互联网DNS安全研究现状与挑战

胡宁; 邓文平; 姚苏

doi:10.11959/j.issn.2096-109x.2017.00154

您当前的位置：

首页 >

文章列表页 >

互联网DNS安全研究现状与挑战

综述 | 更新时间：2024-06-03

- 互联网DNS安全研究现状与挑战
- Issues and challenges of Internet DNS security
- 网络与信息安全学报 2017年3卷第3期页码：13-21
- 作者机构：
  
  1. 国防科技大学计算机学院，湖南长沙 410073
  2. 北京交通大学电子信息工程学院，北京 100044
- 作者简介：
  
  [ "胡宁（1972-），男，湖南长沙人，博士，国防科技大学研究员，主要研究方向为网络与系统安全、计算机网络体系结构、网络管理技术。" ]
  [ "邓文平（1981-），男，湖南耒阳人，博士，国防科技大学助理研究员，主要研究方向为网络与系统安全、计算机网络体系结构、高性能路由与交换技术。" ]
  [ "姚苏（1986-），男，安徽舒城人，北京交通大学博士生，主要研究方向为网络与系统安全、网络安全标准应用技术。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61202486)
- DOI：10.11959/j.issn.2096-109x.2017.00154
  中图分类号： TP393
- 网络首发：2017-03，
  
  纸质出版：2017-03-15
- 稿件说明：
移动端阅览
胡宁, 邓文平, 姚苏. 互联网DNS安全研究现状与挑战[J]. 网络与信息安全学报, 2017,3(3):13-21.

Ning HU, Wen-ping DENG, Su YAO. Issues and challenges of Internet DNS security[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 13-21.
胡宁, 邓文平, 姚苏. 互联网DNS安全研究现状与挑战[J]. 网络与信息安全学报, 2017,3(3):13-21. DOI： 10.11959/j.issn.2096-109x.2017.00154.

Ning HU, Wen-ping DENG, Su YAO. Issues and challenges of Internet DNS security[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 13-21. DOI： 10.11959/j.issn.2096-109x.2017.00154.

摘要

域名系统为互联网的应用提供域名与IP地址的相互转换服务，是互联网的重要基础设施。DNS的安全是互联网稳定运行的保障，也是互联网安全研究的重要内容。现有研究主要通过设计增强协议、监测机制和使用方法来提高DNS系统的安全防护能力，但近期的DNS攻击事件表明，DNS安全依然存在很多极具挑战性的问题没有解决。从安全增强、行为监测和隐私保护等方面对现有成果和挑战问题进行了总结和讨论。

Abstract

The domain name system is a critical component of the Internet infrastructure

which maps host names to IP ad-dresses and is involved in most Internet transactions.DNS security has a profound effect on the overall security of Internet and it is also a vital research content of Internet security.In order to improve the security capability of DNS

many enhanced protocols

monitoring mechanisms and best practices were proposed.But recent DNS attack events indicate there are still many recent major research challenges of DNS security problems.The existing achievements and challenges were summarized and discussed

which included security enhanced

behavior monitoring and privacy protection.

关键词

Keywords

references

BARNES R , SCHNEIER B , JENNINGS C , et al . Confidentiality in the face of pervasive surveillance:a threat model and problem statement [S ] . IETF RFC 7624 , 2015 .

王垚 , 胡铭曾 , 李斌 , 等 . 域名系统安全研究综述 [J ] . 通信学报 , 2007 , 28 ( 9 ): 91 - 103 .

WANG Y , HU M , LI B , et al . Survey on domain name system secu-rity [J ] . Journal on Communications , 2007 , 28 ( 9 ): 91 - 103 .

单既如 , 罗万明 . 互联网域名系统安全管理的现状及研究进展 [J ] . 数据通信 , 2009 , 2009 ( 2 ): 17 - 19 .

SHAN J , LUO W . The present situation and research progress of internet domain name system security management [J ] . Data Com-munications , 2009 , 2009 ( 2 ): 17 - 19 .

