).
“It has been a remarkable success,” Curran said.
Arbor Networks, which is providing network monitoring support for the test, on Wednesday noted a modest uptick in native IPv6 data. “We are not seeing a huge increase in IPv6 traffic,” said Rob Malan, chief technology officer at Arbor. But the testing appears to be going “without a hiccup,” he said.
The real test of the IPv6 protocol, however, will come when companies start migrating to it in earnest in the next few years, several analysts and vendor representatives said on Wednesday.
“When it comes to upgrading the Internet in place, there are a lot of moving parts to consider,” Earl Zmijewski, general manager of Internet monitoring firm Renesys, said in a blog post .
The moving parts include end-user operating systems, home networks, routers, firewalls, servers, Internet service providers and applications, Zmijewski said. “Despite all the transition planning that has been carried out to date, a lot can go wrong,” he wrote.
Many of the problems are likely to stem from the simple fact that IPv6 is far newer and untested compared with IPv4, and that the two protocols will need to also coexist with each other for several years.
One of the biggest potential threats lies in the immaturity of the various implementations of the protocol, said Noa Bar Yosef, senior security strategist with Imperva.
IPv4 addresses are 32-bit numbers while the IPv6 protocol uses 128-bit numbers. The difference is like having a postal system with a 5-digit Zip code, and one with a 9-digit Zip code, she said. Older IPv4 systems are designed to handle smaller sized addresses, whereas IPv6 systems rely on 128 bit addresses.
A failure to properly accommodate the much longer address space in IPv6 by network vendors, security vendors, software makers are others can result in vulnerabilities such as buffer over flow flaws and those that enable denial of service attacks and address spoofing, she said.
Enterprises will also need to support both protocols for several more years in order to ensure that their websites and services are accessible to others and vice versa, and that could be a problem as well.
The tunneling or encapsulation technologies and methods used to enable IPv4 sites and IPv6 sites to communicate with each other during the transition period for instance could be one weak link, said Carl Herberger, vice president of security solutions at Radware.
“The challenge with encapsulation is that there are no standards on the way to encapsulate,” which could be a potential security weakness, Herberger said.
Similarly, the memory and processing requirements needed to handle IPv6 address headers. which are four times larger than IPv4 address headers, could also make older network components such as routers and switches easier to ‘tip over,’ he said.
Core security tools such as firewalls and intrusion detection systems designed for IPv4 networks could trip up in an IPv6 environment.
Many of these are issues that will need to be addressed by vendors of various technologies. However, enterprises also need to be aware of the potential implications and prepare for them said Curran.
Enterprises need to realize that IPv6 is out there,” he said. “Whether they have turned it on or not it is important they assess how to deal with it.”
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld.
