基于无证书签名的抗DNS中间人攻击方案

胡杨; 韩增杰; 叶帼华; 姚志强

doi:10.11959/j.issn.2096-109x.2021093

您当前的位置：

首页 >

文章列表页 >

基于无证书签名的抗DNS中间人攻击方案

学术论文 | 更新时间：2024-06-03

- 基于无证书签名的抗DNS中间人攻击方案
- Preventing man-in-the-middle attacks in DNS through certificate less signature
- 网络与信息安全学报 2021年7卷第6期页码：167-177
- 作者机构：
  
  1. 福建师范大学计算机与网络空间安全学院，福建福州 350117
  2. 福建省公共服务大数据挖掘与应用工程技术研究中心，福建福州 350108
  3. 非遗数字化与多源信息融合福建省高校工程研究中心，福建福清 350300
- 作者简介：
  
  [ "胡杨（1996− ），男，河南鹤壁人，福建师范大学硕士生，主要研究方向为大数据安全与隐私保护" ]
  [ "韩增杰（1997− ），男，山西洪洞人，福建师范大学硕士生，主要研究方向为大数据安全与隐私保护" ]
  [ "叶帼华（1976− ），女，福建霞浦人，福建师范大学副教授，主要研究方向为大数据安全与隐私保护、信息安全" ]
  [ "姚志强（1967− ），男，福建莆田人，博士，福建师范大学教授、博士生导师，主要研究方向为大数据安全与隐私保护、多媒体安全、应用安全" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61872090);国家自然科学基金;The National Natural Science Foundation of China(61972096);福建省引导性科技项目计划;The Guiding Science and Technology Planning Project of Fujian(2019H0010);非遗数字化与多源信息融合福建省高校工程研究中心开放课题;The Foundation of Engineering Research Center for ICH Digitalization and Multi-Source Information Fusion(FJ-ICH201901)
- DOI：10.11959/j.issn.2096-109x.2021093
  中图分类号： TP393
- 网络首发：2021-12，
  
  纸质出版：2021-12-15
- 稿件说明：
移动端阅览
胡杨, 韩增杰, 叶帼华, 等. 基于无证书签名的抗DNS中间人攻击方案[J]. 网络与信息安全学报, 2021,7(6):167-177.

Yang HU, Zengjie HAN, Guohua YE, et al. Preventing man-in-the-middle attacks in DNS through certificate less signature[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 167-177.
胡杨, 韩增杰, 叶帼华, 等. 基于无证书签名的抗DNS中间人攻击方案[J]. 网络与信息安全学报, 2021,7(6):167-177. DOI： 10.11959/j.issn.2096-109x.2021093.

Yang HU, Zengjie HAN, Guohua YE, et al. Preventing man-in-the-middle attacks in DNS through certificate less signature[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 167-177. DOI： 10.11959/j.issn.2096-109x.2021093.

摘要

为应对域名系统协议中存在的中间人攻击问题，提出一种轻量化的解决方案。该方案在 DNSSEC的基础上引入无证书签名技术构建新的签名算法，去除难以部署的信任链以提高消息认证的效率和安全性；同时通过使用对称加密技术确保消息的机密性，加大敌手的攻击难度。理论分析证明了所提方案能够抵抗常见的中间人攻击类型，实验对比结果显示所提方案较同类方案具有更好的性能表现。

Abstract

Aiming at resisting the man-in-the-middle attacks in the domain name system protocol

a lightweight solution was proposed.The scheme introduced certificate less signature algorithm

removed the difficult-to-deploy trust chain to improve the efficiency and security of authentication.By using symmetric encryption technology

the proposed solution ensured the confidentiality of the message and increase the attack difficulty.The theoretical analysis proved the proposed scheme can resist common man-in-the-middle attacks.Experimental comparison results show the scheme has better performance than similar schemes.

关键词

Keywords

references

王文通 , 胡宁 , 刘波 , 等 . DNS 安全防护技术研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2205 - 2220 .

WANG W T , HU N , LIU B , et al . Survey on technology of security enhancement for DNS [J ] . Journal of Software , 2020 , 31 ( 7 ): 2205 - 2220 .

CONTI M , DRAGONI N , LESYK V . A survey of man in the middle attacks [J ] . IEEE Communications Surveys ＆ Tutorials , 2016 , 18 ( 3 ): 2027 - 2051 .

HERZBERG A , SHULMAN H . Antidotes for DNS poisoning by off-path adversaries [C ] // Proceedings of 2012 Seventh International Conference on Availability,Reliability and Security . Piscataway:IEEE Press , 2012 : 262 - 267 .

THOMAS M , MOHAISEN A . Kindred domains:detecting and clustering botnet domains using DNS traffic [C ] // Proceedings of the 23rd International Conference on World Wide Web . 2014 : 707 - 712 .

ZHAO Y , HU N , ZHANG C , et al . DCG:aclient-side protection method for DNS cache [J ] . Journal of Internet Services and Information Security , 2020 , 10 ( 2 ): 103 - 121 .

EASTLAKE D , ANDREWS M . Domain name system (DNS) cookies [R ] . RFC Editor , 2016 .

EASTLAKE D , KAUFMAN C . Domain name system security extensions [R ] . RFC Editor , 1997 .

HERRMANN D , FUCHS K P , LINDEMANN J , et al . EncDNS:A lightweight privacy-preserving name resolution service [M ] . Computer Security-ESORICS 2014 , 2014 : 37 - 55 .