柳青 . 我国互联网域名系统的安全问题 [J ] . 现代电信科技 , 2010 , 2010 ( 4 ): 9 - 11 .

LIU Q . The security issues of Chinese DNS [J ] . Modern Science ＆Technology of Telecommunications , 2010 , 2010 ( 4 ): 9 - 11 .

MOCKAPETRIS P . Domain names concepts and facilities [S ] . IETF RFC 1034 , 1987 ,11.

DNS RFC [EB/OL ] . https://www.isc.org/community/rfcs/dns/ https://www.isc.org/community/rfcs/dns/ .

DNS Ecosystem [EB/OL ] . https://www.nsrc.org/workshops/ 2016/nsrc-nicsn-aftld-iroc/documents/prezo/DNS_Org.pdf https://www.nsrc.org/workshops/ 2016/nsrc-nicsn-aftld-iroc/documents/prezo/DNS_Org.pdf .

LEVINE J . DNS blacklists and whitelists [S ] . IETF RFC 5782 , 2010 .

LEIGHTON T . Improving performance on the Internet [J ] . Communications of the ACM , 2009 , 52 ( 2 ): 44 - 51 .

2016 Dyn cyberattack [EB/OL ] . https://en.wikipedia.org/wiki/2016_Dyn_cyberattack https://en.wikipedia.org/wiki/2016_Dyn_cyberattack .

Turkey DNS [EB/OL ] . https://blog.radware.com/security/2015/12/turkey-dns-servers-under-attack/ https://blog.radware.com/security/2015/12/turkey-dns-servers-under-attack/ .

China DNS [EB/OL ] . http://www.scmp.com/news/china/article/1410423/major-internet-outage-hits-millions-china-cyberattacks-suspected http://www.scmp.com/news/china/article/1410423/major-internet-outage-hits-millions-china-cyberattacks-suspected .

Chinese CN [EB/OL ] . http://www.computerworld.com/article/2484097/internet/major-ddos-attacks--cn-domain--disrupts-internet-in-china.html http://www.computerworld.com/article/2484097/internet/major-ddos-attacks--cn-domain--disrupts-internet-in-china.html .

ATKINS D . Threats analysis of the domain name system(dns) [S ] . IETF RFC 3833 , 2004 .

DNS threat analysis [EB/OL ] . https://www.nlnetlabs.nl/downloads/se-consult.pdf https://www.nlnetlabs.nl/downloads/se-consult.pdf .

Towards improving DNS security,stability,and resiliency [EB/OL ] . https://www.internetsociety.org/sites/default/files/bp-dnsresiliency201201-en_0.pdf https://www.internetsociety.org/sites/default/files/bp-dnsresiliency201201-en_0.pdf .

SCHOMP K , CALLAHAN T , RABINOVICH M , et al . Assessing DNS vulnerability to record injection [C ] // The International Conference on Passive and Active Measurement . 2014 : 214 - 223 .

Black Ops 2008:It’s the end of the cache as we know it [EB/OL ] . https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Kamins ky/BlackHat-Japan-08-Kaminsky-DNS08-BlackOps.pdf https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Kamins ky/BlackHat-Japan-08-Kaminsky-DNS08-BlackOps.pdf .

DAGON D , PROVOS N , LEE C , et al . Corrupted DNS resolution paths:the rise of a malicious resolution authority [C ] // The Network and Distributed System Security Symposium(NDSS 2008) . 2008 .

XU K , BUTLER P , SAHA S , et al . DNS for massive-scale command and control [J ] . IEEE TDSC , 2013 , 10 ( 3 ): 143 - 153 .

MOHAISEN A . Evaluation of privacy for DNS private exchange [S ] . IETF Internet Draft , 2015 - 05 .

BORTZMEYER S . DNS privacy considerations [S ] . IETF RFC7626 , 2015 .

