Internet naming and addressing system security technology and application analysis

Cui-cui WANG; Zhi-wei YAN; Guang-gang GENG

doi:10.11959/j.issn.2096-109x.2017.00147

您当前的位置：

首页 >

文章列表页 >

Internet naming and addressing system security technology and application analysis

academic paper | 更新时间：2024-06-03

- Internet naming and addressing system security technology and application analysis
- Chinese Journal of Network and Information Security Vol. 3, Issue 3, Pages: 34-42(2017)
- 作者机构：
  
  1. 中国互联网络信息中心，北京 100190
  2. 互联网域名管理技术国家工程实验室，北京 100190
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00147
  CLC： TP393
- Online First：2017-03，
  
  Published：15 March 2017
- 稿件说明：
移动端阅览
Cui-cui WANG, Zhi-wei YAN, Guang-gang GENG. Internet naming and addressing system security technology and application analysis[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 34-42.
DOI：

Cui-cui WANG, Zhi-wei YAN, Guang-gang GENG. Internet naming and addressing system security technology and application analysis[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 34-42. DOI： 10.11959/j.issn.2096-109x.2017.00147.

摘要

为了确保域名系统与域间路由系统的安全运行，互联网工程任务组（IETF

internet engineering task force）提出了2项互联网名址体系安全保障技术——DNS安全扩展（DNSSEC

domain name system security extention）与资源公钥基础设施（RPKI

resource public key infrastructure）。在域名系统层面，DNSSEC通过使用公钥基础设施在DNS原有的体系结构上添加数字签名，为DNS提供了权限认证和信息完整性验证，成为了域名系统安全的基石；域间路由系统层面，RPKI 通过公钥证书对互联网码号资源的所有权和使用权进行认证，构建了一个支撑域间路由安全的互联网基础资源管理体系。近年来，DNSSEC与RPKI在全球范围内的部署不断推进，为了解其在全球互联网的应用情况，以 Alex 前 10<sup>6</sup>个网站为数据集，对 2 项互联网名址体系安全保障技术及其应用状况进行了研究与分析。

Abstract

In order to ensure the security of domain name system and inter-domain routing system

Internet Engineering Task Force(IETF)proposed two kinds of security technology

namely domain name system security extention(DNSSEC)and resource public key infrastructure(RPKI).For the domain name system

DNSSEC added the digital signature to the original architecture of DNS using the public key infrastructure and it provided the authentication and integrity verification of DNS information

which became the anchor of domain name system security.For the inter-domain routing system

RPKI utilized the public key certificate to authenticate the ownership and usage rights of the Internet number resources and builds an Internet resource management system to enhance inter-domain routing security.Recently

the globally development of DNSSEC and RPKI were continuously expanding.In order to research the application of the two kinds of technology

Alexa top 1 million websites were taken as the data set to study and analyze the application status of DNSSEC and RPKI.

关键词

Keywords

references

ERMAN , BENLI , HANDE , et al . Optimality condition of place of injury rule in cross-border internet torts and implications for turkey [J ] . US-China Law Review , 2014 , 411 ( 10 ): 1315 - 1321 .

朱韵成 . YouTube 全球受阻两小时的背后 [J ] . 中国教育网络 , 2008 ( 4 ): 26 - 27 .

ZHU Y C . The whole truth of YouTube was has been blocked two hours [J ] . China Education Network , 2008 ( 4 ): 26 - 27 .

SOSNOVICH A , GRUMBERG O , NAKIBLY G . Analyzing Internet routing security using model checking [M ] // Logic for Programming,Artificial Intelligence,Reasoning . 2015 .

刘宇靖 . 互联网域间路由系统生存性研究 [D ] . 长沙:国防科学技术大学 , 2013 .

LIU Y J . Study of the Internet inter-domain routing system surviv-ability [D ] . Changsha:National University of Defense Technol-ogy , 2013 .

SCHLAMP J , HOLZ R , JACQUEMART Q , et al . HEAP:reliable assessment of BGP hijacking attacks [J ] . IEEE Journal on Selected Areas in Communications , 2016 , 34 ( 6 ): 1849 - 1861 .

BALLANIH , ,FRANCIS P , ZHANGX . DNSSEC 技术发展及影响分析 [C ] // Conference on Applications,Technologies,Architectures and Protocols for Computer Communications . 2007 : 65 - 276 .

崔淑田 , 刘越 . DNSSEC 技术发展及影响分析 [J ] . 电信科学 , 2012 , 28 ( 9 ): 100 - 105 .

CUI S T , LIU Y . The development and influence analysis of DNSSEC [J ] . Telecommunications Science , 2012 , 28 ( 9 ): 100 - 105 .

刘晓伟 , 延志伟 , 耿光刚 , 等 . RPKI中CA资源分配风险及防护技术 [J ] . 计算机系统应用 , 2016 , 25 ( 8 ): 16 - 22 .

LIU X W , YAN Z W , GENG G G , et al . CA resource allocation risk and protective technique in RPKI [J ] . Computer Systems and Application , 2016 , 25 ( 8 ): 16 - 22 .

LEPINSKIM , KENTS . An infrastructure to support secure Internet routing [S ] . IETF RFC , 2012 .

LEPINSKIM , KENTS , KONGD . A profile for route origin authorizations(ROA) [S ] . IETF RFC , 2012 .

WAEHLISCH M . Resource public key infrastructure(RPKI)router implementation [R ] . 2014 .

RPKI local trust anchor use cases [DB/OL ] . https://tools.ietf.org/html/draft-ymbk-lta-use-cases-00 https://tools.ietf.org/html/draft-ymbk-lta-use-cases-00 .

IAMARTINO D , PELSSER C , BUSH R . Measuring BGP route origin registration and validation [M ] . Passive and Active Measurement . Berlin : Springer International PublishingPress , 2015 : 28 - 40 .

HUSTONG , MICHAELSONG . Validation of route origination using the resource certificate public key infrastructure(PKI)and route origin authorizations(ROAs) [S ] . IETF RFC , 2012 .

Views

1581

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Method for the discovery of IPv6 DNS services based on the dynamic domain name watermarks

Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers

Preventing man-in-the-middle attacks in DNS through certificate less signature

Research on improved scheme of resource public key infrastructure data synchronization

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

Liu Qingyun

JIAO Liang

ZHAO Lei

Related Institution

School of Cyber Science and Engineering, Jinan University

Institute of Information Engineering, Chinese Academy of Sciences

School of Cyberspace Security, University of Chinese Academy of Sciences

College of Computer and Data Science, Fuzhou University

Institute for Network Sciences and Cyberspace, Tsinghua University

⁰