BERNSTEIN D J . DNSCurve:usable security for DNS [EB ] . 2009 .

ZHU L , HU Z , HEIDEMANN J , et al . Connection-oriented DNS to improve privacy and security [C ] // Proceedings of 2015 IEEE Symposium on Security and Privacy . 2015 : 171 - 186 .

ALI M , NELSON J , SHEA R , et al . Blockstack:a global naming and storage system secured by blockchains [C ] // Proceedings of 25th Usenix Security Symposium . 2016 : 181 - 194 .

CHETIOUI K , ORHANOU G , HAJJI S E . New protocol E-DNSSEC to enhance DNSSEC security [J ] . International Journal of Network Security , 2018 , 20 ( 1 ): 19 - 24 .

DIFFIE W , HELLMAN M . New directions in cryptography [J ] . IEEE Transactions on Information Theory , 1976 , 22 ( 6 ): 644 - 654 .

宋潇潇 . PKI技术在电子政务中的研究与应用 [J ] . 电子元器件与信息技术 , 2019 , 3 ( 3 ): 19 - 21 , 25 .

SONG X X . Research and application of PKI technology in E-government [J ] . Electronic Component and Information Technology , 2019 , 3 ( 3 ): 19 - 21 , 25 .

SHAMIR A . Identity-based cryptosystems and signature schemes [M ] // Advances in Cryptology . Berlin,Heidelberg : Springer Berlin Heidelberg , 1984 : 47 - 53 .

Al-RIYAMI S S , PATERSON K G . Certificateless public key cryptography [C ] // Proceedings of 1st International Conference on Applied Cryptography and Network Security . 2003 : 452 - 473 .

LIU J K , AU M H , SUSILO W . Self-generated-certificate public key cryptography and certificateless signature/encryption scheme in the standard model:extended abstract [C ] // Proceedings of the 2nd ACM Symposium on Information,Computer and Communications Security . 2007 : 273 - 283 .

CHOI K Y , PARK J H , HWANG J Y , et al . Efficient certificateless signature schemes [M ] // Applied Cryptography and Network Security . Berlin,Heidelberg : Springer , 2007 : 443 - 458 .

XIONG H , QIN Z , LI F . An improved certificateless signature scheme secure in the standard model [J ] . Fundamental Informaticae , 2008 , 88 ( 1 ): 193 - 206 .

HE D , CHEN J , ZHANG R . An efficient and provably-secure certificateless signature scheme without bilinear pairings [J ] . International Journal of Communication Systems , 2012 , 25 ( 11 ): 1432 - 1442 .

TSAI J L , LO N W , WU T C . Weaknesses and improvements of an efficient certificateless signature scheme without using bilinear pairings [J ] . International Journal of Communication Systems , 2014 , 27 ( 7 ): 1083 - 1090 .

ISLAM S H , BISWAS G P . Provably secure and pairing-free certificateless digital signature scheme using elliptic curve cryptography [J ] . International Journal of Computer Mathematics , 2013 , 90 ( 11 ): 2244 - 2258 .

TIWARI N . On the security of pairing-free certificateless digital signature schemes using ECC [J ] . ICT Express , 2015 , 1 ( 2 ): 94 - 95 .

YEH K H , SU C H , CHOO K K Raymond , et al . A novel certificateless signature scheme for smart objects in the Internet of things [J ] . Sensors (Basel,Switzerland) , 2017 , 17 ( 5 ): 1001 .

WU F , XU L L , KUMARI S , et al . A new and secure authentication scheme for wireless sensor networks with formal proof [J ] . Peer-to-Peer Networking and Applications , 2017 , 10 ( 1 ): 16 - 30 .

WANG D , LI W T , WANG P . Measuring two-factor authentication schemes for real-time data access in industrial wireless sensor networks [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 9 ): 4081 - 4092 .

SAEED M E S , LIU Q Y , TIAN G Y , et al . Remote authentication schemes for wireless body area networks based on the internet of things [J ] . IEEE Internet of Things Journal , 2018 , 5 ( 6 ): 4926 - 4944 .

汪定 , 李文婷 , 王平 . 对三个多服务器环境下匿名认证协议的分析 [J ] . 软件学报 , 2018 , 29 ( 7 ): 1937 - 1952 .

WANG D , LI W T , WANG P . Crytanalysis of three anonymous authentication schemes for multi-server environment [J ] . Journal of Software , 2018 , 29 ( 7 ): 1937 - 1952 .

HUANG X Y , MU Y , SUSILO W , et al . Certificateless signatures:new schemes and security models [J ] . The Computer Journal , 2011 , 55 ( 4 ): 457 - 474 .

KARATI A , HAFIZUL ISLAM S , BISWAS G P . A pairing-free and provably secure certificateless signature scheme [J ] . Information Sciences , 2018 , 450 : 378 - 391 .

PAKNIAT N , VANDA B A . Cryptanalysis and improvement of a pairing-free certificateless signature scheme [C ] // Proceedings of 2018 15th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC) . Piscataway:IEEE Press , 2018 : 1 - 5 .

DENG L Z , YANG Y X , GAO R H , et al . Certificateless short signature scheme from pairing in the standard model [J ] . International Journal of Communication Systems , 2018 , 31 ( 17 ): e3796 .

浏览量

505

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于动态域名水印的IPv6 DNS服务发现方法

递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析

DNSSEC自动化部署相关问题分析

互联网名址体系安全保障技术及其应用分析