DNSSEC自动化部署相关问题分析

郭川; 冷峰

doi:10.11959/j.issn.2096-109x.2017.00155

您当前的位置：

首页 >

文章列表页 >

DNSSEC自动化部署相关问题分析

学术论文 | 更新时间：2024-06-03

- DNSSEC自动化部署相关问题分析
- Analysis of problems in the DNSSEC automation deployment
- 网络与信息安全学报 2017年3卷第3期页码：58-63
- 作者机构：
- 作者简介：
  
  [ "郭川（1988-），男，河北石家庄人，硕士，中国互联网络信息中心系统工程师，主要研究方向为域名系统安全。" ]
  [ "冷峰（1982-），男，山东烟台人，中国互联网络信息中心规划工程师，主要研究方向为域名服务平台优化和域名系统安全。" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00155
  中图分类号： TP393
- 网络首发：2017-03，
  
  纸质出版：2017-03-15
- 稿件说明：
移动端阅览
郭川, 冷峰. DNSSEC自动化部署相关问题分析[J]. 网络与信息安全学报, 2017,3(3):58-63.

Chuan GUO, Feng LENG. Analysis of problems in the DNSSEC automation deployment[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 58-63.
郭川, 冷峰. DNSSEC自动化部署相关问题分析[J]. 网络与信息安全学报, 2017,3(3):58-63. DOI： 10.11959/j.issn.2096-109x.2017.00155.

Chuan GUO, Feng LENG. Analysis of problems in the DNSSEC automation deployment[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 58-63. DOI： 10.11959/j.issn.2096-109x.2017.00155.

摘要

基于国家顶级域名系统安全扩展协议部署实践，总结了域名系统安全扩展协议发展背景，分析了域名系统安全扩展协议当前应用现状，提出并分析了域名系统安全扩展协议部署中的自动化问题，总结并分析了在生产环境中部署实施域名系统安全扩展协议时所需要注意的若干问题。

Abstract

Based on the practice of domain name system security extensions protocols' deployment in country code top-level domain

the development background of the domain name system security extensions protocols were summarized

the current applications of the domain name system security extensions protocols were analyzed

the automation problems in the domain name system security extensions protocols' deployment were put forward and analyzed

several issues that need to be addressed when deploying the domain name system security extensions protocols in the production environment were summarized and analyzed.

关键词

Keywords

references

BELLOVIN S M , . Using the domain name system for system break-ins [C ] // Usenix Unix Security Symposium . 1996 .

SCHUBA C L , SPAFFORD E H . Addressing weaknesses in the domain name system protocol [D ] . Indiana:Purdue University , 1994 .

VIXIE P , . DNS and BIND security issues [C ] // Usenix Unix Security Symposium . 1995 : 263 - 279 .

EASTLAKE D . RFC 2065:domain name system security extensions [S ] . RFC IETF , 1997 .

EASTLAKE D . RFC 2535:domain name system security extensions [S ] . RFC IETF , 1999 .

AUSTEIN R . RFC 3833:threat analysis of the domain name system [S ] . RFC IETF , 2004 .

US-CERT.Multiple DNS implementations vulnerable to cache poisoning [EB/OL ] . http://www.kb.cert.org/vuls/id/800113 http://www.kb.cert.org/vuls/id/800113 .

LAURIE B , SISSON G , ARENDS R , et al . RFC5155:DNS security(DNSSEC)hashed authenticated denial of existence [S ] . RFC IETF , 2008 .

AUSTEIN R , LARSON M . RFC 4033:DNS security introduction and requirements [S ] . RFC IETF , 2005 .

ARENDS R , AUSTEIN R , LARSON M , et al . RFC4034:resource records for the DNS security extensions [S ] . RFC IETF , 2005 .

ARENDS R , AUSTEIN R , LARSON M , et al . RFC4035:protocol modifications for the DNS security extensions [S ] . RFC IETF , 2005 .

YANG H , OSTERWEIL E , MASSEY D , et al . Deploying cryptography in internet-scale systems:a case study on DNSSEC [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2010 , 8 ( 5 ): 656 - 669 .

KOLKMAN O , GIEBEN R . RFC4641:DNSSEC operational practices [S ] . RFC IETF , 2006 .

STJOHNS M . RFC5011:automated updates of dns security(DNSSEC)trust anchors [S ] . RFC IETF , 2007 .

LAURIE B , SISSON G , ARENDS R , et al . RFC5155:DNS security(DNSSEC)hashed authenticated denial of existence [S ] . RFC IETF , 2003 .

GIEBEN R , MEKKING W . RFC7129:authenticated denial of existence in the DNS [S ] . RFC IETF , 2014 .

浏览量

1617

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于动态域名水印的IPv6 DNS服务发现方法

递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析

基于无证书签名的抗DNS中间人攻击方案

互联网名址体系安全保障技术及其应用分析