ROSSEBO J , CADZOW S , SIJBEN P , et al . A threat,vulnerability and risk assessment method and tool for europe [C ] // The International Conference on Availability,Reliability and Security . 2007 : 925 - 933 .

KONINGS B , BACHMAIER C , SCHAUB F , et al . Device names in the wild:Investigating privacy risks of zero configuration networking [C ] // The International Conference on Mobile Data Management . 2013 : 51 - 56 .

KRISHNAN S , MONROSE F . DNS prefetching and its privacy implications:when good things go bad [C ] // The 3rd USENIX Conference on Large-scale Exploits and Emergent Threats:Botnets,Spyware,Worms,and More . 2010 :10.

BANSE C , Herrmann D , FEDERRATH H . Tracking users on the Internet with behavioral patterns:evaluation of its practical feasibility [M ] // Information Security and Privacy Research . Berlin Heidelberg : SpringerPress , 2012 235 - 248

OpenDNS [EB/OL ] . http://www.opendns.com/technology http://www.opendns.com/technology .

Google Public DNS [EB/OL ] . https://developers.google.com/speed/public-dns/docs/performance https://developers.google.com/speed/public-dns/docs/performance .

SCHOMP K , CALLAHAN T , RABINOVICH M , et al . On measuring the client-side DNS infrastructure [C ] // The Conference on Internet Measurement Conference . 2013 : 77 - 90 .

PANG J , AKELLA A , SHAIKH A , et al . On the Responsiveness of DNS-based Network Control [C ] // The 4th ACM Sigcomm Conference on Internet Measurement 2004 . 2004 : 21 - 26 .

CALLAHAN T , ALLMAN M , RABINOVICH M . On modern DNS behavior and properties [J ] . ACM Sigcomm Computer Communication Review , 2013 , 43 ( 3 ): 7 - 15 .

SHULMAN H , WAIDNER M . Towards security of Internet naming infrastructure [C ] // Computer Security-ESORICS 2015 . 2015 .

ATENIESE G , MANGARD S . A new approach to DNS security(DNSSEC) [C ] // The 8th ACM conference on Computer and Communications Security . 2001 : 86 - 95 .

BAU J , MITCHELL J . A security evaluation of DNSSEC with NSEC3 [C ] // Network and Distributed System Security Symposium(NDSS 2010) . 2010 .

VantioTM AuthServe . Authoritative DNS [EB/OL ] . http://www.nominum.com/product/vantio-authserve/ http://www.nominum.com/product/vantio-authserve/ .

ICANN Research [EB/OL ] . http://stats.research.icann.org/dns/tld_report/ http://stats.research.icann.org/dns/tld_report/ .

HERZBERG A , SHULMAN H . DNSSEC:security and availability challenges [C ] // Communications and Network Security . 2013 :365366.

LIAN W , RESCORLA E , SHACHAM H , et al . Measuring the practical impact of DNSSEC deployment [C ] // USENIX Security 2013 . 2013 : 573 - 588 .

US-CERT [EB/OL ] . https://www.us-cert.gov/ncas/alerts/TA13-088A https://www.us-cert.gov/ncas/alerts/TA13-088A .

ZHU L , HU Z , HEIDEMANN J , et al . Connection-oriented DNS to improve privacy and security [C ] // ACM Conference on Sigcomm . 2015 : 379 - 380 .

HU Z , ZHU L.HEIDEMANN J , et al . DNS over TLS:initiation and performance considerations [S ] . IETF Internet Draft , 2015 .

REDDY T,WING , PATIL P . DNS over DTLS(DNSoD) [S ] . IETF Internet Draft , 2015 .

RESCORLA E.Datagram transport layer security version 1 . 2 [S ] . IETF RFC6347 , 2012 .

SHULMAN H , . Pretty bad privacy:pitfalls of DNS encryption [C ] // The Workshop on Privacy in the Electronic Society . 2014 : 191 - 200 .

