Addressless：一种新的防止网络扫描的Internet服务器模型
Addressless: A New Internet Server Model to Prevent Network Scanning
摘要：
消除不必要的暴露是服务器安全性的一个原则。巨大的IPv6地址空间通过使扫描不可行来增强安全性，然而，随着IPv6扫描技术的最新进展，网络扫描再次威胁服务器安全。本文提出了一种新的无地址服务器模型，该模型将服务器分为入口模块和主服务模块，并为主服务模块分配IPv6前缀而不是IPv6地址。入口模块通过加密客户端地址在此前缀下生成合法的IPv6地址，以便客户端可以在每个连接中不同的目的地址上访问主服务器。通过这种方式，该模型提供了对主服务器的隔离，防止网络扫描，并最大限度地减少暴露。此外，它还提供了一种新颖的框架，支持灵活的负载均衡、高可用性和其他所需的特性。该模型很简单，不需要对客户端或网络进行任何修改。我们实现了一个原型和实验表明，我们的模型可以防止主服务器被扫描，在轻微的性能成本。
英文摘要：
Eliminating unnecessary exposure is a principle of server security. The huge IPv6 address space enhances security by making scanning infeasible, however, with recent advances of IPv6 scanning technologies, network scanning is again threatening server security. In this paper, we propose a new model named addressless server, which separates the server into an entrance module and a main service module, and assigns an IPv6 prefix instead of an IPv6 address to the main service module. The entrance module generates a legitimate IPv6 address under this prefix by encrypting the client address, so that the client can access the main server on a destination address that is different in each connection. In this way, the model provides isolation to the main server, prevents network scanning, and minimizes exposure. Moreover it provides a novel framework that supports flexible load balancing, high-availability, and other desirable features. The model is simple and does not require any modification to the client or the network. We implement a prototype and experiments show that our model can prevent the main server from being scanned at a slight performance cost.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
