递归侧DNSSEC错误配置检测能力大规模探测分析

刘林晖; 涂菲帆; 陈勇; 左鹏; 刘东杰; 张银炎; 耿光刚

doi:10.11959/j.issn.2096-109x.2024068

您当前的位置：

首页 >

文章列表页 >

递归侧DNSSEC错误配置检测能力大规模探测分析

专题：互联网域名安全 | 更新时间：2024-12-20

- 递归侧DNSSEC错误配置检测能力大规模探测分析
- Large-scale measurement and analysis on misconfigurations of DNSSEC from recursive side
- 网络与信息安全学报 2024年10卷第5期页码：81-94
- 作者机构：
  
  1.暨南大学网络空间安全学院，广东广州 510632
  2.中国互联网络信息中心，北京 100079
- 作者简介：
  
  [ "刘林晖(2001- )，男，江西赣州人，暨南大学硕士生，主要研究方向为DNS安全、邮件安全。" ]
  [ "涂菲帆(2000- )，女，广东广州人，暨南大学硕士生，主要研究方向为时间序列异常检测。" ]
  [ "陈勇(1977- )，男，湖南涟源人，中国互联网络信息中心高级工程师，主要研究方向为DNS安全。" ]
  [ "左鹏（1985- ），男，安徽，中国互联网络信息中心高级工程师，主要研究方向为网络安全、互联网基础资源关键技术。" ]
  [ "刘东杰(1989- )，女，河南信阳人，暨南大学讲师，主要研究方向为网络安全、机器学习。" ]
  [ "张银炎(1994- )，男，广东汕尾人，暨南大学研究员，主要研究方向为计算智能。" ]
  [ "耿光刚（1980- ），男，山东泰安人，博士，暨南大学教授，主要研究方向为机器学习、大数据分析和互联网基础资源安全。" ]
- 基金信息：
  
  国家重点研究计划(2022YFB3103000)
- DOI：10.11959/j.issn.2096-109x.2024068
  中图分类号： TP393
- 收稿：2024-03-28，
  
  修回：2024-08-30，
  
  纸质出版：2024-10-25
- 稿件说明：
移动端阅览
刘林晖, 涂菲帆, 陈勇, 等. 递归侧DNSSEC错误配置检测能力大规模探测分析[J]. 网络与信息安全学报, 2024, 10(5): 81-94.

Format: LIU L H, TU F F, CHEN Y, et al. Large-scale measurement and analysis on misconfigurations of DNSSEC from recursive side[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 81-94.
刘林晖, 涂菲帆, 陈勇, 等. 递归侧DNSSEC错误配置检测能力大规模探测分析[J]. 网络与信息安全学报, 2024, 10(5): 81-94. DOI： 10.11959/j.issn.2096-109x.2024068.

Format: LIU L H, TU F F, CHEN Y, et al. Large-scale measurement and analysis on misconfigurations of DNSSEC from recursive side[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 81-94. DOI： 10.11959/j.issn.2096-109x.2024068.

摘要

DNSSEC（domain name system security extensions）是一种域名系统（DNS，domain name system）的安全扩展协议，通过为DNS记录添加签名来增加DNS的安全性。域名递归服务器能否有效验证DNSSEC配置的正确性，并且在配置错误时返回相应的错误类型，对保障整个DNS的安全至关重要。为此，基于 RFC 8914 标准，选择了8种在权威侧可配置的DNSSEC错误类型，并在8个不同的子域分别配置了相应的DNSSEC错误。接下来，面向全球范围内的公共DNS服务器，筛选出其中支持DNSSEC的递归服务器作为探测对象，针对上述8个子域发起解析请求，对探测结果进行了收集、分析及可视化。探测结果表明，对于部分错误，多数支持DNSSEC的递归服务器可以正确地检测出域名的DNSSEC错误配置，并且返回相应的错误类型，如signature_expired、signature_not_valid、RRSIG_missing、DNSKEY_missing等错误。对当前全球范围内重要递归服务器检测DNSSEC错误配置的能力开展了大规模测量分析，可有效指导未来DNSSEC广泛部署中递归侧的能力建设。

Abstract

Domain name system security extensions (DNSSEC) was a secure extension protocol for the domain name system (DNS)

which enhanced DNS security by adding signatures to DNS records. It was very important to ensure the security of the entire DNS that the domain name recursive server could effectively verify the correctness of the DNSSEC configuration and return the corresponding error type when the configuration was wrong. For this purpose

building upon the RFC 8914 standard

eight configurable error types were selected and corresponding DNSSEC errors were configured in eight different subdomains. Next

the recursive server supporting DNSSEC was selected as the probe object for the global public DNS server

and the resolution requests were launched for the aforementioned eight subdomains

and the probe results were collected

analyzed

and visualized. Experiments showed that most recursive servers that supported DNSSEC could correctly detect the DNSSEC misconfiguration of domain names and return the corresponding error type for some errors such as signature_expired

signature_not_valid

RRSIG_missing

DNSKEY_missing

and so on. This large-scale detection and analysis provided valuable insights into the capabilities of important recursive servers worldwide in validating DNSSEC configurations

guiding future efforts in enhancing DNSSEC deployment on the recursive side.