DAGON D , ANTONAKAKIS M , VIXIE P , et al . Increased DNS forgery resistance through 0x20-bit encoding [C ] // ACM CCS’08 . 2008 : 211 - 222 .

HERZBERG A , SHULMAN H . DNS authentication as a service:preventing amplification attacks [C ] // ACM ACSAC’14 . 2014 : 356 - 365 .

SCHOMP K , ALLMAN M , RABINOVICH M . DNS resolvers considered harmful [C ] // ACM Workshop on HotNets . 2014 : 1 - 7 .

SCAIFE N , CARTER H , TRAYNOR P . OnionDNS:a seizure-resistant top-level domain [C ] // Communications and Network Security . 2015 : 379 - 387 .

ANTONAKAKIS M , PERDISCI R , LEE W , et al . Detecting malware domains at the upper DNS hierarchy [C ] // The 20th USENIX Conference on Security . 2011 : 21 - 27 .

GAO H , YEGNESWARAN V , CHEN Y , et al . An empirical reexamination of global DNS behavior [J ] . ACM Sigcomm Computer Communication Review , 2013 , 43 ( 4 ): 267 - 278 .

HAO S , FEAMSTER N , PANDRANGI R . Monitoring the initial DNS behavior of malicious domains [C ] // ACM Sigcomm Conference on Internet Measurement . 2011 : 269 - 278 .

YADAV S , REDDY A , RANJAN S , et al . Detecting algorithmically generated malicious domain names [C ] // ACM Sigcomm Conference on Internet Measurement 2010 . 2010 : 48 - 61 .

PERDISCI R , CORONA I , GIACINTO G . Early detection of malicious flux networks via large-scale passive DNS traffic analysis [J ] . IEEE Transactions on Dependable and Secure Computing , 2012 , 9 ( 5 ): 714 - 726 .

SCHOMP K , RABINOVICH M , ALLMAN M . Towards a model of DNS client behavior [C ] // PAM 2016 . 2016 : 263 - 275 .

JONES B , FEAMSTER N , PAXSON V , et al . Detecting DNS root manipulation [M ] // Passive and Active Measurement.Berlin:Springer . 2016 .

LUO P , TORRES R , ZHANG Z , et al . Leveraging client-side DNS failure patterns to identify malicious behaviors [C ] // Communications and Network Security . 2015 : 406 - 414 .

BILGE L , KIRDA E , KRUEGEL C , et al . EXPOSURE:Finding malicious domains using passive DNS analysis [C ] // The Network and Distributed System Security Symposium(NDSS 2011) . 2011 .

ANTONAKAKIS M , PERDISCI R , DAGON D , et al . Building a dynamic reputation system for DNS [C ] // Usenix Security . 2010 : 18 - 36 .

ZHAO F , HORI Y , SAKURAI K . Analysis of privacy disclosure in DNS query [C ] // The International Conference on Multimedia and Ubiquitous Engineering . 2007 : 952 - 957 .

ZHAO F , HORI Y , SAKURAI K . Two-servers PIR based DNS query scheme with privacy-preserving [C ] // IEEE International Conference on Intelligent Pervasive Computing . 2007 : 299 - 302 .

CASTILLO-PEREZ S , GARCIA-ALFRO J . Evaluation of two privacy preserving protocols for the DNS [C ] // The International Conference on Information Technology:New Generations . 2009 : 411 - 416 .

HERRMANN D , FUCHS K , LINDEMANN J , et al . EncDNS:a lightweight privacy-preserving name resolution service [C ] // Computer Security-ESORICS 2014 . 2014 : 37 - 55 .

LU Y , TSUDIK G . Towards plugging privacy leaks in the domain name system [C ] // IEEE 10th International Conference on Peer-toPeer Computing . 2010 : 1 - 10 .

DNSSEC deployment report [EB/OL ] . http://rick.eng.br/dnssecstat/ http://rick.eng.br/dnssecstat/ .

浏览量

4213

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据