关键词

Keywords

references

ATKINS D , AUSTEIN R . Threat analysis of the domain name system (DNS) [J ] . RFC , 2004 , 3833 : 1 - 16 .

ADRICHEM N L M , BLENN N , LÚA A R , et al . A measurement study of DNSSEC misconfigurations [J ] . Security Informatics , 2015 , 4 ( 1 ): 8 .

HERZBERG A , SCHULMANN H . Towards adoption of DNSSEC: availability and security challenges [J ] . IACR Cryptol EPrint Arch , 2013 , 2013 : 254 .

CHUNG T , VAN RIJSWIJK-DEIJ R , CHANDRASEKARAN B , et al . A longitudinal,{end-to-end} view of the {DNSSEC} ecosystem [C ] // Proceedings of the 26th USENIX Security Symposium (USENIX Security 17) . BOSTON : USENIX , 2017 : 1307 - 1322 .

KUMARI W , HUNT E , ARENDS R , et al . Extended DNS errors [R ] . 2020 .

KIM T H , REEVES D . A survey of domain name system vulnerabilities and attacks [J ] . Journal of Surveillance, Security and Safety , 2020 , 1 ( 1 ): 34 - 60 .

MOCKAPETRIS P V . RFC0882: domain names: concepts and facilities [S ] . 1983 .

LU C Y , LIU B J , LI Z , et al . An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 .

CHANG D , ZHANG Q , LI X . Study on os fingerprinting and nat/tethering based on DNS log analysis [C ] // Proceedings of the IRTF & ISOC Workshop on Research and Applications of Internet Measurements (RAIM) . 2015 .

PARK J , JANG R , MOHAISEN M , et al . A large-scale behavioral analysis of the open DNS resolvers on the Internet [J ] . IEEE/ACM Transactions on Networking , 2022 , 30 ( 1 ): 76 - 89 .

WANG M , ZHANG Z , XU H . DNS configurations and its security analyzing via resource records of the top-level domains [C ] // Proceedings of the 2017 11th IEEE International Conference on Anti-counterfeiting, Security, and Identification (ASID) . IEEE , 2017 : 21 - 25 .

CHUNG T , VAN RIJSWIJK-DEIJ R , CHOFFNES D , et al . Understanding the role of registrars in DNSSEC deployment [C ] // Proceedings of the 2017 Internet Measurement Conference . New York : ACM , 2017 : 369 - 383 .

徐恪 , 凌思通 , 李琦 , 等 . 基于区块链的网络安全体系结构与关键技术研究进展 [J ] . 计算机学报 , 2021 , 44 ( 1 ): 55 - 83 .

XU K , LING S T , LI Q , et al . Research progress of network security architecture and key technologies based on blockchain [J ] . Chinese Journal of Computers , 2021 , 44 ( 1 ): 55 - 83 .

LIAN W , RESCORLA E , SHACHAM H , et al . Measuring the practical impact of DNSSEC deployment [C ] // Proceedings of the 22nd USENIX Conference on Security . BOSTON : USENIX , 2013 : 573 - 588 .

张曼 , 姚健康 , 李洪涛 , 等 . DNS 信道传输加密技术: 现状、趋势和挑战 [J ] . 软件学报 , 2023 , 35 ( 1 ): 309 - 332 .

ZHANG M , YAO J K , LI H T , et al . Encryption technologies for DNS channel transmission: status, trends and challenges [J ] . Journal of Software , 2023 , 35 ( 1 ): 309 - 332 .

MIGAULT D , GIRARD C , LAURENT M . A performance view on DNSSEC migration [C ] // Proceedings of the 2010 International Conference on Network and Service Management . Piscataway : IEEE Press , 2010 : 469 - 474 .

YANG Z W , GAO S , XU J L , et al . Authentication of range query results in mapreduce environments [C ] // Proceedings of the Third International Workshop on Cloud Data Management . New York : ACM , 2011 : 25 - 32 .

DECCIO C T . A case for comprehensive DNSSEC monitoring and analysis tools [R ] . 2011 .

王文通 , 胡宁 , 刘波 , 等 . DNS 安全防护技术研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2205 - 2220 .

WANG W T , HU N , LIU B , et al . Survey on technology of security enhancement for DNS [J ] . Journal of Software , 2020 , 31 ( 7 ): 2205 - 2220 .

DAI T , SHULMAN H , WAIDNER M . DNSSEC misconfigurations in popular domains [C ] // Proceedings of the Cryptology and Network Security: 15th International Conference . Berlin : Springer , 2016 : 651 - 660 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于时空特征融合深度学习的NXNSAttack流量识别方法